What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] outerinfo and problems

13 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
i have outerinfo on my computer and am having problems with redirects and pop ups, etc. how do i remove? below is a hijackthis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:51:53 PM, on 3/23/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\SCardSvr.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Microsoft ActiveSync\Wcescomm.exe
C:\DOCUME~1\MATTHE~1\MYDOCU~1\ASEMBL~1\msconfig.exe
C:\Program Files\JavaCore\JavaCore.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trillian\trillian.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.netvibes.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\stsystra.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [BMf38a0635] Rundll32.exe "C:\WINDOWS\system32\fbnguqlp.dll",s
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\Wcescomm.exe"
O4 - HKCU\..\Run: [Tair] "C:\DOCUME~1\MATTHE~1\MYDOCU~1\ASEMBL~1\msconfig.exe" -vt yazb
O4 - HKCU\..\Run: [JavaCore] C:\Program Files\\JavaCore\\JavaCore.exe
O4 - Startup: Digsby.lnk = C:\Program Files\Digsby\digsby.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Sothink SWF Catcher - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {474F00F5-3853-492C-AC3A-476512BBC336} (UploadListView Class) - http://picasaweb.google.com/s/v/26.34/uploader2.cab
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/Facebo…toUploader3.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1199301478109
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.4.2) - http://javadl-esd.sun.com/update/1.4.2/jin…indows-i586.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3E82C3F3-908E-4BCF-8C37-05C2B7302E1F}: NameServer = 192.168.18.254
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

–
End of file - 7457 bytes
Post #2
_________________________________
Welcome to the Forums.

The fixes we will use are specific to your problems and should only be used for this issue on this machine.

Please only use this topic to reply to. Do not start another thread.
If any other issues arise let me know.
The process is not instant. Please continue to review my answers until I tell you your machine is clear. Absence of symptoms does not mean that everything is clear. So lets do this to the end!

  • Save and quit any work your doing before beginning the fix.
  • All hijackthis logs I ask for should be done in normal mode ( not safe mode)
  • These logs should be done last after you have followed my instructions in the previous post.


Please if you decide to seek help at another forum let us know. There is a shortage of helpers and tying 2 of us up is a waste of time.
If you have any questions about any advice given here please STOP and ask!





______________________________
RUN HJT

HJT
Run hijackthis and choose scan only and place a check by the following lines if present.
Close all other windows and browsers except HJT before clicking on Fix Checked

O4 - HKCU\..\Run: [JavaCore] C:\Program Files\JavaCore\JavaCore.exe


Close that.





digsby.exe

I see this is some new free software that has to do with IM's.
Always tosses a red flag for me lets get it scanned,


_____________________________
Submit a file to Jotti
Please go here : http://virusscan.jotti.org/
On top of the page there is a field to add the filepath, copy and paste these filepaths: 1 at a time.


C:\Program Files\Digsby\digsby.exe


Then hit Submit
The scan will take a while before the result comes up so please be patient.
Then copy the result and post it here in this thread.

If Jotti's service load is too high, you can use the following scanner instead:
http://www.virustotal.com/xhtml/index_en.html


________________________________




1. Download Combo fix from one of these locations.
* IMPORTANT !!! Place combofix.exe on your Desktop

http://download.bleepingcomputer.com/sUBs/ComboFix.exe
http://subs.geekstogo.com/ComboFix.exe

2. Click start/run and copy and Paste this in exactly using the picture below for reference:

"%userprofile%\desktop\combofix.exe" /killall


[external image: Posted Image]

3. Combo will begin to run DO NOTHING while this is happeneing.
  • It will kill a few processes and disconnect you from the internet.
  • If by chance it stops prematurly you can re-establish your internet connection by restarting your computer.
  • This needs to be done so the program can work most efficiently for you.
Do not attempt to use the internet or anything else while it's doing its job for you.

If when it's completed you can not get on the internet just reboot the computer

Post the log from comboFix for me located in
c:\comboFix.txt




_________________________
In your next reply I would like to see:
  • A new HJT log
  • The report from ComboFix
  • The report from Jottis/Virus total
Post #3
thank you. the results from the Virustotal scan of Digsby can be found at this permalink: http://www.virustotal.com/analisis/e3705bc…58d9db00def86c1. Just so you know, it is a new IM client. Below you will also find the HJT log and the combo fix log.


HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:03, on 2008-03-24
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft ActiveSync\Wcescomm.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.netvibes.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 8\SnagItBHO.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: testCPV6 - {15421B84-3488-49A7-AD18-CBF84A3EFAF6} - C:\Program Files\CPV\CPV7.dll
O2 - BHO: 0 - {C88DB50F-B1E8-4E02-33A3-E3F5089F5A4E} - C:\Program Files\MSN Gaming Zone\lawu.dll (file missing)
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\stsystra.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\Wcescomm.exe"
O4 - HKCU\..\Run: [Tair] "C:\DOCUME~1\MATTHE~1\MYDOCU~1\ASEMBL~1\msconfig.exe" -vt yazb
O4 - Startup: Digsby.lnk = C:\Program Files\Digsby\digsby.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Sothink SWF Catcher - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {474F00F5-3853-492C-AC3A-476512BBC336} (UploadListView Class) - http://picasaweb.google.com/s/v/26.34/uploader2.cab
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/Facebo…toUploader3.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1199301478109
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.4.2) - http://javadl-esd.sun.com/update/1.4.2/jin…indows-i586.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3E82C3F3-908E-4BCF-8C37-05C2B7302E1F}: NameServer = 192.168.18.254
O20 - Winlogon Notify: byxvurq - byxvurq.dll (file missing)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

–
End of file - 7462 bytes


Combo Fix log:

ComboFix 08-03-23.2 - matthew robinson 2008-03-24 7:52:24.5 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.603 [GMT -4:00]
Running from: C:\Documents and Settings\[removed]\desktop\combofix.exe
Command switches used :: /killall
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
– Other TimeOuts –
CF27611.exe /c " dir /a/s/b C:\_desktop.ini C:\desktop_.ini C:\cnsmin* C:\_install.exe >DirRoot"
CF27611.exe /c " dir /a/s/b C:\_desktop.ini C:\desktop_.ini C:\cnsmin* C:\_install.exe >DirRoot"

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\LocalService\Application Data\NetMon
C:\Documents and Settings\LocalService\Application Data\NetMon\domains.txt
C:\Documents and Settings\LocalService\Application Data\NetMon\log.txt
C:\Documents and Settings\matthew robinson\My Documents\ASEMBL~1
C:\Documents and Settings\matthew robinson\My Documents\ASEMBL~1\a?sembly\
C:\Documents and Settings\matthew robinson\My Documents\ASEMBL~1\msconfig.exe
C:\Program Files\JavaCore
C:\Program Files\JavaCore\JavaCore.exe
C:\Program Files\JavaCore\UnInstall.exe
C:\Program Files\Outlook Express\suwi89104.dll
C:\Program Files\Temporary
C:\Program Files\Temporary\InsiDERInst.exe
C:\Temp\1cb
C:\Temp\1cb\syscheck.log
C:\WINDOWS\BMf38a0635.xml
C:\WINDOWS\cookies.ini
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\aolqgpbm.ini
C:\WINDOWS\system32\bcxfcswj.dll
C:\WINDOWS\system32\byxvurq.dll
C:\WINDOWS\system32\fbnguqlp.dll
C:\WINDOWS\system32\fcccdcb.dll
C:\WINDOWS\system32\hgjlm.ini
C:\WINDOWS\system32\hgjlm.ini2
C:\WINDOWS\system32\mbpgqloa.dll
C:\WINDOWS\system32\mljgh.dll
C:\WINDOWS\system32\pac.txt

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_CMDSERVICE
——-\Legacy_NETWORK_MONITOR
——-\Legacy_TNIDRIVER
——-\Service_TnIDriver


((((((((((((((((((((((((( Files Created from 2008-02-24 to 2008-03-24 )))))))))))))))))))))))))))))))
.

2008-03-23 12:17 . 2008-03-23 13:13 d——– C:\Program Files\TrustedAntivirus
2008-03-23 12:17 . 2008-03-23 13:13 d——– C:\Program Files\Common Files\TrustedAntivirus
2008-03-23 12:17 . 2001-03-08 18:30 24,064 –a—— C:\WINDOWS\system32\msxml3a.dll
2008-03-23 12:11 . 2008-03-23 12:11 d——– C:\Program Files\CPV
2008-03-23 12:09 . 2008-03-24 08:04 d–hs—- C:\WINDOWS\TWF0dGhldyBSb2JpbnNvbg
2008-03-23 12:09 . 2006-01-03 17:45 1,989 –a—— C:\WINDOWS\uninstall_nmon.vbs
2008-03-23 12:08 . 2008-03-23 13:13 d——– C:\WINDOWS\system32\xTmp
2008-03-23 12:08 . 2008-03-23 12:08 d——– C:\WINDOWS\system32\usnv
2008-03-23 12:08 . 2008-03-23 12:08 d——– C:\WINDOWS\system32\md2
2008-03-23 12:08 . 2008-03-23 12:08 d——– C:\WINDOWS\system32\IDME
2008-03-23 12:08 . 2008-03-23 12:08 d——– C:\WINDOWS\system32\aqVreo01
2008-03-23 12:08 . 2008-03-23 12:08 d——– C:\temp\gbRve12
2008-03-23 12:08 . 2008-03-23 12:08 41,723 —hs—- C:\Program Files\Common Files\Yazzle1281OinUninstaller.exe
2008-03-23 12:08 . 2008-03-23 12:08 37,376 –a—— C:\WINDOWS\mrofinu572.exe.tmp
2008-03-23 12:08 . 2008-03-23 12:12 37,376 –a—— C:\WINDOWS\mrofinu572.exe
2008-03-23 12:08 . 2008-03-23 12:08 37,376 –a—— C:\WINDOWS\mrofinu1000106.exe
2008-03-20 17:09 . 2006-04-20 14:34 100,304 –a—— C:\WINDOWS\system32\drivers\sscdmdm.sys
2008-03-20 17:09 . 2006-04-20 14:35 79,216 –a—— C:\WINDOWS\system32\drivers\sscdserd.sys
2008-03-20 17:09 . 2006-04-20 14:33 66,672 –a—— C:\WINDOWS\system32\drivers\sscdbus.sys
2008-03-20 17:09 . 2006-04-20 14:34 9,328 –a—— C:\WINDOWS\system32\drivers\sscdmdfl.sys
2008-03-20 17:09 . 2006-04-20 14:34 6,240 –a—— C:\WINDOWS\system32\drivers\sscdcmnt.sys
2008-03-20 17:09 . 2006-04-20 14:34 6,240 –a—— C:\WINDOWS\system32\drivers\sscdcm.sys
2008-03-20 17:09 . 2006-04-20 14:33 5,904 –a—— C:\WINDOWS\system32\drivers\sscdwhnt.sys
2008-03-20 17:09 . 2006-04-20 14:33 5,904 –a—— C:\WINDOWS\system32\drivers\sscdwh.sys
2008-03-20 16:41 . 2008-03-20 16:41 d——– C:\Program Files\SAMSUNG
2008-03-19 13:43 . 2005-10-20 21:47 30,592 ——— C:\WINDOWS\system32\drivers\rndismpx.sys
2008-03-19 13:43 . 2005-10-20 21:47 12,800 ——— C:\WINDOWS\system32\drivers\usb8023x.sys
2008-03-18 15:54 . 2008-03-18 15:54 d——– C:\Program Files\Savings Bond Wizard
2008-03-18 15:54 . 1999-12-17 09:13 86,016 –a—— C:\WINDOWS\unvise32.exe
2008-03-17 13:39 . 2008-03-17 11:39 66,560 –a—— C:\WINDOWS\b155.exe
2008-03-15 08:43 . 2008-03-15 08:43 32,768 –a—— C:\WINDOWS\system32\aqVreo01\aqVreo011065.exe
2008-03-08 19:59 . 2008-03-24 08:05 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2008-03-08 19:59 . 2008-03-08 19:59 1,409 –a—— C:\WINDOWS\QTFont.for
2008-03-08 19:58 . 2008-03-08 19:59 d——– C:\Program Files\iTunes
2008-03-08 19:58 . 2008-03-08 19:58 d——– C:\Program Files\iPod
2008-03-08 19:57 . 2008-03-08 19:57 d——– C:\Program Files\QuickTime
2008-03-04 17:32 . 2008-03-04 15:32 105,984 –a—— C:\WINDOWS\b152.exe
2008-03-02 12:26 . 2008-03-02 10:26 73,728 –a—— C:\WINDOWS\b153.exe
2008-02-29 16:45 . 2008-02-29 16:45 d——– C:\Program Files\SourceTec
2008-02-29 16:45 . 2008-02-29 16:45 d——– C:\Program Files\Common Files\SourceTec
2008-02-29 16:30 . 2008-02-29 16:30 d——– C:\Program Files\SWFSOFT Flash Compiler & Decompiler
2008-02-25 11:00 . 2008-02-25 09:00 81,920 –a—— C:\WINDOWS\b154.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-23 16:42 ——— d—–w C:\Program Files\Trillian
2008-03-19 17:43 ——— d—–w C:\Program Files\Microsoft ActiveSync
2008-02-22 18:34 ——— d—–w C:\Program Files\Picasa2
2008-02-22 14:15 ——— d—–w C:\Program Files\Trend Micro
2008-02-22 05:35 ——— d—–w C:\Program Files\Lavasoft
2008-02-22 05:35 ——— d—–w C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-02-22 05:34 ——— d—–w C:\Program Files\Common Files\Wise Installation Wizard
2008-02-22 00:36 ——— d—–w C:\Program Files\Enigma Software Group
2008-02-21 03:36 ——— d—–w C:\Program Files\Digsby
2008-02-19 21:38 ——— d—–w C:\Documents and Settings\matthew robinson\Application Data\Digsby
2008-02-13 19:15 ——— d—–w C:\Documents and Settings\matthew robinson\Application Data\DivX
2008-02-13 18:41 ——— d—–w C:\Program Files\DivX
2008-02-08 19:15 ——— d—–w C:\Program Files\Windows Media Connect 2
2008-02-08 19:04 ——— d—–w C:\Program Files\Netflix
2008-01-15 21:52 140,800 –sh–w C:\Program Files\Common Files\Yazzle1281OinAdmin.exe
2005-07-29 20:24 472 –sha-r C:\WINDOWS\TWF0dGhldyBSb2JpbnNvbg\nqIXx315xV1mvZLDvBhSv0.vbs
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{15421B84-3488-49A7-AD18-CBF84A3EFAF6}]
2008-03-23 12:11 51200 –a—— C:\Program Files\CPV\CPV7.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C88DB50F-B1E8-4E02-33A3-E3F5089F5A4E}]
C:\Program Files\MSN Gaming Zone\lawu.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 06:00 15360]
"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\Wcescomm.exe" [2006-11-13 13:39 1289000]
"Tair"="C:\DOCUME~1\MATTHE~1\MYDOCU~1\ASEMBL~1\msconfig.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 06:00 110592 C:\WINDOWS\system32\bthprops.cpl]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2007-03-30 21:00 138008]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2007-03-30 21:00 162584]
"Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2007-03-30 20:59 138008]
"Broadcom Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY.exe" [2007-03-16 19:10 1392640]
"SigmatelSysTrayApp"="C:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exe" [2007-05-10 11:22 405504]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2004-09-13 16:49 49152]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [2003-11-19 18:48 32881]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-02-01 00:13 385024]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 14:10 267048]

C:\Documents and Settings\matthew robinson\Start Menu\Programs\Startup\
Digsby.lnk - C:\Program Files\Digsby\digsby.exe [2008-02-15 19:30:48 117760]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 05:44:06 29696]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-04 20:28:24 258048]
HP Image Zone Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-04 20:50:52 53248]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\byxvurq]
byxvurq.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe"= C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe"= C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"= C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service


.
Contents of the 'Scheduled Tasks' folder
"2008-03-22 22:41:12 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-24 08:05:16
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\System32\SCardSvr.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2008-03-24 8:07:21 - machine was rebooted
ComboFix-quarantined-files.txt 2008-03-24 12:07:18
ComboFix2.txt 2008-02-27 22:49:13
ComboFix3.txt 2008-02-26 03:49:56
ComboFix4.txt 2008-02-24 16:01:56
ComboFix5.txt 2008-02-23 16:09:21
.
2008-03-20 12:37:45 — E O F —
Post #4
We now suggest that you install the Windows Recovery Console.
The Windows recovery console will allow you to boot up into a special recovery mode that allows us to help you
in the case that your computer has a problem after an attempted removal of malware.

Go to Microsoft's website => http://support.microsoft.com/kb/310994
Select the download that's appropriate for your Operating System

[external image: Posted Image]


Download the file & save it as it's originally named, next to ComboFix.exe.

[external image: Posted Image]

Now close all open windows and programs, then drag the setup package onto ComboFix.exe and drop it.
Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Microsoft Recovery Console.
When complete, a log named CF_RC.txt will open. Please post the contents of that log.
Post #5
here ya go: WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
Post #6
______________________________
RUN HJT

HJT
Run hijackthis and choose scan only and place a check by the following lines if present.
Close all other windows and browsers except HJT before clicking on Fix Checked


O2 - BHO: testCPV6 - {15421B84-3488-49A7-AD18-CBF84A3EFAF6} - C:\Program Files\CPV\CPV7.dll
O2 - BHO: 0 - {C88DB50F-B1E8-4E02-33A3-E3F5089F5A4E} - C:\Program Files\MSN Gaming Zone\lawu.dll (file missing)
O4 - HKCU\..\Run: [Tair] "C:\DOCUME~1\MATTHE~1\MYDOCU~1\ASEMBL~1\msconfig.exe" -vt yazb
O20 - Winlogon Notify: byxvurq - byxvurq.dll (file missing)

Close that.




________________________________________
Open notepad and copy/paste the text in the quotebox below into it: 

File:: 
C:\WINDOWS\uninstall_nmon.vbs
C:\Program Files\Common Files\Yazzle1281OinUninstaller.exe
C:\WINDOWS\mrofinu572.exe.tmp
C:\WINDOWS\mrofinu572.exe
C:\WINDOWS\mrofinu1000106.exe
C:\WINDOWS\unvise32.exe
C:\WINDOWS\b155.exe
C:\WINDOWS\system32\aqVreo01\aqVreo011065.exe
C:\WINDOWS\b152.exe
C:\WINDOWS\b153.exe
C:\WINDOWS\b154.exe
C:\Program Files\Common Files\Yazzle1281OinAdmin.exe
C:\WINDOWS\TWF0dGhldyBSb2JpbnNvbg\nqIXx315xV1mvZLDvBhSv0.vbs

Folder:: 
C:\Program Files\CPV
C:\WINDOWS\TWF0dGhldyBSb2JpbnNvbg
C:\Program Files\TrustedAntivirus
C:\Program Files\Common Files\TrustedAntivirus
C:\WINDOWS\system32\xTmp
C:\WINDOWS\system32\usnv
C:\WINDOWS\system32\md2
C:\WINDOWS\system32\IDME
C:\WINDOWS\system32\aqVreo01
C:\temp\gbRve12


NOTE: This script was done for this user specifically.
DO NOT ATTEMPT TO USE IT IF YOU ARE NOT THIS USER
YOU WILL HURT THE WORKINGS OF YOUR COMPUTER !!.

Save this as CFScript.txt, in the same location as ComboFix.exe


[external image: Posted Image]

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:ComboFix.txt which I will need in your next reply.



_______________________________________________


You need to update SunJava for security reasons.
Updating Java:
Download the latest version of
Java Runtime Environment (JRE) 6 Update5

  • Scroll down to where it says "Java Runtime Environment (JRE) 6 Update 5
    … allows end-users to run Java applications".
  • Click the "Download" button to the right.
  • Check the box that says: "Accept License Agreement".
  • Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
  • Check any item with Java Runtime Environment (JRE or J2SE) in the name. It should have the [external image: Posted Image] icon next to it.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u5-windows-i586-p.exe
    to install the newest version.


_____________________________________________





Download and install CCleaner from here


If you use either the Firefox or Mozilla browsers, the box to uncheck for Cookies is on the Applications tab, under Firefox/Mozilla.

  • Set Cookie Retention.
    Click on the Options block on the left, then choose Cookies.
    Under the Cookies to delete pane, highlight any cookies you would like to retain permanently (those companies or sites with which you regularly visit or do business), and click the right arrow > to move them to the Cookies to keep pane.
  • Reset Temp File Removal for Regular Use.
    Click on the Options block on the left. Select the Advanced button.
    Check "Only delete files in Windows Temp folders older than 48 hours".


    Now run the program and click on Run Cleaner
    ( Do not use the Registry function to clean anything with this program. Having anything auto clean your regisrty is risky).


_________________________________

Using Internet Explorer, please do a Kaspersky Online Scan

Answer Yes, when prompted to install an ActiveX component.
  • The program will then begin downloading the latest definition files.
  • Once the files have been downloaded click on NEXT
  • Locate the Scan Settings button & configure as follows:
    • Scan using the following Anti-Virus database:
      • Extended
        • Scan Options:
          • Scan Archives
          • Scan Mail Bases

          • Click OK & have it scan My Computer
          • Once the scan is complete, it will provide a report if your system is infected. It does not provide an option to clean/disinfect. We only require a report from it.

          Click save report as

          [external image: Posted Image]

        • Click the Save as Text button to save the file to your desktop and post it in your next reply
          • [external image: Posted Image]



          Turn off the real time scanner of any existing antivirus program while performing the online scan
          _________________________
          In your next reply I would like to see:
          • A new HJT log
          • The report from ComboFix
          • The report from Kasperskys
Post #7
HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:57, on 2008-03-24
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft ActiveSync\Wcescomm.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE
C:\Program Files\Trillian\trillian.exe
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.netvibes.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 8\SnagItBHO.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\stsystra.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\Wcescomm.exe"
O4 - Startup: Digsby.lnk = C:\Program Files\Digsby\digsby.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Sothink SWF Catcher - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {474F00F5-3853-492C-AC3A-476512BBC336} (UploadListView Class) - http://picasaweb.google.com/s/v/26.34/uploader2.cab
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/Facebo…toUploader3.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1199301478109
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3E82C3F3-908E-4BCF-8C37-05C2B7302E1F}: NameServer = 192.168.18.254
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

–
End of file - 7338 bytes


Combo Fix log:

ComboFix 08-03-23.2 - matthew robinson 2008-03-24 14:25:27.6 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.577 [GMT -4:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\matthew robinson\Desktop\CFScript.txt
* Created a new restore point

FILE ::
C:\Program Files\Common Files\Yazzle1281OinAdmin.exe
C:\Program Files\Common Files\Yazzle1281OinUninstaller.exe
C:\WINDOWS\b152.exe
C:\WINDOWS\b153.exe
C:\WINDOWS\b154.exe
C:\WINDOWS\b155.exe
C:\WINDOWS\mrofinu1000106.exe
C:\WINDOWS\mrofinu572.exe
C:\WINDOWS\mrofinu572.exe.tmp
C:\WINDOWS\system32\aqVreo01\aqVreo011065.exe
C:\WINDOWS\TWF0dGhldyBSb2JpbnNvbg\nqIXx315xV1mvZLDvBhSv0.vbs
C:\WINDOWS\uninstall_nmon.vbs
C:\WINDOWS\unvise32.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\Common Files\TrustedAntivirus
C:\Program Files\Common Files\Yazzle1281OinAdmin.exe
C:\Program Files\Common Files\Yazzle1281OinUninstaller.exe
C:\Program Files\CPV
C:\Program Files\TrustedAntivirus
C:\Program Files\TrustedAntivirus\Activate.exe
C:\Program Files\TrustedAntivirus\al.dat
C:\Program Files\TrustedAntivirus\Config\pgs.xml
C:\Program Files\TrustedAntivirus\Dat\Activate.dat
C:\Program Files\TrustedAntivirus\Dat\BkSites.dat
C:\Program Files\TrustedAntivirus\Dat\bnlink.dat
C:\Program Files\TrustedAntivirus\Dat\cd.dat
C:\Program Files\TrustedAntivirus\Dat\incmp.dat
C:\Program Files\TrustedAntivirus\Dat\index.dat
C:\Program Files\TrustedAntivirus\Dat\pv.dat
C:\Program Files\TrustedAntivirus\dhlp.dll
C:\Program Files\TrustedAntivirus\Engines\AWBase\database\enemies.dat
C:\Program Files\TrustedAntivirus\Engines\AWBase\vbpv.dat
C:\Program Files\TrustedAntivirus\Engines\PGBase\vbpv.dat
C:\Program Files\TrustedAntivirus\Engines\plugins\BORLNDMM.DLL
C:\Program Files\TrustedAntivirus\Engines\plugins\SCANADWR.DLL
C:\Program Files\TrustedAntivirus\Engines\plugins\SCANBCDR.DLL
C:\Program Files\TrustedAntivirus\Engines\plugins\SCANDLDR.DLL
C:\Program Files\TrustedAntivirus\Engines\plugins\SCANDOS1.DLL
C:\Program Files\TrustedAntivirus\Engines\plugins\SCANEMUL.DLL
C:\Program Files\TrustedAntivirus\Engines\plugins\SCANFUNC.DLL
C:\Program Files\TrustedAntivirus\Engines\plugins\SCANKRNL.DLL
C:\Program Files\TrustedAntivirus\Engines\plugins\SCANMCR1.DLL
C:\Program Files\TrustedAntivirus\Engines\plugins\SCANOTHR.DLL
C:\Program Files\TrustedAntivirus\Engines\plugins\SCANSCR.DLL
C:\Program Files\TrustedAntivirus\Engines\plugins\SCANTOOL.DLL
C:\Program Files\TrustedAntivirus\Engines\plugins\SCANTROJ.DLL
C:\Program Files\TrustedAntivirus\Engines\plugins\SCANWIN1.DLL
C:\Program Files\TrustedAntivirus\Engines\plugins\UNACPU.DLL
C:\Program Files\TrustedAntivirus\Engines\plugins\UNADBX.DLL
C:\Program Files\TrustedAntivirus\Engines\plugins\unamscan.dll
C:\Program Files\TrustedAntivirus\Engines\plugins\UNMIME.DLL
C:\Program Files\TrustedAntivirus\Engines\plugins\UNPACK.DLL
C:\Program Files\TrustedAntivirus\Engines\plugins\UNPACKS.DLL
C:\Program Files\TrustedAntivirus\Engines\plugins\UNPACKS2.DLL
C:\Program Files\TrustedAntivirus\Engines\plugins\UNPEPACK.DLL
C:\Program Files\TrustedAntivirus\Engines\plugins\UpDate\UA27601.DLL
C:\Program Files\TrustedAntivirus\Engines\plugins\UpDate\UA27602.DLL
C:\Program Files\TrustedAntivirus\Engines\plugins\UpDate\UA27603.DLL
C:\Program Files\TrustedAntivirus\Engines\plugins\UpDate\UA27604.DLL
C:\Program Files\TrustedAntivirus\Engines\plugins\UpDate\UADAILY.DLL
C:\Program Files\TrustedAntivirus\Engines\plugins\vbpv.dat
C:\Program Files\TrustedAntivirus\Graphics\cross.gif
C:\Program Files\TrustedAntivirus\Graphics\ga6p.gif
C:\Program Files\TrustedAntivirus\Graphics\kb.url
C:\Program Files\TrustedAntivirus\Graphics\main.ico
C:\Program Files\TrustedAntivirus\Graphics\mini.ico
C:\Program Files\TrustedAntivirus\Graphics\Online.url
C:\Program Files\TrustedAntivirus\Graphics\rm.url
C:\Program Files\TrustedAntivirus\Graphics\support.ico
C:\Program Files\TrustedAntivirus\Graphics\Support.url
C:\Program Files\TrustedAntivirus\Graphics\uninstall.ico
C:\Program Files\TrustedAntivirus\LA\lapv.dat
C:\Program Files\TrustedAntivirus\LA\License.rtf
C:\Program Files\TrustedAntivirus\pgs.exe
C:\Program Files\TrustedAntivirus\ptask.exe
C:\Program Files\TrustedAntivirus\scnkrnl.dll
C:\Program Files\TrustedAntivirus\settings.ini
C:\Program Files\TrustedAntivirus\sqlite3.dll
C:\Program Files\TrustedAntivirus\Tools\pblock.dll
C:\Program Files\TrustedAntivirus\Tools\sbiebho.dll
C:\Program Files\TrustedAntivirus\unins000.dat
C:\Program Files\TrustedAntivirus\unins000.exe
C:\Program Files\TrustedAntivirus\Up\ASupdater.dat
C:\Program Files\TrustedAntivirus\Up\gup.exe
C:\Program Files\TrustedAntivirus\Up\PGupdater.dat
C:\Program Files\TrustedAntivirus\Up\UBupdater.dat
C:\Program Files\TrustedAntivirus\Up\up.dat
C:\Program Files\TrustedAntivirus\Up\updater.dat
C:\temp\gbRve12
C:\temp\gbRve12\csLioes.log
C:\WINDOWS\b152.exe
C:\WINDOWS\b153.exe
C:\WINDOWS\b154.exe
C:\WINDOWS\b155.exe
C:\WINDOWS\mrofinu1000106.exe
C:\WINDOWS\mrofinu572.exe
C:\WINDOWS\mrofinu572.exe.tmp
C:\WINDOWS\system32\aqVreo01
C:\WINDOWS\system32\aqVreo01\aqVreo011065.exe
C:\WINDOWS\system32\IDME
C:\WINDOWS\system32\IDME\dimnet201.exe
C:\WINDOWS\system32\md2
C:\WINDOWS\system32\md2\tr11dll.exe
C:\WINDOWS\system32\usnv
C:\WINDOWS\system32\usnv\pax89104.exe
C:\WINDOWS\system32\xTmp
C:\WINDOWS\TWF0dGhldyBSb2JpbnNvbg
C:\WINDOWS\TWF0dGhldyBSb2JpbnNvbg\nqIXx315xV1mvZLDvBhSv0.vbs
C:\WINDOWS\uninstall_nmon.vbs
C:\WINDOWS\unvise32.exe

.
((((((((((((((((((((((((( Files Created from 2008-02-24 to 2008-03-24 )))))))))))))))))))))))))))))))
.

2008-03-23 12:17 . 2001-03-08 18:30 24,064 –a—— C:\WINDOWS\system32\msxml3a.dll
2008-03-20 17:09 . 2006-04-20 14:34 100,304 –a—— C:\WINDOWS\system32\drivers\sscdmdm.sys
2008-03-20 17:09 . 2006-04-20 14:35 79,216 –a—— C:\WINDOWS\system32\drivers\sscdserd.sys
2008-03-20 17:09 . 2006-04-20 14:33 66,672 –a—— C:\WINDOWS\system32\drivers\sscdbus.sys
2008-03-20 17:09 . 2006-04-20 14:34 9,328 –a—— C:\WINDOWS\system32\drivers\sscdmdfl.sys
2008-03-20 17:09 . 2006-04-20 14:34 6,240 –a—— C:\WINDOWS\system32\drivers\sscdcmnt.sys
2008-03-20 17:09 . 2006-04-20 14:34 6,240 –a—— C:\WINDOWS\system32\drivers\sscdcm.sys
2008-03-20 17:09 . 2006-04-20 14:33 5,904 –a—— C:\WINDOWS\system32\drivers\sscdwhnt.sys
2008-03-20 17:09 . 2006-04-20 14:33 5,904 –a—— C:\WINDOWS\system32\drivers\sscdwh.sys
2008-03-20 16:41 . 2008-03-20 16:41 d——– C:\Program Files\SAMSUNG
2008-03-19 13:43 . 2005-10-20 21:47 30,592 ——— C:\WINDOWS\system32\drivers\rndismpx.sys
2008-03-19 13:43 . 2005-10-20 21:47 12,800 ——— C:\WINDOWS\system32\drivers\usb8023x.sys
2008-03-18 15:54 . 2008-03-18 15:54 d——– C:\Program Files\Savings Bond Wizard
2008-03-08 19:59 . 2008-03-24 08:05 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2008-03-08 19:59 . 2008-03-08 19:59 1,409 –a—— C:\WINDOWS\QTFont.for
2008-03-08 19:58 . 2008-03-08 19:59 d——– C:\Program Files\iTunes
2008-03-08 19:58 . 2008-03-08 19:58 d——– C:\Program Files\iPod
2008-03-08 19:57 . 2008-03-08 19:57 d——– C:\Program Files\QuickTime
2008-02-29 16:45 . 2008-02-29 16:45 d——– C:\Program Files\SourceTec
2008-02-29 16:45 . 2008-02-29 16:45 d——– C:\Program Files\Common Files\SourceTec
2008-02-29 16:30 . 2008-02-29 16:30 d——– C:\Program Files\SWFSOFT Flash Compiler & Decompiler

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-23 16:42 ——— d—–w C:\Program Files\Trillian
2008-03-19 17:43 ——— d—–w C:\Program Files\Microsoft ActiveSync
2008-02-22 18:34 ——— d—–w C:\Program Files\Picasa2
2008-02-22 14:15 ——— d—–w C:\Program Files\Trend Micro
2008-02-22 05:35 ——— d—–w C:\Program Files\Lavasoft
2008-02-22 05:35 ——— d—–w C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-02-22 05:34 ——— d—–w C:\Program Files\Common Files\Wise Installation Wizard
2008-02-22 00:36 ——— d—–w C:\Program Files\Enigma Software Group
2008-02-21 03:36 ——— d—–w C:\Program Files\Digsby
2008-02-19 21:38 ——— d—–w C:\Documents and Settings\matthew robinson\Application Data\Digsby
2008-02-13 19:15 ——— d—–w C:\Documents and Settings\matthew robinson\Application Data\DivX
2008-02-13 18:41 ——— d—–w C:\Program Files\DivX
2008-02-08 19:15 ——— d—–w C:\Program Files\Windows Media Connect 2
2008-02-08 19:04 ——— d—–w C:\Program Files\Netflix
2008-01-04 21:59 524,288 —-a-w C:\WINDOWS\system32\DivXsm.exe
2008-01-04 21:58 3,596,288 —-a-w C:\WINDOWS\system32\qt-dx331.dll
2008-01-04 21:58 200,704 —-a-w C:\WINDOWS\system32\ssldivx.dll
2008-01-04 21:58 129,784 —-a-w C:\WINDOWS\system32\pxafs.dll
2008-01-04 21:58 120,056 —-a-w C:\WINDOWS\system32\pxcpyi64.exe
2008-01-04 21:58 118,520 —-a-w C:\WINDOWS\system32\pxinsi64.exe
2008-01-04 21:58 1,044,480 —-a-w C:\WINDOWS\system32\libdivx.dll
2008-01-04 21:57 823,296 —-a-w C:\WINDOWS\system32\divx_xx0c.dll
2008-01-04 21:57 823,296 —-a-w C:\WINDOWS\system32\divx_xx07.dll
2008-01-04 21:57 81,920 —-a-w C:\WINDOWS\system32\dpl100.dll
2008-01-04 21:57 802,816 —-a-w C:\WINDOWS\system32\divx_xx11.dll
2008-01-04 21:57 682,496 —-a-w C:\WINDOWS\system32\DivX.dll
2008-01-04 21:57 593,920 —-a-w C:\WINDOWS\system32\dpuGUI11.dll
2008-01-04 21:57 57,344 —-a-w C:\WINDOWS\system32\dpv11.dll
2008-01-04 21:57 53,248 —-a-w C:\WINDOWS\system32\dpuGUI10.dll
2008-01-04 21:57 344,064 —-a-w C:\WINDOWS\system32\dpus11.dll
2008-01-04 21:57 294,912 —-a-w C:\WINDOWS\system32\dpu11.dll
2008-01-04 21:57 294,912 —-a-w C:\WINDOWS\system32\dpu10.dll
2008-01-04 21:57 196,608 —-a-w C:\WINDOWS\system32\dtu100.dll
2008-01-04 21:56 156,992 —-a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-01-04 21:56 12,288 —-a-w C:\WINDOWS\system32\DivXWMPExtType.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 06:00 15360]
"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\Wcescomm.exe" [2006-11-13 13:39 1289000]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 06:00 110592 C:\WINDOWS\system32\bthprops.cpl]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2007-03-30 21:00 138008]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2007-03-30 21:00 162584]
"Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2007-03-30 20:59 138008]
"Broadcom Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY.exe" [2007-03-16 19:10 1392640]
"SigmatelSysTrayApp"="C:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exe" [2007-05-10 11:22 405504]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2004-09-13 16:49 49152]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [2003-11-19 18:48 32881]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-02-01 00:13 385024]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 14:10 267048]

C:\Documents and Settings\matthew robinson\Start Menu\Programs\Startup\
Digsby.lnk - C:\Program Files\Digsby\digsby.exe [2008-02-15 19:30:48 117760]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 05:44:06 29696]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-04 20:28:24 258048]
HP Image Zone Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-04 20:50:52 53248]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe"= C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe"= C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"= C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service


.
Contents of the 'Scheduled Tasks' folder
"2008-03-22 22:41:12 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-24 14:27:11
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-03-24 14:27:36
ComboFix-quarantined-files.txt 2008-03-24 18:27:27
ComboFix2.txt 2008-03-24 12:07:22
ComboFix3.txt 2008-02-27 22:49:13
ComboFix4.txt 2008-02-26 03:49:56
ComboFix5.txt 2008-02-24 16:01:56
.
2008-03-20 12:37:45 — E O F —

Kaspersky Report:

——————————————————————————-
KASPERSKY ONLINE SCANNER REPORT
2008-03-24 18:59
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 24/03/2008
Kaspersky Anti-Virus database records: 659498
——————————————————————————-

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
E:\
F:\

Scan Statistics:
Total number of scanned objects: 61586
Number of viruses found: 19
Number of infected objects: 48
Number of suspicious objects: 0
Duration of the scan process: 01:57:29

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\matthew robinson\Application Data\$_hpcst$.hpc Object is locked skipped
C:\Documents and Settings\matthew robinson\Application Data\Mozilla\Firefox\Profiles\hfnc2e43.default\cert8.db Object is locked skipped
C:\Documents and Settings\matthew robinson\Application Data\Mozilla\Firefox\Profiles\hfnc2e43.default\formhistory.dat Object is locked skipped
C:\Documents and Settings\matthew robinson\Application Data\Mozilla\Firefox\Profiles\hfnc2e43.default\history.dat Object is locked skipped
C:\Documents and Settings\matthew robinson\Application Data\Mozilla\Firefox\Profiles\hfnc2e43.default\key3.db Object is locked skipped
C:\Documents and Settings\matthew robinson\Application Data\Mozilla\Firefox\Profiles\hfnc2e43.default\parent.lock Object is locked skipped
C:\Documents and Settings\matthew robinson\Application Data\Mozilla\Firefox\Profiles\hfnc2e43.default\search.sqlite Object is locked skipped
C:\Documents and Settings\matthew robinson\Application Data\Mozilla\Firefox\Profiles\hfnc2e43.default\urlclassifier2.sqlite Object is locked skipped
C:\Documents and Settings\matthew robinson\Application Data\Mozilla\Firefox\Profiles\hfnc2e43.default\webappsstore.sqlite Object is locked skipped
C:\Documents and Settings\matthew robinson\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\matthew robinson\Local Settings\Application Data\ApplicationHistory\hpqgalry.exe.cf8dd223.ini.inuse Object is locked skipped
C:\Documents and Settings\matthew robinson\Local Settings\Application Data\HP\Digital Imaging\db\administrativeInfo.dbf Object is locked skipped
C:\Documents and Settings\matthew robinson\Local Settings\Application Data\HP\Digital Imaging\db\albumImagesTable.cdx Object is locked skipped
C:\Documents and Settings\matthew robinson\Local Settings\Application Data\HP\Digital Imaging\db\albumImagesTable.dbf Object is locked skipped
C:\Documents and Settings\matthew robinson\Local Settings\Application Data\HP\Digital Imaging\db\albumTable.cdx Object is locked skipped
C:\Documents and Settings\matthew robinson\Local Settings\Application Data\HP\Digital Imaging\db\albumTable.dbf Object is locked skipped
C:\Documents and Settings\matthew robinson\Local Settings\Application Data\HP\Digital Imaging\db\CB_Server_Errors.txt Object is locked skipped
C:\Documents and Settings\matthew robinson\Local Settings\Application Data\HP\Digital Imaging\db\EXIFTable.cdx Object is locked skipped
C:\Documents and Settings\matthew robinson\Local Settings\Application Data\HP\Digital Imaging\db\EXIFTable.dbf Object is locked skipped
C:\Documents and Settings\matthew robinson\Local Settings\Application Data\HP\Digital Imaging\db\imageTable.cdx Object is locked skipped
C:\Documents and Settings\matthew robinson\Local Settings\Application Data\HP\Digital Imaging\db\imageTable.dbf Object is locked skipped
C:\Documents and Settings\matthew robinson\Local Settings\Application Data\HP\Digital Imaging\db\imageTable.fpt Object is locked skipped
C:\Documents and Settings\matthew robinson\Local Settings\Application Data\HP\Digital Imaging\db\keywordImagesTable.cdx Object is locked skipped
C:\Documents and Settings\matthew robinson\Local Settings\Application Data\HP\Digital Imaging\db\keywordImagesTable.dbf Object is locked skipped
C:\Documents and Settings\matthew robinson\Local Settings\Application Data\HP\Digital Imaging\db\keywordTable.cdx Object is locked skipped
C:\Documents and Settings\matthew robinson\Local Settings\Application Data\HP\Digital Imaging\db\keywordTable.dbf Object is locked skipped
C:\Documents and Settings\matthew robinson\Local Settings\Application Data\HP\Digital Imaging\db\managedFolderTable.dbf Object is locked skipped
C:\Documents and Settings\matthew robinson\Local Settings\Application Data\HP\Digital Imaging\db\pathnameTable.cdx Object is locked skipped
C:\Documents and Settings\matthew robinson\Local Settings\Application Data\HP\Digital Imaging\db\pathnameTable.dbf Object is locked skipped
C:\Documents and Settings\matthew robinson\Local Settings\Application Data\HP\Digital Imaging\db\ROFImagesTable.cdx Object is locked skipped
C:\Documents and Settings\matthew robinson\Local Settings\Application Data\HP\Digital Imaging\db\ROFImagesTable.dbf Object is locked skipped
C:\Documents and Settings\matthew robinson\Local Settings\Application Data\HP\Digital Imaging\db\ROFTable.cdx Object is locked skipped
C:\Documents and Settings\matthew robinson\Local Settings\Application Data\HP\Digital Imaging\db\ROFTable.dbf Object is locked skipped
C:\Documents and Settings\matthew robinson\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\matthew robinson\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\matthew robinson\Local Settings\Application Data\Mozilla\Firefox\Profiles\hfnc2e43.default\Cache\_CACHE_001_ Object is locked skipped
C:\Documents and Settings\matthew robinson\Local Settings\Application Data\Mozilla\Firefox\Profiles\hfnc2e43.default\Cache\_CACHE_002_ Object is locked skipped
C:\Documents and Settings\matthew robinson\Local Settings\Application Data\Mozilla\Firefox\Profiles\hfnc2e43.default\Cache\_CACHE_003_ Object is locked skipped
C:\Documents and Settings\matthew robinson\Local Settings\Application Data\Mozilla\Firefox\Profiles\hfnc2e43.default\Cache\_CACHE_MAP_ Object is locked skipped
C:\Documents and Settings\matthew robinson\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\matthew robinson\Local Settings\History\History.IE5\MSHist012008032420080325\index.dat Object is locked skipped
C:\Documents and Settings\matthew robinson\Local Settings\temp\5F.tmp Object is locked skipped
C:\Documents and Settings\matthew robinson\Local Settings\temp\hpodvd09.log Object is locked skipped
C:\Documents and Settings\matthew robinson\Local Settings\temp\WCESLog.log Object is locked skipped
C:\Documents and Settings\matthew robinson\Local Settings\temp\~DF2446.tmp Object is locked skipped
C:\Documents and Settings\matthew robinson\Local Settings\temp\~DF7097.tmp Object is locked skipped
C:\Documents and Settings\matthew robinson\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
C:\Documents and Settings\matthew robinson\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\matthew robinson\My Documents\Accenture\Executables\axinstall.exe/AXUNINSTALL.EXE/PSKILL.EXE Infected: not-a-virus:RiskTool.Win32.PsKill.103 skipped
C:\Documents and Settings\matthew robinson\My Documents\Accenture\Executables\axinstall.exe/AXUNINSTALL.EXE Infected: not-a-virus:RiskTool.Win32.PsKill.103 skipped
C:\Documents and Settings\matthew robinson\My Documents\Accenture\Executables\axinstall.exe ZIP: infected - 2 skipped
C:\Documents and Settings\matthew robinson\My Documents\Socialight\Kamida_Inc._–_Consulting_Agreement_(Robinson).doc Object is locked skipped
C:\Documents and Settings\matthew robinson\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\matthew robinson\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Program Files\SourceTec\Sothink SWF Decompiler\SWFDecompiler.exe Infected: Backdoor.Win32.Ciadoor.123.bm skipped
C:\Program Files\TechSmith\SnagIt 8\SnagIt Add-in.dot Object is locked skipped
C:\Program Files\Trillian\users\default\logs\AIM\Query\bbrito77.log Object is locked skipped
C:\Program Files\Trillian\users\default\logs\AIM\Query\dsharkowitz.log Object is locked skipped
C:\Program Files\Trillian\users\default\logs\AIM\Query\kergek.log Object is locked skipped
C:\QooBox\Quarantine\C\Documents and Settings\matthew robinson\My Documents\ASEMBL~1\msconfig.exe.vir Infected: Trojan-Downloader.Win32.PurityScan.fj skipped
C:\QooBox\Quarantine\C\Documents and Settings\matthew robinson\My Documents\DOBE~1\rυndll.exe.vir Infected: not-a-virus:AdWare.Win32.PurityScan.gw skipped
C:\QooBox\Quarantine\C\Program Files\Common Files\Yazzle1281OinAdmin.exe.vir Infected: Trojan.Win32.Scapur.k skipped
C:\QooBox\Quarantine\C\Program Files\Common Files\Yazzle1281OinUninstaller.exe.vir/data0001 Infected: not-a-virus:AdWare.Win32.PurityScan.gp skipped
C:\QooBox\Quarantine\C\Program Files\Common Files\Yazzle1281OinUninstaller.exe.vir NSIS: infected - 1 skipped
C:\QooBox\Quarantine\C\Program Files\JavaCore\JavaCore.exe.vir Infected: not-a-virus:AdWare.Win32.Insider.c skipped
C:\QooBox\Quarantine\C\Program Files\MSN Gaming Zone\lawu.dll.vir Infected: Trojan.Win32.BHO.ab skipped
C:\QooBox\Quarantine\C\Program Files\Outerinfo\FF\components\FF.dll.vir Infected: not-a-virus:AdWare.Win32.ZenoSearch.ad skipped
C:\QooBox\Quarantine\C\Program Files\Outlook Express\suwi89104.dll.vir Infected: not-a-virus:AdWare.Win32.TTC.d skipped
C:\QooBox\Quarantine\C\Program Files\PPPATC~1\userinit.exe.vir Infected: Trojan-Downloader.Win32.PurityScan.fj skipped
C:\QooBox\Quarantine\C\Program Files\Temporary\InsiDERInst.exe.vir Infected: not-a-virus:AdWare.Win32.Insider.d skipped
C:\QooBox\Quarantine\C\WINDOWS\b152.exe.vir Infected: not-a-virus:AdWare.Win32.Insider.c skipped
C:\QooBox\Quarantine\C\WINDOWS\b153.exe.vir Infected: not-a-virus:AdWare.Win32.Insider.d skipped
C:\QooBox\Quarantine\C\WINDOWS\b154.exe.vir Infected: Trojan-Downloader.Win32.Agent.kha skipped
C:\QooBox\Quarantine\C\WINDOWS\mrofinu1000106.exe.vir Infected: Trojan-Downloader.Win32.Agent.lqu skipped
C:\QooBox\Quarantine\C\WINDOWS\mrofinu572.exe.tmp.vir Infected: Trojan-Downloader.Win32.Agent.lqu skipped
C:\QooBox\Quarantine\C\WINDOWS\mrofinu572.exe.vir Infected: Trojan-Downloader.Win32.Agent.lqu skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\aqVreo01\aqVreo011065.exe.vir Infected: Trojan-Downloader.Win32.VB.dkg skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\bcxfcswj.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\biwghnm.dll.vir Infected: not-a-virus:AdWare.Win32.Agent.acn skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\cms4\kipon89104.exe.vir/data0002 Infected: not-a-virus:AdWare.Win32.TTC.d skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\cms4\kipon89104.exe.vir NSIS: infected - 1 skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\faephxfu.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\fbnguqlp.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\fcccdcb.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\jruyirjn.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\kpfsagko.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\mbpgqloa.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\nGpxx01\nGpxx011065.exe.vir Infected: Trojan-Downloader.Win32.VB.cgu skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\oqoeyghl.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\rarc.dll.vir Infected: not-a-virus:AdWare.Win32.PurityScan.gv skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\sxpluehl.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\usnv\pax89104.exe.vir/data0002 Infected: not-a-virus:AdWare.Win32.TTC.d skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\usnv\pax89104.exe.vir NSIS: infected - 1 skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\vpllajpc.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\windows.vir Infected: Trojan.Win32.Zapchast.dt skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\yabyxur.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\tk58.exe.vir Infected: Trojan.Win32.BHO.ab skipped
C:\QooBox\Quarantine\catchme2008-02-23_110659.18.zip/ddcyv.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\catchme2008-02-23_110659.18.zip/faephxfu.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\catchme2008-02-23_110659.18.zip/rqrpmkk.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\catchme2008-02-23_110659.18.zip ZIP: infected - 3 skipped
C:\QooBox\Quarantine\catchme2008-03-24_ 80510.34.zip/byxvurq.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\catchme2008-03-24_ 80510.34.zip ZIP: infected - 1 skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{CDAEDD19-7D57-4BD1-B3FA-9231C4D30C80}\RP26\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{71C3CD62-D4AF-434A-8F7B-ED6EFB55E695}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
F:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

Scan process completed.
Post #8
Curious where you got this program from >>SourceTec<< It's infected. I'm guessing a torrent download.

________________________________________
Open notepad and copy/paste the text in the quotebox below into it: 

File:: 

C:\Documents and Settings\matthew robinson\My Documents\Accenture\Executables\axinstall.exe/AXUNINSTALL.EXE/PSKILL.EXE 
C:\Program Files\SourceTec\Sothink SWF Decompiler\SWFDecompiler.exe


NOTE: This script was done for this user specifically.
DO NOT ATTEMPT TO USE IT IF YOU ARE NOT THIS USER
YOU WILL HURT THE WORKINGS OF YOUR COMPUTER !!.

Save this as CFScript.txt, in the same location as ComboFix.exe


[external image: Posted Image]

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:ComboFix.txt which I will need in your next reply.

__________________________________________



I see no signs of an anti virus program.. I suggest you get one in asap.
I will list 2 free anti virus programs just choose 1.


Avast

Avira AntiVir Personal Edition Classic


_________________________________________



I see no evidence of a fire wall. I suggest you get one in place now.

A few words on Microsofts firewall in XP . It only works in one direction. Incoming.
That means if something gets by it you would never know it was trying
to contact the internet.
Example: A bad program installs itself. You would never know it was contacting the internet.
Downloading other nasties and so forth.

If you decide to run one of these you should be certain Microsofts firewall is disabled.
To disable it.

I will list a few free firewalls for you. These are good (free) firewalls:

Never run 2 firwalls together. They will interfere with each other.
So just download and install one!


Comodo Fairly simple to use

Sunbelt Personal Firewall





_________________________
In your next reply I would like to see:
  • A new HJT log
  • The report from ComboFix
  • Let me know how things are running.]
Post #9
thanks. i don't know what SourceTech is either, and I don't really use a bit torrent client. I think things are better with pop ups and stuff like that but I noticed that when i use IE it will not recognize username/password entries for any site. i can log into the same sites using Firefox just fine. so this is pretty concerning. also, my clock is still on military time which was changed by whatever I got as well. here are the logs:

HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:17, on 2008-03-24
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft ActiveSync\Wcescomm.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE
C:\Program Files\Trillian\trillian.exe
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.netvibes.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 8\SnagItBHO.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\stsystra.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\Wcescomm.exe"
O4 - Startup: Digsby.lnk = C:\Program Files\Digsby\digsby.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Sothink SWF Catcher - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {474F00F5-3853-492C-AC3A-476512BBC336} (UploadListView Class) - http://picasaweb.google.com/s/v/26.34/uploader2.cab
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/Facebo…toUploader3.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1199301478109
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3E82C3F3-908E-4BCF-8C37-05C2B7302E1F}: NameServer = 192.168.18.254
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

–
End of file - 7255 bytes

Combo Fix log:

ComboFix 08-03-23.2 - matthew robinson 2008-03-24 20:13:10.7 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.373 [GMT -4:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\matthew robinson\Desktop\CFScript.txt
* Created a new restore point

FILE ::
C:\Documents and Settings\matthew robinson\My Documents\Accenture\Executables\axinstall.exe/AXUNINSTALL.EXE/PSKILL.EXE
C:\Program Files\SourceTec\Sothink SWF Decompiler\SWFDecompiler.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\SourceTec\Sothink SWF Decompiler\SWFDecompiler.exe

.
((((((((((((((((((((((((( Files Created from 2008-02-25 to 2008-03-25 )))))))))))))))))))))))))))))))
.

2008-03-24 14:53 . 2008-03-24 14:53 d——– C:\WINDOWS\system32\Kaspersky Lab
2008-03-24 14:53 . 2008-03-24 14:53 d——– C:\WINDOWS\LastGood
2008-03-24 14:53 . 2008-03-24 14:53 d——– C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-03-24 14:48 . 2008-03-24 14:48 d——– C:\Program Files\CCleaner
2008-03-24 14:42 . 2008-02-22 02:33 69,632 –a—— C:\WINDOWS\system32\javacpl.cpl
2008-03-24 14:41 . 2008-03-24 14:41 d——– C:\Program Files\Common Files\Java
2008-03-23 12:17 . 2001-03-08 18:30 24,064 –a—— C:\WINDOWS\system32\msxml3a.dll
2008-03-20 17:09 . 2006-04-20 14:34 100,304 –a—— C:\WINDOWS\system32\drivers\sscdmdm.sys
2008-03-20 17:09 . 2006-04-20 14:35 79,216 –a—— C:\WINDOWS\system32\drivers\sscdserd.sys
2008-03-20 17:09 . 2006-04-20 14:33 66,672 –a—— C:\WINDOWS\system32\drivers\sscdbus.sys
2008-03-20 17:09 . 2006-04-20 14:34 9,328 –a—— C:\WINDOWS\system32\drivers\sscdmdfl.sys
2008-03-20 17:09 . 2006-04-20 14:34 6,240 –a—— C:\WINDOWS\system32\drivers\sscdcmnt.sys
2008-03-20 17:09 . 2006-04-20 14:34 6,240 –a—— C:\WINDOWS\system32\drivers\sscdcm.sys
2008-03-20 17:09 . 2006-04-20 14:33 5,904 –a—— C:\WINDOWS\system32\drivers\sscdwhnt.sys
2008-03-20 17:09 . 2006-04-20 14:33 5,904 –a—— C:\WINDOWS\system32\drivers\sscdwh.sys
2008-03-20 16:41 . 2008-03-20 16:41 d——– C:\Program Files\SAMSUNG
2008-03-19 13:43 . 2005-10-20 21:47 30,592 ——— C:\WINDOWS\system32\drivers\rndismpx.sys
2008-03-19 13:43 . 2005-10-20 21:47 12,800 ——— C:\WINDOWS\system32\drivers\usb8023x.sys
2008-03-18 15:54 . 2008-03-18 15:54 d——– C:\Program Files\Savings Bond Wizard
2008-03-08 19:59 . 2008-03-24 14:38 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2008-03-08 19:59 . 2008-03-08 19:59 1,409 –a—— C:\WINDOWS\QTFont.for
2008-03-08 19:58 . 2008-03-08 19:59 d——– C:\Program Files\iTunes
2008-03-08 19:58 . 2008-03-08 19:58 d——– C:\Program Files\iPod
2008-03-08 19:57 . 2008-03-08 19:57 d——– C:\Program Files\QuickTime
2008-02-29 16:45 . 2008-02-29 16:45 d——– C:\Program Files\SourceTec
2008-02-29 16:45 . 2008-02-29 16:45 d——– C:\Program Files\Common Files\SourceTec
2008-02-29 16:30 . 2008-02-29 16:30 d——– C:\Program Files\SWFSOFT Flash Compiler & Decompiler

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-24 18:42 ——— d—–w C:\Program Files\Java
2008-03-24 18:36 ——— d—–w C:\Program Files\Trillian
2008-03-19 17:43 ——— d—–w C:\Program Files\Microsoft ActiveSync
2008-02-22 18:34 ——— d—–w C:\Program Files\Picasa2
2008-02-22 14:15 ——— d—–w C:\Program Files\Trend Micro
2008-02-22 05:35 ——— d—–w C:\Program Files\Lavasoft
2008-02-22 05:35 ——— d—–w C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-02-22 05:34 ——— d—–w C:\Program Files\Common Files\Wise Installation Wizard
2008-02-22 00:36 ——— d—–w C:\Program Files\Enigma Software Group
2008-02-21 03:36 ——— d—–w C:\Program Files\Digsby
2008-02-19 21:38 ——— d—–w C:\Documents and Settings\matthew robinson\Application Data\Digsby
2008-02-13 19:15 ——— d—–w C:\Documents and Settings\matthew robinson\Application Data\DivX
2008-02-13 18:41 ——— d—–w C:\Program Files\DivX
2008-02-08 19:15 ——— d—–w C:\Program Files\Windows Media Connect 2
2008-02-08 19:04 ——— d—–w C:\Program Files\Netflix
2008-01-04 21:59 524,288 —-a-w C:\WINDOWS\system32\DivXsm.exe
2008-01-04 21:58 3,596,288 —-a-w C:\WINDOWS\system32\qt-dx331.dll
2008-01-04 21:58 200,704 —-a-w C:\WINDOWS\system32\ssldivx.dll
2008-01-04 21:58 129,784 —-a-w C:\WINDOWS\system32\pxafs.dll
2008-01-04 21:58 120,056 —-a-w C:\WINDOWS\system32\pxcpyi64.exe
2008-01-04 21:58 118,520 —-a-w C:\WINDOWS\system32\pxinsi64.exe
2008-01-04 21:58 1,044,480 —-a-w C:\WINDOWS\system32\libdivx.dll
2008-01-04 21:57 823,296 —-a-w C:\WINDOWS\system32\divx_xx0c.dll
2008-01-04 21:57 823,296 —-a-w C:\WINDOWS\system32\divx_xx07.dll
2008-01-04 21:57 81,920 —-a-w C:\WINDOWS\system32\dpl100.dll
2008-01-04 21:57 802,816 —-a-w C:\WINDOWS\system32\divx_xx11.dll
2008-01-04 21:57 682,496 —-a-w C:\WINDOWS\system32\DivX.dll
2008-01-04 21:57 593,920 —-a-w C:\WINDOWS\system32\dpuGUI11.dll
2008-01-04 21:57 57,344 —-a-w C:\WINDOWS\system32\dpv11.dll
2008-01-04 21:57 53,248 —-a-w C:\WINDOWS\system32\dpuGUI10.dll
2008-01-04 21:57 344,064 —-a-w C:\WINDOWS\system32\dpus11.dll
2008-01-04 21:57 294,912 —-a-w C:\WINDOWS\system32\dpu11.dll
2008-01-04 21:57 294,912 —-a-w C:\WINDOWS\system32\dpu10.dll
2008-01-04 21:57 196,608 —-a-w C:\WINDOWS\system32\dtu100.dll
2008-01-04 21:56 156,992 —-a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-01-04 21:56 12,288 —-a-w C:\WINDOWS\system32\DivXWMPExtType.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 06:00 15360]
"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\Wcescomm.exe" [2006-11-13 13:39 1289000]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 06:00 110592 C:\WINDOWS\system32\bthprops.cpl]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2007-03-30 21:00 138008]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2007-03-30 21:00 162584]
"Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2007-03-30 20:59 138008]
"Broadcom Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY.exe" [2007-03-16 19:10 1392640]
"SigmatelSysTrayApp"="C:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exe" [2007-05-10 11:22 405504]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2004-09-13 16:49 49152]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-02-01 00:13 385024]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 14:10 267048]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]

C:\Documents and Settings\matthew robinson\Start Menu\Programs\Startup\
Digsby.lnk - C:\Program Files\Digsby\digsby.exe [2008-02-15 19:30:48 117760]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 05:44:06 29696]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-04 20:28:24 258048]
HP Image Zone Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-04 20:50:52 53248]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe"= C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe"= C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"= C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service


.
Contents of the 'Scheduled Tasks' folder
"2008-03-22 22:41:12 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-24 20:14:44
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-03-24 20:15:01
ComboFix-quarantined-files.txt 2008-03-25 00:14:59
ComboFix2.txt 2008-03-24 18:27:37
ComboFix3.txt 2008-03-24 12:07:22
ComboFix4.txt 2008-02-27 22:49:13
ComboFix5.txt 2008-02-26 03:49:56
.
2008-03-20 12:37:45 — E O F —
Post #10
Everything looks better. The clock was changed by one of the fixes we use. We will get to that later.

We can try and fix internet explorer. As long as Firefox is working don't be to concerned.


_________________________________
Open Internet Explorer.
Click Tools and select Internet Options.
Select the Content tab.
Click the Settings button under AutoComplete.
Place a check beside the User names and passwords on forms option.
Click Apply and OK.

__________________________
Why haven't you placed an Anti virus Program or Firewall in yet ?
Post #11
IE is fine now. i have installed avast and comodo. comodo keeps find files that are trying to access the internet. tons of them. i just blocked them.
Post #12

comodo keeps find files that are trying to access the internet. tons of them. i just blocked them.


That's it's job. You should look into each item that wants to contact the internet by googling the file name if you do not recognize it. This is one way to determine if something bad has gotten onto your machine.
There are many items that need to contact the internet that are OK. Be sure to use the "remember" button once you make a decision so you aren't asked each time.


Great news ! [external image: Posted Image]

Your log now appears to be clean.


Go to start > run and copy and paste this in the field:

ComboFix /u

Make sure there's a space between Combofix and /
Then hit enter.

This will uninstall Combofix, delete its related folders and files, reset your clock settings, hide file extensions, hide the
system/hidden files and resets System Restore again.

______________________________



A few things to help with possible threats

These are optional . But will help protect you further.
___________________________________

SpywareBlaster

Install SpywareBlaster

SpywareBlaster will add a large list of programs and sites to your Internet Explorer settings that will protect you from accidentally running or downloading known malicious programs.
After the installation, click Download Latest Protection Updates. When it finishes, click Enable All Protection.


______________________________
SiteHound

http://www.firetrust.com/firetrustsitehound.html

This tool bar will help protect you from.

Over 4,000 fake bank and credit sites.
Tens of thousands of pornographic
and adult sites.
The never ending fake phishing sites.
Malicious sites, which can infect you
with spyware and adware if you visit
them.
Sites to download software which
may infect your computer with
spyware, a virus or adware


___________________________________
Download and Install a HOSTS File
A Hosts file is a plain text file which prevents your computer from connecting to malware and spyware sites by redirecting the connection request to 127.0.0.1, which is your local address. If you use a proxy server, or if you are on AOL, be sure to read the special instructions.
You can download the MVPS Hosts File and see a HOSTS file tutorial here :
This website also contains useful tips, and links to other resources and utilities.


___________________________________
Make your Internet Explorer more secure
1. From within Internet Explorer click on the Tools menu and then click on Options.
2. Click on the Security tab
3. Click the Internet icon so it becomes highlighted.
4. Click on Default Level and click Ok
5. Click on the Custom Level button.

Change the Download signed ActiveX controls to Prompt
Change the Download unsigned ActiveX controls to Disable
Change the Initialise and script ActiveX controls not marked as safe to Disable
Change the Installation of desktop items to Prompt
Change the Launching programs and files in an IFRAME to Prompt
Change the Navigate sub-frames across different domains to Prompt

When all these settings have been made, click on the OK button.
If it prompts you as to whether or not you want to save the settings, press the Yes button.

6. Next press the Apply button and then the OK to exit the Internet Properties page.


Here's a site with great advise on how to AVOID malware. Much easier to do than removing it.


___________________________________
If your anything like me you should be mad these people have done this to you.
Please take the time to tell us what you would like to be done to these idiots!
We can only get something done about this if the people that we help, like you, are prepared to complain.
We have a dedicated forum for collecting these complaints Malware Complaints, you do not have to be registered to post.. just find your country room and register your complaint.
The infections you had was Vundo


Safe and Happy Surfing. :)
Post #13
thank you. the reason that i didn't have the protection software before is b/c it always slows down your computer so much…i guess slow is better than non-functioning though. the same seems to be the case now with the ones i have installed. so should i be running avast on-access scanner, avast virus recovery database, and comodo firewall? just want to make sure i need all of these b/c it takes forever for pages to load now…remniscent of dial-up. thanks a lot for your help. i not sure you want me posting what i think should happen to these days but it would require a new pair of needle nose pliers and acess to a small, dark room at about 98 degrees for approximately 72 hours.
Post #14

i guess slow is better than non-functioning though. the same seems to be the case now with the ones i have installed. just want to make sure i need all of these b/c it takes forever for pages to load now…remniscent of dial-up.


Your absolutely right that a little bit slower is better than non functioning. You got off easy this time. We were able to repair the computer this time. many we see can't be repaired and all is lost.


so should i be running avast on-access scanner, avast virus recovery database, and comodo firewall?


I wouldn't be doing what I should be if I told you other wise.
You remember part of what we discussed about that old program was infected by the virus and would have to be Re-installed .
Avast covers part of that. How well it works I can't tell you. In your case you didn't need the program so we just removed it.


File repairing using Virus Recovery Database (VRDB)

An important improvement of version 4 is also the possibility to repair infected files using so called Virus Recovery Database (VRDB). This database is generated automatically when the computer is idle (it can be set how often).

If a file is infected by a virus, avast! consults its data in VRDB and if the file does have a record in the database, it is recovered exactly to its original state.


What you keep for protection is up to you. Next time could be worse.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI