Spyware / Malware / Virus Removal

[Resolved] Please help me with this hijackthis log

10 min read

Looking for the outcome? Ask AI

sanzo Topic Starter

Post #1February 28, 2008, 2:31 PM UTC

hi,

Please take a look with this hijackthis log.
Everytime I start PC, this message keep on appearing "Windows cannot find 'C:\WINDOWS\mmhren1.exe. Make sure you typed the name correctly, and then try again. To search for a file, click the Start button, and then click Search.

and if i will click OK, a message will follow "Could not load or run C;\WINDOWS\mmhren1.exe specified in the registry. Make sure the file exists on your computer or remove the reference to it in the registry. If I click OK again another message box will appear - "Error loading C:\WINDOWS\system32\dkhpbinu.dll The Specified module could not be found.
Also c:\bot.exe always detected by AVG, even if I HEAL it or move it to VAULT.
Another thing, WINDOWS Firewall keeps on turning off every minute.

Thanks in Advance.
sanzo

below is the hijack log i run:

Logfile of HijackThis v1.99.1
Scan saved at 9:41:37 PM, on 2/28/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\VM303_STI.EXE
C:\WINDOWS\system32\pcntrlwb.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\njjl.exe
C:\DOCUME~1\~Aubrey\LOCALS~1\Temp\winlogon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 192.168.0.0.0.0:5050
F3 - REG:win.ini: run=C:\WINDOWS\mmhren1.exe
O1 - Hosts: 76.23.178.195 paypal.com
O1 - Hosts: 76.23.178.195 www.paypal.com
O1 - Hosts: 76.23.178.195 epassporte.com
O1 - Hosts: 76.23.178.195 www.epassporte.com
O1 - Hosts: 76.23.178.195 gmail.com
O1 - Hosts: 76.23.178.195 www.gmail.com
O1 - Hosts: 76.23.178.195 mail.google.com
O1 - Hosts: 76.23.178.195 mail.yahoo.com
O1 - Hosts: 76.23.178.195 yahoo.com
O1 - Hosts: 76.23.178.195 hotmail.com
O1 - Hosts: 76.23.178.195 www.hotmail.com
O1 - Hosts: 76.23.178.195 hotmail.co.uk
O1 - Hosts: 76.23.178.195 www.hotmail.co.uk
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: dlTube Driver Search - {5790FD20-AE0B-496E-8B86-582EB400CE64} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O4 - HKLM\..\Run: [VMSnap3] -C:\WINDOWS\VMSnap3.EXE
O4 - HKLM\..\Run: [Domino] -C:\WINDOWS\Domino.EXE
O4 - HKLM\..\Run: [BigDog303] C:\WINDOWS\VM303_STI.EXE VIMICRO USB PC Camera (ZC0301PLH)
O4 - HKLM\..\Run: [ATICCC] -"C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [00saskda] -"C:\Program Files\1st Security Agent\newlock.exe" saskda
O4 - HKLM\..\Run: [QuickTime Task] -"C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Frag Settings Draw Download] -C:\Documents and Settings\All Users\Application Data\2 team frag settings\Meet Axis.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] -"C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [ExploreUpdSched] C:\WINDOWS\system32\pcntrlwb.exe DWoli5
O4 - HKLM\..\Run: [f4e37052] rundll32.exe "C:\WINDOWS\system32\dkhpbinu.dll",b
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [WintelUpdate] C:\njjl.exe
O4 - HKCU\..\Run: [Firewall auto setup] C:\DOCUME~1\~Aubrey\LOCALS~1\Temp\winlogon.exe
O4 - Startup: Deewoo.lnk = C:\WINDOWS\system32\pcntrlwb.exe
O4 - Startup: DW_Start.lnk = C:\WINDOWS\system32\kqwdw64j.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Toolbars\Restrictions present
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: Compare Prices with &Dealio - C:\Documents and Settings\~Aubrey\Application Data\Dealio\kb124\res\DealioSearch.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jin…ows-i586-jc.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Unknown owner - -"C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe (file missing)
O23 - Service: Microsoft security update service (msupdate) - Unknown owner - c:\windows\system32\msvcrtd.exe (file missing)
O23 - Service: Office Source Engine (ose) - Unknown owner - -"C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Scotty

Post #2February 28, 2008, 5:15 PM UTC

Hi

Hi! Welcome to the WTT forums.
My name is Scotty. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research.
Please be patient.

Please make a uninstall list using HijackThis
To access the Uninstall Manager you would do the following:

1. Start HijackThis
2. Click on the Config button
3. Click on the Misc Tools button
4. Click on the Open Uninstall Manager button.
5. Click on the Save list… button and specify where you would like to save this file. When you press Save button a notepad will open with the contents of that file. Simply copy and paste the contents of that notepad here in a reply.

If you already have Combofix, please delete that copy and download it again as it's being updated regularly.

Please download Combofix from Bleeping Computer.

If you can't download it from there, please try these 2 alternative sites:

Forospyware
Geeks to Go

Save it to your Desktop.
Disconnect from the Internet, than disable your anti-virus and any real-time anti-spyware monitors that are running.
Click Start>Run copy/paste or type "%userprofile%\desktop\combofix.exe" /killall into the Run box and click OK.
When finished, it shall produce a log for you. Post that log in your next reply with a new HijackThis log.

Note 1: Do not mouseclick combofix's window whilst it's running. That may cause it to stall
Note 2:Remember to re-enable your anti-virus and anti-spyware before reconnecting to the Internet.

In your next reply post:
Uninstall list
ComboFix.txt
New HijackThis log taken after the above scan has run

sanzo

Post #3February 29, 2008, 2:59 PM UTC

hi Scotty, I'm please to meet you and be very greatful of your help. As what you have instructed me, I've done the first 4 instructions 1. Start HijackThis 2. Click on the Config button 3. Click on the Misc Tools button 4. Click on the Open Uninstall Manager button. but for the fifth instruction, when i click on the Save list button, nothing happened. It doesnt specify me where I would like to save the file. What do u think is the problem? Thanks.

Scotty

Post #4February 29, 2008, 8:37 PM UTC

Hi

Follow these instructions first.

Rename HijackThis
There is a possibility an infection which is hiding part of the HijackThis log because it's called hijackthis.exe.
Using Windows Explore by right-clicking the Start button and left clicking Explore navigate to: C:\Program Files\HijackThis\HijackThis.exe

Right-click on HijackThis.exe & select Rename to iseeu.exe and post back a new Hijackthis log.

Then follow the instructions I posted previously.

sanzo

Post #5March 1, 2008, 2:28 PM UTC

Hi!
I've done your instruction of renaming the Highjack This log to iseeu.exe and it worked.
Then, I proceed to the next step - and that is downloading the ComboFix.exe and disabling the anti-virus, anti-spyware etc.
but my problem now is that my Run command is missing in the Start Menu. I also tried the shortcut keys, but a message pop-up in my screen stating : "This operation has been cancelled due to restrictions in effect on this computer. Please contact your system administrator." I even look at the TaskBar and Start Menu properties only to find out that Run is missing in the list of options.

What alternative can I do?

This is the result of the new Highjackthis log after renaming it to isseu.exe:

Logfile of HijackThis v1.99.1
Scan saved at 8:22:04 PM, on 3/1/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\VM303_STI.EXE
C:\WINDOWS\system32\pcntrlwb.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\njjl.exe
C:\DOCUME~1\~Aubrey\LOCALS~1\Temp\winlogon.exe
C:\PROGRA~1\Grisoft\AVG7\avgw.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Hijackthis\iseeu.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 192.168.0.0.0.0:5050
F3 - REG:win.ini: run=C:\WINDOWS\mmhren1.exe
O1 - Hosts: 76.23.178.195 paypal.com
O1 - Hosts: 76.23.178.195 www.paypal.com
O1 - Hosts: 76.23.178.195 epassporte.com
O1 - Hosts: 76.23.178.195 www.epassporte.com
O1 - Hosts: 76.23.178.195 gmail.com
O1 - Hosts: 76.23.178.195 www.gmail.com
O1 - Hosts: 76.23.178.195 mail.google.com
O1 - Hosts: 76.23.178.195 mail.yahoo.com
O1 - Hosts: 76.23.178.195 yahoo.com
O1 - Hosts: 76.23.178.195 hotmail.com
O1 - Hosts: 76.23.178.195 www.hotmail.com
O1 - Hosts: 76.23.178.195 hotmail.co.uk
O1 - Hosts: 76.23.178.195 www.hotmail.co.uk
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: TBSB00808 - {425E30F0-CCC6-4E24-BBEB-BCBD31720B37} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7921CF40-BAD1-4F1C-A29D-D8E574C0637C} - C:\WINDOWS\system32\wvuvt.dll
O2 - BHO: (no name) - {98663E21-9CCE-4CF6-863C-911A9523A66F} - C:\WINDOWS\system32\pmnlmjj.dll (file missing)
O2 - BHO: {577e5ef4-eeaa-79fa-49b4-bdaa7392f2cc} - {cc2f2937-aadb-4b94-af97-aaee4fe5e775} - C:\WINDOWS\system32\nqssdamk.dll (file missing)
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: dlTube Driver Search - {5790FD20-AE0B-496E-8B86-582EB400CE64} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O4 - HKLM\..\Run: [VMSnap3] -C:\WINDOWS\VMSnap3.EXE
O4 - HKLM\..\Run: [Domino] -C:\WINDOWS\Domino.EXE
O4 - HKLM\..\Run: [BigDog303] C:\WINDOWS\VM303_STI.EXE VIMICRO USB PC Camera (ZC0301PLH)
O4 - HKLM\..\Run: [ATICCC] -"C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [00saskda] -"C:\Program Files\1st Security Agent\newlock.exe" saskda
O4 - HKLM\..\Run: [QuickTime Task] -"C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Frag Settings Draw Download] -C:\Documents and Settings\All Users\Application Data\2 team frag settings\Meet Axis.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] -"C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [ExploreUpdSched] C:\WINDOWS\system32\pcntrlwb.exe DWoli5
O4 - HKLM\..\Run: [f4e37052] rundll32.exe "C:\WINDOWS\system32\dkhpbinu.dll",b
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [WintelUpdate] C:\njjl.exe
O4 - HKCU\..\Run: [Firewall auto setup] C:\DOCUME~1\~Aubrey\LOCALS~1\Temp\winlogon.exe
O4 - Startup: Deewoo.lnk = C:\WINDOWS\system32\pcntrlwb.exe
O4 - Startup: DW_Start.lnk = C:\WINDOWS\system32\kqwdw64j.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Toolbars\Restrictions present
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: Compare Prices with &Dealio - C:\Documents and Settings\~Aubrey\Application Data\Dealio\kb124\res\DealioSearch.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jin…ows-i586-jc.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab
O20 - Winlogon Notify: pmnlmjj - pmnlmjj.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Unknown owner - -"C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe (file missing)
O23 - Service: Microsoft security update service (msupdate) - Unknown owner - c:\windows\system32\msvcrtd.exe (file missing)
O23 - Service: Office Source Engine (ose) - Unknown owner - -"C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Scotty

Post #6March 1, 2008, 2:41 PM UTC

Hi

Run this first

Download SDFix and save it to your Desktop.

Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)

Please then reboot your computer in Safe Mode by doing the following :

Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, the Advanced Options Menu should appear;
Select the first option, to run Windows in Safe Mode, then press Enter.
Choose your usual account.

Open the extracted SDFix folder and double click RunThis.bat to start the script.
Type Y to begin the cleanup process.
It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
Press any Key and it will restart the PC.
When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
(Report.txt will also be copied to Clipboard ready for posting back on the forum).
Finally paste the contents of the Report.txt back in your next reply.

Then run Combofix in Normal Mode by double-clicking the icon on your Desktop but remember to disable your anti-virus and any other running programs first.

sanzo

Post #7March 3, 2008, 2:03 PM UTC

hi,

i followed all your instructions and here is the result of the following:

1)after running the SDFix

SDFix: Version 1.150

Run by [removed] on Mon 03/03/2008 at 08:55 PM

Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix

Checking Services :

Name:
msupdate
SysLibrary

Path:
c:\windows\system32\msvcrtd.exe
\??\C:\WINDOWS\system32\DefLib.sys

msupdate - Deleted
SysLibrary - Deleted

Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting

Checking Files :

Trojan Files Found:

C:\-18642~1 - Deleted
C:\DOCUME~1\~Aubrey\LOCALS~1\Temp\winlogon.exe - Deleted
C:\WINDOWS\system32\msnav32.ax - Deleted
C:\WINDOWS\system32\zxdnt3d.cfg - Deleted

Removing Temp Files

ADS Check :

Final Check :

catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-03 21:10:42
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden services & system hive …

scanning hidden registry entries …

scanning hidden files …

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

Remaining Services :

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe:*:Enabled:Yahoo! FT Server"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Documents and Settings\\aubrey\\Desktop\\sanzo fave music\\LimeWire\\LimeWire.exe"="C:\\Documents and Settings\\aubrey\\Desktop\\sanzo fave music\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Disabled:Skype. Take a deep breath "
"C:\\Documents and Settings\\aubrey\\My Documents\\My Music\\downloaded\\BitDownload\\BitDownload.exe"="C:\\Documents and Settings\\aubrey\\My Documents\\My Music\\downloaded\\BitDownload\\BitDownload.exe:*:Enabled:Warez3"
"C:\\Program Files\\Sony Ericsson\\Update Service\\Update Service.exe"="C:\\Program Files\\Sony Ericsson\\Update Service\\Update Service.exe:*:Enabled:Update Service"
"C:\\Program Files\\Windows Media Player\\wmplayer.exe"="C:\\Program Files\\Windows Media Player\\wmplayer.exe:*:Disabled:Windows Media Player"
"C:\\Documents and Settings\\~Aubrey\\My Documents\\my programs\\Kazaa Lite Revolution\\kazaalite.kpp"="C:\\Documents and Settings\\~Aubrey\\My Documents\\my programs\\Kazaa Lite Revolution\\kazaalite.kpp:*:Enabled:kazaalite"
"C:\\Program Files\\Java\\jre1.6.0_03\\bin\\javaw.exe"="C:\\Program Files\\Java\\jre1.6.0_03\\bin\\javaw.exe:*:Enabled:Java™ Platform SE binary"
"C:\\Program Files\\Soulseek\\slsk.exe"="C:\\Program Files\\Soulseek\\slsk.exe:*:Enabled:SoulSeek"
"C:\\Documents and Settings\\~Aubrey\\My Documents\\my programs\\Soulseek\\slsk.exe"="C:\\Documents and Settings\\~Aubrey\\My Documents\\my programs\\Soulseek\\slsk.exe:*:Enabled:SoulSeek"
"C:\\Documents and Settings\\~Aubrey\\My Documents\\rei\\BearShare MP3 Downloader\\BearShare MP3 Downloader.exe"="C:\\Documents and Settings\\~Aubrey\\My Documents\\rei\\BearShare MP3 Downloader\\BearShare MP3 Downloader.exe:*:Enabled:BearShare MP3 Downloader"
"C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"="C:\\Program Files\\Grisoft\\AVG7\\avginet.exe:*:Enabled:avginet.exe"
"C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe:*:Enabled:avgamsvr.exe"
"C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe:*:Enabled:avgcc.exe"
"C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe:*:Enabled:avgemc.exe"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

Remaining Files :

File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes :

Wed 4 Aug 2004 60,416 A.SH. — "C:\Program Files\Outlook Express\msimn.exe"
Thu 6 Dec 2007 4,348 A.SH. — "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Thu 6 Dec 2007 401 A.SH. — "C:\Documents and Settings\All Users\DRM\DRMv16.bak"
Wed 23 Jan 2008 0 A..H. — "C:\WINDOWS\SoftwareDistribution\Download\f7db876e78b88fd8276fd7d29cb7e4eb\BIT4.tmp"
Thu 6 Dec 2007 4,348 …H. — "C:\Documents and Settings\marion\My Documents\My Music\License Backup\drmv1key.bak"
Thu 6 Dec 2007 401 …H. — "C:\Documents and Settings\marion\My Documents\My Music\License Backup\drmv1lic.bak"
Thu 6 Dec 2007 312 …H. — "C:\Documents and Settings\marion\My Documents\My Music\License Backup\drmv2key.bak"
Thu 6 Dec 2007 1,536 …H. — "C:\Documents and Settings\marion\My Documents\My Music\License Backup\drmv2lic.bak"

Finished!

2) THE RESULT OF UNINSTALL

1st Security Agent with IE Internet Security
A4 TECH PC Camera H
A4 TECH USB PC Camera H
Adobe Acrobat 5.0
Adobe Flash Player ActiveX
ATI - Software Uninstall Utility
ATI Catalyst Control Center
ATI Display Driver
ATITool Overclocking Utility
AVG 7.5
Big Fish Games Client
BookWorm Deluxe
Creative PCI Audio Drivers
Disc2Phone
DivX Content Uploader
DivX Web Player
dlTube Driver Search
DriverGuide DriverScan
Dynomite
Free Window Registry Repair
Hijackthis 1.99.1
HijackThis 1.99.1
Hotfix for Windows XP (KB915865)
Java™ 6 Update 3
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office Professional Edition 2003
Mjuice Media Support for Winamp
MP3 Player Utilities
MSN
MSXML 4.0 SP2 (KB936181)
QuickTime
Security Update for Microsoft .NET Framework 2.0 (KB928365)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 9 (KB936782)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901190)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921503)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926247)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB933729)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
Security Update for Windows XP (KB936021)
Security Update for Windows XP (KB937894)
Security Update for Windows XP (KB938127)
Security Update for Windows XP (KB938829)
Security Update for Windows XP (KB941202)
Security Update for Windows XP (KB941568)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB941644)
Security Update for Windows XP (KB942615)
Security Update for Windows XP (KB943055)
Security Update for Windows XP (KB943460)
Security Update for Windows XP (KB943485)
Security Update for Windows XP (KB944653)
Security Update for Windows XP (KB946026)
Skype™ 3.6
Sony Ericsson PC Suite 1.20.173
SoulSeek Client 156c
Sound Blaster AudioPCI Drivers Online Help
Spybot - Search & Destroy
Spybot - Search & Destroy 1.5.2.20
Update for Windows XP (KB894391)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB908531)
Update for Windows XP (KB910437)
Update for Windows XP (KB911280)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB927891)
Update for Windows XP (KB930916)
Update for Windows XP (KB938828)
Update for Windows XP (KB942763)
Update for Windows XP (KB942840)
Update for Windows XP (KB946627)
Update Service
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891781
WinZip Self-Extractor
Yahoo! Browser Services
Yahoo! Install Manager
Yahoo! Internet Mail
Yahoo! Messenger
Yahoo! Toolbar
ZoneAlarm
ZoneAlarm Spy Blocker
Zuma Deluxe

3) THE RESULT OF ComboFix:

ComboFix 08-03-01.3 - ~Aubrey 2008-03-03 21:22:48.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.48 [GMT 8:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\~Aubrey\Start Menu\Programs\Startup\Deewoo.lnk
C:\Documents and Settings\~Aubrey\Start Menu\Programs\Startup\DW_Start.lnk
C:\Documents and Settings\sanzo\Start Menu\Programs\Startup\Deewoo.lnk
C:\WINDOWS\hosts
C:\WINDOWS\system32\tvuvw.ini
C:\WINDOWS\system32\tvuvw.ini2
C:\WINDOWS\system32\winpfz37.sys
C:\WINDOWS\system32\zxdnt3d.cfg

.
((((((((((((((((((((((((( Files Created from 2008-02-03 to 2008-03-03 )))))))))))))))))))))))))))))))
.

2008-03-03 20:50 . 2008-03-03 20:51 d——– C:\WINDOWS\ERUNT
2008-03-03 20:43 . 2008-03-03 21:15 d——– C:\SDFix
2008-03-01 21:22 . 2008-03-01 21:26 d——– C:\Documents and Settings\sanzo\Application Data\Yahoo!
2008-03-01 21:19 . 2008-03-03 20:37 d——– C:\Documents and Settings\sanzo\Application Data\AVG7
2008-02-27 20:44 . 2008-03-03 21:30 2,887,712 –ahs—- C:\WINDOWS\system32\drivers\fidbox.dat
2008-02-27 20:44 . 2008-03-03 21:28 35,912 –ahs—- C:\WINDOWS\system32\drivers\fidbox.idx
2008-02-27 20:34 . 2008-02-27 20:34 d——– C:\Program Files\ZoneAlarmSB
2008-02-27 20:25 . 2008-02-27 20:25 d——– C:\Documents and Settings\All Users\Application Data\MailFrontier
2008-02-27 20:24 . 2008-02-27 20:35 4,212 –ah—– C:\WINDOWS\system32\zllictbl.dat
2008-02-27 20:23 . 2007-11-14 16:05 75,248 –a—— C:\WINDOWS\zllsputility.exe
2008-02-27 20:23 . 2004-04-27 04:40 11,264 –a—— C:\WINDOWS\system32\SpOrder.dll
2008-02-27 20:18 . 2007-11-14 16:05 1,086,952 –a—— C:\WINDOWS\system32\zpeng24.dll
2008-02-27 20:17 . 2008-02-27 20:23 d——– C:\WINDOWS\system32\ZoneLabs
2008-02-27 20:17 . 2008-02-27 20:17 d——– C:\Program Files\Zone Labs
2008-02-27 20:17 . 2008-03-03 21:30 353,366 –a—— C:\WINDOWS\system32\vsconfig.xml
2008-02-27 20:15 . 2008-03-03 21:32 d——– C:\WINDOWS\Internet Logs
2008-02-26 22:18 . 2008-03-02 20:38 d——– C:\Documents and Settings\~Aubrey\Application Data\AVG7
2008-02-26 22:16 . 2008-02-26 22:16 d——– C:\Documents and Settings\LocalService\Application Data\AVG7
2008-02-26 22:16 . 2008-02-26 22:16 d——– C:\Documents and Settings\All Users\Application Data\Grisoft
2008-02-26 21:52 . 2008-02-26 21:52 d——– C:\Documents and Settings\april\Application Data\Dealio
2008-02-26 21:39 . 2008-03-03 21:28 4,194,304 –a—— C:\Documents and Settings\~Aubrey\ntuser.dat
2008-02-26 21:00 . 2008-02-26 22:58 13 –ah—– C:\WINDOWS\mmax_hren2.ini
2008-02-26 20:55 . 2008-02-26 22:07 594 –ahs—- C:\WINDOWS\system32\unibphkd.ini
2008-02-26 01:08 . 2008-02-26 01:08 d——– C:\Program Files\Common Files\SWF Studio
2008-02-26 01:07 . 2008-02-26 21:17 d——– C:\Documents and Settings\~Aubrey\Application Data\Dealio
2008-02-26 01:06 . 2008-02-26 21:41 d——– C:\Program Files\Dealio
2008-02-26 01:04 . 2008-02-26 01:04 52,236 –a—— C:\njjl.exe
2008-02-26 01:03 . 2008-02-26 01:04 200,774 –a—— C:\WINDOWS\system32\pcntrlwb.exe
2008-02-25 20:52 . 2008-02-25 20:52 d——– C:\Documents and Settings\All Users\Application Data\ESET
2008-02-25 20:34 . 2008-02-27 19:01 d——– C:\Documents and Settings\All Users\Application Data\Avg7
2008-02-24 02:26 . 2008-02-24 02:26 d——– C:\Program Files\DivX
2008-02-24 02:02 . 2008-02-24 02:26 dr-h—– C:\Documents and Settings\marion.OLIQUIAN-E3D9A7\Application Data\yahoo!
2008-02-24 02:01 . 2008-02-24 02:01 d——– C:\Documents and Settings\marion.OLIQUIAN-E3D9A7\Application Data\ATI
2008-02-24 01:59 . 2004-08-04 09:07 221,184 –a—— C:\WINDOWS\system32\wmpns.dll
2008-02-21 10:05 . 2008-02-21 10:05 1,044,480 –a—— C:\WINDOWS\system32\libdivx.dll
2008-02-21 10:05 . 2008-02-21 10:05 200,704 –a—— C:\WINDOWS\system32\ssldivx.dll
2008-02-17 14:04 . 2008-02-17 14:28 d——– C:\Program Files\Soulseek
2008-02-15 23:52 . 2008-02-15 23:52 d——– C:\Documents and Settings\~Aubrey\Incomplete
2008-02-15 23:51 . 2008-02-15 23:51 d——– C:\WINDOWS\Sun
2008-02-15 23:51 . 2008-02-15 23:51 d——– C:\Documents and Settings\~Aubrey\Application Data\Sun
2008-02-15 23:48 . 2007-09-24 23:31 69,632 –a—— C:\WINDOWS\system32\javacpl.cpl
2008-02-15 23:45 . 2008-02-15 23:48 d——– C:\Program Files\Java
2008-02-15 23:41 . 2008-02-15 23:41 d——– C:\Program Files\Common Files\Java
2008-02-15 23:33 . 2008-02-17 13:55 d——– C:\Documents and Settings\~Aubrey\Application Data\Imesh MP3 Downloader
2008-02-15 23:32 . 2008-02-15 23:32 d–h—– C:\Program Files\Imesh MP3 Downloader
2008-02-13 23:46 . 2008-02-13 23:46 d——– C:\Documents and Settings\~Aubrey\Application Data\Kazaa Lite
2008-02-13 20:31 . 2008-02-13 20:31 d——– C:\Documents and Settings\All Users\Application Data\Kazaa Lite
2008-02-13 20:06 . 2008-02-15 22:48 d——– C:\My Shared Folder
2008-02-11 09:40 . 2008-02-11 09:40 2,715,648 –a—— C:\WINDOWS\system32\OnlineScanner.ocx
2008-02-11 09:39 . 2008-02-11 09:39 253,952 –a—— C:\WINDOWS\system32\OnlineScannerDLLA.dll
2008-02-11 09:39 . 2008-02-11 09:39 237,568 –a—— C:\WINDOWS\system32\OnlineScannerDLLW.dll
2008-02-08 13:53 . 2008-02-08 13:53 110,592 –a—— C:\WINDOWS\system32\OnlineScannerLang.dll
2008-02-06 22:09 . 2008-02-06 21:32 691,545 –a—— C:\WINDOWS\unins000.exe
2008-02-06 22:09 . 2008-02-06 22:09 3,454 –a—— C:\WINDOWS\unins000.dat
2008-02-05 08:48 . 2008-02-05 08:48 77,824 –a—— C:\WINDOWS\system32\OnlineScannerUninstaller.exe
2008-02-04 10:42 . 2008-02-12 02:43 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2008-02-04 10:42 . 2008-02-04 10:42 1,409 –a—— C:\WINDOWS\QTFont.for
2008-02-03 21:07 . 2008-02-03 21:07 125 –a—— C:\ioSpecial.ini

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-03 13:28 4,194,304 —-a-w C:\Documents and Settings\~Aubrey\ntuser.dat
2008-03-03 12:33 1,365,504 —-a-w C:\WINDOWS\Internet Logs\xDB7.tmp
2008-03-03 12:33 1,168,896 —-a-w C:\WINDOWS\Internet Logs\xDB6.tmp
2008-03-02 15:23 1,906,176 —-a-w C:\WINDOWS\Internet Logs\xDB5.tmp
2008-03-02 12:38 ——— d—–w C:\Documents and Settings\~Aubrey\Application Data\AVG7
2008-03-01 15:12 3,335,168 —-a-w C:\WINDOWS\Internet Logs\xDB4.tmp
2008-02-29 13:30 27,498 —-a-w C:\WINDOWS\Internet Logs\zlclient_2nd_2008_02_28_21_58_15_small.dmp.zip
2008-02-27 17:33 12,800 —-a-w C:\WINDOWS\Internet Logs\xDB2.tmp
2008-02-27 17:33 1,326,592 —-a-w C:\WINDOWS\Internet Logs\xDB3.tmp
2008-02-27 17:22 3,118,592 —-a-w C:\WINDOWS\Internet Logs\xDB1.tmp
2008-02-26 13:54 ——— d—–w C:\Documents and Settings\april\Application Data\Skype
2008-02-26 13:17 ——— d—–w C:\Documents and Settings\~Aubrey\Application Data\Dealio
2008-02-25 12:29 ——— d-s—w C:\Documents and Settings\~Aubrey\Application Data\Microsoft
2008-02-24 01:51 ——— d—–w C:\Documents and Settings\april\Application Data\skypePM
2008-02-21 13:14 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-02-17 05:55 ——— d—–w C:\Documents and Settings\~Aubrey\Application Data\Imesh MP3 Downloader
2008-02-15 15:51 ——— d—–w C:\Documents and Settings\~Aubrey\Application Data\Sun
2008-02-13 15:46 ——— d—–w C:\Documents and Settings\~Aubrey\Application Data\Kazaa Lite
2008-02-04 15:11 ——— d—–w C:\Program Files\Sony Ericsson
2008-02-03 06:35 ——— d—a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-02-02 08:40 ——— d—–w C:\Documents and Settings\All Users\Application Data\BigFishGamesCache
2008-02-02 08:31 ——— d—–w C:\Program Files\bfgclient
2008-01-28 15:19 ——— d—–w C:\Documents and Settings\~Aubrey\Application Data\Yahoo!
2008-01-28 15:04 ——— d—–w C:\Documents and Settings\~Aubrey\Application Data\Macromedia
2008-01-28 14:59 ——— d—–w C:\Documents and Settings\~Aubrey\Application Data\Teleca
2008-01-28 14:59 ——— d—–w C:\Documents and Settings\~Aubrey\Application Data\Adobe
2008-01-28 14:58 ——— d—–w C:\Documents and Settings\~Aubrey\Application Data\ATI
2008-01-28 14:57 ——— d—–w C:\Documents and Settings\~Aubrey\Application Data\Identities
2008-01-28 12:01 ——— d—–w C:\Documents and Settings\All Users\Application Data\2 team frag settings
2008-01-26 14:02 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-01-26 10:50 ——— d—–w C:\Program Files\Spybot - Search & Destroy
2008-01-19 08:20 ——— d—–w C:\Program Files\MANAGER FILM DATE
2008-01-07 10:57 32 —-a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
2008-01-07 10:54 ——— d—–w C:\Program Files\Skype
2008-01-07 10:54 ——— d—–w C:\Program Files\Common Files\Skype
2008-01-07 10:54 ——— d—–w C:\Documents and Settings\All Users\Application Data\Skype
2008-01-05 15:56 ——— d—–w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-01-05 15:52 ——— d—–w C:\Program Files\QuickTime
2008-01-05 14:54 ——— d—–w C:\Program Files\Common Files\Apple
2008-01-05 09:00 ——— d—–w C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-01-05 08:57 ——— d—–w C:\Documents and Settings\All Users\Application Data\Yahoo!
2008-01-05 08:56 ——— d—–w C:\Program Files\Yahoo!
2008-01-04 18:18 ——— d—–w C:\Program Files\CREATIVE
2008-01-04 15:43 ——— d—–w C:\Program Files\DriverGuide DriverScan
2008-01-04 15:40 ——— d—–w C:\Program Files\Free Window Registry Repair
2008-01-04 13:48 ——— d—–w C:\Program Files\SBAudioSetup_W2k
2007-12-12 00:40 705,711 ——w C:\WINDOWS\LOTR_Legolas.exe
2007-12-12 00:40 386,848 ——w C:\WINDOWS\LOTR_Legolas.scr
2007-12-12 00:40 30,208 ——w C:\WINDOWS\mickey32.dll
2007-12-07 02:21 824,832 —-a-w C:\WINDOWS\system32\wininet.dll
2007-12-04 18:38 550,912 —-a-w C:\WINDOWS\system32\oleaut32.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{425E30F0-CCC6-4E24-BBEB-BCBD31720B37}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{cc2f2937-aadb-4b94-af97-aaee4fe5e775}]
C:\WINDOWS\system32\nqssdamk.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E57A8BBF-EBF4-40F0-901B-FB54EDE9FFC7}]
C:\WINDOWS\system32\wvuvt.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA}]
2008-02-27 20:34 262144 –a—— C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{BA52B914-B692-46C4-B683-905236F6F655}
{5790FD20-AE0B-496E-8B86-582EB400CE64}
{EF99BD32-C1FB-11D2-892F-0090271D4F88}
{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}

[HKEY_CLASSES_ROOT\clsid\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 06:56 15360]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 17:43 4670704]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VMSnap3"="-C:\WINDOWS\VMSnap3.EXE" [ ]
"Domino"="-C:\WINDOWS\Domino.EXE" [ ]
"BigDog303"="C:\WINDOWS\VM303_STI.exe" [2005-10-25 12:56 61440]
"ATICCC"="-C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [ ]
"00saskda"="-C:\Program Files\1st Security Agent\newlock.exe" [ ]
"QuickTime Task"="-C:\Program Files\QuickTime\qttask.exe" [ ]
"Frag Settings Draw Download"="-C:\Documents and Settings\All Users\Application Data\2 team frag settings\Meet Axis.exe" [ ]
"SunJavaUpdateSched"="-C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [ ]
"f4e37052"="C:\WINDOWS\system32\dkhpbinu.dll" [ ]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-02-26 22:16 579072]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-11-14 16:05 919016]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-02-26 22:16 219136]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableCAD"= 1 (0x1)
"HideShutdownScripts"= 0 (0x0)
"RunLogonScriptSync"= 0 (0x0)
"RunStartupScriptSync"= 0 (0x0)
"HideStartupScripts"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableLockWorkstation"= 0 (0x0)
"DisableChangePassword"= 0 (0x0)
"HideLogonScripts"= 0 (0x0)
"HideLogoffScripts"= 0 (0x0)
"HideLegacyLogonScripts"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoWelcomeScreen"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoChangeKeyboardNavigationIndicators"= 0 (0x0)
"NoChangeAnimation"= 0 (0x0)
"NoAddPrinter"= 0 (0x0)
"NoDeletePrinter"= 0 (0x0)
"RestrictCpl"= 0 (0x0)
"DisallowCpl"= 0 (0x0)
"NoViewOnDrive"= 0 (0x0)
"NoRecycleFiles"= 0 (0x0)
"ForceRecycleBinSize"= 0 (0x0)
"NoCustomizeWebView"= 0 (0x0)
"NoFileAssociate"= 0 (0x0)
"NoDFSTab"= 0 (0x0)
"NoInstrumentation"= 0 (0x0)
"NoCustomizeThisFolder"= 0 (0x0)
"NoWebView"= 0 (0x0)
"DontShowSuperHidden"= 0 (0x0)
"NoOnlinePrintsWizard"= 0 (0x0)
"NoPublishingWizard"= 0 (0x0)
"NoSMConfigurePrograms"= 0 (0x0)
"NoSMMyPictures"= 0 (0x0)
"NoStartMenuMyMusic"= 0 (0x0)
"NoFavoritesMenu"= 0 (0x0)
"NoHelp"= 0 (0x0)
"NoCommonGroups"= 0 (0x0)
"NoStartMenuMFUprogramsList"= 0 (0x0)
"NoStartMenuPinnedList"= 0 (0x0)
"NoUserNameInStartMenu"= 0 (0x0)
"NoStartMenuMorePrograms"= 0 (0x0)
"NoStartMenuEjectPC"= 0 (0x0)
"NoSimpleStartMenu"= 0 (0x0)
"ForceStartMenuLogoff"= 0 (0x0)
"NoStartMenuSubFolders"= 0 (0x0)
"NoDisconnect"= 0 (0x0)
"NoNtSecurity"= 0 (0x0)
"GreyMSIAds"= 0 (0x0)
"ForceMaxRecentDocs"= 0 (0x0)
"NoSMBalloonTip"= 0 (0x0)
"NoSMBalloonTips"= 0 (0x0)
"LockTaskbar"= 0 (0x0)
"NoTaskGrouping"= 0 (0x0)
"NoWebServices"= 0 (0x0)
"NoFileUrl"= 0 (0x0)
"NoBandCustomize"= 0 (0x0)
"NoToolbarCustomize"= 0 (0x0)
"NoExpandedNewMenu"= 0 (0x0)
"SpecifyDefaultButtons"= 0 (0x0)
"NoRecentDocsNetHood"= 0 (0x0)
"EnforceShellExtensionSecurity"= 0 (0x0)
"NoLogOff"= 0 (0x0)
"NoRunasInstallPrompt"= 0 (0x0)
"PromptRunasInstallNetPath"= 1 (0x1)
"NoResolveTrack"= 0 (0x0)
"NoResolveSearch"= 0 (0x0)
"NoDevMgrUpdate"= 0 (0x0)
"NoThumbnailCache"= 0 (0x0)
"ForceCopyAclwithFile"= 0 (0x0)
"StartRunNoHOMEPATH"= 0 (0x0)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoThemesTab"= 0 (0x0)
"NoChangeKeyboardNavigationIndicators"= 0 (0x0)
"NoChangeAnimation"= 0 (0x0)
"NoAddPrinter"= 0 (0x0)
"NoDeletePrinter"= 0 (0x0)
"RestrictCpl"= 0 (0x0)
"DisallowCpl"= 0 (0x0)
"NoViewOnDrive"= 0 (0x0)
"RestrictRun"= 0 (0x0)
"DisallowRun"= 0 (0x0)
"NoRecycleFiles"= 0 (0x0)
"ForceRecycleBinSize"= 0 (0x0)
"NoCustomizeWebView"= 0 (0x0)
"NoViewContextMenu"= 0 (0x0)
"NoWinKeys"= 0 (0x0)
"NoFileAssociate"= 0 (0x0)
"NoDFSTab"= 0 (0x0)
"NoInstrumentation"= 0 (0x0)
"NoCustomizeThisFolder"= 0 (0x0)
"NoWebView"= 0 (0x0)
"DontShowSuperHidden"= 0 (0x0)
"NoOnlinePrintsWizard"= 0 (0x0)
"NoPublishingWizard"= 0 (0x0)
"NoRun"= 0 (0x0)
"NoSMConfigurePrograms"= 0 (0x0)
"NoSMMyPictures"= 0 (0x0)
"NoStartMenuMyMusic"= 0 (0x0)
"NoFavoritesMenu"= 0 (0x0)
"NoHelp"= 0 (0x0)
"NoCommonGroups"= 0 (0x0)
"NoFind"= 0 (0x0)
"NoStartMenuMFUprogramsList"= 0 (0x0)
"NoStartMenuPinnedList"= 0 (0x0)
"NoUserNameInStartMenu"= 0 (0x0)
"NoStartMenuMorePrograms"= 0 (0x0)
"NoStartMenuEjectPC"= 0 (0x0)
"NoSimpleStartMenu"= 0 (0x0)
"ForceStartMenuLogoff"= 0 (0x0)
"StartMenuLogoff"= 0 (0x0)
"NoStartMenuSubFolders"= 0 (0x0)
"NoDisconnect"= 0 (0x0)
"NoNtSecurity"= 0 (0x0)
"NoSetFolders"= 0 (0x0)
"GreyMSIAds"= 0 (0x0)
"ForceMaxRecentDocs"= 0 (0x0)
"NoSMBalloonTip"= 0 (0x0)
"NoSMBalloonTips"= 0 (0x0)
"NoTrayContextMenu"= 0 (0x0)
"LockTaskbar"= 0 (0x0)
"HideClock"= 0 (0x0)
"NoTaskGrouping"= 0 (0x0)
"NoActiveDesktopChanges"= 0 (0x0)
"NoWebServices"= 0 (0x0)
"NoFileUrl"= 0 (0x0)
"NoBandCustomize"= 0 (0x0)
"NoToolbarCustomize"= 0 (0x0)
"NoExpandedNewMenu"= 0 (0x0)
"SpecifyDefaultButtons"= 0 (0x0)
"NoRecentDocsNetHood"= 0 (0x0)
"EnforceShellExtensionSecurity"= 0 (0x0)
"NoClose"= 0 (0x0)
"NoLogOff"= 0 (0x0)
"NoRunasInstallPrompt"= 0 (0x0)
"PromptRunasInstallNetPath"= 1 (0x1)
"NoResolveTrack"= 0 (0x0)
"NoResolveSearch"= 0 (0x0)
"NoDevMgrUpdate"= 0 (0x0)
"NoThumbnailCache"= 0 (0x0)
"ForceCopyAclwithFile"= 0 (0x0)
"StartRunNoHOMEPATH"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\pmnlmjj]
pmnlmjj.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ATITool.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ATITool.lnk
backup=C:\WINDOWS\pss\ATITool.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
——— 2004-10-14 00:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]
-r——- 2005-10-26 16:17 159744 C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
–a—— 2007-08-30 17:43 4670704 C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\Sony Ericsson\\Update Service\\Update Service.exe"=
"C:\\Program Files\\Windows Media Player\\wmplayer.exe"=
"C:\\Program Files\\Java\\jre1.6.0_03\\bin\\javaw.exe"=
"C:\\Documents and Settings\\~Aubrey\\My Documents\\my programs\\Soulseek\\slsk.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R3 vmfilter303;vmfilter303;C:\WINDOWS\system32\drivers\vmfilter303.sys [2006-04-25 10:57]
R3 ZSMC303;A4 TECH PC Camera H;C:\WINDOWS\system32\Drivers\usbVM303.sys [2006-12-01 14:23]
S3 ctlsb16;Creative SB16/AWE32/AWE64 Driver (WDM);C:\WINDOWS\system32\drivers\ctlsb16.sys [2001-08-17 12:19]
S3 DIGIRPS;Digi PortServer Driver;C:\WINDOWS\system32\DRIVERS\digirlpt.sys [2001-08-17 12:17]
S3 W700bus;Sony Ericsson W700 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\W700bus.sys [2007-12-02 00:10]
S3 W700mdfl;Sony Ericsson W700 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\W700mdfl.sys [2007-12-02 00:10]
S3 W700mdm;Sony Ericsson W700 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\W700mdm.sys [2007-12-02 00:10]
S3 W700mgmt;Sony Ericsson W700 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\W700mgmt.sys [2007-12-02 00:10]
S3 W700obex;Sony Ericsson W700 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\W700obex.sys [2007-12-02 00:10]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bb60306a-9b4f-11dc-b50e-f69d947bdfd6}]
\Shell\0pen\command - krag.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL krag.exe

.
Contents of the 'Scheduled Tasks' folder
"2008-03-02 15:00:02 C:\WINDOWS\Tasks\AE30F59B91FF65EF.job"
- c:\docume~1\aubrey\applic~1\manage~1\LogShimData.exe
"2008-02-08 12:00:01 C:\WINDOWS\Tasks\McAfee.com Scan for Viruses - My Computer (OLIQUIAN-E3D9A7-Administrator).job"
- c:\program files\mcafee.com\vso\mcmnhdlr.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-03 21:31:47
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
.
**************************************************************************
.
Completion time: 2008-03-03 21:36:26 - machine was rebooted
ComboFix-quarantined-files.txt 2008-03-03 13:36:15
.
2008-02-14 07:46:04 — E O F —

4) THE RESULT OF NEW HIJACKTHIS LOG

Logfile of HijackThis v1.99.1
Scan saved at 8:22:04 PM, on 3/1/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\VM303_STI.EXE
C:\WINDOWS\system32\pcntrlwb.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\njjl.exe
C:\DOCUME~1\~Aubrey\LOCALS~1\Temp\winlogon.exe
C:\PROGRA~1\Grisoft\AVG7\avgw.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Hijackthis\iseeu.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 192.168.0.0.0.0:5050
F3 - REG:win.ini: run=C:\WINDOWS\mmhren1.exe
O1 - Hosts: 76.23.178.195 paypal.com
O1 - Hosts: 76.23.178.195 www.paypal.com
O1 - Hosts: 76.23.178.195 epassporte.com
O1 - Hosts: 76.23.178.195 www.epassporte.com
O1 - Hosts: 76.23.178.195 gmail.com
O1 - Hosts: 76.23.178.195 www.gmail.com
O1 - Hosts: 76.23.178.195 mail.google.com
O1 - Hosts: 76.23.178.195 mail.yahoo.com
O1 - Hosts: 76.23.178.195 yahoo.com
O1 - Hosts: 76.23.178.195 hotmail.com
O1 - Hosts: 76.23.178.195 www.hotmail.com
O1 - Hosts: 76.23.178.195 hotmail.co.uk
O1 - Hosts: 76.23.178.195 www.hotmail.co.uk
O2 - BHO: &Yahoo;! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: TBSB00808 - {425E30F0-CCC6-4E24-BBEB-BCBD31720B37} - (no file)
O2 - BHO: Spybot-S&D; IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7921CF40-BAD1-4F1C-A29D-D8E574C0637C} - C:\WINDOWS\system32\wvuvt.dll
O2 - BHO: (no name) - {98663E21-9CCE-4CF6-863C-911A9523A66F} - C:\WINDOWS\system32\pmnlmjj.dll (file missing)
O2 - BHO: {577e5ef4-eeaa-79fa-49b4-bdaa7392f2cc} - {cc2f2937-aadb-4b94-af97-aaee4fe5e775} - C:\WINDOWS\system32\nqssdamk.dll (file missing)
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: dlTube Driver Search - {5790FD20-AE0B-496E-8B86-582EB400CE64} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O4 - HKLM\..\Run: [VMSnap3] -C:\WINDOWS\VMSnap3.EXE
O4 - HKLM\..\Run: [Domino] -C:\WINDOWS\Domino.EXE
O4 - HKLM\..\Run: [BigDog303] C:\WINDOWS\VM303_STI.EXE VIMICRO USB PC Camera (ZC0301PLH)
O4 - HKLM\..\Run: [ATICCC] -"C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [00saskda] -"C:\Program Files\1st Security Agent\newlock.exe" saskda
O4 - HKLM\..\Run: [QuickTime Task] -"C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Frag Settings Draw Download] -C:\Documents and Settings\All Users\Application Data\2 team frag settings\Meet Axis.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] -"C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [ExploreUpdSched] C:\WINDOWS\system32\pcntrlwb.exe DWoli5
O4 - HKLM\..\Run: [f4e37052] rundll32.exe "C:\WINDOWS\system32\dkhpbinu.dll",b
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [WintelUpdate] C:\njjl.exe
O4 - HKCU\..\Run: [Firewall auto setup] C:\DOCUME~1\~Aubrey\LOCALS~1\Temp\winlogon.exe
O4 - Startup: Deewoo.lnk = C:\WINDOWS\system32\pcntrlwb.exe
O4 - Startup: DW_Start.lnk = C:\WINDOWS\system32\kqwdw64j.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Toolbars\Restrictions present
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: Compare Prices with &Dealio; - C:\Documents and Settings\~Aubrey\Application Data\Dealio\kb124\res\DealioSearch.html
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jin…ows-i586-jc.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab
O20 - Winlogon Notify: pmnlmjj - pmnlmjj.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Unknown owner - -"C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe (file missing)
O23 - Service: Microsoft security update service (msupdate) - Unknown owner - c:\windows\system32\msvcrtd.exe (file missing)
O23 - Service: Office Source Engine (ose) - Unknown owner - -"C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Scotty

Post #8March 3, 2008, 5:46 PM UTC

Hi

We now suggest that you install the Windows Recovery Console. The Windows recovery console will allow you to boot up into a special recovery mode that allows us to help you in the case that your computer has a problem after an attempted removal of malware.

Go to Microsoft's website => http://support.microsoft.com/kb/310994
Select the download that's appropriate for your Operating System

[external image: Posted Image]

Download the file & save it as it's originally named, next to ComboFix.exe.

[external image: Posted Image]

Now close all open windows and programs, then drag the setup package onto ComboFix.exe and drop it. Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Microsoft Recovery Console. When complete, a log named CF_RC.txt will open. Please post the contents of that log.

Please do not reboot your machine until we have reviewed the log.

sanzo

Post #9March 4, 2008, 1:50 PM UTC

hi, Just to clarify things, which one will i download the Windows XP Service Pack 1 or Pack 2. Thanks.

Scotty

Post #10March 4, 2008, 2:22 PM UTC

Hi SP2

sanzo

Post #11March 5, 2008, 12:25 PM UTC

hi, this is the contents of the log. WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

Scotty

Post #12March 5, 2008, 2:43 PM UTC

Hi

Download Flash_Disinfector from here and save it to your desktop.
Doubleclick on Flash_Disinfector.exe to run it and follow the prompts.
Wait until it has finished scanning and then exit the program.
The utility may ask you to insert your flash drive and/or other removable drives. This may include your mobile phone.
Please do so and allow the utility to clean up those drives as well.

Remember to disconnect from the Internet before carrying out the next instruction, and to save the following script before you do.

Open Notepad - it must be Notepad, not Wordpad.
Copy the text below in the code box by highlighting all the text with your mouse and pressing Ctrl+C

KillAll::
 
File::
C:\WINDOWS\mmax_hren2.ini
C:\WINDOWS\system32\unibphkd.ini
C:\njjl.exe
C:\WINDOWS\system32\pcntrlwb.exe
C:\WINDOWS\Tasks\AE30F59B91FF65EF.job

Folder::
C:\Documents and Settings\All Users\Application Data\2 team frag settings
C:\Program Files\MANAGER FILM DATE
c:\docume~1\aubrey\applic~1\manage~1

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{cc2f2937-aadb-4b94-af97-aaee4fe5e775}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E57A8BBF-EBF4-40F0-901B-FB54EDE9FFC7}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{5790FD20-AE0B-496E-8B86-582EB400CE64}"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Frag Settings Draw Download"=-
"f4e37052"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\pmnlmjj]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bb60306a-9b4f-11dc-b50e-f69d947bdfd6}]

Go to the Notepad window and click Edit > Paste
Then click File > Save
Name the file "CFScript.txt" (including the quotes)
Save the file to your Desktop

[external image: Posted Image]

Refering to the picture above, drag CFScript into ComboFix.exe

In your next reply post:
ComboFix.txt
New HijackThis log taken after the above scan has run

sanzo

Post #13March 5, 2008, 3:17 PM UTC

hi, will it not damaged my phone? just an assurance. Tnx.

Scotty

Post #14March 5, 2008, 3:32 PM UTC

No. It shouldnt.

sanzo

Post #15March 6, 2008, 12:57 PM UTC

Hi,

Below are the results of ComboFix & New HijackThis log:

1)

ComboFix 08-03-01.3 - ~Aubrey 2008-03-06 20:06:47.2 - NTFSx86
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\~Aubrey\Desktop\CFScript.txt
* Created a new restore point

FILE ::
C:\njjl.exe
C:\WINDOWS\mmax_hren2.ini
C:\WINDOWS\system32\pcntrlwb.exe
C:\WINDOWS\system32\unibphkd.ini
C:\WINDOWS\Tasks\AE30F59B91FF65EF.job
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\2 team frag settings
C:\njjl.exe
C:\Program Files\MANAGER FILM DATE
C:\WINDOWS\mmax_hren2.ini
C:\WINDOWS\system32\pcntrlwb.exe
C:\WINDOWS\system32\unibphkd.ini
C:\WINDOWS\Tasks\AE30F59B91FF65EF.job

.
((((((((((((((((((((((((( Files Created from 2008-02-06 to 2008-03-06 )))))))))))))))))))))))))))))))
.

2008-03-03 20:50 . 2008-03-03 20:51 d——– C:\WINDOWS\ERUNT
2008-03-03 20:43 . 2008-03-03 21:15 d——– C:\SDFix
2008-03-01 21:22 . 2008-03-01 21:26 d——– C:\Documents and Settings\sanzo\Application Data\Yahoo!
2008-03-01 21:19 . 2008-03-03 20:37 d——– C:\Documents and Settings\sanzo\Application Data\AVG7
2008-02-27 20:44 . 2008-03-06 20:19 5,462,048 –ahs—- C:\WINDOWS\system32\drivers\fidbox.dat
2008-02-27 20:44 . 2008-03-06 20:15 66,080 –ahs—- C:\WINDOWS\system32\drivers\fidbox.idx
2008-02-27 20:34 . 2008-02-27 20:34 d——– C:\Program Files\ZoneAlarmSB
2008-02-27 20:25 . 2008-02-27 20:25 d——– C:\Documents and Settings\All Users\Application Data\MailFrontier
2008-02-27 20:24 . 2008-02-27 20:35 4,212 –ah—– C:\WINDOWS\system32\zllictbl.dat
2008-02-27 20:23 . 2007-11-14 16:05 75,248 –a—— C:\WINDOWS\zllsputility.exe
2008-02-27 20:23 . 2004-04-27 04:40 11,264 –a—— C:\WINDOWS\system32\SpOrder.dll
2008-02-27 20:18 . 2007-11-14 16:05 1,086,952 –a—— C:\WINDOWS\system32\zpeng24.dll
2008-02-27 20:17 . 2008-02-27 20:23 d——– C:\WINDOWS\system32\ZoneLabs
2008-02-27 20:17 . 2008-02-27 20:17 d——– C:\Program Files\Zone Labs
2008-02-27 20:17 . 2008-03-06 20:19 353,366 –a—— C:\WINDOWS\system32\vsconfig.xml
2008-02-27 20:15 . 2008-03-06 20:22 d——– C:\WINDOWS\Internet Logs
2008-02-26 22:18 . 2008-03-06 19:34 d——– C:\Documents and Settings\~Aubrey\Application Data\AVG7
2008-02-26 22:16 . 2008-02-26 22:16 d——– C:\Documents and Settings\LocalService\Application Data\AVG7
2008-02-26 22:16 . 2008-02-26 22:16 d——– C:\Documents and Settings\All Users\Application Data\Grisoft
2008-02-26 21:52 . 2008-02-26 21:52 d——– C:\Documents and Settings\april\Application Data\Dealio
2008-02-26 21:39 . 2008-03-06 20:15 4,194,304 –a—— C:\Documents and Settings\~Aubrey\ntuser.dat
2008-02-26 01:08 . 2008-02-26 01:08 d——– C:\Program Files\Common Files\SWF Studio
2008-02-26 01:07 . 2008-02-26 21:17 d——– C:\Documents and Settings\~Aubrey\Application Data\Dealio
2008-02-26 01:06 . 2008-02-26 21:41 d——– C:\Program Files\Dealio
2008-02-25 20:52 . 2008-02-25 20:52 d——– C:\Documents and Settings\All Users\Application Data\ESET
2008-02-25 20:34 . 2008-02-27 19:01 d——– C:\Documents and Settings\All Users\Application Data\Avg7
2008-02-24 02:26 . 2008-02-24 02:26 d——– C:\Program Files\DivX
2008-02-24 02:02 . 2008-02-24 02:26 dr-h—– C:\Documents and Settings\marion.OLIQUIAN-E3D9A7\Application Data\yahoo!
2008-02-24 02:01 . 2008-02-24 02:01 d——– C:\Documents and Settings\marion.OLIQUIAN-E3D9A7\Application Data\ATI
2008-02-24 01:59 . 2004-08-04 09:07 221,184 –a—— C:\WINDOWS\system32\wmpns.dll
2008-02-21 10:05 . 2008-02-21 10:05 1,044,480 –a—— C:\WINDOWS\system32\libdivx.dll
2008-02-21 10:05 . 2008-02-21 10:05 200,704 –a—— C:\WINDOWS\system32\ssldivx.dll
2008-02-17 14:04 . 2008-02-17 14:28 d——– C:\Program Files\Soulseek
2008-02-15 23:52 . 2008-02-15 23:52 d——– C:\Documents and Settings\~Aubrey\Incomplete
2008-02-15 23:51 . 2008-02-15 23:51 d——– C:\WINDOWS\Sun
2008-02-15 23:51 . 2008-02-15 23:51 d——– C:\Documents and Settings\~Aubrey\Application Data\Sun
2008-02-15 23:48 . 2007-09-24 23:31 69,632 –a—— C:\WINDOWS\system32\javacpl.cpl
2008-02-15 23:45 . 2008-02-15 23:48 d——– C:\Program Files\Java
2008-02-15 23:41 . 2008-02-15 23:41 d——– C:\Program Files\Common Files\Java
2008-02-15 23:33 . 2008-02-17 13:55 d——– C:\Documents and Settings\~Aubrey\Application Data\Imesh MP3 Downloader
2008-02-15 23:32 . 2008-02-15 23:32 d–h—– C:\Program Files\Imesh MP3 Downloader
2008-02-13 23:46 . 2008-02-13 23:46 d——– C:\Documents and Settings\~Aubrey\Application Data\Kazaa Lite
2008-02-13 20:31 . 2008-02-13 20:31 d——– C:\Documents and Settings\All Users\Application Data\Kazaa Lite
2008-02-13 20:06 . 2008-02-15 22:48 d——– C:\My Shared Folder
2008-02-11 09:40 . 2008-02-11 09:40 2,715,648 –a—— C:\WINDOWS\system32\OnlineScanner.ocx
2008-02-11 09:39 . 2008-02-11 09:39 253,952 –a—— C:\WINDOWS\system32\OnlineScannerDLLA.dll
2008-02-11 09:39 . 2008-02-11 09:39 237,568 –a—— C:\WINDOWS\system32\OnlineScannerDLLW.dll
2008-02-08 13:53 . 2008-02-08 13:53 110,592 –a—— C:\WINDOWS\system32\OnlineScannerLang.dll
2008-02-06 22:09 . 2008-02-06 21:32 691,545 –a—— C:\WINDOWS\unins000.exe
2008-02-06 22:09 . 2008-02-06 22:09 3,454 –a—— C:\WINDOWS\unins000.dat

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-06 12:15 4,194,304 —-a-w C:\Documents and Settings\~Aubrey\ntuser.dat
2008-03-06 11:34 ——— d—–w C:\Documents and Settings\~Aubrey\Application Data\AVG7
2008-03-03 12:33 1,365,504 —-a-w C:\WINDOWS\Internet Logs\xDB7.tmp
2008-03-03 12:33 1,168,896 —-a-w C:\WINDOWS\Internet Logs\xDB6.tmp
2008-03-02 15:23 1,906,176 —-a-w C:\WINDOWS\Internet Logs\xDB5.tmp
2008-03-01 15:12 3,335,168 —-a-w C:\WINDOWS\Internet Logs\xDB4.tmp
2008-02-29 13:30 27,498 —-a-w C:\WINDOWS\Internet Logs\zlclient_2nd_2008_02_28_21_58_15_small.dmp.zip
2008-02-27 17:33 12,800 —-a-w C:\WINDOWS\Internet Logs\xDB2.tmp
2008-02-27 17:33 1,326,592 —-a-w C:\WINDOWS\Internet Logs\xDB3.tmp
2008-02-27 17:22 3,118,592 —-a-w C:\WINDOWS\Internet Logs\xDB1.tmp
2008-02-26 13:54 ——— d—–w C:\Documents and Settings\april\Application Data\Skype
2008-02-26 13:17 ——— d—–w C:\Documents and Settings\~Aubrey\Application Data\Dealio
2008-02-25 12:29 ——— d-s—w C:\Documents and Settings\~Aubrey\Application Data\Microsoft
2008-02-24 01:51 ——— d—–w C:\Documents and Settings\april\Application Data\skypePM
2008-02-21 13:14 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-02-17 05:55 ——— d—–w C:\Documents and Settings\~Aubrey\Application Data\Imesh MP3 Downloader
2008-02-15 15:51 ——— d—–w C:\Documents and Settings\~Aubrey\Application Data\Sun
2008-02-13 15:46 ——— d—–w C:\Documents and Settings\~Aubrey\Application Data\Kazaa Lite
2008-02-05 00:48 77,824 —-a-w C:\WINDOWS\system32\OnlineScannerUninstaller.exe
2008-02-04 15:11 ——— d—–w C:\Program Files\Sony Ericsson
2008-02-03 06:35 ——— d—a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-02-02 08:40 ——— d—–w C:\Documents and Settings\All Users\Application Data\BigFishGamesCache
2008-02-02 08:31 ——— d—–w C:\Program Files\bfgclient
2008-01-28 15:19 ——— d—–w C:\Documents and Settings\~Aubrey\Application Data\Yahoo!
2008-01-28 15:04 ——— d—–w C:\Documents and Settings\~Aubrey\Application Data\Macromedia
2008-01-28 14:59 ——— d—–w C:\Documents and Settings\~Aubrey\Application Data\Teleca
2008-01-28 14:59 ——— d—–w C:\Documents and Settings\~Aubrey\Application Data\Adobe
2008-01-28 14:58 ——— d—–w C:\Documents and Settings\~Aubrey\Application Data\ATI
2008-01-28 14:57 ——— d—–w C:\Documents and Settings\~Aubrey\Application Data\Identities
2008-01-26 14:02 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-01-26 10:50 ——— d—–w C:\Program Files\Spybot - Search & Destroy
2008-01-07 10:57 32 —-a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
2008-01-07 10:54 ——— d—–w C:\Program Files\Skype
2008-01-07 10:54 ——— d—–w C:\Program Files\Common Files\Skype
2008-01-07 10:54 ——— d—–w C:\Documents and Settings\All Users\Application Data\Skype
2007-12-12 00:40 705,711 ——w C:\WINDOWS\LOTR_Legolas.exe
2007-12-12 00:40 386,848 ——w C:\WINDOWS\LOTR_Legolas.scr
2007-12-12 00:40 30,208 ——w C:\WINDOWS\mickey32.dll
2007-12-07 02:21 824,832 —-a-w C:\WINDOWS\system32\wininet.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{425E30F0-CCC6-4E24-BBEB-BCBD31720B37}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA}]
2008-02-27 20:34 262144 –a—— C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{BA52B914-B692-46C4-B683-905236F6F655}
{EF99BD32-C1FB-11D2-892F-0090271D4F88}
{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}

[HKEY_CLASSES_ROOT\clsid\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}"= C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL [2008-02-27 20:34 262144]

[HKEY_CLASSES_ROOT\clsid\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 06:56 15360]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 17:43 4670704]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VMSnap3"="-C:\WINDOWS\VMSnap3.EXE" [ ]
"Domino"="-C:\WINDOWS\Domino.EXE" [ ]
"BigDog303"="C:\WINDOWS\VM303_STI.exe" [2005-10-25 12:56 61440]
"ATICCC"="-C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [ ]
"00saskda"="-C:\Program Files\1st Security Agent\newlock.exe" [ ]
"QuickTime Task"="-C:\Program Files\QuickTime\qttask.exe" [ ]
"SunJavaUpdateSched"="-C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [ ]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-02-26 22:16 579072]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-11-14 16:05 919016]
"combofix"="C:\WINDOWS\system32\CF30961.exe" [2004-08-04 06:56 388608]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-02-26 22:16 219136]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableCAD"= 1 (0x1)
"HideShutdownScripts"= 0 (0x0)
"RunLogonScriptSync"= 0 (0x0)
"RunStartupScriptSync"= 0 (0x0)
"HideStartupScripts"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableLockWorkstation"= 0 (0x0)
"DisableChangePassword"= 0 (0x0)
"HideLogonScripts"= 0 (0x0)
"HideLogoffScripts"= 0 (0x0)
"HideLegacyLogonScripts"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoWelcomeScreen"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoChangeKeyboardNavigationIndicators"= 0 (0x0)
"NoChangeAnimation"= 0 (0x0)
"NoAddPrinter"= 0 (0x0)
"NoDeletePrinter"= 0 (0x0)
"RestrictCpl"= 0 (0x0)
"DisallowCpl"= 0 (0x0)
"NoViewOnDrive"= 0 (0x0)
"NoRecycleFiles"= 0 (0x0)
"ForceRecycleBinSize"= 0 (0x0)
"NoCustomizeWebView"= 0 (0x0)
"NoFileAssociate"= 0 (0x0)
"NoDFSTab"= 0 (0x0)
"NoInstrumentation"= 0 (0x0)
"NoCustomizeThisFolder"= 0 (0x0)
"NoWebView"= 0 (0x0)
"DontShowSuperHidden"= 0 (0x0)
"NoOnlinePrintsWizard"= 0 (0x0)
"NoPublishingWizard"= 0 (0x0)
"NoSMConfigurePrograms"= 0 (0x0)
"NoSMMyPictures"= 0 (0x0)
"NoStartMenuMyMusic"= 0 (0x0)
"NoFavoritesMenu"= 0 (0x0)
"NoHelp"= 0 (0x0)
"NoCommonGroups"= 0 (0x0)
"NoStartMenuMFUprogramsList"= 0 (0x0)
"NoStartMenuPinnedList"= 0 (0x0)
"NoUserNameInStartMenu"= 0 (0x0)
"NoStartMenuMorePrograms"= 0 (0x0)
"NoStartMenuEjectPC"= 0 (0x0)
"NoSimpleStartMenu"= 0 (0x0)
"ForceStartMenuLogoff"= 0 (0x0)
"NoStartMenuSubFolders"= 0 (0x0)
"NoDisconnect"= 0 (0x0)
"NoNtSecurity"= 0 (0x0)
"GreyMSIAds"= 0 (0x0)
"ForceMaxRecentDocs"= 0 (0x0)
"NoSMBalloonTip"= 0 (0x0)
"NoSMBalloonTips"= 0 (0x0)
"LockTaskbar"= 0 (0x0)
"NoTaskGrouping"= 0 (0x0)
"NoWebServices"= 0 (0x0)
"NoFileUrl"= 0 (0x0)
"NoBandCustomize"= 0 (0x0)
"NoToolbarCustomize"= 0 (0x0)
"NoExpandedNewMenu"= 0 (0x0)
"SpecifyDefaultButtons"= 0 (0x0)
"NoRecentDocsNetHood"= 0 (0x0)
"EnforceShellExtensionSecurity"= 0 (0x0)
"NoLogOff"= 0 (0x0)
"NoRunasInstallPrompt"= 0 (0x0)
"PromptRunasInstallNetPath"= 1 (0x1)
"NoResolveTrack"= 0 (0x0)
"NoResolveSearch"= 0 (0x0)
"NoDevMgrUpdate"= 0 (0x0)
"NoThumbnailCache"= 0 (0x0)
"ForceCopyAclwithFile"= 0 (0x0)
"StartRunNoHOMEPATH"= 0 (0x0)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoThemesTab"= 0 (0x0)
"NoChangeKeyboardNavigationIndicators"= 0 (0x0)
"NoChangeAnimation"= 0 (0x0)
"NoAddPrinter"= 0 (0x0)
"NoDeletePrinter"= 0 (0x0)
"RestrictCpl"= 0 (0x0)
"DisallowCpl"= 0 (0x0)
"NoViewOnDrive"= 0 (0x0)
"RestrictRun"= 0 (0x0)
"DisallowRun"= 0 (0x0)
"NoRecycleFiles"= 0 (0x0)
"ForceRecycleBinSize"= 0 (0x0)
"NoCustomizeWebView"= 0 (0x0)
"NoViewContextMenu"= 0 (0x0)
"NoWinKeys"= 0 (0x0)
"NoFileAssociate"= 0 (0x0)
"NoDFSTab"= 0 (0x0)
"NoInstrumentation"= 0 (0x0)
"NoCustomizeThisFolder"= 0 (0x0)
"NoWebView"= 0 (0x0)
"DontShowSuperHidden"= 0 (0x0)
"NoOnlinePrintsWizard"= 0 (0x0)
"NoPublishingWizard"= 0 (0x0)
"NoRun"= 0 (0x0)
"NoSMConfigurePrograms"= 0 (0x0)
"NoSMMyPictures"= 0 (0x0)
"NoStartMenuMyMusic"= 0 (0x0)
"NoFavoritesMenu"= 0 (0x0)
"NoHelp"= 0 (0x0)
"NoCommonGroups"= 0 (0x0)
"NoFind"= 0 (0x0)
"NoStartMenuMFUprogramsList"= 0 (0x0)
"NoStartMenuPinnedList"= 0 (0x0)
"NoUserNameInStartMenu"= 0 (0x0)
"NoStartMenuMorePrograms"= 0 (0x0)
"NoStartMenuEjectPC"= 0 (0x0)
"NoSimpleStartMenu"= 0 (0x0)
"ForceStartMenuLogoff"= 0 (0x0)
"StartMenuLogoff"= 0 (0x0)
"NoStartMenuSubFolders"= 0 (0x0)
"NoDisconnect"= 0 (0x0)
"NoNtSecurity"= 0 (0x0)
"NoSetFolders"= 0 (0x0)
"GreyMSIAds"= 0 (0x0)
"ForceMaxRecentDocs"= 0 (0x0)
"NoSMBalloonTip"= 0 (0x0)
"NoSMBalloonTips"= 0 (0x0)
"NoTrayContextMenu"= 0 (0x0)
"LockTaskbar"= 0 (0x0)
"HideClock"= 0 (0x0)
"NoTaskGrouping"= 0 (0x0)
"NoActiveDesktopChanges"= 0 (0x0)
"NoWebServices"= 0 (0x0)
"NoFileUrl"= 0 (0x0)
"NoBandCustomize"= 0 (0x0)
"NoToolbarCustomize"= 0 (0x0)
"NoExpandedNewMenu"= 0 (0x0)
"SpecifyDefaultButtons"= 0 (0x0)
"NoRecentDocsNetHood"= 0 (0x0)
"EnforceShellExtensionSecurity"= 0 (0x0)
"NoClose"= 0 (0x0)
"NoLogOff"= 0 (0x0)
"NoRunasInstallPrompt"= 0 (0x0)
"PromptRunasInstallNetPath"= 1 (0x1)
"NoResolveTrack"= 0 (0x0)
"NoResolveSearch"= 0 (0x0)
"NoDevMgrUpdate"= 0 (0x0)
"NoThumbnailCache"= 0 (0x0)
"ForceCopyAclwithFile"= 0 (0x0)
"StartRunNoHOMEPATH"= 0 (0x0)

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ATITool.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ATITool.lnk
backup=C:\WINDOWS\pss\ATITool.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
——— 2004-10-14 00:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]
-r——- 2005-10-26 16:17 159744 C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
–a—— 2007-08-30 17:43 4670704 C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\Sony Ericsson\\Update Service\\Update Service.exe"=
"C:\\Program Files\\Windows Media Player\\wmplayer.exe"=
"C:\\Program Files\\Java\\jre1.6.0_03\\bin\\javaw.exe"=
"C:\\Documents and Settings\\~Aubrey\\My Documents\\my programs\\Soulseek\\slsk.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R3 vmfilter303;vmfilter303;C:\WINDOWS\system32\drivers\vmfilter303.sys [2006-04-25 10:57]
R3 ZSMC303;A4 TECH PC Camera H;C:\WINDOWS\system32\Drivers\usbVM303.sys [2006-12-01 14:23]
S3 ctlsb16;Creative SB16/AWE32/AWE64 Driver (WDM);C:\WINDOWS\system32\drivers\ctlsb16.sys [2001-08-17 12:19]
S3 DIGIRPS;Digi PortServer Driver;C:\WINDOWS\system32\DRIVERS\digirlpt.sys [2001-08-17 12:17]
S3 W700bus;Sony Ericsson W700 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\W700bus.sys [2007-12-02 00:10]
S3 W700mdfl;Sony Ericsson W700 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\W700mdfl.sys [2007-12-02 00:10]
S3 W700mdm;Sony Ericsson W700 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\W700mdm.sys [2007-12-02 00:10]
S3 W700mgmt;Sony Ericsson W700 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\W700mgmt.sys [2007-12-02 00:10]
S3 W700obex;Sony Ericsson W700 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\W700obex.sys [2007-12-02 00:10]

.
Contents of the 'Scheduled Tasks' folder
"2008-02-08 12:00:01 C:\WINDOWS\Tasks\McAfee.com Scan for Viruses - My Computer (OLIQUIAN-E3D9A7-Administrator).job"
- c:\program files\mcafee.com\vso\mcmnhdlr.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-06 20:20:32
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\WINDOWS\system32\Ati2evxx.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
.
**************************************************************************
.
Completion time: 2008-03-06 20:26:09 - machine was rebooted
ComboFix-quarantined-files.txt 2008-03-06 12:25:51
ComboFix2.txt 2008-03-03 13:36:28
.
2008-02-14 07:46:04 — E O F —

2)
Logfile of HijackThis v1.99.1
Scan saved at 8:29:48 PM, on 3/6/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\VM303_STI.EXE
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Hijackthis\iseeu.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 192.168.0.0.0.0:5050
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: TBSB00808 - {425E30F0-CCC6-4E24-BBEB-BCBD31720B37} - (no file)
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O4 - HKLM\..\Run: [VMSnap3] -C:\WINDOWS\VMSnap3.EXE
O4 - HKLM\..\Run: [Domino] -C:\WINDOWS\Domino.EXE
O4 - HKLM\..\Run: [BigDog303] C:\WINDOWS\VM303_STI.EXE VIMICRO USB PC Camera (ZC0301PLH)
O4 - HKLM\..\Run: [ATICCC] -"C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [00saskda] -"C:\Program Files\1st Security Agent\newlock.exe" saskda
O4 - HKLM\..\Run: [QuickTime Task] -"C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] -"C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Toolbars\Restrictions present
O8 - Extra context menu item: Compare Prices with &Dealio - C:\Documents and Settings\~Aubrey\Application Data\Dealio\kb124\res\DealioSearch.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jin…ows-i586-jc.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Unknown owner - -"C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe (file missing)
O23 - Service: Office Source Engine (ose) - Unknown owner - -"C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] Please help me with this hijackthis log

✨ Ask AI

Ask AI