topic closed! - downloader problem!

Was out of town for a couple of days and didn't get back to trying to resolve this issue! Here's my original thread:

http://forums.whatthetech.com/downloader_p…094#entry441094

Most recent HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:41:04 PM, on 3/5/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\JulaPan.Exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Documents and Settings\Administrator\Desktop\spyware\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O4 - HKLM\..\Run: [JulaPan] JulaPan.Exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4A27027D-9371-47B2-A07A-1B5CC3A6F3B3}: NameServer = 192.168.1.1
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe

–
End of file - 2318 bytes

————————

Combofix:

ComboFix 08-02-25.3 - Administrator 2008-02-28 15:36:59.22 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1553 [GMT 1:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Administrator\Desktop\cfscript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\msn_0802_upd181826.exe
.

((((((((((((((((((((((((( Files Created from 2008-01-28 to 2008-02-28 )))))))))))))))))))))))))))))))
.

2008-02-27 13:00 . 2008-02-27 13:00 1 –a—— C:\WINDOWS\system32\rc.dat
2008-02-27 13:00 . 2008-02-27 13:00 1 –a—— C:\WINDOWS\system32\ps1.dat
2008-02-27 13:00 . 2008-02-27 13:00 1 –a—— C:\WINDOWS\system32\cs.dat
2008-02-22 08:19 . 2008-02-22 08:20 d——– C:\Program Files\Spybot - Search & Destroy
2008-02-22 08:19 . 2008-02-22 08:18 691,545 –a—— C:\WINDOWS\unins000.exe
2008-02-22 08:19 . 2008-02-22 08:19 2,548 –a—— C:\WINDOWS\unins000.dat
2008-02-01 01:27 . 2008-02-15 01:44 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2008-02-01 01:27 . 2008-02-01 01:27 1,409 –a—— C:\WINDOWS\QTFont.for
2008-01-29 19:11 . 2008-01-29 19:11 d——– C:\Documents and Settings\Administrator\Application Data\InstallShield

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-28 08:00 ——— d—–w C:\Documents and Settings\Administrator\Application Data\Azureus
2008-02-27 12:38 ——— d—–w C:\Program Files\XviD
2008-02-27 12:38 ——— d—–w C:\Program Files\Windows Media Connect 2
2008-02-27 12:38 ——— d—–w C:\Program Files\MSN Messenger
2008-02-27 12:37 ——— d—–w C:\Program Files\Easy Video Splitter
2008-02-27 12:37 ——— d—–w C:\Program Files\Common Files\Raxco
2008-02-27 12:36 ——— d—–w C:\Program Files\Common Files\Autodesk Shared
2008-02-27 12:36 ——— d—–w C:\Program Files\backburner 2
2008-02-22 08:41 68,320 —-a-w C:\Documents and Settings\Administrator\Application Data\GDIPFONTCACHEV1.DAT
2008-02-22 07:20 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-07 22:38 ——— d—–w C:\Program Files\ESET
2008-01-29 18:07 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-01-20 17:51 ——— d—–w C:\Program Files\Common Files\AnswerWorks 4.0
2008-01-19 17:59 ——— d—–w C:\Documents and Settings\All Users\Application Data\TVU Networks
2008-01-06 18:15 ——— d—–w C:\Documents and Settings\Administrator\Application Data\ATI
2008-01-06 17:30 ——— d—–w C:\Program Files\VIA
2007-12-05 13:17 593,920 ——w C:\WINDOWS\system32\ati2sgag.exe
2007-12-05 03:05 368,640 —-a-w C:\WINDOWS\system32\ATIDEMGX.dll
2007-12-05 03:04 269,312 ——w C:\WINDOWS\system32\ati2dvag.dll
2007-12-05 02:56 147,456 —-a-w C:\WINDOWS\system32\atipdlxx.dll
2007-12-05 02:55 43,520 —-a-w C:\WINDOWS\system32\ati2edxx.dll
2007-12-05 02:55 26,112 —-a-w C:\WINDOWS\system32\Ati2mdxx.exe
2007-12-05 02:55 122,880 —-a-w C:\WINDOWS\system32\Oemdspif.dll
2007-12-05 02:55 122,880 —-a-w C:\WINDOWS\system32\ati2evxx.dll
2007-12-05 02:54 307,200 —-a-w C:\WINDOWS\system32\atiiiexx.dll
2007-12-05 02:53 53,248 —-a-w C:\WINDOWS\system32\ATIDDC.DLL
2007-12-05 02:53 495,616 —-a-w C:\WINDOWS\system32\ati2evxx.exe
2007-12-05 02:48 9,535,488 —-a-w C:\WINDOWS\system32\atioglx2.dll
2007-12-05 02:44 3,175,584 ——w C:\WINDOWS\system32\ati3duag.dll
2007-12-05 02:33 1,640,192 ——w C:\WINDOWS\system32\ativvaxx.dll
2007-12-05 02:19 5,435,392 —-a-w C:\WINDOWS\system32\atioglxx.dll
2007-12-05 02:19 385,024 —-a-w C:\WINDOWS\system32\atikvmag.dll
2007-12-05 02:17 17,408 —-a-w C:\WINDOWS\system32\atitvo32.dll
2007-12-05 02:14 180,224 —-a-w C:\WINDOWS\system32\atiok3x2.dll
2007-12-05 02:11 499,712 ——w C:\WINDOWS\system32\ati2cqag.dll
2007-11-29 18:19 3,532 —-a-w C:\drmHeader.bin
.

——- Sigcheck ——-

8f078ae4ed187aaabc0a305146de6716 C:\WINDOWS\system32\svchost.exe
—-a-w 14,336 2007-11-24 14:23:34 C:\WINDOWS\system32\svchost.exe

1800f293bccc8ede8a70e12b88d80036 C:\WINDOWS\system32\user32.dll
—-a-w 577,024 2002-12-31 12:00:00 C:\WINDOWS\system32\user32.dll

2ed0b7f12a60f90092081c50fa0ec2b2 C:\WINDOWS\system32\ws2_32.dll
—-a-w 82,944 2002-12-31 12:00:00 C:\WINDOWS\system32\ws2_32.dll

63fdfea54eb53de2d863ee454937ce1e C:\WINDOWS\system32\drivers\tcpip.sys
—-a-w 359,936 2002-12-31 12:00:00 C:\WINDOWS\system32\drivers\tcpip.sys

b66dbc40d428fe1293041d621d836ac8 C:\WINDOWS\system32\winlogon.exe
—-a-w 502,784 2002-12-31 12:00:00 C:\WINDOWS\system32\winlogon.exe

558635d3af1c7546d26067d5d9b6959e C:\WINDOWS\system32\drivers\ndis.sys
—-a-w 182,912 2002-12-31 12:00:00 C:\WINDOWS\system32\drivers\ndis.sys

d8aba3eab509627e707a3b14f00fbb6b C:\WINDOWS\system32\ntkrnlpa.exe
—-a-w 2,056,832 2002-12-31 12:00:00 C:\WINDOWS\system32\ntkrnlpa.exe

28187802b7c368c0d3aef7d4c382aabb C:\WINDOWS\system32\ntoskrnl.exe
—-a-w 2,179,456 2002-12-31 12:00:00 C:\WINDOWS\system32\ntoskrnl.exe

98d45efddd1a67f90353be8d28ed72db C:\WINDOWS\explorer.exe
—-a-w 1,032,192 2002-12-31 12:00:00 C:\WINDOWS\explorer.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0CA10898-7F98-4709-A479-B8134AB3D9F3}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"JulaPan"="JulaPan.Exe" [2005-07-05 16:27 425984 C:\WINDOWS\system32\JulaPan.exe]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-11-24 15:39 949376]

[HKLM\~\startupfolder\C:^Documents and Settings^Administrator^Start Menu^Programs^Startup^Adobe Gamma Loader.exe]
path=C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\Adobe Gamma Loader.exe
backup=C:\WINDOWS\pss\Adobe Gamma Loader.exeStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Administrator^Start Menu^Programs^Startup^Adobe Gamma.lnk]
path=C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\Adobe Gamma.lnk
backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Administrator^Start Menu^Programs^Startup^HDD temperature.lnk]
path=C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\HDD temperature.lnk
backup=C:\WINDOWS\pss\HDD temperature.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk
backup=C:\WINDOWS\pss\Adobe Acrobat Speed Launcher.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Synchronizer.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Synchronizer.lnk
backup=C:\WINDOWS\pss\Adobe Acrobat Synchronizer.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^AutoCAD Startup Accelerator.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\AutoCAD Startup Accelerator.lnk
backup=C:\WINDOWS\pss\AutoCAD Startup Accelerator.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^BTTray.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\BTTray.lnk
backup=C:\WINDOWS\pss\BTTray.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^m-trip Launcher.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\m-trip Launcher.lnk
backup=C:\WINDOWS\pss\m-trip Launcher.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^msn_0802_upd181826.exe]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\msn_0802_upd181826.exe
backup=C:\WINDOWS\pss\msn_0802_upd181826.exeCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Suitcase 11.0.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Suitcase 11.0.lnk
backup=C:\WINDOWS\pss\Suitcase 11.0.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ABIT uGuru]
d:\Program Files\ABIT\ABIT uGuru\uGuru.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 7.0]
D:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
–a—— 2002-12-31 13:00 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
–a—— 2005-12-10 15:57 133016 d:\Program Files\DAEMON Tools\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033]
D:\Program Files\D-Tools\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\gcasServ]
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GuruClock]
d:\Program Files\ABIT\ABIT uGuru\GuruClock.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H2O]
C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HDDHealth]
d:\Program Files\HDD Health\hddhealth.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\JulaPan]
–a—— 2005-07-05 16:27 425984 C:\WINDOWS\system32\JulaPan.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Kernel and Hardware Abstraction Layer]


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Hardware Abstraction Layer]


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Windows System Kernel]


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
–a—— 2001-07-09 10:50 155648 C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
D:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RaidTool]
–a—— 2005-06-20 18:53 1056768 C:\Program Files\VIA\RAID\raid_tool.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
–a—— 2005-01-10 03:36 77824 C:\WINDOWS\SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
-rahs—- 2008-01-28 11:43 2097488 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
–a—— 2007-07-12 03:00 132496 C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
D:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"PDSched"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

R3 ipgd;IC Plus IP1000 Family Gigabit Ethernet Adapter Driver;C:\WINDOWS\system32\DRIVERS\ipgdnd51.sys [2005-01-11 09:47]
R3 JULA_01;Service for Juli@ 1;C:\WINDOWS\system32\drivers\JulaWdm.sys [2005-07-05 16:27]
R3 JULA_AA;Service for Juli@ Audio Driver (EWDM);C:\WINDOWS\system32\drivers\Jula.sys [2005-07-05 16:27]
S3 MA_CMIDI;%EVOL_USB.SvcDesc%;C:\WINDOWS\system32\drivers\ma_cmidi.sys []

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-28 15:38:21
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-28 15:39:00
ComboFix-quarantined-files.txt 2008-02-28 14:38:39
ComboFix2.txt 2008-02-28 08:04:01
ComboFix3.txt 2008-02-27 12:47:20
ComboFix4.txt 2007-12-08 12:28:03

———————

Malwaybytes:

Malwarebytes' Anti-Malware 1.05
Database version: 421

Scan type: Full Scan (A:\|C:\|D:\|E:\|F:\|)
Objects scanned: 253614
Time elapsed: 1 hour(s), 20 minute(s), 36 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 5

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\cs.dat (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\rc.dat (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ps1.dat (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\cmds.txt (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\inf\ultra.PNF (Malware.Trace) -> Quarantined and deleted successfully.

———–

Computer running OK, still some web problems that I didn't have before (multiple links not opening when I click on them in IE, have to go open new window). Another problem that has arisen is with HJT, see the following:

Please help us improve HijackThis by reporting this error

Click 'Yes' to submit

Error Details:

An unexpected error has occurred at procedure: modRegistry_IniGetString(sFile=system.ini, sSection=boot, sValue=Shell)
Error #5 - Invalid procedure call or argument

Windows version: Windows NT 5.01.2600
MSIE version: 6.0.2900.2180
HijackThis version: 2.0.2

———

Reinstalled, but problem still appeared. Scan ran with no issues though.