[Resolved] Red Circle White X Systray - Your system is infected

Well I feel like I just put another 2.5 hours in at work. My other life is a tech support engineer at Symantec. I just got off of the phone with the good Doc. He is learning how to do many things that he has never done before. Here's my story.

The machine is running like molasses on a cold winter morning. Slower than snails. We ran the lspfix.exe and there were no occasions of epknatsr.dll We lost the network connection that we had before and could not create a new one. I know the dll is running as a part of the O10 - Unknown file in Winsock LSP: c:\windows\system32\epknatsr.dll as shown in the HijackThis log. The task bar has now disappeared (this opened a new can of worms for Doc ). We ran task manager and stopped the following process:pcmservice.exe(This is the file that we stopped the last time to complete the Combofix program.) We were unable to drag and drop the CFScript.txt onto ComboFix.exe
We could not drag any icon - verified Arrange Icons by - Show Desktop Icons was only item checked

Ran CFSxript by using the "Open with" option from a right mouse button click on the CFScript.txt and we associated it to run with ComboFix.exe. It took 15minutes to run the file to the display of the ComboFix.log

There were 2 errors that popped up : Error loading C:\Windows\Systems32\dtltttdptpd.drv. This specific module could not be found. Choice of OK as a button on the bottom. We clicked on OK
This same error came up a total of 2 times, one after the other. We clicked on OK again.

After restart with the network cable connected. The same error as listed above with the OK button to close.
We clicked on OK.

Here is this ComboFix log
////////////////////////////
ComboFix 08-03-17.1 - Dr Bob 2008-03-26 18:17:19.10 - NTFSx86

Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Dr Bob\Desktop\CFScript.txt

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\30.tmp
C:\31.tmp
C:\32.tmp
C:\33.tmp
C:\34.tmp
C:\35.tmp
C:\36.tmp
C:\37.tmp
C:\38.tmp
C:\39.tmp
C:\DOCUME~1\DRBOB~1\LOCALS~1\Temp\dhddlt.nls
C:\DOCUME~1\DRBOB~1\LOCALS~1\Temp\dhddlt.nls WLEntryPoint
C:\WINDOWS\SYSTEM32\APCUPSn.dll
C:\WINDOWS\SYSTEM32\dtltttdptpd.drv
C:\WINDOWS\SYSTEM32\hthddphd.dll
C:\WINDOWS\SYSTEM32\ldhtthhddll.nls
C:\WINDOWS\SYSTEM32\pdlllldtpdl.sys
C:\WINDOWS\SYSTEM32\thhplltlpdt.drv
C:\WINDOWS\SYSTEM32\tphltpldhp.sys
C:\WINDOWS\SYSTEM32\tpppphptltl.nls
C:\WINDOWS\SYSTEM32\ttlplhhthl.dll
C:\WINDOWS\taskmon.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\30.tmp
C:\31.tmp
C:\32.tmp
C:\33.tmp
C:\34.tmp
C:\35.tmp
C:\36.tmp
C:\37.tmp
C:\38.tmp
C:\39.tmp
C:\WINDOWS\noscavow
C:\WINDOWS\noscavow\1.png
C:\WINDOWS\noscavow\2.png
C:\WINDOWS\noscavow\3.png
C:\WINDOWS\noscavow\4.png
C:\WINDOWS\noscavow\5.png
C:\WINDOWS\noscavow\6.png
C:\WINDOWS\noscavow\bottom-rc.gif
C:\WINDOWS\noscavow\content.png
C:\WINDOWS\noscavow\download.gif
C:\WINDOWS\noscavow\frame-bottom-left.gif
C:\WINDOWS\noscavow\frame-h1bg.gif
C:\WINDOWS\noscavow\head.png
C:\WINDOWS\noscavow\indexsc.html
C:\WINDOWS\noscavow\indexsd.html
C:\WINDOWS\noscavow\main.css
C:\WINDOWS\noscavow\net.png
C:\WINDOWS\noscavow\pc-mag.gif
C:\WINDOWS\noscavow\pc.gif
C:\WINDOWS\noscavow\poloska1.png
C:\WINDOWS\noscavow\poloska2.png
C:\WINDOWS\noscavow\poloska3.png
C:\WINDOWS\noscavow\promosc1.html
C:\WINDOWS\noscavow\promosc2.html
C:\WINDOWS\noscavow\promosc3.html
C:\WINDOWS\noscavow\promosc4.html
C:\WINDOWS\noscavow\promosc5.html
C:\WINDOWS\noscavow\promosd1.html
C:\WINDOWS\noscavow\promosd2.html
C:\WINDOWS\noscavow\promosd3.html
C:\WINDOWS\noscavow\promosd4.html
C:\WINDOWS\noscavow\promosd5.html
C:\WINDOWS\noscavow\reg.png
C:\WINDOWS\noscavow\repair.png
C:\WINDOWS\noscavow\scr-1.png
C:\WINDOWS\noscavow\scr-2.png
C:\WINDOWS\noscavow\scr-3.png
C:\WINDOWS\noscavow\scr-4.png
C:\WINDOWS\noscavow\styles.css
C:\WINDOWS\noscavow\top-rc.gif
C:\WINDOWS\noscavow\vline.gif
C:\WINDOWS\SYSTEM32\.e0c72f57
C:\WINDOWS\SYSTEM32\.e0c72f57\e0c72f57.Aff.config
C:\WINDOWS\SYSTEM32\.e0c72f57\e0c72f57.BR.config
C:\WINDOWS\SYSTEM32\.e0c72f57\e0c72f57.GR.config
C:\WINDOWS\SYSTEM32\.e0c72f57\e0c72f57.Rdr.config
C:\WINDOWS\SYSTEM32\.e0c72f57\e0c72f57.ServerPlugin.config
C:\WINDOWS\SYSTEM32\APCUPSn.dll
C:\WINDOWS\SYSTEM32\dtltttdptpd.drv
C:\WINDOWS\SYSTEM32\hthddphd.dll
C:\WINDOWS\SYSTEM32\ldhtthhddll.nls
C:\WINDOWS\SYSTEM32\pdlllldtpdl.sys
C:\WINDOWS\SYSTEM32\thhplltlpdt.drv
C:\WINDOWS\SYSTEM32\tphltpldhp.sys
C:\WINDOWS\SYSTEM32\tpppphptltl.nls
C:\WINDOWS\SYSTEM32\ttlplhhthl.dll

.
((((((((((((((((((((((((( Files Created from 2008-02-27 to 2008-03-27 )))))))))))))))))))))))))))))))
.

2008-03-20 17:06 . 2008-03-20 17:06 80,801 –a—— C:\catchme2008-03-20_201530.53.zip
2008-03-20 16:57 . 2008-03-20 16:57 127 –a—— C:\WINDOWS\SYSTEM32\MRT.INI
2008-03-10 19:44 . 2008-03-10 20:01 d——– C:\Program Files\Unlocker
2008-03-09 13:49 . 2008-03-09 13:49 d——– C:\Documents and Settings\Dr Bob\Application Data\Talkback
2008-03-09 12:48 . 2008-03-10 19:25 d——– C:\Program Files\Spyware Doctor
2008-03-09 12:48 . 2008-03-10 19:25 d-a—— C:\Documents and Settings\All Users\Application Data\TEMP
2008-03-09 12:31 . 2008-03-09 12:31 d——– C:\Program Files\CCleaner
2008-03-06 09:12 . 2008-03-06 09:12 d——– C:\Documents and Settings\Sandi\Application Data\Grisoft
2008-03-04 20:10 . 2008-03-04 20:10 d——– C:\Documents and Settings\Dr Bob\Application Data\Grisoft
2008-03-04 20:08 . 2008-03-04 20:08 d——– C:\Documents and Settings\All Users\Application Data\Grisoft
2008-03-04 20:08 . 2007-05-30 05:10 10,872 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\AvgAsCln.sys
2008-03-02 13:19 . 2008-03-02 13:19 d——– C:\Program Files\Lavasoft
2008-03-02 13:19 . 2008-03-02 13:20 d——– C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-03-02 13:18 . 2008-03-10 16:21 d——– C:\Program Files\Common Files\Wise Installation Wizard
2008-03-02 13:08 . 2008-03-09 10:59 77,383 –a—— C:\WINDOWS\SYSTEM32\atasnt40.dll
2008-03-02 13:08 . 2008-03-02 13:08 51,304 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\atnt40k.sys
2008-03-02 12:22 . 2008-03-02 12:22 d——– C:\Documents and Settings\Dr Bob\Application Data\BrowserObjects
2008-03-02 12:22 . 2008-03-02 12:22 d——– C:\Documents and Settings\Dr Bob\Application Data\Autorun
2008-03-02 12:16 . 2008-03-09 16:41 11,776 –a—— C:\WINDOWS\SYSTEM32\WLCtrl32.dl_
2008-03-02 11:57 . 2008-03-09 16:40 11,776 –a—— C:\WINDOWS\SYSTEM32\WLCtrl32.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-05 04:25 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-03-03 19:01 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2008-03-03 15:34 ——— d—–w C:\Program Files\Symantec AntiVirus
2008-03-02 18:58 14,336 —-a-w C:\WINDOWS\SYSTEM32\svchost.exe
2008-03-02 18:58 14,336 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\svchost.exe
2008-02-25 21:37 60,968 —-a-w C:\Documents and Settings\Dr Bob\GoToAssistDownloadHelper.exe
2004-07-26 18:46 520,192 —-a-w C:\Documents and Settings\Rosa\chatlnk.exe
.

——- Sigcheck ——-

2005-03-13 17:55 359808 0e66b538096a6529d1ac66e78eb0d5c8 C:\WINDOWS\$hf_mig$\KB893066\SP2GDR\tcpip.sys
2005-05-25 12:07 359936 63fdfea54eb53de2d863ee454937ce1e C:\WINDOWS\$hf_mig$\KB893066\SP2QFE\tcpip.sys
2006-01-13 10:07 360448 5562cc0a47b2aef06d3417b733f3c195 C:\WINDOWS\$hf_mig$\KB913446\SP2QFE\tcpip.sys
2006-04-20 05:18 360576 b2220c618b42a2212a59d91ebd6fc4b4 C:\WINDOWS\$hf_mig$\KB917953\SP2QFE\tcpip.sys
2007-10-30 09:53 360832 64798ecfa43d78c7178375fcdd16d8c8 C:\WINDOWS\$hf_mig$\KB941644\SP2QFE\tcpip.sys
2005-02-22 19:00 339968 466cbd4831e80729173654ab2b8c0fee C:\WINDOWS\$NtServicePackUninstall$\tcpip.sys
2004-08-03 23:14 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\$NtUninstallKB893066$\tcpip.sys
2004-03-19 15:43 332928 244a2f9816bc9b593957281ef577d976 C:\WINDOWS\$NtUninstallKB893066_0$\tcpip.sys
2005-05-25 12:04 359808 88763a98a4c26c409741b4aa162720c9 C:\WINDOWS\$NtUninstallKB913446$\tcpip.sys
2006-01-12 19:28 359808 583e063fdc888ca30d05c2724b0d7ef4 C:\WINDOWS\$NtUninstallKB917953$\tcpip.sys
2006-04-20 04:51 359808 1dbf125862891817f374f407626967f4 C:\WINDOWS\$NtUninstallKB941644$\tcpip.sys
2004-08-03 23:14 359040 1745b00fc1141404b28f4b94f69a8871 C:\WINDOWS\ServicePackFiles\i386\tcpip.sys
2007-10-30 10:20 360064 ecf02439fd31bbd0dbc2ec05600cf08a C:\WINDOWS\SYSTEM32\DLLCACHE\tcpip.sys
2007-10-30 10:20 360064 ecf02439fd31bbd0dbc2ec05600cf08a C:\WINDOWS\SYSTEM32\DRIVERS\tcpip.sys
.
((((((((((((((((((((((((((((( snapshot@2008-03-18_18.04.11.59 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-02-04 23:09:46 18,214,008 —-a-w C:\WINDOWS\SYSTEM32\MRT.exe
+ 2008-03-05 16:30:54 19,148,408 —-a-w C:\WINDOWS\SYSTEM32\MRT.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NBJ"="C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" [2004-04-27 16:23 1863680]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-10-19 09:59 126976]
"PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [2004-04-11 18:15 290816]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2004-07-14 21:32 77824]
"MimBoot"="C:\PROGRA~1\MUSICM~1\MUSICM~2\mimboot.exe" [2006-01-19 12:06 11776]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-03-07 14:02 53408]
"vptray"="C:\PROGRA~1\SYMANT~1\\vptray.exe" [2006-03-17 06:34 124656]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 02:25 6731312]
"UnlockerAssistant"="C:\Program Files\Unlocker\UnlockerAssistant.exe" [2008-02-29 22:10 15872]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2000-01-21 01:15:54 65588]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Yahoo!\\Yahoo! Music Jukebox\\YahooMusicEngine.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"15257:TCP"= 15257:TCP:@xpsp2res.dll,-22005
"19708:TCP"= 19708:TCP:@xpsp2res.dll,-22005
"41091:TCP"= 41091:TCP:@xpsp2res.dll,-22005
"50406:TCP"= 50406:TCP:@xpsp2res.dll,-22005


.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-26 18:21:01
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-03-26 18:22:40
ComboFix-quarantined-files.txt 2008-03-27 01:22:36
ComboFix2.txt 2008-03-25 00:03:15
ComboFix3.txt 2008-03-19 01:05:11
.
2008-03-20 23:57:13 — E O F —
///////////////////////////
We ran the HijackThis program with no problem.
//////////////////////////
Here is the current HijackThis log after restart into normal mode
////////////////////////
Logfile of HijackThis v1.99.1
Scan saved at 6:42:14 PM, on 3/26/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\PROGRA~1\SYMANT~1\vptray.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\Dr Bob\Desktop\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/mywaybiz
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~2\mimboot.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\\vptray.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Open Picture in &Microsoft; PhotoDraw - res://C:\PROGRA~1\MICROS~4\Office\1033\phdintl.dll/phdContext.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://support2.charter.com/sdccommon/download/tgctlcm.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {9E58D78E-C5D3-DCF5-F38E-D1FBF76F5CBA} (MNPerformer Class) - http://www.charter.net/files/musicnet/down…merSetup-sa.exe
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://symantec.webex.com/client/T23L/support/ieatgpc.cab
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Application Layer Gateway Service (ALG) - Unknown owner - C:\WINDOWS\System32\alg.exe (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe


It is a real hard battle at this point. I would like to thank you for all your help. I only hope that the machine holds out,

Thanks
Robert

We left the machine running overnight. Doc got back to the office this morning and the ComboFix log had been created. I guess it just took its good ole time. There is still no network connection or taskbar. I'm going to have him try to run ipconfig and netsh winsock reset from the command prompt to see if we can get the metwork connection back. The taskbar shows the double arrow at the bottom of the screen but we cannot resize. It will not allow the drag to resize. I tried to have him hit the CTRL & Esc button to bring up the start menu and the taskbar to see if it is locked but no luck. Nothing came up on the keystroke entry. We even flipped the keyboard over and tapped the top and bottm edges to make sure there were no keys stuck. I think he said a 57 Chevy fell out. I will have him try to log on as a different user and see if the taskbar appears. It may be a corrupt user file. Any othe suggestions are appreciated.

The machine is running slow but not like before. We can drag icons on the desktop now but as I mentioned we cannot resize the taskbar.

Here is the ComboFix Log

ComboFix 08-03-27.2 - Dr Bob 2008-03-28 18:07:51.11 - NTFSx86

Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Dr Bob\Desktop\CFScript.txt

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\WINDOWS\SYSTEM32\WLCtrl32.dl_
C:\WINDOWS\SYSTEM32\WLCtrl32.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Dr Bob\Application Data\Autorun
C:\Documents and Settings\Dr Bob\Application Data\BrowserObjects
C:\WINDOWS\system32\WLCtrl32.dl_
C:\WINDOWS\SYSTEM32\WLCtrl32.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_ASC3550P
——-\Service_asc3550p
——-\Service_npf


((((((((((((((((((((((((( Files Created from 2008-02-28 to 2008-03-29 )))))))))))))))))))))))))))))))
.

2008-03-20 17:06 . 2008-03-20 17:06 80,801 –a—— C:\catchme2008-03-20_201530.53.zip
2008-03-20 16:57 . 2008-03-20 16:57 127 –a—— C:\WINDOWS\SYSTEM32\MRT.INI
2008-03-10 19:44 . 2008-03-10 20:01 d——– C:\Program Files\Unlocker
2008-03-09 13:49 . 2008-03-09 13:49 d——– C:\Documents and Settings\Dr Bob\Application Data\Talkback
2008-03-09 12:48 . 2008-03-10 19:25 d——– C:\Program Files\Spyware Doctor
2008-03-09 12:48 . 2008-03-10 19:25 d-a—— C:\Documents and Settings\All Users\Application Data\TEMP
2008-03-09 12:31 . 2008-03-09 12:31 d——– C:\Program Files\CCleaner
2008-03-06 09:12 . 2008-03-06 09:12 d——– C:\Documents and Settings\Sandi\Application Data\Grisoft
2008-03-04 20:10 . 2008-03-04 20:10 d——– C:\Documents and Settings\Dr Bob\Application Data\Grisoft
2008-03-04 20:08 . 2008-03-04 20:08 d——– C:\Documents and Settings\All Users\Application Data\Grisoft
2008-03-04 20:08 . 2007-05-30 05:10 10,872 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\AvgAsCln.sys
2008-03-02 13:19 . 2008-03-02 13:19 d——– C:\Program Files\Lavasoft
2008-03-02 13:19 . 2008-03-02 13:20 d——– C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-03-02 13:18 . 2008-03-10 16:21 d——– C:\Program Files\Common Files\Wise Installation Wizard
2008-03-02 13:08 . 2008-03-09 10:59 77,383 –a—— C:\WINDOWS\SYSTEM32\atasnt40.dll
2008-03-02 13:08 . 2008-03-02 13:08 51,304 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\atnt40k.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-05 04:25 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-03-03 19:01 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2008-03-03 15:34 ——— d—–w C:\Program Files\Symantec AntiVirus
2008-02-25 21:37 60,968 —-a-w C:\Documents and Settings\Dr Bob\GoToAssistDownloadHelper.exe
2004-07-26 18:46 520,192 —-a-w C:\Documents and Settings\Rosa\chatlnk.exe
.

——- Sigcheck ——-

2004-03-19 15:43 12800 0f7d9c87b0ce1fa520473119752c6f79 C:\WINDOWS\$NtServicePackUninstall$\svchost.exe
2004-08-04 00:56 14336 8f078ae4ed187aaabc0a305146de6716 C:\WINDOWS\ServicePackFiles\i386\svchost.exe
2008-03-02 11:58 14336 8f078ae4ed187aaabc0a305146de6716 C:\WINDOWS\SYSTEM32\svchost.exe
2008-03-02 11:58 14336 8f078ae4ed187aaabc0a305146de6716 C:\WINDOWS\SYSTEM32\DLLCACHE\svchost.exe

2005-03-02 11:09 577024 de2db164bbb35db061af0997e4499054 C:\WINDOWS\$hf_mig$\KB890859\SP2GDR\user32.dll
2005-03-02 11:19 577024 1800f293bccc8ede8a70e12b88d80036 C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\user32.dll
2007-03-08 08:48 578048 7aa4f6c00405dfc4b70ed4214e7d687b C:\WINDOWS\$hf_mig$\KB925902\SP2QFE\user32.dll
2005-03-02 11:20 561152 74202eb1bd67e8be9509e38c8d2234b0 C:\WINDOWS\$NtServicePackUninstall$\user32.dll
2004-03-19 15:44 560128 dd9269230c21ee8fb7fd3fccc3b1cfcb C:\WINDOWS\$NtUninstallKB824141$\USER32.DLL
2003-09-25 02:49 560128 32173306185f603e75c477e117f3bb8d C:\WINDOWS\$NtUninstallKB840987$\user32.dll
2004-08-04 00:56 577024 c72661f8552ace7c5c85e16a3cf505c4 C:\WINDOWS\$NtUninstallKB890859$\user32.dll
2004-06-17 10:58 560128 31fb2d788a9aa618452c02e8375b6dcd C:\WINDOWS\$NtUninstallKB890859_0$\user32.dll
2005-03-02 11:09 577024 de2db164bbb35db061af0997e4499054 C:\WINDOWS\$NtUninstallKB925902$\user32.dll
2004-08-04 00:56 577024 c72661f8552ace7c5c85e16a3cf505c4 C:\WINDOWS\ServicePackFiles\i386\user32.dll
2004-12-28 18:31 574464 0706e1cd6b89800781db038f4b3f5654 C:\WINDOWS\SoftwareDistribution\Download\8a4341850daecfe5fcade73622025bbf\sp1qfe\user32.dll
2007-03-08 08:36 577536 b409909f6e2e8a7067076ed748abf1e7 C:\WINDOWS\SYSTEM32\user32.dll
2007-03-08 08:36 577536 b409909f6e2e8a7067076ed748abf1e7 C:\WINDOWS\SYSTEM32\DLLCACHE\user32.dll

2003-07-10 12:19 70656 06bf1d3c21274f92ddd0e09317c80b35 C:\WINDOWS\$NtServicePackUninstall$\ws2_32.dll
2004-03-19 15:45 75264 8529c295df59b564d37a73b5629162b1 C:\WINDOWS\$NtUninstallKB817778$\ws2_32.dll
2004-08-04 00:56 82944 2ed0b7f12a60f90092081c50fa0ec2b2 C:\WINDOWS\ServicePackFiles\i386\ws2_32.dll
2004-08-04 00:56 82944 2ed0b7f12a60f90092081c50fa0ec2b2 C:\WINDOWS\SYSTEM32\ws2_32.dll

2005-09-02 16:53 660480 97a6fd7cafd688cf2c78939ebaf0cd0c C:\WINDOWS\$hf_mig$\KB896688\SP2QFE\wininet.dll
2005-07-02 19:09 659456 6e533d155b259eb2363d3e04b5be309f C:\WINDOWS\$hf_mig$\KB896727\SP2QFE\wininet.dll
2005-10-20 20:38 661504 af785c4947676a7fc1673fdc5c8d0b5b C:\WINDOWS\$hf_mig$\KB905915\SP2QFE\wininet.dll
2005-02-18 16:19 592384 33bde2b6c11c96969e1cbf894c5980af C:\WINDOWS\$NtServicePackUninstall$\wininet.dll
2004-02-06 16:05 588288 4f64d1df989e3aa2fad91a2f1167b9c7 C:\WINDOWS\$NtUninstallKB889293-IE6SP1-20041111.235619$\wininet.dll
2004-08-23 20:32 589312 01893ed35886aff539b58a025736f7ed C:\WINDOWS\$NtUninstallKB890923-IE6SP1-20050225.103456$\wininet.dll
2005-07-02 19:11 658432 5b5ff992c0fa762ccf8655fc290e6e52 C:\WINDOWS\$NtUninstallKB896688$\wininet.dll
2004-08-04 00:56 656384 c0823fc5469663ba63e7db88f9919d70 C:\WINDOWS\$NtUninstallKB896727$\wininet.dll
2005-09-02 16:52 658432 af61ebb1f550175eff406d545d6ab086 C:\WINDOWS\$NtUninstallKB905915$\wininet.dll
2005-10-20 20:39 658432 e7b27b6b6e06ce34ea019fd8b858c613 C:\WINDOWS\$NtUninstallKB912812$\wininet.dll
2006-03-03 20:58 663552 c0845ecbf4f9164e618ee381b79c9032 C:\WINDOWS\$NtUninstallKB916281$\wininet.dll
2006-05-09 22:25 663552 d94cffdb53e7ac867438e2dfd50e7cbc C:\WINDOWS\$NtUninstallKB918899$\wininet.dll
2006-06-23 04:25 664576 64ce26db72810b30f7855ea51e1df836 C:\WINDOWS\$NtUninstallKB922760$\wininet.dll
2006-09-14 01:31 664576 d207370287cf769aebebf03837784963 C:\WINDOWS\$NtUninstallKB925454$\wininet.dll
2006-10-23 08:34 664576 231ef4179acabe486376b5ca893f1076 C:\WINDOWS\$NtUninstallKB928090$\wininet.dll
2007-01-04 07:05 665088 3ffa1573fc274e5aa7467d03941c45ee C:\WINDOWS\$NtUninstallKB931768$\wininet.dll
2007-02-20 02:52 665600 b258c922d22deec880b60720531d7627 C:\WINDOWS\$NtUninstallKB933566$\wininet.dll
2007-04-18 05:46 665600 4261ba03afd659de04f0a17dfbdd454d C:\WINDOWS\$NtUninstallKB937143$\wininet.dll
2007-06-26 07:35 665600 e1a3dd68b5380b360a7310a64d9bb188 C:\WINDOWS\$NtUninstallKB939653$\wininet.dll
2007-08-22 05:55 665600 a1bc17eb3758d73c3938b2318820f5b4 C:\WINDOWS\$NtUninstallKB942615$\wininet.dll
2007-10-10 22:57 666112 80d660a49e0d118144423099b2a9f5da C:\WINDOWS\$NtUninstallKB944533$\wininet.dll
2004-08-04 00:56 656384 c0823fc5469663ba63e7db88f9919d70 C:\WINDOWS\ServicePackFiles\i386\wininet.dll
2004-12-07 17:37 590336 9ffcb74df9474fd2a4148c355b40fc55 C:\WINDOWS\SoftwareDistribution\Download\64a79cf0f12e33eb879c32f446d6e441\rtmgdr\wininet.dll
2004-12-07 18:23 581120 209afec76c2b577c9298f4c78f0e574e C:\WINDOWS\SoftwareDistribution\Download\64a79cf0f12e33eb879c32f446d6e441\RTMQFE\wininet.dll
2005-06-17 23:49 574976 ece5d8e5c4b797f057e6933b539a7982 C:\WINDOWS\SoftwareDistribution\Download\ca8b35be26e9d95fe078871d32caf0c0\rtmgdr\wininet.dll
2005-06-18 01:07 585728 0cbce38abbc366b1bf0e5cda87da1fc8 C:\WINDOWS\SoftwareDistribution\Download\ca8b35be26e9d95fe078871d32caf0c0\RTMQFE\wininet.dll
2005-04-27 10:54 574976 dfd44fb5f51809859b4ba320735a2274 C:\WINDOWS\SoftwareDistribution\Download\ea4fe5325a873581baacd3ab51700fd2\rtmgdr\wininet.dll
2005-04-27 10:51 585216 dae47d23f08b81c08fd4872fd1e1c451 C:\WINDOWS\SoftwareDistribution\Download\ea4fe5325a873581baacd3ab51700fd2\RTMQFE\wininet.dll
2007-12-06 17:44 666112 085a7c37f9c6ede1ba870b7dbec06399 C:\WINDOWS\SYSTEM32\wininet.dll
2007-12-06 17:44 666112 085a7c37f9c6ede1ba870b7dbec06399 C:\WINDOWS\SYSTEM32\DLLCACHE\wininet.dll

2005-03-13 17:55 359808 0e66b538096a6529d1ac66e78eb0d5c8 C:\WINDOWS\$hf_mig$\KB893066\SP2GDR\tcpip.sys
2005-05-25 12:07 359936 63fdfea54eb53de2d863ee454937ce1e C:\WINDOWS\$hf_mig$\KB893066\SP2QFE\tcpip.sys
2006-01-13 10:07 360448 5562cc0a47b2aef06d3417b733f3c195 C:\WINDOWS\$hf_mig$\KB913446\SP2QFE\tcpip.sys
2006-04-20 05:18 360576 b2220c618b42a2212a59d91ebd6fc4b4 C:\WINDOWS\$hf_mig$\KB917953\SP2QFE\tcpip.sys
2007-10-30 09:53 360832 64798ecfa43d78c7178375fcdd16d8c8 C:\WINDOWS\$hf_mig$\KB941644\SP2QFE\tcpip.sys
2005-02-22 19:00 339968 466cbd4831e80729173654ab2b8c0fee C:\WINDOWS\$NtServicePackUninstall$\tcpip.sys
2004-08-03 23:14 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\$NtUninstallKB893066$\tcpip.sys
2004-03-19 15:43 332928 244a2f9816bc9b593957281ef577d976 C:\WINDOWS\$NtUninstallKB893066_0$\tcpip.sys
2005-05-25 12:04 359808 88763a98a4c26c409741b4aa162720c9 C:\WINDOWS\$NtUninstallKB913446$\tcpip.sys
2006-01-12 19:28 359808 583e063fdc888ca30d05c2724b0d7ef4 C:\WINDOWS\$NtUninstallKB917953$\tcpip.sys
2006-04-20 04:51 359808 1dbf125862891817f374f407626967f4 C:\WINDOWS\$NtUninstallKB941644$\tcpip.sys
2004-08-03 23:14 359040 1745b00fc1141404b28f4b94f69a8871 C:\WINDOWS\ServicePackFiles\i386\tcpip.sys
2007-10-30 10:20 360064 ecf02439fd31bbd0dbc2ec05600cf08a C:\WINDOWS\SYSTEM32\DLLCACHE\tcpip.sys
2007-10-30 10:20 360064 ecf02439fd31bbd0dbc2ec05600cf08a C:\WINDOWS\SYSTEM32\DRIVERS\tcpip.sys
.
((((((((((((((((((((((((((((( snapshot@2008-03-18_18.04.11.59 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-02-04 23:09:46 18,214,008 —-a-w C:\WINDOWS\SYSTEM32\MRT.exe
+ 2008-03-05 16:30:54 19,148,408 —-a-w C:\WINDOWS\SYSTEM32\MRT.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NBJ"="C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" [2004-04-27 16:23 1863680]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-10-19 09:59 126976]
"PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [2004-04-11 18:15 290816]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2004-07-14 21:32 77824]
"MimBoot"="C:\PROGRA~1\MUSICM~1\MUSICM~2\mimboot.exe" [2006-01-19 12:06 11776]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-03-07 14:02 53408]
"vptray"="C:\PROGRA~1\SYMANT~1\\vptray.exe" [2006-03-17 06:34 124656]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 02:25 6731312]
"UnlockerAssistant"="C:\Program Files\Unlocker\UnlockerAssistant.exe" [2008-02-29 22:10 15872]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2000-01-21 01:15:54 65588]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\e0c72f57]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Uae61.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Yahoo!\\Yahoo! Music Jukebox\\YahooMusicEngine.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"15257:TCP"= 15257:TCP:@xpsp2res.dll,-22005
"19708:TCP"= 19708:TCP:@xpsp2res.dll,-22005
"41091:TCP"= 41091:TCP:@xpsp2res.dll,-22005
"50406:TCP"= 50406:TCP:@xpsp2res.dll,-22005


.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-28 18:16:17
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\WINDOWS\System32\rsvp.exe
.
**************************************************************************
.
Completion time: 2008-03-28 18:59:47 - machine was rebooted
ComboFix-quarantined-files.txt 2008-03-29 01:59:42
ComboFix2.txt 2008-03-27 01:22:41
ComboFix3.txt 2008-03-25 00:03:15
ComboFix4.txt 2008-03-19 01:05:11
Pre-Run: 59,282,444,288 bytes free
Post-Run: 59,267,928,064 bytes free
.
2008-03-20 23:57:13 — E O F —


Here is the HiJackThis Log after reboot

Logfile of HijackThis v1.99.1
Scan saved at 11:20:13 AM, on 3/29/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\PROGRA~1\SYMANT~1\vptray.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\Dr Bob\Desktop\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/mywaybiz
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~2\mimboot.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\\vptray.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Open Picture in &Microsoft PhotoDraw - res://C:\PROGRA~1\MICROS~4\Office\1033\phdintl.dll/phdContext.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://support2.charter.com/sdccommon/download/tgctlcm.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {9E58D78E-C5D3-DCF5-F38E-D1FBF76F5CBA} (MNPerformer Class) - http://www.charter.net/files/musicnet/down…merSetup-sa.exe
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://symantec.webex.com/client/T23L/support/ieatgpc.cab
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Application Layer Gateway Service (ALG) - Unknown owner - C:\WINDOWS\System32\alg.exe (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

I will let you know if wehave any success regarding the network connection ort taskbar and what we did to correct the issue.

Thanks
Robert

We ran the netsh winsock reset and the network connection came back. The settings and workgroup information was all correct. Interesting that the taskbar came back after we ran the command.

Doc reports the machine is running faster than it has been for the past few months. I took control of his set using Webex and ran a virus scan with AVG. Here are the results.

I also ran regedit and got rid of the previously mentioned error loading the C:\WINDOWS\SYSTEM32\dtltttdptpd.drv. This was loding in the registry as taskmon (path was C:\WINDOWS\SYSTEM32\run32.dll C:\WINDOWS\SYSTEM32\dtltttdptpd.drv) Once I removed it from the registry the error stopped posting the VB warning message at boot.
———————————————————
AVG Anti-Spyware - Scan Report
———————————————————

+ Created at: 7:28:40 PM 3/29/2008

+ Scan result:



C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\APCUPSn.dll.vir -> Backdoor.Agent.frr : Cleaned.
C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP8\A0012635.dll -> Backdoor.Agent.frr : Cleaned.
C:\WINDOWS\SYSTEM32\CONFIG\31274142.Evt -> Backdoor.Hupigon.ayik : Cleaned.
C:\WINDOWS\SYSTEM32\CONFIG\32914792.Evt -> Backdoor.Hupigon.ayik : Cleaned.
C:\WINDOWS\SYSTEM32\CONFIG\46333482.Evt -> Backdoor.Hupigon.ayik : Cleaned.
C:\WINDOWS\SYSTEM32\CONFIG\46772286.Evt -> Backdoor.Hupigon.ayik : Cleaned.
C:\WINDOWS\SYSTEM32\CONFIG\51942320.Evt -> Backdoor.Hupigon.ayik : Cleaned.
C:\WINDOWS\SYSTEM32\CONFIG\61497422.Evt -> Backdoor.Hupigon.ayik : Cleaned.
C:\WINDOWS\SYSTEM32\CONFIG\63205778.Evt -> Backdoor.Hupigon.ayik : Cleaned.
C:\WINDOWS\SYSTEM32\CONFIG\65430000.Evt -> Backdoor.Hupigon.ayik : Cleaned.
C:\WINDOWS\SYSTEM32\CONFIG\65998822.Evt -> Backdoor.Hupigon.ayik : Cleaned.
C:\WINDOWS\SYSTEM32\CONFIG\66443298.Evt -> Backdoor.Hupigon.ayik : Cleaned.
C:\WINDOWS\SYSTEM32\CONFIG\66590266.Evt -> Backdoor.Hupigon.ayik : Cleaned.
C:\WINDOWS\SYSTEM32\CONFIG\77057080.Evt -> Backdoor.Hupigon.ayik : Cleaned.
C:\WINDOWS\SYSTEM32\CONFIG\77522090.Evt -> Backdoor.Hupigon.ayik : Cleaned.
C:\!KillBox\mrofinu27.exe -> Downloader.Agent.krh : Cleaned.
C:\QooBox\Quarantine\C\WINDOWS\mrofinu27.exe.tmp.vir -> Downloader.Agent.krh : Cleaned.
C:\QooBox\Quarantine\C\WINDOWS\mrofinu27.exe.vir -> Downloader.Agent.krh : Cleaned.
C:\QooBox\Quarantine\C\Documents and Settings\Dr Bob\Local Settings\Application Data\cftmon.exe.vir -> Downloader.Small.ipy : Cleaned.
C:\QooBox\Quarantine\C\Documents and Settings\LocalService\Local Settings\Application Data\cftmon.exe.vir -> Downloader.Small.ipy : Cleaned.
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\DRIVERS\spools.exe.vir -> Downloader.Small.ipy : Cleaned.
C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP5\A0011333.exe -> Downloader.Small.ipy : Cleaned.
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\winivstr.exe.vir -> Not-A-Virus.PUP.Reanimator.a : Cleaned.
C:\Documents and Settings\Dr Bob\Cookies\dr bob@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Dr Bob\Cookies\dr [removed][1].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\Dr Bob\Cookies\dr bob@hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned.
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\.e0c72f57\e0c72f57.core.dll.vir -> Trojan.Pakes.chv : Cleaned.
C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP5\A0011327.dll -> Trojan.Pakes.chv : Cleaned.
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\.e0c72f57\e0c72f57.exe.vir -> Trojan.Pakes.chw : Cleaned.
C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP5\A0011328.exe -> Trojan.Pakes.chw : Cleaned.
C:\!KillBox\epknatsr.dll -> Worm.Locksky.da : Cleaned.
C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP8\A0012617.dll -> Worm.Locksky.da : Cleaned.


::Report end
//////////////////////

I also ran a scan using AdAware and it found and deleted 42 infections.

Scan mode: Full
Scan time: 00:25:29
Number of objects scanned: 281103
Number of infections found: 42
Critical: 37
Privacy Objects: 5
Infections deleted: 42
Total infections quarantined: 0
Total infections ignored by scanner: 0
////////////////////

I ran a HijackThis after a reboot. Here is the log.

Logfile of HijackThis v1.99.1
Scan saved at 8:30:00 PM, on 3/29/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mim.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Dr Bob\My Documents\rid redex\dl\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/mywaybiz
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~2\mimboot.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Open Picture in &Microsoft; PhotoDraw - res://C:\PROGRA~1\MICROS~4\Office\1033\phdintl.dll/phdContext.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://support2.charter.com/sdccommon/download/tgctlcm.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {9E58D78E-C5D3-DCF5-F38E-D1FBF76F5CBA} (MNPerformer Class) - http://www.charter.net/files/musicnet/down…merSetup-sa.exe
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://symantec.webex.com/client/T23L/support/ieatgpc.cab
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Application Layer Gateway Service (ALG) - Unknown owner - C:\WINDOWS\System32\alg.exe (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
////////////////////

Everything seems to be back to normal. I just wanted to send the information to you for your review.
///////////////////

Now lets talk $$$$$$$. I will donate to the site using PayPal but what about you? Do you get any $$$$ for your service? I would like to make sure that you get something for your help. Everybody's time is worth compensation. Let me know what your thoughts are LD.

Thanks again for your help.
Robert