What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Browser Hijack

10 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Lets try combofix then.

Download ComboFix from Here or Here to your Desktop.
**Note: In the event you already have Combofix, please delete it from your desktop and download this new version . It is important that it is saved directly to your desktop**
——————————————————————–
  • Close any open browsers and make sure you are disconnected from the net. Unplug the cable if need be before running combofix.
  • WARNING: IF you have not already done so Combofix will disconnect your machine from the Internet when it starts
  • Please do not re-connect your machine back to the Internet until Combofix has completely finished.
——————————————————————–

Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review

****Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze ****

*If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.

Give it atleast 20-30 minutes to finish
Post #19
Here are the log files:

ComboFix 08-07-27.2 - Administrator 2008-07-27 15:49:02.1 - NTFSx86 MINIMAL
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.367 [GMT -4:00]
Running from: D:\combofix.com.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Peter\Application Data\macromedia\Flash Player\#SharedObjects\6B5427WH\iforex.com
C:\Documents and Settings\Peter\Application Data\macromedia\Flash Player\#SharedObjects\6B5427WH\iforex.com\Emerp\Events\flash_object.swf\user_data.sol
C:\Documents and Settings\Peter\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com
C:\Documents and Settings\Peter\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com\settings.sol
C:\Documents and Settings\Peter\Favorites\Error Cleaner.url
C:\Documents and Settings\Peter\Favorites\Privacy Protector.url
C:\Documents and Settings\Peter\Favorites\Spyware&Malware Protection.url
C:\Program Files\downloadmanager\agent.dll
C:\Program Files\downloadmanager\api.exe
C:\Program Files\downloadmanager\mptray.exe
C:\Program Files\downloadmanager\mpupdate.exe
C:\Program Files\downloadmanager\p2pinst.exe
C:\Program Files\downloadmanager\p2pl.exe
C:\Program Files\mediapipe
C:\Program Files\mediapipe\ErrorLog.txt
C:\Program Files\mediapipe\ItBill_terms.txt
C:\Program Files\oemji
C:\Program Files\oemji\INSTALL.LOG
C:\Program Files\oemji\oemji.ini
C:\Program Files\oemji\OemjiSearchPlus\OemjiSearchPlus.dll
C:\Program Files\oemji\OemjiSearchPlus\OemjiSearchPlus.ini
C:\Program Files\oemji\OemjiSearchPlus\sfbnsp.dll
C:\Program Files\oemji\OemjiSearchPlus\Unreg.bat
C:\Program Files\oemji\OemjiUninstall.exe
C:\Program Files\oemji\referral.htm
C:\Program Files\oemji\Toolbar\PopupBlocker\BlockLst.dat
C:\Program Files\oemji\Toolbar\PopupBlocker\OemjiPopupBlocker.chm
C:\Program Files\oemji\Toolbar\PopupBlocker\OemjiPopupBlocker.exe
C:\Program Files\oemji\Toolbar\PopupBlocker\PBHelper.dll
C:\Program Files\oemji\Toolbar\WebPoi.dll
C:\Program Files\oemji\UNWISE.EXE
C:\Program Files\oemji\watermark.bmp
C:\Program Files\oemji\wse.ini
C:\Program Files\p2pnetworks
C:\Program Files\p2pnetworks\AlConfig.xml
C:\Program Files\p2pnetworks\alp2plib.log
C:\Program Files\p2pnetworks\alp2plib.log.bak
C:\Program Files\p2pnetworks\install.log
C:\Program Files\p2pnetworks\p2pnetworks.exe
C:\Program Files\p2pnetworks\sp2p.cache
C:\Program Files\p2pnetworks\uninst.exe
C:\Program Files\PCHealthCenter
C:\Program Files\PCHealthCenter\0.exe
C:\Program Files\PCHealthCenter\0.gif
C:\Program Files\PCHealthCenter\1.exe
C:\Program Files\PCHealthCenter\1.gif
C:\Program Files\PCHealthCenter\2.gif
C:\Program Files\PCHealthCenter\3.exe
C:\Program Files\PCHealthCenter\3.gif
C:\Program Files\PCHealthCenter\7.exe
C:\Program Files\PCHealthCenter\sex1.ico
C:\Program Files\PCHealthCenter\sex2.ico
C:\Program Files\VAV
C:\Program Files\VAV\vav.ooo
C:\Program Files\VAV\vav0.dat
C:\Program Files\VAV\vav1.dat
C:\WINDOWS\ccang.dat
C:\WINDOWS\cookies.ini
C:\WINDOWS\desktop.html
C:\WINDOWS\dobez.dat
C:\WINDOWS\Downloaded Program Files\mediaticketsinstaller.ocx
C:\WINDOWS\eqvwamkl.dll
C:\WINDOWS\etpx.exe
C:\WINDOWS\fdkowvbp.dll
C:\WINDOWS\fhipa.dat
C:\WINDOWS\grswptdl.exe
C:\WINDOWS\jzvzi.dat
C:\WINDOWS\khbwb.dat
C:\WINDOWS\lfqib.dat
C:\WINDOWS\mzuuq.dat
C:\WINDOWS\netdx.dat
C:\WINDOWS\npjgs.dat
C:\WINDOWS\system32\ahazh.dat
C:\WINDOWS\system32\aqncwgss.dll
C:\WINDOWS\system32\bemmdbmv.dll
C:\WINDOWS\system32\clbdll.dll
C:\WINDOWS\system32\clbdll.old
C:\WINDOWS\system32\clbinit.dll
C:\WINDOWS\system32\cmbqpwlh.ini
C:\WINDOWS\system32\ddpad.dat
C:\WINDOWS\system32\drivers\clbdriver.sys
C:\WINDOWS\system32\fccyaATL.dll
C:\WINDOWS\system32\fijygl.dll
C:\WINDOWS\system32\gcycxbpj.dll
C:\WINDOWS\system32\ggkqmm.dll
C:\WINDOWS\system32\hllcfk.dll
C:\WINDOWS\system32\ieyakbtu.dll
C:\WINDOWS\system32\igmziw.dll
C:\WINDOWS\system32\iiwuq.dat
C:\WINDOWS\system32\jvqhd.dat
C:\WINDOWS\system32\kmaohnqg.ini
C:\WINDOWS\system32\letfx.dat
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\ndbrjtsw.ini
C:\WINDOWS\system32\pcyht.dat
C:\WINDOWS\system32\pfqwyv.dll
C:\WINDOWS\system32\pftnyhpk.dll
C:\WINDOWS\system32\rebuoryu.dll
C:\WINDOWS\system32\snkbcvax.ini
C:\WINDOWS\system32\urqQiJYR.dll
C:\WINDOWS\system32\vbyciojs.ini
C:\WINDOWS\system32\VxGQstwa.ini
C:\WINDOWS\system32\VxGQstwa.ini2
C:\WINDOWS\system32\WinCtrl32.dll
C:\WINDOWS\system32\wnsapisv.exe
C:\WINDOWS\system32\YJlSAcfe.ini
C:\WINDOWS\system32\YJlSAcfe.ini2
C:\WINDOWS\system32\yndmyelr.ini
C:\WINDOWS\system32\zhaww.dat
C:\WINDOWS\system32\znbngf.dll
C:\WINDOWS\system32\zztef.dat
C:\WINDOWS\ulwde.dat
C:\WINDOWS\wkbqz.dat
C:\WINDOWS\wnslvxtf.dll
C:\WINDOWS\xnsbg.dat

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_CLBDRIVER


((((((((((((((((((((((((( Files Created from 2008-06-27 to 2008-07-27 )))))))))))))))))))))))))))))))
.

2008-07-27 13:53 . 2008-07-27 13:53 95,360 –a—— C:\WINDOWS\system32\gqnhoamk.dll
2008-07-27 03:09 . 2008-07-27 03:09 d——– C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-07-27 03:03 . 2008-07-27 03:06 d——– C:\Documents and Settings\Administrator
2008-07-25 05:18 . 2008-07-25 05:18 323,584 –a—— C:\WINDOWS\system32\efcASlJY.dll
2008-07-25 04:06 . 2008-07-27 16:04 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2008-07-25 04:06 . 2008-07-25 04:06 1,409 –a—— C:\WINDOWS\QTFont.for
2008-07-25 01:10 . 2008-07-27 03:09 d——– C:\Program Files\SUPERAntiSpyware
2008-07-25 01:10 . 2008-07-25 01:10 d——– C:\Documents and Settings\Peter\Application Data\SUPERAntiSpyware.com
2008-07-24 20:02 . 2001-08-18 08:00 4,224 –a—— C:\WINDOWS\system32\beep.sys
2008-07-18 11:28 . 2008-07-18 12:50 d——– C:\Documents and Settings\All Users\Application Data\RCGOnyx2
2008-07-18 11:27 . 2008-07-18 11:28 d——– C:\Program Files\Turbo Trader 2

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-27 19:50 ——— d—–w C:\Program Files\DownloadManager
2008-07-26 18:22 ——— d—–w C:\Documents and Settings\Peter\Application Data\AVG7
2008-07-26 15:27 ——— d—–w C:\Documents and Settings\All Users\Application Data\Google Updater
2008-07-25 12:00 ——— d—–w C:\Documents and Settings\LocalService\Application Data\AVG7
2008-07-25 05:07 ——— d—–w C:\Program Files\Common Files\Wise Installation Wizard
2008-07-25 02:24 ——— d—–w C:\Program Files\WinMX
2008-06-20 10:45 360,320 —-a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:44 138,368 —-a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 09:52 225,920 —-a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-06 02:20 ——— d—–w C:\Program Files\Craftsman
2008-06-04 15:18 ——— d—–w C:\Documents and Settings\Peter\Application Data\.wyzo
2006-03-15 03:50 26,922 —-a-w C:\Program Files\MoviePass Terms.html
2005-03-12 21:37 0 —-a-w C:\Documents and Settings\Peter\Upgrade.exe
2005-03-02 01:59 79,872 –sh–r C:\Documents and Settings\Peter\Application Data\eetu.exe
2004-05-26 15:50 26 —-a-w C:\Documents and Settings\Peter\Application Data\tvmcwrd.dll
2004-05-26 15:45 167,435 —-a-w C:\Documents and Settings\Peter\Application Data\tvmknwrd.dll
2005-01-24 16:25 0 –sha-w C:\WINDOWS\addnv32.exe
2005-01-19 15:12 3,567 –sha-w C:\WINDOWS\dgbvv.dat
2005-01-15 22:50 3,547 –sha-w C:\WINDOWS\geslz.dat
2005-01-20 02:47 0 –sha-w C:\WINDOWS\gulcy.dat
2004-12-21 19:22 0 –sha-w C:\WINDOWS\hlspq.dll
2004-12-11 04:29 3,547 –sha-w C:\WINDOWS\iovmc.dat
2005-01-14 15:29 0 –sha-w C:\WINDOWS\jzdwv.dat
2005-01-14 04:43 0 –sha-w C:\WINDOWS\mfcyu.exe
2005-01-13 16:07 0 –sha-w C:\WINDOWS\mjzop.dll
2005-02-01 15:51 3,567 –sha-w C:\WINDOWS\zrpwb.dat
2005-02-08 14:16 0 –sha-w C:\WINDOWS\system32\addnb.exe
2005-01-28 02:09 0 –sha-w C:\WINDOWS\system32\aoanv.dat
2005-01-31 00:36 3,567 –sha-w C:\WINDOWS\system32\bzwcp.dat
2005-02-02 20:29 3,567 –sha-w C:\WINDOWS\system32\czpml.dat
2005-01-31 21:10 0 –sha-w C:\WINDOWS\system32\dlylu.dat
2005-01-21 09:13 0 –sha-w C:\WINDOWS\system32\dtisc.dat
2005-01-31 12:23 3,567 –sha-w C:\WINDOWS\system32\enppy.dat
2005-01-23 00:14 0 –sha-w C:\WINDOWS\system32\ewdgg.dll
2005-01-12 09:48 3,547 –sha-w C:\WINDOWS\system32\ezruq.dat
2004-12-10 17:14 4,402 –sha-w C:\WINDOWS\system32\hdnjn.dat
2004-11-09 23:04 4,354 –sha-w C:\WINDOWS\system32\ignqk.dat
2005-01-20 16:30 0 –sha-w C:\WINDOWS\system32\iniht.dat
2005-01-24 16:25 0 –sha-w C:\WINDOWS\system32\ipht32.exe
2005-02-03 01:41 0 –sha-w C:\WINDOWS\system32\ndisv.dll
2005-01-27 00:44 0 –sha-w C:\WINDOWS\system32\nocit.dat
2005-01-08 14:01 3,547 –sha-w C:\WINDOWS\system32\nqmww.dat
2005-01-21 00:23 3,547 –sha-w C:\WINDOWS\system32\pkblc.dat
2004-12-20 05:14 4,354 –sha-w C:\WINDOWS\system32\ramjh.dat
2005-01-26 09:21 3,547 –sha-w C:\WINDOWS\system32\rhtby.dat
2005-01-15 18:06 0 –sha-w C:\WINDOWS\system32\sohrb.dll
2005-01-24 00:56 0 –sha-w C:\WINDOWS\system32\sysgx.exe
2005-01-12 17:16 0 –sha-w C:\WINDOWS\system32\wtaxw.dat
2005-03-01 15:17 417,792 –sha-r C:\WINDOWS\system32\w?nword.exe
2005-01-09 23:51 3,547 –sha-w C:\WINDOWS\system32\xminb.dat
2004-11-02 10:08 3,547 –sha-w C:\WINDOWS\system32\yibcc.dat
2004-11-30 05:07 0 –sha-w C:\WINDOWS\system32\yltkj.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B49B759C-7D11-4233-96B9-972A582F6673}]
2008-07-25 05:18 323584 –a—— C:\WINDOWS\system32\efcASlJY.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 12:24 1694208]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:56 15360]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-04-23 13:17 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [2008-04-15 08:54 579584]
"AVG7_EMC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe" [2007-12-21 09:54 406528]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24 286720]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 11:09 63712]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-09-26 14:42 267064]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"f05a0621"="C:\WINDOWS\system32\gqnhoamk.dll" [2008-07-27 13:53 95360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe" [2007-10-23 08:55 219136]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2004-08-04 03:56 53760 C:\WINDOWS\system32\narrator.exe]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{FA010552-4A27-4cb1-A1BB-3E2D697F1639}"= "c:\Program Files\interMute\SpySubtract\sshook.dll" [2005-03-04 01:08 77824]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 10:13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wincj41.sys]
@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^Peter^Start Menu^Programs^Startup^winupdate34969854[1].exe]
path=C:\Documents and Settings\Peter\Start Menu\Programs\Startup\winupdate34969854[1].exe
backup=C:\WINDOWS\pss\winupdate34969854[1].exeStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Peter^Start Menu^Programs^Startup^winupdate45414185[1].exe]
path=C:\Documents and Settings\Peter\Start Menu\Programs\Startup\winupdate45414185[1].exe
backup=C:\WINDOWS\pss\winupdate45414185[1].exeStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Peter^Start Menu^Programs^Startup^winupdate54951361[1].exe]
path=C:\Documents and Settings\Peter\Start Menu\Programs\Startup\winupdate54951361[1].exe
backup=C:\WINDOWS\pss\winupdate54951361[1].exeStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
–a—— 2004-10-13 12:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"NVSvc"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\WINDOWS\\system32\\javaw.exe"=
"C:\\ENSIGN\\Ensign.exe"=
"C:\\Program Files\\1stWORKS\\hotCommCL\\BIN\\hotComm.exe"=
"C:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"C:\\StubInstaller.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\Conference\\Conference.dll"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=

S0 Wincj41;Wincj41;C:\WINDOWS\system32\Drivers\Wincj41.sys []
S4 Kern32;Manageer Network Connections;C:\WINDOWS\System32\telcmd.exe []
.
Contents of the 'Scheduled Tasks' folder
2008-07-25 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job - C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 14:57]
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-mswspl - (no file)
Notify-WgaLogon - (no file)
MSConfigStartUp-mswspl - C:\Program Files\STOPzilla!\Stopzilla.exe
MSConfigStartUp-STOPzilla - C:\Program Files\STOPzilla!\Stopzilla.exe


.
——- Supplementary Scan ——-
.
R0 -: HKCU-Main,Start Page = about:blank
R0 -: HKCU-Main,SearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
R0 -: HKLM-Main,Start Page = about:blank
O8 -: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O16 -: Microsoft XML Parser for Java - file://C:\WINDOWS\Java\classes\xmldso.cab
C:\WINDOWS\Downloaded Program Files\Microsoft XML Parser for Java.osd

O16 -: {24BACF02-5676-11D3-B8DE-00105A17A9E6} - hxxp://www.schaeffersresearch.com/Download/Cfx4Financial.cab
C:\WINDOWS\Downloaded Program Files\Cfx4FCli.dll


**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-27 16:04:49
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

PROCESS: C:\WINDOWS\explorer.exe
-> C:\WINDOWS\system32\gqnhoamk.dll
-> ?:\WINDOWS\System32\CSCDLL.dll
.
———————— Other Running Processes ————————
.
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\verclsid.exe
.
**************************************************************************
.
Completion time: 2008-07-27 16:13:54 - machine was rebooted [Peter]
ComboFix-quarantined-files.txt 2008-07-27 20:13:45

Pre-Run: 19,341,402,112 bytes free
Post-Run: 19,246,268,416 bytes free

311 — E O F — 2008-07-24 08:44:21


Logfile of HijackThis v1.99.1
Scan saved at 17:02, on 2008-07-27
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16441)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\PROGRA~1\MICROS~2\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\HJT\spyware.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [f05a0621] rundll32.exe "C:\WINDOWS\system32\gqnhoamk.dll",b
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: STOPzilla Local Service - Unknown owner - C:\Program Files\STOPzilla!\szntsvc.exe (file missing)
Post #20
I need you to do this first.

Delete this file:

C:\Windows\System32\beep.sys

Download beep.sys from here and save it to
C:\Windows\system32\drivers\

Answer yes if it asks to overwrite.

I will be back with another fix in a minute.
Post #22
Ok beep.sys is replaced. Here's another log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:15, on 2008-07-27
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16441)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [f05a0621] rundll32.exe "C:\WINDOWS\system32\gqnhoamk.dll",b
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {21F49842-BFA9-11D2-A89C-00104B62BDDA} (ChartFX Internet Control) - http://www.schaeffersresearch.com/download/CfxIEAx.cab
O16 - DPF: {24BACF02-5676-11D3-B8DE-00105A17A9E6} (ChartFX Internet Financial Client 4.0) - http://www.schaeffersresearch.com/Download/Cfx4Financial.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: STOPzilla Local Service - Unknown owner - C:\Program Files\STOPzilla!\szntsvc.exe (file missing)
O24 - Desktop Component 0: (no name) - (no file)
O24 - Desktop Component 1: (no name) - http://www.watermansguild.com/menumachine/core/spacer.gif

–
End of file - 5767 bytes
Post #23
Open notepad and copy/paste the text in the Codebox below into it:

File::
C:\WINDOWS\system32\gqnhoamk.dll
C:\WINDOWS\system32\efcASlJY.dll
C:\Documents and Settings\Peter\Upgrade.exe
C:\Documents and Settings\Peter\Application Data\eetu.exe
C:\Documents and Settings\Peter\Application Data\tvmcwrd.dll
C:\Documents and Settings\Peter\Application Data\tvmknwrd.dll
C:\WINDOWS\addnv32.exe
C:\WINDOWS\dgbvv.dat
C:\WINDOWS\geslz.dat
C:\WINDOWS\gulcy.dat
C:\WINDOWS\hlspq.dll
C:\WINDOWS\iovmc.dat
C:\WINDOWS\jzdwv.dat
C:\WINDOWS\mfcyu.exe
C:\WINDOWS\mjzop.dll
C:\WINDOWS\zrpwb.dat
C:\WINDOWS\system32\addnb.exe
C:\WINDOWS\system32\aoanv.dat
C:\WINDOWS\system32\bzwcp.dat
C:\WINDOWS\system32\czpml.dat
C:\WINDOWS\system32\dlylu.dat
C:\WINDOWS\system32\dtisc.dat
C:\WINDOWS\system32\enppy.dat
C:\WINDOWS\system32\ewdgg.dll
C:\WINDOWS\system32\ezruq.dat
C:\WINDOWS\system32\hdnjn.dat
C:\WINDOWS\system32\ignqk.dat
C:\WINDOWS\system32\iniht.dat
C:\WINDOWS\system32\ipht32.exe
C:\WINDOWS\system32\ndisv.dll
C:\WINDOWS\system32\nocit.dat
C:\WINDOWS\system32\nqmww.dat
C:\WINDOWS\system32\pkblc.dat
C:\WINDOWS\system32\ramjh.dat
C:\WINDOWS\system32\rhtby.dat
C:\WINDOWS\system32\sohrb.dll
C:\WINDOWS\system32\sysgx.exe
C:\WINDOWS\system32\wtaxw.dat
C:\WINDOWS\system32\w?nword.exe
C:\WINDOWS\system32\xminb.dat
C:\WINDOWS\system32\yibcc.dat
C:\WINDOWS\system32\yltkj.dat
C:\WINDOWS\system32\Drivers\Wincj41.sys
C:\WINDOWS\system32\gqnhoamk.dll

Driver::
Wincj41

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B49B759C-7D11-4233-96B9-972A582F6673}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"f05a0621"=-

Save this as Save this as "CFScript"


[external image: Posted Image]

Drag CFScript.txt into ComboFix.exe

Then post the results log and a new HijackThis log.


Also please describe how your computer behaves at the moment.
Post #24
Ok here's the latest logs:

ComboFix 08-07-27.2 - Peter 2008-07-27 21:50:43.2 - NTFSx86
Running from: D:\ComboFix.exe
Command switches used :: D:\CFScript.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\Documents and Settings\Peter\Application Data\eetu.exe
C:\Documents and Settings\Peter\Application Data\tvmcwrd.dll
C:\Documents and Settings\Peter\Application Data\tvmknwrd.dll
C:\Documents and Settings\Peter\Upgrade.exe
C:\WINDOWS\addnv32.exe
C:\WINDOWS\dgbvv.dat
C:\WINDOWS\geslz.dat
C:\WINDOWS\gulcy.dat
C:\WINDOWS\hlspq.dll
C:\WINDOWS\iovmc.dat
C:\WINDOWS\jzdwv.dat
C:\WINDOWS\mfcyu.exe
C:\WINDOWS\mjzop.dll
C:\WINDOWS\system32\addnb.exe
C:\WINDOWS\system32\aoanv.dat
C:\WINDOWS\system32\bzwcp.dat
C:\WINDOWS\system32\czpml.dat
C:\WINDOWS\system32\dlylu.dat
C:\WINDOWS\system32\Drivers\Wincj41.sys
C:\WINDOWS\system32\dtisc.dat
C:\WINDOWS\system32\efcASlJY.dll
C:\WINDOWS\system32\enppy.dat
C:\WINDOWS\system32\ewdgg.dll
C:\WINDOWS\system32\ezruq.dat
C:\WINDOWS\system32\gqnhoamk.dll
C:\WINDOWS\system32\hdnjn.dat
C:\WINDOWS\system32\ignqk.dat
C:\WINDOWS\system32\iniht.dat
C:\WINDOWS\system32\ipht32.exe
C:\WINDOWS\system32\ndisv.dll
C:\WINDOWS\system32\nocit.dat
C:\WINDOWS\system32\nqmww.dat
C:\WINDOWS\system32\pkblc.dat
C:\WINDOWS\system32\ramjh.dat
C:\WINDOWS\system32\rhtby.dat
C:\WINDOWS\system32\sohrb.dll
C:\WINDOWS\system32\sysgx.exe
C:\WINDOWS\system32\wtaxw.dat
C:\WINDOWS\system32\xminb.dat
C:\WINDOWS\system32\yibcc.dat
C:\WINDOWS\system32\yltkj.dat
C:\WINDOWS\zrpwb.dat
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Peter\Application Data\eetu.exe
C:\Documents and Settings\Peter\Application Data\tvmcwrd.dll
C:\Documents and Settings\Peter\Application Data\tvmknwrd.dll
C:\Documents and Settings\Peter\Desktop\Vista Antivirus 2008.lnk
C:\Documents and Settings\Peter\Upgrade.exe
C:\WINDOWS\addnv32.exe
C:\WINDOWS\dgbvv.dat
C:\WINDOWS\geslz.dat
C:\WINDOWS\gulcy.dat
C:\WINDOWS\hlspq.dll
C:\WINDOWS\iovmc.dat
C:\WINDOWS\jzdwv.dat
C:\WINDOWS\mfcyu.exe
C:\WINDOWS\mjzop.dll
C:\WINDOWS\system32\addnb.exe
C:\WINDOWS\system32\aoanv.dat
C:\WINDOWS\system32\bzwcp.dat
C:\WINDOWS\system32\czpml.dat
C:\WINDOWS\system32\dlylu.dat
C:\WINDOWS\system32\dtisc.dat
C:\WINDOWS\system32\efcASlJY.dll
C:\WINDOWS\system32\enppy.dat
C:\WINDOWS\system32\ewdgg.dll
C:\WINDOWS\system32\ezruq.dat
C:\WINDOWS\system32\gqnhoamk.dll
C:\WINDOWS\system32\hdnjn.dat
C:\WINDOWS\system32\ignqk.dat
C:\WINDOWS\system32\iniht.dat
C:\WINDOWS\system32\ipht32.exe
C:\WINDOWS\system32\ndisv.dll
C:\WINDOWS\system32\nocit.dat
C:\WINDOWS\system32\nqmww.dat
C:\WINDOWS\system32\pkblc.dat
C:\WINDOWS\system32\ramjh.dat
C:\WINDOWS\system32\rhtby.dat
C:\WINDOWS\system32\sohrb.dll
C:\WINDOWS\system32\sysgx.exe
C:\WINDOWS\system32\wtaxw.dat
C:\WINDOWS\system32\xminb.dat
C:\WINDOWS\system32\yibcc.dat
C:\WINDOWS\system32\yltkj.dat
C:\WINDOWS\zrpwb.dat

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Service_Wincj41


((((((((((((((((((((((((( Files Created from 2008-06-28 to 2008-07-28 )))))))))))))))))))))))))))))))
.

2008-07-27 17:31 . 2008-07-27 17:28 4,224 –a—— C:\WINDOWS\system32\beep.sys
2008-07-27 17:15 . 2008-07-27 17:15 d——– C:\Program Files\Trend Micro
2008-07-27 16:13 . 2008-07-27 21:52 474 —hs—- C:\WINDOWS\system32\kmaohnqg.ini
2008-07-27 03:09 . 2008-07-27 03:09 d——– C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-07-27 03:03 . 2008-07-27 03:06 d——– C:\Documents and Settings\Administrator
2008-07-25 04:06 . 2008-07-27 22:05 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2008-07-25 04:06 . 2008-07-25 04:06 1,409 –a—— C:\WINDOWS\QTFont.for
2008-07-25 01:10 . 2008-07-27 03:09 d——– C:\Program Files\SUPERAntiSpyware
2008-07-25 01:10 . 2008-07-25 01:10 d——– C:\Documents and Settings\Peter\Application Data\SUPERAntiSpyware.com
2008-07-18 11:28 . 2008-07-18 12:50 d——– C:\Documents and Settings\All Users\Application Data\RCGOnyx2
2008-07-18 11:27 . 2008-07-18 11:28 d——– C:\Program Files\Turbo Trader 2

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-27 19:50 ——— d—–w C:\Program Files\DownloadManager
2008-07-26 18:22 ——— d—–w C:\Documents and Settings\Peter\Application Data\AVG7
2008-07-26 15:27 ——— d—–w C:\Documents and Settings\All Users\Application Data\Google Updater
2008-07-25 12:00 ——— d—–w C:\Documents and Settings\LocalService\Application Data\AVG7
2008-07-25 05:07 ——— d—–w C:\Program Files\Common Files\Wise Installation Wizard
2008-07-25 02:24 ——— d—–w C:\Program Files\WinMX
2008-06-20 10:45 360,320 —-a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:44 138,368 —-a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 09:52 225,920 —-a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-06 02:20 ——— d—–w C:\Program Files\Craftsman
2008-06-04 15:18 ——— d—–w C:\Documents and Settings\Peter\Application Data\.wyzo
2006-03-15 03:50 26,922 —-a-w C:\Program Files\MoviePass Terms.html
2005-03-01 15:17 417,792 –sha-r C:\WINDOWS\system32\w?nword.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 12:24 1694208]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:56 15360]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-04-23 13:17 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [2008-04-15 08:54 579584]
"AVG7_EMC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe" [2007-12-21 09:54 406528]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24 286720]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 11:09 63712]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-09-26 14:42 267064]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe" [2007-10-23 08:55 219136]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2004-08-04 03:56 53760 C:\WINDOWS\system32\narrator.exe]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{FA010552-4A27-4cb1-A1BB-3E2D697F1639}"= "c:\Program Files\interMute\SpySubtract\sshook.dll" [2005-03-04 01:08 77824]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 10:13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wincj41.sys]
@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^Peter^Start Menu^Programs^Startup^winupdate34969854[1].exe]
path=C:\Documents and Settings\Peter\Start Menu\Programs\Startup\winupdate34969854[1].exe
backup=C:\WINDOWS\pss\winupdate34969854[1].exeStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Peter^Start Menu^Programs^Startup^winupdate45414185[1].exe]
path=C:\Documents and Settings\Peter\Start Menu\Programs\Startup\winupdate45414185[1].exe
backup=C:\WINDOWS\pss\winupdate45414185[1].exeStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Peter^Start Menu^Programs^Startup^winupdate54951361[1].exe]
path=C:\Documents and Settings\Peter\Start Menu\Programs\Startup\winupdate54951361[1].exe
backup=C:\WINDOWS\pss\winupdate54951361[1].exeStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
–a—— 2004-10-13 12:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"NVSvc"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\WINDOWS\\system32\\javaw.exe"=
"C:\\ENSIGN\\Ensign.exe"=
"C:\\Program Files\\1stWORKS\\hotCommCL\\BIN\\hotComm.exe"=
"C:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"C:\\StubInstaller.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\Conference\\Conference.dll"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=

R4 Ctp1xx;Ctp1xx;C:\WINDOWS\system32\DRIVERS\Ctp1xx.syS []
R4 hpt3xx;hpt3xx;C:\WINDOWS\system32\DRIVERS\hpt3xx.syS []
R4 Kern32;Manageer Network Connections;C:\WINDOWS\System32\telcmd.exe []
R4 TY164;Working Network Connections;C:\WINDOWS\System32\hicom.exe []

.
Contents of the 'Scheduled Tasks' folder
2008-07-25 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job - C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 14:57]
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-27 22:05:06
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\imapi.exe
.
**************************************************************************
.
Completion time: 2008-07-27 22:15:00 - machine was rebooted
ComboFix-quarantined-files.txt 2008-07-28 02:14:51
ComboFix2.txt 2008-07-27 20:13:56

Pre-Run: 19,244,777,472 bytes free
Post-Run: 19,191,029,760 bytes free

219 — E O F — 2008-07-24 08:44:21


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:03, on 2008-07-28
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16441)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {21F49842-BFA9-11D2-A89C-00104B62BDDA} (ChartFX Internet Control) - http://www.schaeffersresearch.com/download/CfxIEAx.cab
O16 - DPF: {24BACF02-5676-11D3-B8DE-00105A17A9E6} (ChartFX Internet Financial Client 4.0) - http://www.schaeffersresearch.com/Download/Cfx4Financial.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: STOPzilla Local Service - Unknown owner - C:\Program Files\STOPzilla!\szntsvc.exe (file missing)
O24 - Desktop Component 0: (no name) - (no file)
O24 - Desktop Component 1: (no name) - http://www.watermansguild.com/menumachine/core/spacer.gif

–
End of file - 5448 bytes
Post #25
Open notepad and copy/paste the text in the Codebox below into it:

File::
C:\WINDOWS\system32\beep.sys
C:\WINDOWS\system32\kmaohnqg.ini
C:\WINDOWS\system32\w?nword.exe
C:\Documents and Settings\Peter\Start Menu\Programs\Startup\winupdate34969854[1].exe
C:\WINDOWS\pss\winupdate34969854[1].exe
C:\Documents and Settings\Peter\Start Menu\Programs\Startup\winupdate45414185[1].exe
C:\WINDOWS\pss\winupdate45414185[1].exeStartup
C:\Documents and Settings\Peter\Start Menu\Programs\Startup\winupdate54951361[1].exe
C:\WINDOWS\pss\winupdate54951361[1].exeStartup
C:\WINDOWS\pss\winupdate45414185[1].exe
C:\WINDOWS\pss\winupdate54951361[1].exe

Registry::
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wincj41.sys]
[-HKLM\~\startupfolder\C:^Documents and Settings^Peter^Start Menu^Programs^Startup^winupdate34969854[1].exe]
[-HKLM\~\startupfolder\C:^Documents and Settings^Peter^Start Menu^Programs^Startup^winupdate45414185[1].exe]
[-HKLM\~\startupfolder\C:^Documents and Settings^Peter^Start Menu^Programs^Startup^winupdate54951361[1].exe]

Save this as Save this as "CFScript"


[external image: Posted Image]

Drag CFScript.txt into ComboFix.exe

Then post the results log and a new HijackThis log.


Also please describe how your computer behaves at the moment.
Post #26
Here are the latest logs:

ComboFix 08-07-28.4 - Peter 2008-07-29 0:17:01.3 - NTFSx86
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Peter\Desktop\CFScript.txt

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\Documents and Settings\Peter\Start Menu\Programs\Startup\winupdate34969854[1].exe
C:\Documents and Settings\Peter\Start Menu\Programs\Startup\winupdate45414185[1].exe
C:\Documents and Settings\Peter\Start Menu\Programs\Startup\winupdate54951361[1].exe
C:\WINDOWS\pss\winupdate34969854[1].exe
C:\WINDOWS\pss\winupdate45414185[1].exe
C:\WINDOWS\pss\winupdate45414185[1].exeStartup
C:\WINDOWS\pss\winupdate54951361[1].exe
C:\WINDOWS\pss\winupdate54951361[1].exeStartup
C:\WINDOWS\system32\beep.sys
C:\WINDOWS\system32\kmaohnqg.ini
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\beep.sys
C:\WINDOWS\system32\kmaohnqg.ini

.
((((((((((((((((((((((((( Files Created from 2008-06-28 to 2008-07-29 )))))))))))))))))))))))))))))))
.

2008-07-27 17:15 . 2008-07-27 17:15 d——– C:\Program Files\Trend Micro
2008-07-27 03:09 . 2008-07-27 03:09 d——– C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-07-27 03:03 . 2008-07-27 03:06 d——– C:\Documents and Settings\Administrator
2008-07-25 04:06 . 2008-07-28 23:29 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2008-07-25 04:06 . 2008-07-25 04:06 1,409 –a—— C:\WINDOWS\QTFont.for
2008-07-25 01:10 . 2008-07-27 03:09 d——– C:\Program Files\SUPERAntiSpyware
2008-07-25 01:10 . 2008-07-25 01:10 d——– C:\Documents and Settings\Peter\Application Data\SUPERAntiSpyware.com
2008-07-18 11:28 . 2008-07-18 12:50 d——– C:\Documents and Settings\All Users\Application Data\RCGOnyx2
2008-07-18 11:27 . 2008-07-18 11:28 d——– C:\Program Files\Turbo Trader 2

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-29 03:37 ——— d—–w C:\Documents and Settings\All Users\Application Data\Google Updater
2008-07-27 19:50 ——— d—–w C:\Program Files\DownloadManager
2008-07-26 18:22 ——— d—–w C:\Documents and Settings\Peter\Application Data\AVG7
2008-07-25 12:00 ——— d—–w C:\Documents and Settings\LocalService\Application Data\AVG7
2008-07-25 05:07 ——— d—–w C:\Program Files\Common Files\Wise Installation Wizard
2008-07-25 02:24 ——— d—–w C:\Program Files\WinMX
2008-06-20 17:41 245,248 —-a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 10:45 360,320 —-a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:44 138,368 —-a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 09:52 225,920 —-a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-06 02:20 ——— d—–w C:\Program Files\Craftsman
2008-06-04 15:18 ——— d—–w C:\Documents and Settings\Peter\Application Data\.wyzo
2008-05-07 05:18 1,287,680 —-a-w C:\WINDOWS\system32\quartz.dll
2006-03-15 03:50 26,922 —-a-w C:\Program Files\MoviePass Terms.html
2005-03-01 15:17 417,792 –sha-r C:\WINDOWS\system32\w?nword.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 12:24 1694208]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:56 15360]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-04-23 13:17 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [2008-04-15 08:54 579584]
"AVG7_EMC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe" [2007-12-21 09:54 406528]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24 286720]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 11:09 63712]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-09-26 14:42 267064]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe" [2007-10-23 08:55 219136]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2004-08-04 03:56 53760 C:\WINDOWS\system32\narrator.exe]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{FA010552-4A27-4cb1-A1BB-3E2D697F1639}"= "c:\Program Files\interMute\SpySubtract\sshook.dll" [2005-03-04 01:08 77824]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 10:13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
–a—— 2004-10-13 12:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"NVSvc"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\WINDOWS\\system32\\javaw.exe"=
"C:\\ENSIGN\\Ensign.exe"=
"C:\\Program Files\\1stWORKS\\hotCommCL\\BIN\\hotComm.exe"=
"C:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"C:\\StubInstaller.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\Conference\\Conference.dll"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=

R4 Ctp1xx;Ctp1xx;C:\WINDOWS\system32\DRIVERS\Ctp1xx.syS []
R4 hpt3xx;hpt3xx;C:\WINDOWS\system32\DRIVERS\hpt3xx.syS []
R4 Kern32;Manageer Network Connections;C:\WINDOWS\System32\telcmd.exe []
R4 TY164;Working Network Connections;C:\WINDOWS\System32\hicom.exe []


*Newly Created Service* - CATCHME
.
Contents of the 'Scheduled Tasks' folder

2008-07-25 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 14:57]
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-29 00:19:49
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-07-29 0:22:53
ComboFix-quarantined-files.txt 2008-07-29 04:22:37
ComboFix2.txt 2008-07-28 02:15:02
ComboFix3.txt 2008-07-27 20:13:56

Pre-Run: 19,085,537,280 bytes free
Post-Run: 19,093,282,816 bytes free

121 — E O F — 2008-07-28 18:26:24


ogfile of Trend Micro HijackThis v2.0.2
Scan saved at 02:33, on 2008-07-29
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16441)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.surfline.com/home/index.cfm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {21F49842-BFA9-11D2-A89C-00104B62BDDA} (ChartFX Internet Control) - http://www.schaeffersresearch.com/download/CfxIEAx.cab
O16 - DPF: {24BACF02-5676-11D3-B8DE-00105A17A9E6} (ChartFX Internet Financial Client 4.0) - http://www.schaeffersresearch.com/Download/Cfx4Financial.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: STOPzilla Local Service - Unknown owner - C:\Program Files\STOPzilla!\szntsvc.exe (file missing)
O24 - Desktop Component 0: (no name) - (no file)
O24 - Desktop Component 1: (no name) - http://www.watermansguild.com/menumachine/core/spacer.gif

–
End of file - 5397 bytes
Post #27
Guess this bad guy didn't want to die.

Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\WINDOWS\system32\w?nword.exe


Save this as CFScript.txt


[external image: Posted Image]

Refering to the picture above, drag CFScript.txt into ComboFix.exe

Then post the results log and a new HijackThis log.
Post #28
Here are the recent Logs:

ComboFix 08-07-28.4 - Peter 2008-07-29 21:48:26.4 - NTFSx86
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Peter\Desktop\CFScript.txt

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-06-28 to 2008-07-30 )))))))))))))))))))))))))))))))
.

2008-07-27 17:15 . 2008-07-27 17:15 d——– C:\Program Files\Trend Micro
2008-07-27 03:09 . 2008-07-27 03:09 d——– C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-07-27 03:03 . 2008-07-27 03:06 d——– C:\Documents and Settings\Administrator
2008-07-25 04:06 . 2008-07-29 21:36 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2008-07-25 04:06 . 2008-07-25 04:06 1,409 –a—— C:\WINDOWS\QTFont.for
2008-07-25 01:10 . 2008-07-27 03:09 d——– C:\Program Files\SUPERAntiSpyware
2008-07-25 01:10 . 2008-07-25 01:10 d——– C:\Documents and Settings\Peter\Application Data\SUPERAntiSpyware.com
2008-07-18 11:28 . 2008-07-18 12:50 d——– C:\Documents and Settings\All Users\Application Data\RCGOnyx2
2008-07-18 11:27 . 2008-07-18 11:28 d——– C:\Program Files\Turbo Trader 2
2008-06-20 13:41 . 2008-06-20 13:41 245,248 —–c— C:\WINDOWS\system32\dllcache\mswsock.dll
2008-06-20 06:44 . 2008-06-20 06:44 138,368 —–c— C:\WINDOWS\system32\dllcache\afd.sys
2008-06-11 02:58 . 2008-04-14 07:01 272,128 —–c— C:\WINDOWS\system32\dllcache\bthport.sys
2008-06-05 22:20 . 2008-06-05 22:20 d——– C:\Program Files\Craftsman
2008-06-04 11:18 . 2008-06-04 11:18 d——– C:\Documents and Settings\Peter\Application Data\.wyzo

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-29 03:37 ——— d—–w C:\Documents and Settings\All Users\Application Data\Google Updater
2008-07-27 19:50 ——— d—–w C:\Program Files\DownloadManager
2008-07-26 18:22 ——— d—–w C:\Documents and Settings\Peter\Application Data\AVG7
2008-07-25 12:00 ——— d—–w C:\Documents and Settings\LocalService\Application Data\AVG7
2008-07-25 05:07 ——— d—–w C:\Program Files\Common Files\Wise Installation Wizard
2008-07-25 02:24 ——— d—–w C:\Program Files\WinMX
2008-06-20 17:41 245,248 —-a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 10:45 360,320 —-a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:44 138,368 —-a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 09:52 225,920 —-a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-05-07 05:18 1,287,680 —-a-w C:\WINDOWS\system32\quartz.dll
2008-04-19 03:18 45,056 —-a-w C:\WINDOWS\system32\HSSICore.dll
2006-03-15 03:50 26,922 —-a-w C:\Program Files\MoviePass Terms.html
2005-03-01 15:17 417,792 –sha-r C:\WINDOWS\system32\w?nword.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 12:24 1694208]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:56 15360]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-04-23 13:17 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [2008-04-15 08:54 579584]
"AVG7_EMC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe" [2007-12-21 09:54 406528]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24 286720]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 11:09 63712]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-09-26 14:42 267064]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe" [2007-10-23 08:55 219136]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2004-08-04 03:56 53760 C:\WINDOWS\system32\narrator.exe]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{FA010552-4A27-4cb1-A1BB-3E2D697F1639}"= "c:\Program Files\interMute\SpySubtract\sshook.dll" [2005-03-04 01:08 77824]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 10:13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
–a—— 2004-10-13 12:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"NVSvc"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\WINDOWS\\system32\\javaw.exe"=
"C:\\ENSIGN\\Ensign.exe"=
"C:\\Program Files\\1stWORKS\\hotCommCL\\BIN\\hotComm.exe"=
"C:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"C:\\StubInstaller.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\Conference\\Conference.dll"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=

R4 Ctp1xx;Ctp1xx;C:\WINDOWS\system32\DRIVERS\Ctp1xx.syS []
R4 hpt3xx;hpt3xx;C:\WINDOWS\system32\DRIVERS\hpt3xx.syS []
R4 Kern32;Manageer Network Connections;C:\WINDOWS\System32\telcmd.exe []
R4 TY164;Working Network Connections;C:\WINDOWS\System32\hicom.exe []

.
Contents of the 'Scheduled Tasks' folder

2008-07-25 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 14:57]
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-29 21:54:00
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-07-29 21:57:31
ComboFix-quarantined-files.txt 2008-07-30 01:57:23
ComboFix2.txt 2008-07-29 04:22:57
ComboFix3.txt 2008-07-28 02:15:02
ComboFix4.txt 2008-07-27 20:13:56

Pre-Run: 19,013,951,488 bytes free
Post-Run: 19,010,490,368 bytes free

109 — E O F — 2008-07-29 08:18:17

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:01, on 2008-07-29
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16441)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.surfline.com/home/index.cfm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {21F49842-BFA9-11D2-A89C-00104B62BDDA} (ChartFX Internet Control) - http://www.schaeffersresearch.com/download/CfxIEAx.cab
O16 - DPF: {24BACF02-5676-11D3-B8DE-00105A17A9E6} (ChartFX Internet Financial Client 4.0) - http://www.schaeffersresearch.com/Download/Cfx4Financial.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: STOPzilla Local Service - Unknown owner - C:\Program Files\STOPzilla!\szntsvc.exe (file missing)
O24 - Desktop Component 0: (no name) - (no file)
O24 - Desktop Component 1: (no name) - http://www.watermansguild.com/menumachine/core/spacer.gif

–
Post #29
Download Pocket Killbox
http://www.atribune.org/downloads/KillBox.exe
If you already have Killbox first ensure it is this version !.

Then double-click on the killbox.exe program.


Start Killbox and click on Tools->Delete Temp Files.
Then select the option labeled Delete on reboot.

Do not close killbox, and open notepad, by clicking on Start, then Run, and typing notepad.exe and pressing the OK button.


When notepad is open, copy and paste the following bolded text into the notepad screen. You do this by highlighting each of the below bolded filenames and then pressing Control-C on your keyboard. Then click on the open notepad windows and press Control-V to paste the contents into the notepad.

C:\WINDOWS\system32\w?nword.exe


Return to Killbox, go to the File menu and select Paste from Clipboard.


Still in Killbox, click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt. Click No at the Pending Operations prompt.

If your computer does not restart automatically, please restart it manually

"copy/paste" a new log file into this thread.
Also please describe how your computer behaves at the moment.
Post #30
Here's the latest Log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:18, on 2008-07-30
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16441)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.surfline.com/home/index.cfm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {21F49842-BFA9-11D2-A89C-00104B62BDDA} (ChartFX Internet Control) - http://www.schaeffersresearch.com/download/CfxIEAx.cab
O16 - DPF: {24BACF02-5676-11D3-B8DE-00105A17A9E6} (ChartFX Internet Financial Client 4.0) - http://www.schaeffersresearch.com/Download/Cfx4Financial.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: STOPzilla Local Service - Unknown owner - C:\Program Files\STOPzilla!\szntsvc.exe (file missing)
O24 - Desktop Component 0: (no name) - (no file)
O24 - Desktop Component 1: (no name) - http://www.watermansguild.com/menumachine/core/spacer.gif

–
End of file - 5491 bytes

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI