What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Closed] Hijackthis Log

5 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Ok. So i thought I was fairly good with computers. Ive manually removed several infections (such as DCADS ugh) by searching the registry and msconfig and blablabla.

well this one seems to be beyond me. basically. I cannot navigate to any. And if I do get to a site at the bottom it will non stop download (ad.yieldmanager). and a bunch of others. now. if i ctrl+alt+del and stop the RunDLL32.exe process I can navigate perfectly aroudn the web. So heres my Hijackthis. Please help….. P.S. after stopping that process is how I am here now.

Thanks Fellas.



———————————————————-
Logfile of HijackThis v1.99.1
Scan saved at 7:22:23 PM, on 6/7/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Maxtor\Schedule2\schedul2.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\E_S00RP1.EXE
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\SAgent4.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
c:\WINDOWS\system32\ZuneBusEnum.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\HijackThis\hijackthis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [BM3fda38a5] Rundll32.exe "C:\WINDOWS\system32\xkbkqvrn.dll",s
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\npjpi160_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\npjpi160_03.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Maxtor\Schedule2\schedul2.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h cltCommon (file missing)
O23 - Service: EPSON V3 Service2(03) (EPSON_PM_RPCV2_01) - SEIKO EPSON CORPORATION - C:\WINDOWS\system32\E_S00RP1.EXE
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Epson Printer Status Agent4 (StatusAgent4) - SEIKO EPSON CORPORATION - C:\WINDOWS\system32\SAgent4.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
Post #2
Hi Frank1234, and Welcome to WhatTheTech

My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

  • I will working be on your Malware issues, this may or may not, solve other issues you have with your machine.
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.


As I am still training, my posts to you will be checked by an Expert member. This will ensure that all advice and instructions I give you are accurate and safe. This may mean that my replies may take a little longer.
Post #3
Frank1234,

A. Please download ComboFix by sUBs from HERE or HERE directly to your Desktop.

Note: If you already have ComboFix on your machine, please DELETE it from your desktop before downloading the newest version.

B. Now we must disable some of your security programs so that they do not interfere with the running of our tools:

NORTON ANTIVIRUS
Please navigate to the system tray on the bottom right hand corner and look for a [external image: Posted Image] sign.
  • right-click it -> chose "Disable Auto-Protect."
  • select a duration of 5 hours (this assures no interference with the cleanup of your pc)
  • click "Ok."
  • a popup will warn that protection will now be disabled and the sign will now look like this: [external image: Posted Image]
You succesfully disabled the Norton Antivirus Guard.


C.Go to [external image: Posted Image] -> Run -> copy/paste the following single line command in the runbox & click OK

"%userprofile%\desktop\combofix.exe" /killall

[external image: Posted Image]
  • DO NOT USE your computer for any other purpose while ComboFix is running.
  • ComboFix may restart your computer, this is normal.
  • When finished, it will produce a log, ComboFix.txt.
  • Please post ComboFix.txt in your next reply along with a new HijackThis log.


Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
Post #6
Logfile of HijackThis v1.99.1
Scan saved at 21:40, on 2008-06-07
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Maxtor\Schedule2\schedul2.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\E_S00RP1.EXE
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\SAgent4.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
c:\WINDOWS\system32\ZuneBusEnum.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\HijackThis\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\npjpi160_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\npjpi160_03.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Maxtor\Schedule2\schedul2.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h cltCommon (file missing)
O23 - Service: EPSON V3 Service2(03) (EPSON_PM_RPCV2_01) - SEIKO EPSON CORPORATION - C:\WINDOWS\system32\E_S00RP1.EXE
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Epson Printer Status Agent4 (StatusAgent4) - SEIKO EPSON CORPORATION - C:\WINDOWS\system32\SAgent4.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe






And I made it back to the site without going through and disabling that process so its working fairly well so far. But Theres the new log let me know whats next!!!

Thanks a million you are my hero!
Post #8
Frank1234,

Please:
  • Right click on START on the left end of your Windows toolbar (lower left corner of your screen)
  • Click on Explore
  • Click on Local Disk (C:) in the left-hand window pane
  • Look for ComboFix.txt in the right-hand window pane and right click on it
  • Put your cursor (arrow) on Open With
  • Move your cursor to the new menu that opens and click on Choose Program…
  • Click on Notepad

When file opens, Copy/Paste text here
Post #9
Sorry about that….




ComboFix 08-06-07.3 - TEST 2008-06-07 22:06:56.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.588 [GMT -4:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-05-08 to 2008-06-08 )))))))))))))))))))))))))))))))
.

2009-03-03 14:06 . 2008-05-19 17:37 d——– C:\Program Files\Microsoft Silverlight
2009-02-26 17:17 . 2004-05-04 12:53 1,645,320 –a—— C:\WINDOWS\gdiplus.dll
2009-02-26 17:17 . 2006-05-20 17:16 1,184,984 –a—— C:\WINDOWS\system32\wvc1dmod.dll
2009-02-26 17:17 . 2006-05-11 20:21 626,688 –a—— C:\WINDOWS\system32\vp7vfw.dll
2009-02-26 17:17 . 2007-03-18 21:37 65,602 –a—— C:\WINDOWS\system32\cook3260.dll
2009-02-20 17:06 . 2008-03-22 23:32 d——– C:\Program Files\Combined Community Codec Pack
2008-06-07 18:35 . 2008-06-07 18:35 d——– C:\Documents and Settings\TEST\Application Data\Aim
2008-06-07 14:48 . 2008-06-07 14:48 d——– C:\Documents and Settings\Chelsea Lynn\Application Data\ATI
2008-06-07 14:47 . 2007-11-20 16:31 d——– C:\Documents and Settings\Chelsea Lynn\Application Data\Apple Computer
2008-06-07 14:47 . 2008-06-07 14:50 d——– C:\Documents and Settings\Chelsea Lynn
2008-06-06 16:45 . 2008-06-06 16:45 d——– C:\Documents and Settings\TEST\Application Data\ATI
2008-06-06 16:44 . 2007-11-20 16:31 d——– C:\Documents and Settings\TEST\Application Data\Apple Computer
2008-06-06 16:44 . 2008-06-06 16:44 d——– C:\Documents and Settings\TEST
2008-06-04 23:00 . 2008-06-04 23:00 d——– C:\Documents and Settings\All Users\Application Data\ATI
2008-06-04 22:55 . 2008-06-04 22:55 0 –a—— C:\WINDOWS\ativpsrm.bin
2008-06-04 22:30 . 2008-06-04 22:30 d——– C:\Program Files\id Software
2008-06-03 23:31 . 2008-06-03 23:31 d——– C:\Program Files\Smart Projects
2008-05-31 16:07 . 2008-05-31 16:09 d——– C:\Program Files\XBC
2008-05-31 16:07 . 2008-05-31 16:07 d——– C:\Program Files\WinPcap
2008-05-24 21:08 . 2008-05-24 21:08 371,712 –a—— C:\WINDOWS\system32\wvUkHWpN.dll.bak
2008-05-24 21:06 . 2008-05-24 21:06 d——– C:\Program Files\CD Audio Reader Filter
2008-05-24 21:05 . 2008-05-24 21:05 d——– C:\Program Files\SHOUTcast Source
2008-05-24 21:05 . 2008-05-24 21:05 d——– C:\Program Files\RealMedia
2008-05-24 21:05 . 2008-05-24 21:05 d——– C:\Program Files\OpenSource Flash Video Splitter
2008-05-24 21:05 . 2008-05-24 21:05 d——– C:\Program Files\Haali
2008-05-24 21:05 . 2008-05-24 21:05 d——– C:\Program Files\DSP-worx
2008-05-24 21:05 . 2008-05-24 21:07 d——– C:\Program Files\DScaler5
2008-05-24 21:04 . 2008-05-24 21:04 d——– C:\Program Files\Zoom Player
2008-05-24 21:04 . 2008-05-24 21:04 d——– C:\Program Files\DirectVobSub
2008-05-24 21:04 . 2008-06-01 00:14 d——– C:\Documents and Settings\All Users\Application Data\Zoom Player
2008-05-24 21:04 . 2007-11-29 12:52 60,273 –a—— C:\WINDOWS\system32\pthreadGC2.dll
2008-05-24 21:03 . 2008-05-24 21:03 58,880 –a—— C:\WINDOWS\system32\vtUkheCr.dll.bak
2008-05-18 17:55 . 2008-05-24 21:15 d——– C:\Program Files\GetRight
2008-05-18 17:55 . 2008-05-18 18:01 d——– C:\Downloads
2008-05-15 16:13 . 2008-05-15 16:13 d——– C:\Program Files\Magellan
2008-05-15 16:13 . 2008-05-15 16:13 d——– C:\MagellanDrivers
2008-05-15 16:06 . 2008-05-15 16:06 0 –a—— C:\WINDOWS\topo4.INI
2008-05-15 16:03 . 2008-05-15 16:06 197 –a—— C:\WINDOWS\TGPS.KEY
2008-05-15 16:01 . 2007-09-07 18:25 55,808 -ra—— C:\WINDOWS\system32\drivers\MUD.sys
2008-05-15 15:58 . 2008-05-15 15:58 d——– C:\Program Files\TOPO!
2008-05-12 11:43 . 2008-05-12 11:43 10,153,984 –a—— C:\WINDOWS\system32\atioglx2.dll
2008-05-12 11:22 . 2008-05-12 11:22 3,107,788 –a—— C:\WINDOWS\system32\ativva5x.dat
2008-05-12 11:22 . 2008-05-12 11:22 887,724 –a—— C:\WINDOWS\system32\ativva6x.dat
2008-05-12 11:09 . 2008-05-12 11:09 47,104 –a—— C:\WINDOWS\system32\amdpcom32.dll
2008-05-12 11:03 . 2008-05-12 11:03 19,968 –a—— C:\WINDOWS\system32\atiadlxx.dll
2008-05-12 11:02 . 2008-05-12 11:02 241,664 –a—— C:\WINDOWS\system32\atiok3x2.dll
2008-05-10 12:14 . 2008-05-10 12:14 d——– C:\WINDOWS\system32\scripting
2008-05-10 12:14 . 2008-05-10 12:14 d——– C:\WINDOWS\system32\en
2008-05-10 11:38 . 2008-04-13 20:12 69,120 –a—— C:\WINDOWS\system32\wlanapi.dll
2008-05-10 11:38 . 2008-04-13 20:12 50,688 –a—— C:\WINDOWS\system32\tspkg.dll
2008-05-10 11:36 . 2008-04-13 20:11 650,752 –a—— C:\WINDOWS\system32\dot3ui.dll
2008-05-10 01:21 . 2008-03-21 13:57 14,640 –a—— C:\WINDOWS\system32\spmsgXP_2k3.dll
2008-05-10 01:21 . 2008-05-10 01:21 0 –ah—– C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
2008-05-10 01:21 . 2008-05-10 01:21 0 –ah—– C:\WINDOWS\system32\drivers\Msft_Kernel_zumbus_01007.Wdf

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-26 21:17 47,360 —-a-w C:\WINDOWS\system32\drivers\pcouffin.sys
2009-02-26 21:17 ——— d—–w C:\Program Files\VSO
2008-06-05 02:50 ——— d—–w C:\Program Files\ATI Technologies
2008-06-05 02:40 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-06-04 01:21 ——— d—–w C:\Program Files\Quake III Arena
2008-06-02 16:18 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2008-05-30 23:00 805 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
2008-05-30 23:00 60,800 —-a-w C:\WINDOWS\system32\S32EVNT1.DLL
2008-05-30 23:00 123,952 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2008-05-30 23:00 10,671 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2008-05-30 23:00 ——— d—–w C:\Program Files\Symantec
2008-05-23 18:19 ——— d—–w C:\Program Files\AIM
2008-05-14 07:06 ——— d—–w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-05-12 16:30 3,007,488 —-a-w C:\WINDOWS\system32\drivers\ati2mtag.sys
2008-05-12 15:56 397,312 —-a-w C:\WINDOWS\system32\ATIDEMGX.dll
2008-05-12 15:54 305,152 —-a-w C:\WINDOWS\system32\ati2dvag.dll
2008-05-12 15:53 307,200 —-a-w C:\WINDOWS\system32\atiiiexx.dll
2008-05-12 15:45 43,520 —-a-w C:\WINDOWS\system32\ati2edxx.dll
2008-05-12 15:45 26,112 —-a-w C:\WINDOWS\system32\Ati2mdxx.exe
2008-05-12 15:45 180,224 —-a-w C:\WINDOWS\system32\atipdlxx.dll
2008-05-12 15:45 139,264 —-a-w C:\WINDOWS\system32\Oemdspif.dll
2008-05-12 15:44 139,264 —-a-w C:\WINDOWS\system32\ati2evxx.dll
2008-05-12 15:43 540,672 —-a-w C:\WINDOWS\system32\ati2evxx.exe
2008-05-12 15:41 53,248 —-a-w C:\WINDOWS\system32\ATIDDC.DLL
2008-05-12 15:32 3,203,168 —-a-w C:\WINDOWS\system32\ati3duag.dll
2008-05-12 15:22 1,999,616 —-a-w C:\WINDOWS\system32\ativvaxx.dll
2008-05-12 15:05 5,439,488 —-a-w C:\WINDOWS\system32\atioglxx.dll
2008-05-12 15:05 327,680 —-a-w C:\WINDOWS\system32\atikvmag.dll
2008-05-12 15:03 17,408 —-a-w C:\WINDOWS\system32\atitvo32.dll
2008-05-12 15:02 49,152 —-a-w C:\WINDOWS\system32\drivers\ati2erec.dll
2008-05-12 14:57 548,864 —-a-w C:\WINDOWS\system32\ati2cqag.dll
2008-05-12 14:49 593,920 ——w C:\WINDOWS\system32\ati2sgag.exe
2008-05-10 05:25 ——— d—–w C:\Program Files\Zune
2008-05-04 01:34 ——— d—–w C:\Program Files\LimeWire
2008-04-29 23:56 61,856 —-a-w C:\WINDOWS\system32\ZuneBusEnum.exe
2008-04-29 23:56 245,664 —-a-w C:\WINDOWS\system32\ZuneWlanCfgSvc.exe
2008-04-29 23:39 70,144 —-a-w C:\WINDOWS\system32\ZuneIpTransport.dll
2008-04-29 23:39 62,464 —-a-w C:\WINDOWS\system32\ZuneUsbTransport.dll
2008-04-29 23:39 40,704 —-a-w C:\WINDOWS\system32\drivers\zumbus.sys
2008-04-29 23:39 35,328 —-a-w C:\WINDOWS\system32\ZuneUsbCOnnection.dll
2008-04-29 23:39 145,408 —-a-w C:\WINDOWS\system32\ZuneMTPZ.dll
2008-04-26 19:52 ——— d—–w C:\Program Files\iGO POI Explorer beta
2008-04-17 23:11 1,112,288 —-a-w C:\WINDOWS\system32\WdfCoInstaller01007.dll
2008-04-14 09:42 985,088 —-a-w C:\WINDOWS\system32\setupapi.dll
2008-04-14 09:42 11,264 —-a-w C:\WINDOWS\system32\spnpinst.exe
2008-04-14 09:41 423,936 —-a-w C:\WINDOWS\system32\licdll.dll
2008-04-14 00:16 329,728 —-a-w C:\WINDOWS\system32\netsetup.exe
2008-04-14 00:13 92,424 —-a-w C:\WINDOWS\system32\rdpdd.dll
2008-04-14 00:13 87,176 —-a-w C:\WINDOWS\system32\rdpwsx.dll
2008-04-14 00:13 40,840 —-a-w C:\WINDOWS\system32\drivers\termdd.sys
2008-04-14 00:13 21,896 —-a-w C:\WINDOWS\system32\drivers\tdtcp.sys
2008-04-14 00:13 139,656 —-a-w C:\WINDOWS\system32\drivers\rdpwd.sys
2008-04-14 00:13 12,168 —-a-w C:\WINDOWS\system32\tsddd.dll
2008-04-14 00:13 12,040 —-a-w C:\WINDOWS\system32\drivers\tdpipe.sys
2008-04-14 00:11 997,376 —-a-w C:\WINDOWS\system32\msgina.dll
2008-04-14 00:10 53,279 —-a-w C:\WINDOWS\system32\odbcji32.dll
2008-04-14 00:10 4,126 —-a-w C:\WINDOWS\system32\msdxmlc.dll
2008-04-14 00:10 3,584 —-a-w C:\WINDOWS\system32\msafd.dll
2008-04-13 19:30 1,845,632 —-a-w C:\WINDOWS\system32\win32k.sys
2008-04-13 19:28 175,744 —-a-w C:\WINDOWS\system32\drivers\rdbss.sys
2008-04-13 19:27 2,188,928 —-a-w C:\WINDOWS\system32\ntoskrnl.exe
2008-04-13 19:21 162,816 —-a-w C:\WINDOWS\system32\drivers\netbt.sys
2008-04-13 19:20 91,520 —-a-w C:\WINDOWS\system32\drivers\ndiswan.sys
2008-04-13 19:20 361,344 —-a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-04-13 19:20 182,656 —-a-w C:\WINDOWS\system32\drivers\ndis.sys
2008-04-13 19:19 75,264 —-a-w C:\WINDOWS\system32\drivers\ipsec.sys
2008-04-13 19:19 51,328 —-a-w C:\WINDOWS\system32\drivers\rasl2tp.sys
2008-04-13 19:19 48,384 —-a-w C:\WINDOWS\system32\drivers\raspptp.sys
2008-04-13 19:19 146,048 —-a-w C:\WINDOWS\system32\drivers\portcls.sys
2008-04-13 19:19 138,112 —-a-w C:\WINDOWS\system32\drivers\afd.sys
2008-04-13 19:18 52,480 —-a-w C:\WINDOWS\system32\drivers\i8042prt.sys
2008-04-13 19:17 83,072 —-a-w C:\WINDOWS\system32\drivers\wdmaud.sys
2008-04-13 19:17 456,576 —-a-w C:\WINDOWS\system32\drivers\mrxsmb.sys
2008-04-13 19:17 105,344 —-a-w C:\WINDOWS\system32\drivers\mup.sys
2008-04-13 19:16 49,536 —-a-w C:\WINDOWS\system32\drivers\classpnp.sys
2008-04-13 19:16 141,056 —-a-w C:\WINDOWS\system32\drivers\ks.sys
2008-04-13 19:15 64,512 —-a-w C:\WINDOWS\system32\drivers\serial.sys
2008-04-13 19:15 60,800 —-a-w C:\WINDOWS\system32\drivers\sysaudio.sys
2008-04-13 19:15 574,976 —-a-w C:\WINDOWS\system32\drivers\ntfs.sys
2008-04-13 19:15 334,848 —-a-w C:\WINDOWS\system32\drivers\srv.sys
2008-04-13 19:14 63,744 —-a-w C:\WINDOWS\system32\drivers\cdfs.sys
2008-04-13 19:14 143,744 —-a-w C:\WINDOWS\system32\drivers\fastfat.sys
2008-04-13 19:00 30,080 —-a-w C:\WINDOWS\system32\drivers\modem.sys
2008-04-13 19:00 225,664 —-a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-04-13 19:00 19,072 —-a-w C:\WINDOWS\system32\drivers\tdi.sys
2008-04-13 18:57 41,472 —-a-w C:\WINDOWS\system32\drivers\raspppoe.sys
2008-04-13 18:57 40,576 —-a-w C:\WINDOWS\system32\drivers\ndproxy.sys
2008-04-13 18:57 34,560 —-a-w C:\WINDOWS\system32\drivers\wanarp.sys
2008-04-13 18:57 20,864 —-a-w C:\WINDOWS\system32\drivers\ipinip.sys
2008-04-13 18:57 152,832 —-a-w C:\WINDOWS\system32\drivers\ipnat.sys
2008-04-13 18:57 14,336 —-a-w C:\WINDOWS\system32\drivers\asyncmac.sys
2008-04-13 18:57 10,112 —-a-w C:\WINDOWS\system32\drivers\ndistapi.sys
2008-04-13 18:56 88,320 —-a-w C:\WINDOWS\system32\drivers\nwlnkipx.sys
2008-04-13 18:56 69,120 —-a-w C:\WINDOWS\system32\drivers\psched.sys
2008-04-13 18:56 35,072 —-a-w C:\WINDOWS\system32\drivers\msgpc.sys
2008-04-13 18:56 34,688 —-a-w C:\WINDOWS\system32\drivers\netbios.sys
2008-04-13 18:56 30,592 —-a-w C:\WINDOWS\system32\drivers\rndismp.sys
2008-04-13 18:56 30,592 ——w C:\WINDOWS\system32\drivers\rndismpx.sys
2008-04-13 18:56 12,800 —-a-w C:\WINDOWS\system32\drivers\usb8023.sys
2008-04-13 18:56 12,800 ——w C:\WINDOWS\system32\drivers\usb8023x.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Smapp"="C:\Program Files\Analog Devices\SoundMAX\SMTray.exe" [2003-05-05 09:57 143360]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-10 01:59 115816]
"osCheck"="C:\Program Files\Norton AntiVirus\osCheck.exe" [2007-01-14 03:11 771704]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 18:38 583048]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 12:17 61440]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.avis"= ff_acm.acm

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ymetray.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ymetray.lnk
backup=C:\WINDOWS\pss\ymetray.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Frank^Start Menu^Programs^Startup^Adobe Gamma.lnk]
path=C:\Documents and Settings\Frank\Start Menu\Programs\Startup\Adobe Gamma.lnk
backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Frank^Start Menu^Programs^Startup^VirtuaGirl HD.LNK]
path=C:\Documents and Settings\Frank\Start Menu\Programs\Startup\VirtuaGirl HD.LNK
backup=C:\WINDOWS\pss\VirtuaGirl HD.LNKStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\3ce90b39]
C:\WINDOWS\system32\vhemtrlq.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acronis Scheduler2 Service]
–a—— 2007-06-14 17:43 149024 C:\Program Files\Common Files\Maxtor\Schedule2\schedhlp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AcronisTimounterMonitor]
–a—— 2007-06-14 17:52 1945712 C:\Program Files\Maxtor\MaxBlast\TimounterMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
–a—— 2008-01-11 23:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent]
–a—— 2007-06-19 23:28 43008 C:\Program Files\BitTorrent\bittorrent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BM3fda38a5]
C:\WINDOWS\system32\xkbkqvrn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Creative WebCam Tray]
——— 2005-10-27 18:00 299008 C:\Program Files\Creative\Shared Files\CamTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dvd43]
–a—— 2005-12-05 19:04 691200 C:\Program Files\dvd43\dvd43_tray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus CX6000 Series]
–a—— 2006-02-13 05:00 131072 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBIA.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus CX6000 Series on DPR1260 (dlinkps-be0f46 USB Port_4)]
–a—— 2006-02-13 05:00 131072 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBIA.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FLMOFFICE4DMOUSE]
–a—— 2007-09-10 21:19 958464 C:\Program Files\Wireless Laser Mouse\MOffice.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
–a—— 2007-08-24 07:00 33648 C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
–a—— 2007-04-27 11:25 257088 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MaxBlastMonitor.exe]
–a—— 2007-06-14 17:39 1169720 C:\Program Files\Maxtor\MaxBlast\MaxBlastMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MimBoot]
–a—— 2005-03-09 20:10 11776 C:\PROGRA~1\MUSICM~1\MUSICM~1\mimboot.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray]
–a—— 2005-03-09 20:10 110592 C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
–a—— 2008-04-13 20:12 1695232 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBJ]
——— 2004-12-07 17:44 1884160 C:\Program Files\Ahead\Nero BackItUp\NBJ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
–a—— 2001-07-09 11:50 155648 C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PhotoShow Deluxe Media Manager]
–a—— 2004-11-11 21:50 212992 C:\PROGRA~1\Ahead\NEROPH~1\data\Xtras\mssysmgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
–a—— 2007-04-27 09:41 282624 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
–a—— 2007-09-25 01:11 132496 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
–a—— 2008-01-15 18:54 37376 C:\Program Files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zune Launcher]
–a—— 2008-04-29 19:56 158624 c:\Program Files\Zune\ZuneLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=3 (0x3)
"MDM"=2 (0x2)
"iPod Service"=3 (0x3)
"InCDsrvR"=2 (0x2)
"idsvc"=3 (0x3)
"LiveUpdate Notice Service"=2 (0x2)
"LiveUpdate Notice Ex"=2 (0x2)
"Eggdrop"=3 (0x3)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\AIM\\aim.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\WINDOWS\\system32\\sessmgr.exe"=
"C:\\Program Files\\BitTorrent\\bittorrent.exe"=
"C:\\Program Files\\mIRC\\mirc.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"C:\\Program Files\\Yahoo!\\Yahoo! Music Jukebox\\YahooMusicEngine.exe"=
"C:\\Program Files\\Quake III Arena\\quake3.exe"=
"C:\\Program Files\\Microsoft Games\\Age of Empires II\\empires2.exe"=
"C:\\Program Files\\Microsoft Games\\Age of Empires II\\age2_x1.exe"=
"C:\\WINDOWS\\system32\\dplaysvr.exe"=
"C:\\Program Files\\GameSpy Arcade\\Aphex.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\WINDOWS\\system32\\PnkBstrA.exe"=
"C:\\WINDOWS\\system32\\PnkBstrB.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\XBC\\neXBC.exe"=
"C:\\Program Files\\id Software\\Quake 4\\Quake4Ded.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1723:TCP"= 1723:TCP:*:Disabled:@xpsp2res.dll,-22015
"1701:UDP"= 1701:UDP:*:Disabled:@xpsp2res.dll,-22016
"500:UDP"= 500:UDP:@xpsp2res.dll,-22017

R2 zumbus;Zune Bus Enumerator Driver;C:\WINDOWS\system32\DRIVERS\zumbus.sys [2008-04-29 19:39]
R2 ZuneBusEnum;Zune Bus Enumerator;c:\WINDOWS\system32\ZuneBusEnum.exe [2008-04-29 19:56]
S2 BT848;WinFast TV2000 XP WDM Video Capture;C:\WINDOWS\system32\drivers\wf2kvcap.sys [2003-11-14 12:30]
S2 tv2ktunr;WinFast TV2000 XP WDM TVTuner;C:\WINDOWS\system32\drivers\wf2ktunr.sys [2003-11-14 12:30]
S2 Tv2kXbar;WinFast TV2000 XP WDM Crossbar;C:\WINDOWS\system32\drivers\wf2kxbar.sys [2003-11-14 12:30]
S3 AN983;ADMtek AN983/AN985/ADM951X 10/100Mbps Fast Ethernet Adapter;C:\WINDOWS\system32\DRIVERS\AN983.sys [2004-08-04 01:31]
S3 MUD;Driver for Magellan Jupiter USB Device;C:\WINDOWS\system32\DRIVERS\MUD.sys [2007-09-07 18:25]
S3 PsSdk30;PsSdk30;C:\WINDOWS\system32\Drivers\PsSdk30.drv []
S3 WFIOCTL;WFIOCTL;C:\Program Files\WinFast\WFDTV\WFIOCTL.SYS []
S3 ZuneWlanCfgSvc;Zune Wireless Configuration Service;c:\WINDOWS\system32\ZuneWlanCfgSvc.exe [2008-04-29 19:56]
S4 Eggdrop;Eggdrop;C:\smaster\srunner.exe []

.
Contents of the 'Scheduled Tasks' folder
"2008-06-06 01:45:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-06-02 22:06:30 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - Chelsea.job"
- C:\Program Files\Norton AntiVirus\Navw32.exeh/TASK:
"2008-06-02 09:00:07 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - Frank.job"
- C:\Program Files\Norton AntiVirus\Navw32.exeh/TASK:
"2008-06-08 02:06:00 C:\WINDOWS\Tasks\User_Feed_Synchronization-{CAF349E9-BEFF-47BB-B46C-7E555456DE2C}.job"
- C:\WINDOWS\system32\msfeedssync.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-07 22:09:24
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\PsSdk30]
"ImagePath"="\??\C:\WINDOWS\system32\Drivers\PsSdk30.drv"
.
——————— DLLs Loaded Under Running Processes ———————

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\NavLogon.dll
.
Completion time: 2008-06-07 22:10:37
ComboFix-quarantined-files.txt 2008-06-08 02:10:24

Pre-Run: 51,948,503,040 bytes free
Post-Run: 52,028,096,512 bytes free

333 — E O F — 2008-05-19 21:37:01
Post #10
Frank1234,

The ComboFix report you provided is the 3rd run of Combofix. You must have ran the program multiple times. That is dangerous. If you cannot comply with some instruction, please post back and ask for guidance. Do not run tools multiple times unless directed. Please post the earliest report (check the time/date stamp on the file) and then continue with the following instructions while I review it.

P2P
You have LimeWire and BitTorrent, P2P/file sharing programs installed on your computer. P2P applications like it are the largest source of malware we see. You'll be doing yourself a favor by removing it.

References for the risk of these programs can be found in these links:
http://www.microsoft.com/windows/ie/commun…protection.mspx
http://www.techweb.com/wire/160500554
http://www.internetworldstats.com/articles/art053.htm://http://www.techweb.com/wire/1605005…cles/art053.htm://http://www.techweb.com/wire/1605005…cles/art053.htm://http://www.techweb.com/wire/1605005…cles/art053.htm://http://www.techweb.com/wire/1605005…cles/art053.htm://http://www.techweb.com/wire/1605005…cles/art053.htm
See Clean/Infected P2P Programs here

I would recommend that you uninstall LimeWire and BitTorrent, however that choice is up to you. If you choose to remove these programs, you can do so via Control Panel >> Add or Remove Programs.

If you wish to keep it, please do not use it until your computer is cleaned.

  • Please open HijackThis and run Do a system scan only
  • Check the boxes next to ONLY the entries listed below(if present):
    • O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h cltCommon (file missing)
      O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
  • Close all programs except for HijackThis.
  • Click on Fix checked
  • A box will pop up asking you if you wish to fix the selected items. Please choose YES.
  • Once it has fixed them, please exit/close HijackThis.

COMBOFIX-Script

  • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

    KILLALL::

File::
C:\WINDOWS\system32\wvUkHWpN.dll.bak
C:\WINDOWS\system32\vtUkheCr.dll.bak
C:\WINDOWS\system32\vhemtrlq.dll

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\3ce90b39]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BM3fda38a5]
  • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

    [external image: Posted Image]
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI