Spyware / Malware / Virus Removal

[Resolved] w32.agent.pz

13 min read

Looking for the outcome? Ask AI

bltwmayoonwheat Topic Starter

Post #1August 27, 2008, 2:20 AM UTC

My wife visited the website www.healthtreasures.com and it ran a script which infected my computer. I ran stinger.exe and rootkit from mcafee, NAV couldn't fix it, so I downloaded spybot 1.6 and adaware. It wouldn't let me install adaware, so I ran spybot. It detected and claimed to fix. After a reboot, it found 2 more instances of the vunerability. I have run sdfix and hijack this. Logs are attached. Please review and let me know if I am now clear. Thanks in advance for the assistance.

bltwmayoonwheat

Post #2August 27, 2008, 2:24 AM UTC

Just to add more detail. I turned system restore off, rebooted in safe mode, ran S&D as stated above, ran sdfix, rebooted in normal mode, completed sdfix.
- - - - - - - - - - - - - -

SDFix: Version 1.219
Run by [removed] on Tue 08/26/2008 at 09:01 PM

Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix

Checking Services :

Restoring Default Security Values
Restoring Default Hosts File

Rebooting

Checking Files :

No Trojan Files Found

Folder C:\Program Files\Microsoft Common - Removed

Removing Temp Files

ADS Check :

- - - - - - - - - - - - - -

Logfile of HijackThis v1.99.1
Scan saved at 9:21:35 PM, on 8/26/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)

Running processes:
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Network ICE\BlackICE\blackd.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\CyberPower PowerPanel Personal Edition\ppped.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\TiVo Shared\Beacon\TiVoBeacon.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\system32\notepad.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\WINDOWS\system32\ezSP_Px.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\DIGStream\digstream.exe
C:\Program Files\ESPNRunTime\DIGServices.exe
C:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe
C:\Documents and Settings\Happy Puppy\Local Settings\Temp\{231F68F4-70E4-41A6-BEDA-7E7934169B54}\MXOALDR.EXE
C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\Twain_32\Samsung\CLX3170\Scan2Pc.exe
C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\PerSono\perstray.exe
C:\Program Files\Network ICE\BlackICE\blackice.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\PROGRA~1\Dantz\RETROS~1\retrospect.exe
C:\PROGRA~1\Dantz\RETROS~1\retrorun.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.christiantoday.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\oembios.exe,
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: BHOmodObj Class - {7F6828CA-9E42-462C-BC60-418C8144012C} - c:\windows\system\BHOmod.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\system32\ezSP_Px.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [MediaFace Integration] C:\Program Files\Fellowes\MediaFACE 4.0\SetHook.exe
O4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exe
O4 - HKLM\..\Run: [DIGServices] C:\Program Files\ESPNRunTime\DIGServices.exe /brand=ESPN /priority=0 /poll=24
O4 - HKLM\..\Run: [MaxtorOneTouch] C:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe
O4 - HKLM\..\Run: [MXOBG] C:\Documents and Settings\Happy Puppy\Local Settings\Temp\{231F68F4-70E4-41A6-BEDA-7E7934169B54}\MXOALDR.EXE
O4 - HKLM\..\Run: [RetroExpress] C:\PROGRA~1\Dantz\RETROS~1\RetroExpress.exe /h
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [3170 Scan2PC] "C:\WINDOWS\Twain_32\Samsung\CLX3170\Scan2Pc.exe"
O4 - HKLM\..\Run: [Samsung PanelMgr] C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe /autorun
O4 - HKLM\..\Run: [inrhcjmvj0er3g] C:\WINDOWS\Temp\.ttDA.tmp.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Perstray.lnk = ?
O4 - Global Startup: RealSecure® Desktop Protector.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photos.walmart.com/WalmartActivia.cab
O16 - DPF: {6632A7E9-FE1F-43D2-A04A-A15951ED63E0} - http://mediaplayer.walmart.com/installer/install.cab
O16 - DPF: {6F0C8A84-8B0D-11D2-801B-00105AA78F4A} (CobAgent4 Class) - http://ecare4b.netopia.com/smedia/ecare4/c…t_4.2.1.314.cab
O16 - DPF: {74C861A1-D548-4916-BC8A-FDE92EDFF62C} - http://mediaplayer.walmart.com/installer/install.cab
O16 - DPF: {7873B468-E762-4143-83E6-7258CB6B5D9D} (ECareAgent Class) - http://ecare4b.netopia.com/smedia/ecare4/c…/ECareAgent.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://72.240.51.213/activex/AxisCamControl.cab
O16 - DPF: {D1548A26-B8F6-4E86-AE74-E7062CCC2E2A} (igLoader Content on Demand) - http://www.miniclip.com/igloader/igloader.CAB
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: BlackICE - Internet Security Systems, Inc. - C:\Program Files\Network ICE\BlackICE\blackd.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: PowerPanel Personal Edition Service (ppped) - Unknown owner - C:\Program Files\CyberPower PowerPanel Personal Edition\ppped.exe
O23 - Service: RapApp - Internet Security Systems, Inc. - C:\Program Files\Network ICE\BlackICE\RapApp.exe
O23 - Service: Retrospect Express HD Launcher (RetroExpLauncher) - Dantz Development Corporation - C:\PROGRA~1\Dantz\RETROS~1\retrorun.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: TiVo Beacon (TivoBeacon2) - Unknown owner - C:\Program Files\Common Files\TiVo Shared\Beacon\TiVoBeacon.exe" /service (file missing)
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

Rorschach112

Post #3August 27, 2008, 4:50 PM UTC

Hello

Please visit this web page for instructions for downloading and running ComboFix

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

This includes installing the Windows XP Recovery Console in case you have not installed it yet.

For more information on the Windows XP Recovery Console read http://support.microsoft.com/kb/314058.

Once you install the Recovery Console, when you reboot your computer, you'll see the option for the Recovery Console now as well. Don't select Recovery Console as we don't need it. By default, your main OS is selected there. The screen stays for 2 seconds and then it proceeds to load Windows. That is normal.

Post the log from ComboFix when you've accomplished that, along with a new HijackThis log.

bltwmayoonwheat

Post #4August 28, 2008, 10:43 AM UTC

Sorry, it took a while to slipstream a Windows XP SP3 disk so I could install the Windows Recovery Console. I noticed after the Combofix completed that I couldn't get NAV to enable file system realtime scanning again. Even after a reboot, it just sits in the systray looking hosed. I was able to finally get Black Ice to reenable Application Protection. Here is the latest Hijack this log followed by the ComboFix log:

- - - - - - - - - - - - - - -

Logfile of HijackThis v1.99.1
Scan saved at 5:39:42 AM, on 8/28/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)

Running processes:
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\CyberPower PowerPanel Personal Edition\ppped.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\TiVo Shared\Beacon\TiVoBeacon.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Network ICE\BlackICE\blackd.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\WINDOWS\system32\ezSP_Px.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\DIGStream\digstream.exe
C:\Program Files\ESPNRunTime\DIGServices.exe
C:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe
C:\PROGRA~1\Dantz\RETROS~1\RetroExpress.exe
C:\Program Files\Logitech\QuickCam\Quickcam.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\Twain_32\Samsung\CLX3170\Scan2Pc.exe
C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe
C:\WINDOWS\system32\lexpps.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\CyberPower PowerPanel Personal Edition\pppeuser.exe
C:\Program Files\Common Files\TiVo Shared\Transfer\TiVoTransfer.exe
C:\Program Files\TiVo\Desktop\TiVoNotify.exe
C:\Program Files\TiVo\Desktop\TiVoServer.exe
C:\Program Files\PerSono\perstray.exe
C:\PROGRA~1\Dantz\RETROS~1\retrospect.exe
C:\PROGRA~1\Dantz\RETROS~1\retrorun.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files\Network ICE\BlackICE\blackice.exe
C:\Program Files\Network ICE\BlackICE\rapapp.exe
C:\Program Files\Network ICE\BlackICE\RapApp.exe
C:\Program Files\Network ICE\BlackICE\ProUtil.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.christiantoday.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\oembios.exe,
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\system32\ezSP_Px.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [MediaFace Integration] C:\Program Files\Fellowes\MediaFACE 4.0\SetHook.exe
O4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exe
O4 - HKLM\..\Run: [DIGServices] C:\Program Files\ESPNRunTime\DIGServices.exe /brand=ESPN /priority=0 /poll=24
O4 - HKLM\..\Run: [MaxtorOneTouch] C:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe
O4 - HKLM\..\Run: [RetroExpress] C:\PROGRA~1\Dantz\RETROS~1\RetroExpress.exe /h
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [3170 Scan2PC] "C:\WINDOWS\Twain_32\Samsung\CLX3170\Scan2Pc.exe"
O4 - HKLM\..\Run: [Samsung PanelMgr] C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe /autorun
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [PowerPanel Personal Edition User Interaction] "C:\Program Files\CyberPower PowerPanel Personal Edition\pppeuser.exe"
O4 - HKCU\..\Run: [TivoTransfer] "C:\Program Files\Common Files\TiVo Shared\Transfer\TiVoTransfer.exe" /service /registry /auto:TivoTransfer
O4 - HKCU\..\Run: [TivoNotify] "C:\Program Files\TiVo\Desktop\TiVoNotify.exe" /service /registry /auto:TivoNotify
O4 - HKCU\..\Run: [TivoServer] "C:\Program Files\TiVo\Desktop\TiVoServer.exe" /service /registry /auto:TivoServer
O4 - HKCU\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Perstray.lnk = ?
O4 - Global Startup: RealSecure® Desktop Protector.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: SmarThru4 Capture Selection - C:\Program Files\SmarThru 4\WebCapture.dll2.htm
O8 - Extra context menu item: SmarThru4 Save as HTML - C:\Program Files\SmarThru 4\WebCapture.dll1.htm
O8 - Extra context menu item: SmarThru4 Save Selected Text - C:\Program Files\SmarThru 4\WebCapture.dll.htm
O8 - Extra context menu item: SmarThru4 Web Capture - C:\Program Files\SmarThru 4\WebCapture.dll
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: SmarThru4 Web Capture - {5941A0E4-56C1-4a49-9B18-05762CAC5F9B} - C:\Program Files\SmarThru 4\WebCapture.dll (HKCU)
O9 - Extra 'Tools' menuitem: SmarThru4 Web Capture - {5941A0E4-56C1-4a49-9B18-05762CAC5F9B} - C:\Program Files\SmarThru 4\WebCapture.dll (HKCU)
O9 - Extra button: SmarThru4 Capture Selection - {A07BFEF7-DD11-4937-B23B-E70C11D2EDF4} - C:\Program Files\SmarThru 4\WebCapture.dll (HKCU)
O9 - Extra 'Tools' menuitem: SmarThru4 Capture Selection - {A07BFEF7-DD11-4937-B23B-E70C11D2EDF4} - C:\Program Files\SmarThru 4\WebCapture.dll (HKCU)
O9 - Extra button: SmarThru4 Save as HTML - {E753A93F-2367-4978-BFA0-83048C1E61CB} - C:\Program Files\SmarThru 4\WebCapture.dll (HKCU)
O9 - Extra 'Tools' menuitem: SmarThru4 Save as HTML - {E753A93F-2367-4978-BFA0-83048C1E61CB} - C:\Program Files\SmarThru 4\WebCapture.dll (HKCU)
O9 - Extra button: SmarThru4 Save Selected Text - {F1F53366-3E11-47ab-BF84-580C94F9C9AD} - C:\Program Files\SmarThru 4\WebCapture.dll (HKCU)
O9 - Extra 'Tools' menuitem: SmarThru4 Save Selected Text - {F1F53366-3E11-47ab-BF84-580C94F9C9AD} - C:\Program Files\SmarThru 4\WebCapture.dll (HKCU)
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: *.ebay.com
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photos.walmart.com/WalmartActivia.cab
O16 - DPF: {6632A7E9-FE1F-43D2-A04A-A15951ED63E0} - http://mediaplayer.walmart.com/installer/install.cab
O16 - DPF: {6F0C8A84-8B0D-11D2-801B-00105AA78F4A} (CobAgent4 Class) - http://ecare4b.netopia.com/smedia/ecare4/c…t_4.2.1.314.cab
O16 - DPF: {74C861A1-D548-4916-BC8A-FDE92EDFF62C} - http://mediaplayer.walmart.com/installer/install.cab
O16 - DPF: {7873B468-E762-4143-83E6-7258CB6B5D9D} (ECareAgent Class) - http://ecare4b.netopia.com/smedia/ecare4/c…/ECareAgent.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://72.240.51.213/activex/AxisCamControl.cab
O16 - DPF: {D1548A26-B8F6-4E86-AE74-E7062CCC2E2A} (igLoader Content on Demand) - http://www.miniclip.com/igloader/igloader.CAB
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: BlackICE - Internet Security Systems, Inc. - C:\Program Files\Network ICE\BlackICE\blackd.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: PowerPanel Personal Edition Service (ppped) - Unknown owner - C:\Program Files\CyberPower PowerPanel Personal Edition\ppped.exe
O23 - Service: RapApp - Internet Security Systems, Inc. - C:\Program Files\Network ICE\BlackICE\RapApp.exe
O23 - Service: Retrospect Express HD Launcher (RetroExpLauncher) - Dantz Development Corporation - C:\PROGRA~1\Dantz\RETROS~1\retrorun.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: TiVo Beacon (TivoBeacon2) - Unknown owner - C:\Program Files\Common Files\TiVo Shared\Beacon\TiVoBeacon.exe" /service (file missing)
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

- - - - - - - - - - - - - - -

ComboFix 08-08-27.03 - Happy Puppy 2008-08-27 22:27:16.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.511 [GMT -5:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Happy Puppy\Application Data\macromedia\Flash Player\#SharedObjects\R2QGJYKK\bin.clearspring.com
C:\Documents and Settings\Happy Puppy\Application Data\macromedia\Flash Player\#SharedObjects\R2QGJYKK\interclick.com
C:\Documents and Settings\Happy Puppy\Application Data\macromedia\Flash Player\#SharedObjects\R2QGJYKK\interclick.com\ud.sol
C:\Documents and Settings\Happy Puppy\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#bin.clearspring.com
C:\Documents and Settings\Happy Puppy\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com
C:\Documents and Settings\Happy Puppy\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com\settings.sol
C:\Documents and Settings\Happy Puppy\Cookies\[removed][1].txt
C:\Documents and Settings\Happy Puppy\Local Settings\Temporary Internet Files\head_firmware.inf
C:\Documents and Settings\Happy Puppy\Local Settings\Temporary Internet Files\T10.GIF
C:\Documents and Settings\Happy Puppy\Local Settings\Temporary Internet Files\T10_0x4102_0x1113_ENG.ZIP
C:\Documents and Settings\Happy Puppy\Local Settings\Temporary Internet Files\T10_MTP2.HEX
C:\Documents and Settings\Happy Puppy\Local Settings\Temporary Internet Files\temp.dmf
C:\Documents and Settings\Melissa\Application Data\macromedia\Flash Player\#SharedObjects\ZV26RNK6\bin.clearspring.com
C:\Documents and Settings\Melissa\Application Data\macromedia\Flash Player\#SharedObjects\ZV26RNK6\interclick.com
C:\Documents and Settings\Melissa\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#bin.clearspring.com
C:\Documents and Settings\Melissa\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com
C:\WINDOWS\Downloaded Program Files\setup.inf

.
((((((((((((((((((((((((( Files Created from 2008-07-28 to 2008-08-28 )))))))))))))))))))))))))))))))
.

2008-08-27 21:40 . 2008-08-27 21:40 d——– C:\Documents and Settings\Administrator\Application Data\Ahead
2008-08-27 21:39 . 2008-08-27 21:39 d——– C:\Documents and Settings\Administrator\Application Data\ImgBurn
2008-08-27 21:36 . 2008-08-27 21:36 d——– C:\Program Files\ImgBurn
2008-08-27 21:02 . 2008-08-27 21:38 d——– C:\sp3
2008-08-27 20:58 . 2008-08-27 21:33 d——– C:\xp
2008-08-27 20:10 . 2008-08-27 20:10 d——– C:\Documents and Settings\Cocosmd\Application Data\ATI
2008-08-27 20:08 . 2008-08-27 20:08 d–hs—- C:\Documents and Settings\Melissa\Application Data\sysproc64
2008-08-27 19:04 . 2008-08-27 19:04 d——– C:\Documents and Settings\Cocosmd
2008-08-27 18:34 . 2008-08-27 18:34 d——– C:\Documents and Settings\Administrator
2008-08-26 21:30 . 2008-08-26 21:32 d——– C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-08-26 20:47 . 2008-08-26 20:47 d——– C:\WINDOWS\ERUNT
2008-08-26 20:46 . 2008-08-26 21:15 d——– C:\SDFix
2008-08-26 20:02 . 2008-08-26 20:02 d——– C:\Program Files\TeaTimer (Spybot - Search & Destroy)
2008-08-26 19:08 . 2008-08-26 19:08 d——– C:\Program Files\Spybot - Search & Destroy
2008-08-26 19:08 . 2008-08-26 20:22 d——– C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-08-26 18:40 . 2008-08-26 18:40 d–hs—- C:\Documents and Settings\NetworkService\Application Data\sysproc64
2008-08-25 21:00 . 2008-08-25 21:00 d–hs—- C:\Documents and Settings\LocalService\Application Data\sysproc64
2008-08-19 22:29 . 2008-08-19 22:29 d——– C:\WINDOWS\system32\scripting
2008-08-19 22:29 . 2008-08-19 22:29 d——– C:\WINDOWS\system32\en
2008-08-19 22:29 . 2008-08-19 22:29 d——– C:\WINDOWS\l2schemas
2008-08-19 16:16 . 2008-08-19 16:16 d——– C:\Program Files\%MFG%
2008-08-19 14:11 . 2008-08-19 14:11 d——– C:\Documents and Settings\Happy Puppy\Application Data\SmarThru4
2008-08-19 14:11 . 2007-10-22 01:55 41,984 ——— C:\WINDOWS\system32\drivers\DgivEcpXP.sys
2008-08-19 14:10 . 2008-08-19 14:10 d——– C:\Program Files\Common Files\SRC Shared
2008-08-19 14:09 . 2008-08-19 14:11 d——– C:\Program Files\SmarThru 4
2008-08-19 14:09 . 2008-08-19 14:10 d——– C:\Program Files\Readiris10
2008-08-19 14:09 . 2008-02-23 21:28 479,232 –a—— C:\WINDOWS\ssndii.exe
2008-08-19 14:08 . 2008-08-19 14:08 d——– C:\WINDOWS\Samsung
2008-08-19 14:08 . 2007-08-13 00:59 44,544 –a—— C:\WINDOWS\system32\msxml4a.dll
2008-08-19 14:08 . 2007-08-13 00:59 21,776 –a—— C:\WINDOWS\system32\msxml2a.dll
2008-08-19 14:07 . 2007-12-19 23:40 172,032 –a—— C:\WINDOWS\system32\SecSNMP.dll
2008-08-19 14:07 . 2007-08-13 19:59 151,552 –a—— C:\WINDOWS\system32\sst1cci.exe
2008-08-19 14:07 . 2007-08-13 19:59 65,536 –a—— C:\WINDOWS\system32\sst1cci.dll
2008-08-19 14:07 . 2007-08-13 20:01 22,723 –a—— C:\WINDOWS\system32\sst1cl3.dll
2008-08-19 14:07 . 2007-08-13 20:01 361 –a—— C:\WINDOWS\system32\sst1cl3.smt
2008-08-19 14:06 . 2007-10-29 21:05 512,000 -ra—— C:\WINDOWS\system32\ssmgr.cpl
2008-08-19 14:06 . 2007-10-22 21:53 110,592 -ra—— C:\WINDOWS\WiaInst.exe
2008-08-19 14:06 . 2007-08-12 21:49 11,502 ——— C:\WINDOWS\Dr. Printer Icon.ico
2008-08-19 14:05 . 2008-08-19 14:05 d——– C:\WINDOWS\system32\drivers\Samsung
2008-08-19 14:05 . 2007-12-20 03:38 265,216 -ra—— C:\WINDOWS\system32\Sswiadrv.dll
2008-08-19 14:05 . 2007-12-20 03:38 139,776 -ra—— C:\WINDOWS\system32\WIAEH.dll
2008-08-19 14:05 . 2007-12-20 03:38 138,240 -ra—— C:\WINDOWS\system32\Ssuiext.dll
2008-08-19 14:05 . 2007-12-20 03:38 116,736 -ra—— C:\WINDOWS\system32\WIAIPH.dll
2008-08-19 14:05 . 2007-12-20 03:38 87,040 -ra—— C:\WINDOWS\system32\WIASTIIO.dll
2008-08-19 14:05 . 2008-01-10 07:29 81,920 –a—— C:\WINDOWS\system32\ssdevm.dll
2008-08-19 14:05 . 2007-08-13 03:22 49,152 –a—— C:\WINDOWS\system32\Ssusbpn.dll
2008-08-19 14:05 . 2007-08-12 21:51 41,984 ——— C:\WINDOWS\system32\drivers\DGIVECP.SYS
2008-08-19 14:05 . 2007-08-10 02:17 7,409 -ra—— C:\WINDOWS\system32\WIAUISTR.loc
2008-08-19 14:02 . 2008-08-19 14:02 d——– C:\Program Files\Samsung
2008-08-18 17:10 . 2008-04-13 19:12 712,704 ——— C:\WINDOWS\system32\windowscodecs.dll
2008-08-18 17:10 . 2008-04-13 19:12 346,112 ——— C:\WINDOWS\system32\windowscodecsext.dll
2008-08-18 17:10 . 2008-04-13 19:12 276,992 ——— C:\WINDOWS\system32\wmphoto.dll
2008-08-18 17:10 . 2008-04-13 19:12 69,120 ——— C:\WINDOWS\system32\wlanapi.dll
2008-08-18 17:08 . 2008-04-13 19:11 650,752 ——— C:\WINDOWS\system32\dot3ui.dll
2008-08-13 06:17 . 2008-05-01 09:33 331,776 —–c— C:\WINDOWS\system32\dllcache\msadce.dll
2008-08-13 06:16 . 2008-04-11 14:04 691,712 —–c— C:\WINDOWS\system32\dllcache\inetcomm.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-28 03:34 ——— d—–w C:\Documents and Settings\All Users\Application Data\RetroExp
2008-08-28 03:24 ——— d—–w C:\Documents and Settings\All Users\Application Data\DIGStream
2008-08-28 03:23 ——— d—–w C:\Program Files\CyberPower PowerPanel Personal Edition
2008-08-27 02:30 ——— d—–w C:\Program Files\Lavasoft
2008-08-27 00:06 ——— d—–w C:\Program Files\Common Files\Wise Installation Wizard
2008-08-24 19:38 ——— d—a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-08-19 19:09 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-08-09 18:05 ——— d—–w C:\Program Files\Java
2008-08-02 01:10 ——— d—–w C:\Documents and Settings\Happy Puppy\Application Data\ZoomBrowser EX
2008-08-02 01:10 ——— d—–w C:\Documents and Settings\Happy Puppy\Application Data\CameraWindowDC
2008-07-27 19:37 ——— d—–w C:\Program Files\Build In Time
2008-07-20 20:41 ——— d—–w C:\Program Files\Burger Rush
2008-07-20 17:52 ——— d—–w C:\Documents and Settings\Happy Puppy\Application Data\FarmerJane
2008-07-20 17:11 ——— d—–w C:\Program Files\Farmer Jane
2008-07-19 14:22 ——— d—–w C:\Documents and Settings\All Users\Application Data\FreshGames
2008-07-19 14:16 ——— d—–w C:\Program Files\Ranch Rush
2008-07-19 03:10 94,920 —-a-w C:\WINDOWS\system32\cdm.dll
2008-07-19 03:10 53,448 —-a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-19 03:10 45,768 —-a-w C:\WINDOWS\system32\wups2.dll
2008-07-19 03:10 36,552 —-a-w C:\WINDOWS\system32\wups.dll
2008-07-19 03:09 563,912 —-a-w C:\WINDOWS\system32\wuapi.dll
2008-07-19 03:09 325,832 —-a-w C:\WINDOWS\system32\wucltui.dll
2008-07-19 03:09 205,000 —-a-w C:\WINDOWS\system32\wuweb.dll
2008-07-19 03:09 1,811,656 —-a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-07 20:26 253,952 —-a-w C:\WINDOWS\system32\es.dll
2008-06-29 21:11 0 —-a-w C:\WINDOWS\system32\drivers\lvuvc.hs
2008-06-29 21:11 0 —-a-w C:\WINDOWS\system32\drivers\logiflt.iad
2008-06-29 19:18 ——— d—–w C:\Documents and Settings\Happy Puppy\Application Data\GetRightToGo
2008-06-28 17:10 ——— d—–w C:\Program Files\Funcom
2008-06-24 16:43 74,240 —-a-w C:\WINDOWS\system32\mscms.dll
2008-06-23 16:57 826,368 —-a-w C:\WINDOWS\system32\wininet.dll
2008-06-20 17:46 245,248 —-a-w C:\WINDOWS\system32\mswsock.dll
2008-04-14 00:11 783,872 —-a-r C:\Documents and Settings\Happy Puppy\Application Data\oembios.exe
2008-04-14 00:11 1,036,288 —-a-r C:\Documents and Settings\Melissa\Application Data\oembios.exe
2008-03-14 18:25 0 —-a-w C:\Program Files\temp01
2005-04-20 00:25 53,323 —-a-w C:\Program Files\opera\program\plugins\PlugDef.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 19:12 15360]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-16 19:49 68856]
"PowerPanel Personal Edition User Interaction"="C:\Program Files\CyberPower PowerPanel Personal Edition\pppeuser.exe" [2005-10-24 11:26 262144]
"TivoTransfer"="C:\Program Files\Common Files\TiVo Shared\Transfer\TiVoTransfer.exe" [2007-05-02 14:12 1193472]
"TivoNotify"="C:\Program Files\TiVo\Desktop\TiVoNotify.exe" [2007-05-02 14:13 373760]
"TivoServer"="C:\Program Files\TiVo\Desktop\TiVoServer.exe" [2007-05-02 14:14 1463296]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-03-28 23:37 413696]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"vptray"="C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe" [2002-07-30 11:35 77824]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"ezShieldProtector for Px"="C:\WINDOWS\system32\ezSP_Px.exe" [2002-08-20 11:29 40960]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"MediaFace Integration"="C:\Program Files\Fellowes\MediaFACE 4.0\SetHook.exe" [2003-08-18 17:46 53248]
"DIGStream"="C:\Program Files\DIGStream\digstream.exe" [2005-10-31 12:05 278528]
"DIGServices"="C:\Program Files\ESPNRunTime\DIGServices.exe" [2005-10-31 12:18 101888]
"MaxtorOneTouch"="C:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe" [2004-12-22 09:21 823296]
"RetroExpress"="C:\PROGRA~1\Dantz\RETROS~1\RetroExpress.exe" [2004-07-30 16:47 6946816]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-04-01 16:16 5562368]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2005-04-01 16:16 86016]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-05-10 11:12 90112]
"LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam\Quickcam.exe" [2007-10-25 17:37 2178832]
"LogitechCommunicationsManager"="C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-10-25 17:33 563984]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-03-28 23:37 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
"3170 Scan2PC"="C:\WINDOWS\Twain_32\Samsung\CLX3170\Scan2Pc.exe" [2008-01-09 20:23 491520]
"Samsung PanelMgr"="C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe" [2008-05-09 01:59 524288]

C:\Documents and Settings\Ethan\Start Menu\Programs\Startup\
PowerReg Scheduler V3.exe [2007-03-15 17:02:47 225280]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26 29696]
Perstray.lnk - C:\Program Files\PerSono\perstray.exe [2004-09-21 09:57:14 40960]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,C:\\WINDOWS\\system32\\oembios.exe,"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Sierra On-Line\\SIGSPat.exe"=
"C:\\Program Files\\BitTorrent\\btdownloadgui.exe"=
"C:\\Program Files\\Valve\\Steam\\Steam.exe"=
"C:\\Program Files\\Valve\\Steam\\SteamApps\\[removed]\\counter-strike\\hl.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Valve\\Steam\\SteamApps\\[removed]\\condition zero\\hl.exe"=
"C:\\Program Files\\Valve\\Steam\\SteamApps\\[removed]\\day of defeat\\hl.exe"=
"C:\\Program Files\\Valve\\Steam\\SteamApps\\[removed]\\counter-strike source\\hl2.exe"=
"C:\\Program Files\\QuickTime\\QuickTimePlayer.exe"=
"C:\\WINDOWS\\system32\\LEXPPS.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\WINDOWS\\twain_32\\Samsung\\CLX3170\\Sscan2io.exe"=
"C:\\WINDOWS\\twain_32\\Samsung\\CLX3170\\Scan2Pc.exe"=

*Newly Created Service* - PROCEXP90
.
Contents of the 'Scheduled Tasks' folder
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-Steam - (no file)
HKLM-Run-MXOBG - C:\Documents and Settings\Happy Puppy\Local Settings\Temp\{231F68F4-70E4-41A6-BEDA-7E7934169B54}\MXOALDR.EXE

.
——- Supplementary Scan ——-
.
R0 -: HKCU-Main,Start Page = hxxp://www.christiantoday.com/
R0 -: HKCU-Main,SearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
R1 -: HKCU-SearchURL,(Default) = hxxp://www.google.com/search?q=%s
O8 -: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 -: SmarThru4 Capture Selection - C:\Program Files\SmarThru 4\WebCapture.dll2.htm
O8 -: SmarThru4 Save as HTML - C:\Program Files\SmarThru 4\WebCapture.dll1.htm
O8 -: SmarThru4 Save Selected Text - C:\Program Files\SmarThru 4\WebCapture.dll.htm
O8 -: SmarThru4 Web Capture - C:\Program Files\SmarThru 4\WebCapture.dll
O15 -: Trusted Zone: *.ebay.com

O16 -: DirectAnimation Java Classes - file://C:\WINDOWS\Java\classes\dajava.cab
C:\WINDOWS\Downloaded Program Files\DirectAnimation Java Classes.osd

O16 -: Microsoft XML Parser for Java - file://C:\WINDOWS\Java\classes\xmldso.cab
C:\WINDOWS\Downloaded Program Files\Microsoft XML Parser for Java.osd

O16 -: {6632A7E9-FE1F-43D2-A04A-A15951ED63E0} - hxxp://mediaplayer.walmart.com/installer/install.cab
C:\WINDOWS\Downloaded Program Files\Setup.inf

O16 -: {6F0C8A84-8B0D-11D2-801B-00105AA78F4A} - hxxp://ecare4b.netopia.com/smedia/ecare4/components/CobAgent_4.2.1.314.cab
C:\WINDOWS\Downloaded Program Files\CobAgent4_2_1_314.inf
C:\WINDOWS\Downloaded Program Files\CobAgent4_2_1_314.dll

O16 -: {7873B468-E762-4143-83E6-7258CB6B5D9D} - hxxp://ecare4b.netopia.com/smedia/ecare4/components/ECareAgent.cab
C:\WINDOWS\Downloaded Program Files\ECareAgent.dll

O16 -: {D1548A26-B8F6-4E86-AE74-E7062CCC2E2A} - hxxp://www.miniclip.com/igloader/igloader.CAB
C:\WINDOWS\Downloaded Program Files\igloader.inf
C:\WINDOWS\Downloaded Program Files\igloader.dll
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-27 22:46:02
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

C:\WINDOWS\system32\oembios.exe 574464 bytes executable
C:\WINDOWS\system32\sysproc64

scan completed successfully
hidden files: 2

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\System32\NavLogon.dll
.
Completion time: 2008-08-27 23:52:05
ComboFix-quarantined-files.txt 2008-08-28 04:48:27

Pre-Run: 68,335,890,432 bytes free
Post-Run: 68,545,798,144 bytes free

238 — E O F — 2008-08-20 10:41:44

Rorschach112

Post #5August 28, 2008, 1:36 PM UTC

Hello

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the quotebox below into it:

File::

Rootkit::
C:\WINDOWS\system32\oembios.exe
C:\WINDOWS\system32\sysproc64

Folder::
C:\Documents and Settings\NetworkService\Application Data\sysproc64
C:\Documents and Settings\LocalService\Application Data\sysproc64
C:\Documents and Settings\Melissa\Application Data\sysproc64
C:\WINDOWS\system32\sysproc64

KillAll::
Registry::

Driver::

bltwmayoonwheat

Post #6August 29, 2008, 2:05 AM UTC

New log after following instructions:

ComboFix 08-08-28.04 - Happy Puppy 2008-08-28 20:52:24.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.688 [GMT -5:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Happy Puppy\Desktop\CFScript.txt
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\oembios.exe
C:\WINDOWS\system32\sysproc64
C:\WINDOWS\system32\sysproc64\sysproc32.sys
C:\WINDOWS\system32\sysproc64\sysproc86.sys
.
—- Previous Run ——-
.
C:\Documents and Settings\Happy Puppy\Application Data\macromedia\Flash Player\#SharedObjects\R2QGJYKK\interclick.com
C:\Documents and Settings\Happy Puppy\Application Data\macromedia\Flash Player\#SharedObjects\R2QGJYKK\interclick.com\ud.sol
C:\Documents and Settings\Happy Puppy\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com
C:\Documents and Settings\Happy Puppy\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com\settings.sol
C:\Documents and Settings\LocalService\Application Data\sysproc64
C:\Documents and Settings\LocalService\Application Data\sysproc64\sysproc32.sys
C:\Documents and Settings\Melissa\Application Data\sysproc64
C:\Documents and Settings\Melissa\Application Data\sysproc64\sysproc32.sys
C:\Documents and Settings\NetworkService\Application Data\sysproc64
C:\Documents and Settings\NetworkService\Application Data\sysproc64\sysproc32.sys

.
((((((((((((((((((((((((( Files Created from 2008-07-28 to 2008-08-29 )))))))))))))))))))))))))))))))
.

2008-08-28 06:54 . 2008-08-28 20:04 d——– C:\Documents and Settings\All Users\Application Data\SiteAdvisor
2008-08-28 06:52 . 2008-08-28 20:19 d——– C:\Documents and Settings\All Users\Application Data\McAfee
2008-08-27 21:40 . 2008-08-27 21:40 d——– C:\Documents and Settings\Administrator\Application Data\Ahead
2008-08-27 21:39 . 2008-08-27 21:39 d——– C:\Documents and Settings\Administrator\Application Data\ImgBurn
2008-08-27 21:36 . 2008-08-27 21:36 d——– C:\Program Files\ImgBurn
2008-08-27 21:02 . 2008-08-27 21:38 d——– C:\sp3
2008-08-27 20:58 . 2008-08-27 21:33 d——– C:\xp
2008-08-27 20:10 . 2008-08-27 20:10 d——– C:\Documents and Settings\Cocosmd\Application Data\ATI
2008-08-27 19:04 . 2008-08-27 19:04 d——– C:\Documents and Settings\Cocosmd
2008-08-27 18:34 . 2008-08-27 18:34 d——– C:\Documents and Settings\Administrator
2008-08-26 21:30 . 2008-08-26 21:32 d——– C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-08-26 20:47 . 2008-08-26 20:47 d——– C:\WINDOWS\ERUNT
2008-08-26 20:46 . 2008-08-26 21:15 d——– C:\SDFix
2008-08-26 20:02 . 2008-08-26 20:02 d——– C:\Program Files\TeaTimer (Spybot - Search & Destroy)
2008-08-26 19:08 . 2008-08-26 19:08 d——– C:\Program Files\Spybot - Search & Destroy
2008-08-26 19:08 . 2008-08-26 20:22 d——– C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-08-20 05:51 . 2008-08-20 05:51 d——– C:\WINDOWS\system32\config\systemprofile\Application Data\ATI
2008-08-19 22:29 . 2008-08-19 22:29 d——– C:\WINDOWS\system32\scripting
2008-08-19 22:29 . 2008-08-19 22:29 d——– C:\WINDOWS\system32\en
2008-08-19 22:29 . 2008-08-19 22:29 d——– C:\WINDOWS\l2schemas
2008-08-19 16:16 . 2008-08-19 16:16 d——– C:\Program Files\%MFG%
2008-08-19 14:11 . 2008-08-19 14:11 d——– C:\Documents and Settings\Happy Puppy\Application Data\SmarThru4
2008-08-19 14:11 . 2007-10-22 01:55 41,984 ——— C:\WINDOWS\system32\drivers\DgivEcpXP.sys
2008-08-19 14:10 . 2008-08-19 14:10 d——– C:\Program Files\Common Files\SRC Shared
2008-08-19 14:09 . 2008-08-19 14:11 d——– C:\Program Files\SmarThru 4
2008-08-19 14:09 . 2008-08-19 14:10 d——– C:\Program Files\Readiris10
2008-08-19 14:09 . 2008-02-23 21:28 479,232 –a—— C:\WINDOWS\ssndii.exe
2008-08-19 14:08 . 2008-08-19 14:08 d——– C:\WINDOWS\Samsung
2008-08-19 14:08 . 2007-08-13 00:59 44,544 –a—— C:\WINDOWS\system32\msxml4a.dll
2008-08-19 14:08 . 2007-08-13 00:59 21,776 –a—— C:\WINDOWS\system32\msxml2a.dll
2008-08-19 14:07 . 2007-12-19 23:40 172,032 –a—— C:\WINDOWS\system32\SecSNMP.dll
2008-08-19 14:07 . 2007-08-13 19:59 151,552 –a—— C:\WINDOWS\system32\sst1cci.exe
2008-08-19 14:07 . 2007-08-13 19:59 65,536 –a—— C:\WINDOWS\system32\sst1cci.dll
2008-08-19 14:07 . 2007-08-13 20:01 22,723 –a—— C:\WINDOWS\system32\sst1cl3.dll
2008-08-19 14:07 . 2007-08-13 20:01 361 –a—— C:\WINDOWS\system32\sst1cl3.smt
2008-08-19 14:06 . 2007-10-29 21:05 512,000 -ra—— C:\WINDOWS\system32\ssmgr.cpl
2008-08-19 14:06 . 2007-10-22 21:53 110,592 -ra—— C:\WINDOWS\WiaInst.exe
2008-08-19 14:06 . 2007-08-12 21:49 11,502 ——— C:\WINDOWS\Dr. Printer Icon.ico
2008-08-19 14:05 . 2008-08-19 14:05 d——– C:\WINDOWS\system32\drivers\Samsung
2008-08-19 14:05 . 2007-12-20 03:38 265,216 -ra—— C:\WINDOWS\system32\Sswiadrv.dll
2008-08-19 14:05 . 2007-12-20 03:38 139,776 -ra—— C:\WINDOWS\system32\WIAEH.dll
2008-08-19 14:05 . 2007-12-20 03:38 138,240 -ra—— C:\WINDOWS\system32\Ssuiext.dll
2008-08-19 14:05 . 2007-12-20 03:38 116,736 -ra—— C:\WINDOWS\system32\WIAIPH.dll
2008-08-19 14:05 . 2007-12-20 03:38 87,040 -ra—— C:\WINDOWS\system32\WIASTIIO.dll
2008-08-19 14:05 . 2008-01-10 07:29 81,920 –a—— C:\WINDOWS\system32\ssdevm.dll
2008-08-19 14:05 . 2007-08-13 03:22 49,152 –a—— C:\WINDOWS\system32\Ssusbpn.dll
2008-08-19 14:05 . 2007-08-12 21:51 41,984 ——— C:\WINDOWS\system32\drivers\DGIVECP.SYS
2008-08-19 14:05 . 2007-08-10 02:17 7,409 -ra—— C:\WINDOWS\system32\WIAUISTR.loc
2008-08-19 14:02 . 2008-08-19 14:02 d——– C:\Program Files\Samsung
2008-08-18 17:10 . 2008-04-13 19:12 712,704 ——— C:\WINDOWS\system32\windowscodecs.dll
2008-08-18 17:10 . 2008-04-13 19:12 346,112 ——— C:\WINDOWS\system32\windowscodecsext.dll
2008-08-18 17:10 . 2008-04-13 19:12 276,992 ——— C:\WINDOWS\system32\wmphoto.dll
2008-08-18 17:10 . 2008-04-13 19:12 69,120 ——— C:\WINDOWS\system32\wlanapi.dll
2008-08-18 17:08 . 2008-04-13 19:11 650,752 ——— C:\WINDOWS\system32\dot3ui.dll
2008-08-13 06:17 . 2008-05-01 09:33 331,776 —–c— C:\WINDOWS\system32\dllcache\msadce.dll
2008-08-13 06:16 . 2008-04-11 14:04 691,712 —–c— C:\WINDOWS\system32\dllcache\inetcomm.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-29 01:59 ——— d—–w C:\Documents and Settings\All Users\Application Data\DIGStream
2008-08-29 01:57 ——— d—–w C:\Program Files\CyberPower PowerPanel Personal Edition
2008-08-29 01:49 ——— d—–w C:\Documents and Settings\All Users\Application Data\RetroExp
2008-08-27 02:30 ——— d—–w C:\Program Files\Lavasoft
2008-08-27 00:06 ——— d—–w C:\Program Files\Common Files\Wise Installation Wizard
2008-08-24 19:38 ——— d—a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-08-19 19:09 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-08-09 18:05 ——— d—–w C:\Program Files\Java
2008-08-02 01:10 ——— d—–w C:\Documents and Settings\Happy Puppy\Application Data\ZoomBrowser EX
2008-08-02 01:10 ——— d—–w C:\Documents and Settings\Happy Puppy\Application Data\CameraWindowDC
2008-07-27 19:37 ——— d—–w C:\Program Files\Build In Time
2008-07-20 20:41 ——— d—–w C:\Program Files\Burger Rush
2008-07-20 17:52 ——— d—–w C:\Documents and Settings\Happy Puppy\Application Data\FarmerJane
2008-07-20 17:11 ——— d—–w C:\Program Files\Farmer Jane
2008-07-19 14:22 ——— d—–w C:\Documents and Settings\All Users\Application Data\FreshGames
2008-07-19 14:16 ——— d—–w C:\Program Files\Ranch Rush
2008-07-19 03:10 94,920 —-a-w C:\WINDOWS\system32\cdm.dll
2008-07-19 03:10 53,448 —-a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-19 03:10 45,768 —-a-w C:\WINDOWS\system32\wups2.dll
2008-07-19 03:10 36,552 —-a-w C:\WINDOWS\system32\wups.dll
2008-07-19 03:09 563,912 —-a-w C:\WINDOWS\system32\wuapi.dll
2008-07-19 03:09 325,832 —-a-w C:\WINDOWS\system32\wucltui.dll
2008-07-19 03:09 205,000 —-a-w C:\WINDOWS\system32\wuweb.dll
2008-07-19 03:09 1,811,656 —-a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-07 20:26 253,952 —-a-w C:\WINDOWS\system32\es.dll
2008-06-29 21:11 0 —-a-w C:\WINDOWS\system32\drivers\lvuvc.hs
2008-06-29 21:11 0 —-a-w C:\WINDOWS\system32\drivers\logiflt.iad
2008-06-29 19:18 ——— d—–w C:\Documents and Settings\Happy Puppy\Application Data\GetRightToGo
2008-06-28 17:10 ——— d—–w C:\Program Files\Funcom
2008-06-24 16:43 74,240 —-a-w C:\WINDOWS\system32\mscms.dll
2008-06-23 16:57 826,368 —-a-w C:\WINDOWS\system32\wininet.dll
2008-06-20 17:46 245,248 —-a-w C:\WINDOWS\system32\mswsock.dll
2008-04-14 00:11 783,872 —-a-r C:\Documents and Settings\Happy Puppy\Application Data\oembios.exe
2008-04-14 00:11 1,036,288 —-a-r C:\Documents and Settings\Melissa\Application Data\oembios.exe
2008-03-14 18:25 0 —-a-w C:\Program Files\temp01
2005-04-20 00:25 53,323 —-a-w C:\Program Files\opera\program\plugins\PlugDef.dll
.

((((((((((((((((((((((((((((( snapshot@2008-08-27_23.10.24.53 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-08-28 03:23:26 16,384 —-a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2008-08-29 00:37:04 16,384 —-a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
- 2008-08-28 03:23:26 32,768 —-a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2008-08-29 00:37:04 32,768 —-a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2008-04-14 00:12:36 14,336 -c–a-w C:\WINDOWS\system32\dllcache\svchost.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 19:12 15360]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-16 19:49 68856]
"PowerPanel Personal Edition User Interaction"="C:\Program Files\CyberPower PowerPanel Personal Edition\pppeuser.exe" [2005-10-24 11:26 262144]
"TivoTransfer"="C:\Program Files\Common Files\TiVo Shared\Transfer\TiVoTransfer.exe" [2007-05-02 14:12 1193472]
"TivoNotify"="C:\Program Files\TiVo\Desktop\TiVoNotify.exe" [2007-05-02 14:13 373760]
"TivoServer"="C:\Program Files\TiVo\Desktop\TiVoServer.exe" [2007-05-02 14:14 1463296]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-03-28 23:37 413696]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"ezShieldProtector for Px"="C:\WINDOWS\system32\ezSP_Px.exe" [2002-08-20 11:29 40960]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"MediaFace Integration"="C:\Program Files\Fellowes\MediaFACE 4.0\SetHook.exe" [2003-08-18 17:46 53248]
"DIGStream"="C:\Program Files\DIGStream\digstream.exe" [2005-10-31 12:05 278528]
"DIGServices"="C:\Program Files\ESPNRunTime\DIGServices.exe" [2005-10-31 12:18 101888]
"MaxtorOneTouch"="C:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe" [2004-12-22 09:21 823296]
"RetroExpress"="C:\PROGRA~1\Dantz\RETROS~1\RetroExpress.exe" [2004-07-30 16:47 6946816]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-04-01 16:16 5562368]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2005-04-01 16:16 86016]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-05-10 11:12 90112]
"LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam\Quickcam.exe" [2007-10-25 17:37 2178832]
"LogitechCommunicationsManager"="C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-10-25 17:33 563984]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-03-28 23:37 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
"3170 Scan2PC"="C:\WINDOWS\Twain_32\Samsung\CLX3170\Scan2Pc.exe" [2008-01-09 20:23 491520]
"Samsung PanelMgr"="C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe" [2008-05-09 01:59 524288]

C:\Documents and Settings\Ethan\Start Menu\Programs\Startup\
PowerReg Scheduler V3.exe [2007-03-15 17:02:47 225280]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26 29696]
Perstray.lnk - C:\Program Files\PerSono\perstray.exe [2004-09-21 09:57:14 40960]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Sierra On-Line\\SIGSPat.exe"=
"C:\\Program Files\\BitTorrent\\btdownloadgui.exe"=
"C:\\Program Files\\Valve\\Steam\\Steam.exe"=
"C:\\Program Files\\Valve\\Steam\\SteamApps\\[removed]\\counter-strike\\hl.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Valve\\Steam\\SteamApps\\[removed]\\condition zero\\hl.exe"=
"C:\\Program Files\\Valve\\Steam\\SteamApps\\[removed]\\day of defeat\\hl.exe"=
"C:\\Program Files\\Valve\\Steam\\SteamApps\\[removed]\\counter-strike source\\hl2.exe"=
"C:\\Program Files\\QuickTime\\QuickTimePlayer.exe"=
"C:\\WINDOWS\\system32\\LEXPPS.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\WINDOWS\\twain_32\\Samsung\\CLX3170\\Sscan2io.exe"=
"C:\\WINDOWS\\twain_32\\Samsung\\CLX3170\\Scan2Pc.exe"=

R2 TivoBeacon2;TiVo Beacon;C:\Program Files\Common Files\TiVo Shared\Beacon\TiVoBeacon.exe [2007-05-02 14:12]
R2 uacFlt;Plantronics USB Audio Adapter EQ Filter Driver;C:\WINDOWS\system32\DRIVERS\uacflt.sys [2002-05-03 17:03]
R3 RapFile;RapFile;C:\WINDOWS\System32\drivers\RapFile.sys [2003-06-19 19:40]
R3 RapNet;RapNet;C:\WINDOWS\System32\drivers\RapNet.sys [2003-06-19 19:40]
R4 black;black;C:\WINDOWS\system32\drivers\BlackDrv.sys [2005-03-29 17:04]
S2 SSPORT;SSPORT;C:\WINDOWS\system32\Drivers\SSPORT.sys []
S3 14875;14875;C:\WINDOWS\system32\14875.sys []
S3 3d670;3d670;C:\WINDOWS\system32\3d670.sys []
S3 58974;58974;C:\WINDOWS\system32\58974.sys []
S3 6317A;6317A;C:\WINDOWS\system32\6317A.sys []
S3 63e6F;63e6F;C:\WINDOWS\system32\63e6F.sys []
S3 7f173;7f173;C:\WINDOWS\system32\7f173.sys []
S3 7fe6B;7fe6B;C:\WINDOWS\system32\7fe6B.sys []
S3 87268;87268;C:\WINDOWS\system32\87268.sys []
S3 89979;89979;C:\WINDOWS\system32\89979.sys []
S3 9126D;9126D;C:\WINDOWS\system32\9126D.sys []
S3 cda78;cda78;C:\WINDOWS\system32\cda78.sys []
S3 d2d71;d2d71;C:\WINDOWS\system32\d2d71.sys []
S3 de26C;de26C;C:\WINDOWS\system32\de26C.sys []
S3 e0567;e0567;C:\WINDOWS\system32\e0567.sys []
S3 f4277;f4277;C:\WINDOWS\system32\f4277.sys []
S3 f6169;f6169;C:\WINDOWS\system32\f6169.sys []
S3 iatmunin;iatmunin;C:\DOCUME~1\HAPPYP~1\LOCALS~1\Temp\iatmunin.sys []
.
Contents of the 'Scheduled Tasks' folder

2008-08-22 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:57]
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-28 20:57:26
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\System32\NavLogon.dll
.
———————— Other Running Processes ————————
.
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Network ICE\BlackICE\blackd.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\CyberPower PowerPanel Personal Edition\ppped.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\LogiShrd\LQCVFX\COCIManager.exe
C:\PROGRA~1\Dantz\RETROS~1\Retrospect.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\PROGRA~1\Dantz\RETROS~1\retrorun.exe
C:\WINDOWS\system32\verclsid.exe
.
**************************************************************************
.
Completion time: 2008-08-28 21:02:58 - machine was rebooted [Happy Puppy]
ComboFix-quarantined-files.txt 2008-08-29 02:02:53
ComboFix2.txt 2008-08-28 04:53:23

Pre-Run: 69,578,534,912 bytes free
Post-Run: 69,569,806,336 bytes free

268 — E O F — 2008-08-20 10:41:44

Rorschach112

Post #7August 29, 2008, 4:53 PM UTC

File::

Folder::

Registry::

Driver::
14875
3d670
58974
6317A
63e6F
7f173
7fe6B
87268
89979
9126D
cda78
d2d71
de26C
e0567
f4277
f6169
iatmunin

KillAll::

Save this as CFScript.txt, in the same location as ComboFix.exe

[external image: Posted Image]

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

Please do an online scan with Kaspersky WebScanner

Make sure you are using Internet Explorer for this. Click on Kaspersky Online Scanner and click Accept

You will be prompted to install an ActiveX component from Kaspersky, Click Yes.

The program will launch and then begin downloading the latest definition files:
Once the files have been downloaded click on NEXT
Now click on Scan Settings
In the scan settings make that the following are selected:
- Scan using the following Anti-Virus database:
Extended (if available otherwise Standard)
- Scan Options:
Scan Archives
Scan Mail Bases
Click OK
Now under select a target to scan:Select My Computer
This will program will start and scan your system.
The scan will take a while so be patient and let it run.
Once the scan is complete it will display if your system has been infected.
- Now click on the Save as Text button:
Save the file to your desktop.
Copy and paste that information in your next post.

bltwmayoonwheat

Post #8August 30, 2008, 12:50 AM UTC

ComboFix Log:

ComboFix 08-08-29.02 - Happy Puppy 2008-08-29 19:38:34.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.678 [GMT -5:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Happy Puppy\Desktop\CFScript.txt
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Happy Puppy\Cookies\happy_puppy@specificclick[2].txt
C:\Documents and Settings\Melissa\Application Data\sysproc64
C:\Documents and Settings\Melissa\Application Data\sysproc64\sysproc32.sys
C:\Documents and Settings\Melissa\Application Data\sysproc64\sysproc86.sys

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_14875
——-\Legacy_3D670
——-\Legacy_58974
——-\Legacy_63E6F
——-\Legacy_7F173
——-\Legacy_7FE6B
——-\Legacy_87268
——-\Legacy_89979
——-\Legacy_9126D
——-\Legacy_CDA78
——-\Legacy_D2D71
——-\Legacy_DE26C
——-\Legacy_E0567
——-\Legacy_F4277
——-\Legacy_F6169
——-\Legacy_IATMUNIN
——-\Service_14875
——-\Service_3d670
——-\Service_58974
——-\Service_6317A
——-\Service_63e6F
——-\Service_7f173
——-\Service_7fe6B
——-\Service_87268
——-\Service_89979
——-\Service_9126D
——-\Service_cda78
——-\Service_d2d71
——-\Service_de26C
——-\Service_e0567
——-\Service_f4277
——-\Service_f6169
——-\Service_iatmunin

((((((((((((((((((((((((( Files Created from 2008-07-28 to 2008-08-30 )))))))))))))))))))))))))))))))
.

2008-08-29 19:46 . C:\WINDOWS\RY4AHNSZ5BHNTZ6C
2008-08-29 18:18 . 2008-08-29 18:18 d——– C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-08-29 13:44 . 2008-07-18 22:07 270,880 –a—— C:\WINDOWS\system32\mucltui.dll
2008-08-29 13:44 . 2008-07-18 22:07 210,976 –a—— C:\WINDOWS\system32\muweb.dll
2008-08-29 13:44 . 2008-07-18 22:07 29,728 –a—— C:\WINDOWS\system32\mucltui.dll.mui
2008-08-29 09:06 . 2007-10-17 13:53 43,816 –a—— C:\WINDOWS\system32\drivers\fssfltr.sys
2008-08-29 09:05 . 2008-08-29 09:05 d——– C:\Program Files\Microsoft SQL Server Compact Edition
2008-08-29 09:04 . 2008-08-29 09:05 d——– C:\Program Files\Windows Live Toolbar
2008-08-29 09:04 . 2008-08-29 09:04 d——– C:\Program Files\Windows Live Favorites
2008-08-29 09:04 . 2008-08-29 09:04 d——– C:\Documents and Settings\Happy Puppy\Contacts
2008-08-29 09:00 . 2008-08-29 18:17 d——– C:\Program Files\Windows Live
2008-08-29 09:00 . 2008-08-29 09:01 d–hsc— C:\Program Files\Common Files\WindowsLiveInstaller
2008-08-29 08:59 . 2008-08-29 08:59 d——– C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-08-28 06:54 . 2008-08-29 19:28 d——– C:\Documents and Settings\All Users\Application Data\SiteAdvisor
2008-08-28 06:52 . 2008-08-29 19:31 d——– C:\Documents and Settings\All Users\Application Data\McAfee
2008-08-27 21:40 . 2008-08-27 21:40 d——– C:\Documents and Settings\Administrator\Application Data\Ahead
2008-08-27 21:39 . 2008-08-27 21:39 d——– C:\Documents and Settings\Administrator\Application Data\ImgBurn
2008-08-27 21:36 . 2008-08-27 21:36 d——– C:\Program Files\ImgBurn
2008-08-27 21:02 . 2008-08-27 21:38 d——– C:\sp3
2008-08-27 20:58 . 2008-08-27 21:33 d——– C:\xp
2008-08-27 20:10 . 2008-08-27 20:10 d——– C:\Documents and Settings\Cocosmd\Application Data\ATI
2008-08-27 19:04 . 2008-08-27 19:04 d——– C:\Documents and Settings\Cocosmd
2008-08-27 18:34 . 2008-08-27 18:34 d——– C:\Documents and Settings\Administrator
2008-08-26 21:30 . 2008-08-26 21:32 d——– C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-08-26 20:47 . 2008-08-26 20:47 d——– C:\WINDOWS\ERUNT
2008-08-26 20:46 . 2008-08-26 21:15 d——– C:\SDFix
2008-08-26 20:02 . 2008-08-26 20:02 d——– C:\Program Files\TeaTimer (Spybot - Search & Destroy)
2008-08-26 19:08 . 2008-08-26 19:08 d——– C:\Program Files\Spybot - Search & Destroy
2008-08-26 19:08 . 2008-08-26 20:22 d——– C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-08-19 22:29 . 2008-08-19 22:29 d——– C:\WINDOWS\system32\scripting
2008-08-19 22:29 . 2008-08-19 22:29 d——– C:\WINDOWS\system32\en
2008-08-19 22:29 . 2008-08-19 22:29 d——– C:\WINDOWS\l2schemas
2008-08-19 16:16 . 2008-08-19 16:16 d——– C:\Program Files\%MFG%
2008-08-19 14:11 . 2008-08-19 14:11 d——– C:\Documents and Settings\Happy Puppy\Application Data\SmarThru4
2008-08-19 14:11 . 2007-10-22 01:55 41,984 ——— C:\WINDOWS\system32\drivers\DgivEcpXP.sys
2008-08-19 14:10 . 2008-08-19 14:10 d——– C:\Program Files\Common Files\SRC Shared
2008-08-19 14:09 . 2008-08-19 14:11 d——– C:\Program Files\SmarThru 4
2008-08-19 14:09 . 2008-08-19 14:10 d——– C:\Program Files\Readiris10
2008-08-19 14:09 . 2008-02-23 21:28 479,232 –a—— C:\WINDOWS\ssndii.exe
2008-08-19 14:08 . 2008-08-19 14:08 d——– C:\WINDOWS\Samsung
2008-08-19 14:08 . 2007-08-13 00:59 44,544 –a—— C:\WINDOWS\system32\msxml4a.dll
2008-08-19 14:08 . 2007-08-13 00:59 21,776 –a—— C:\WINDOWS\system32\msxml2a.dll
2008-08-19 14:07 . 2007-12-19 23:40 172,032 –a—— C:\WINDOWS\system32\SecSNMP.dll
2008-08-19 14:07 . 2007-08-13 19:59 151,552 –a—— C:\WINDOWS\system32\sst1cci.exe
2008-08-19 14:07 . 2007-08-13 19:59 65,536 –a—— C:\WINDOWS\system32\sst1cci.dll
2008-08-19 14:07 . 2007-08-13 20:01 22,723 –a—— C:\WINDOWS\system32\sst1cl3.dll
2008-08-19 14:07 . 2007-08-13 20:01 361 –a—— C:\WINDOWS\system32\sst1cl3.smt
2008-08-19 14:06 . 2007-10-29 21:05 512,000 -ra—— C:\WINDOWS\system32\ssmgr.cpl
2008-08-19 14:06 . 2007-10-22 21:53 110,592 -ra—— C:\WINDOWS\WiaInst.exe
2008-08-19 14:06 . 2007-08-12 21:49 11,502 ——— C:\WINDOWS\Dr. Printer Icon.ico
2008-08-19 14:05 . 2008-08-19 14:05 d——– C:\WINDOWS\system32\drivers\Samsung
2008-08-19 14:05 . 2007-12-20 03:38 265,216 -ra—— C:\WINDOWS\system32\Sswiadrv.dll
2008-08-19 14:05 . 2007-12-20 03:38 139,776 -ra—— C:\WINDOWS\system32\WIAEH.dll
2008-08-19 14:05 . 2007-12-20 03:38 138,240 -ra—— C:\WINDOWS\system32\Ssuiext.dll
2008-08-19 14:05 . 2007-12-20 03:38 116,736 -ra—— C:\WINDOWS\system32\WIAIPH.dll
2008-08-19 14:05 . 2007-12-20 03:38 87,040 -ra—— C:\WINDOWS\system32\WIASTIIO.dll
2008-08-19 14:05 . 2008-01-10 07:29 81,920 –a—— C:\WINDOWS\system32\ssdevm.dll
2008-08-19 14:05 . 2007-08-13 03:22 49,152 –a—— C:\WINDOWS\system32\Ssusbpn.dll
2008-08-19 14:05 . 2007-08-12 21:51 41,984 ——— C:\WINDOWS\system32\drivers\DGIVECP.SYS
2008-08-19 14:05 . 2007-08-10 02:17 7,409 -ra—— C:\WINDOWS\system32\WIAUISTR.loc
2008-08-19 14:02 . 2008-08-19 14:02 d——– C:\Program Files\Samsung
2008-08-18 17:10 . 2008-04-13 19:12 712,704 ——— C:\WINDOWS\system32\windowscodecs.dll
2008-08-18 17:10 . 2008-04-13 19:12 346,112 ——— C:\WINDOWS\system32\windowscodecsext.dll
2008-08-18 17:10 . 2008-04-13 19:12 276,992 ——— C:\WINDOWS\system32\wmphoto.dll
2008-08-18 17:10 . 2008-04-13 19:12 69,120 ——— C:\WINDOWS\system32\wlanapi.dll
2008-08-18 17:08 . 2008-04-13 19:11 650,752 ——— C:\WINDOWS\system32\dot3ui.dll
2008-08-13 06:17 . 2008-05-01 09:33 331,776 —–c— C:\WINDOWS\system32\dllcache\msadce.dll
2008-08-13 06:16 . 2008-04-11 14:04 691,712 —–c— C:\WINDOWS\system32\dllcache\inetcomm.dll
2008-07-20 15:40 . 2008-07-20 15:41 d——– C:\Program Files\Burger Rush
2008-07-20 12:12 . 2008-07-20 12:52 d——– C:\Documents and Settings\Happy Puppy\Application Data\FarmerJane
2008-07-20 12:11 . 2008-07-20 12:11 d——– C:\Program Files\Farmer Jane
2008-07-19 09:22 . 2008-07-19 09:22 d——– C:\Documents and Settings\All Users\Application Data\FreshGames
2008-07-19 09:16 . 2008-07-19 09:16 d——– C:\Program Files\Ranch Rush
2008-07-13 15:53 . 2008-07-27 14:37 d——– C:\Program Files\Build In Time
2008-07-07 15:26 . 2008-07-07 15:26 253,952 —–c— C:\WINDOWS\system32\dllcache\es.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-30 00:44 ——— d—–w C:\Program Files\CyberPower PowerPanel Personal Edition
2008-08-30 00:36 ——— d—–w C:\Documents and Settings\All Users\Application Data\DIGStream
2008-08-30 00:32 ——— d—–w C:\Documents and Settings\All Users\Application Data\RetroExp
2008-08-29 23:14 ——— d—–w C:\Program Files\Microsoft Silverlight
2008-08-29 14:08 ——— d—–w C:\Program Files\MSN Messenger
2008-08-27 02:30 ——— d—–w C:\Program Files\Lavasoft
2008-08-27 00:06 ——— d—–w C:\Program Files\Common Files\Wise Installation Wizard
2008-08-24 19:38 ——— d—a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-08-19 19:09 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-08-09 18:05 ——— d—–w C:\Program Files\Java
2008-08-02 01:10 ——— d—–w C:\Documents and Settings\Happy Puppy\Application Data\ZoomBrowser EX
2008-08-02 01:10 ——— d—–w C:\Documents and Settings\Happy Puppy\Application Data\CameraWindowDC
2008-06-29 21:11 0 —-a-w C:\WINDOWS\system32\drivers\lvuvc.hs
2008-06-29 21:11 0 —-a-w C:\WINDOWS\system32\drivers\logiflt.iad
2008-06-29 19:18 ——— d—–w C:\Documents and Settings\Happy Puppy\Application Data\GetRightToGo
2008-06-28 17:10 ——— d—–w C:\Program Files\Funcom
2008-04-14 00:11 783,872 —-a-r C:\Documents and Settings\Happy Puppy\Application Data\oembios.exe
2008-04-14 00:11 1,036,288 —-a-r C:\Documents and Settings\Melissa\Application Data\oembios.exe
2008-03-14 18:25 0 —-a-w C:\Program Files\temp01
2005-04-20 00:25 53,323 —-a-w C:\Program Files\opera\program\plugins\PlugDef.dll
.

((((((((((((((((((((((((((((( snapshot@2008-08-27_23.10.24.53 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-08-29 14:05:12 236,392 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.Data.SqlServerCe\9.0.242.0__89845dcd8080cc91\System.Data.SqlServerCe.dll
+ 2005-10-21 01:02:28 163,328 —-a-w C:\WINDOWS\erdnt\subs\ERDNT.EXE
+ 2003-07-07 18:36:00 2,058,343 —-a-r C:\WINDOWS\Installer\$PatchCache$\Managed\9040110900063D11C8EF10054038389C\11.0.5614\OUTLFLTR.DAT
+ 2003-07-08 16:48:00 115,288 —-a-r C:\WINDOWS\Installer\$PatchCache$\Managed\9040110900063D11C8EF10054038389C\11.0.5614\OUTLFLTR.DLL
+ 2008-08-29 14:04:16 86,746 —-a-r C:\WINDOWS\Installer\{184E7118-0295-43C4-B72C-1D54AA75AAF7}\wlmail.exe
+ 2008-08-29 23:18:05 123,008 —-a-r C:\WINDOWS\Installer\{2D4F6BE3-6FEF-4FE9-9D01-1406B220D08C}\WLXPhotoGalleryIcon.exe
+ 2008-08-29 14:02:23 29,926 —-a-r C:\WINDOWS\Installer\{508CE775-4BA4-4748-82DF-FE28DA9F03B0}\MsblIco.Exe
- 2007-07-31 22:49:38 593,920 —-a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\accicons.exe
+ 2008-08-29 23:18:47 593,920 —-a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\accicons.exe
- 2007-07-31 22:49:38 12,288 —-a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
+ 2008-08-29 23:18:47 12,288 —-a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
- 2007-07-31 22:49:38 86,016 —-a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\inficon.exe
+ 2008-08-29 23:18:47 86,016 —-a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\inficon.exe
- 2007-07-31 22:49:37 135,168 —-a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\misc.exe
+ 2008-08-29 23:18:47 135,168 —-a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\misc.exe
- 2007-07-31 22:49:38 11,264 —-a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
+ 2008-08-29 23:18:47 11,264 —-a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
- 2007-07-31 22:49:38 27,136 —-a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
+ 2008-08-29 23:18:47 27,136 —-a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
- 2007-07-31 22:49:38 4,096 —-a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
+ 2008-08-29 23:18:47 4,096 —-a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
- 2007-07-31 22:49:38 794,624 —-a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\outicon.exe
+ 2008-08-29 23:18:47 794,624 —-a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\outicon.exe
- 2007-07-31 22:49:37 249,856 —-a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pptico.exe
+ 2008-08-29 23:18:47 249,856 —-a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pptico.exe
- 2007-07-31 22:49:37 61,440 —-a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pubs.exe
+ 2008-08-29 23:18:47 61,440 —-a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pubs.exe
- 2007-07-31 22:49:38 23,040 —-a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
+ 2008-08-29 23:18:48 23,040 —-a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
- 2007-07-31 22:49:37 286,720 —-a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
+ 2008-08-29 23:18:47 286,720 —-a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
- 2007-07-31 22:49:37 409,600 —-a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
+ 2008-08-29 23:18:47 409,600 —-a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
+ 2008-08-29 11:00:57 170,824 —-a-w C:\WINDOWS\PCHealth\HelpCtr\Config\Cache\Professional_32_1033.dat
+ 2008-08-29 11:00:57 170,824 —-a-w C:\WINDOWS\PCHealth\HelpCtr\Config\Cache\Professional_32_1033.dat.bak
- 2008-08-28 03:23:26 16,384 —-a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2008-08-29 20:39:07 32,768 —-a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
- 2008-08-28 03:23:26 32,768 —-a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2008-08-29 20:39:07 32,768 —-a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2008-08-28 03:23:26 32,768 —-a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2008-08-29 20:39:07 32,768 –sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2008-04-14 00:12:36 14,336 -c–a-w C:\WINDOWS\system32\dllcache\svchost.exe
+ 2007-10-17 18:53:16 43,816 -c–a-w C:\WINDOWS\system32\DRVSTORE\fssfltr_FB301EB9307D2FAB641A9804E59C568C22487732\fssfltr.sys
- 2008-08-20 10:36:50 64,372 —-a-w C:\WINDOWS\system32\perfc009.dat
+ 2008-08-29 14:13:25 64,682 —-a-w C:\WINDOWS\system32\perfc009.dat
- 2008-08-20 10:36:50 409,232 —-a-w C:\WINDOWS\system32\perfh009.dat
+ 2008-08-29 14:13:25 409,526 —-a-w C:\WINDOWS\system32\perfh009.dat
+ 2007-10-18 16:31:46 51,224 —-a-w C:\WINDOWS\system32\sirenacm.dll
+ 2006-06-05 19:14:28 479,232 —-a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb\msvcm80.dll
+ 2006-06-05 19:14:28 548,864 —-a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb\msvcp80.dll
+ 2006-06-05 19:14:28 626,688 —-a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb\msvcr80.dll
+ 2008-02-01 16:11:10 586,240 —-a-w C:\WINDOWS\WLXPGSS.SCR
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 19:12 15360]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-16 19:49 68856]
"PowerPanel Personal Edition User Interaction"="C:\Program Files\CyberPower PowerPanel Personal Edition\pppeuser.exe" [2005-10-24 11:26 262144]
"TivoTransfer"="C:\Program Files\Common Files\TiVo Shared\Transfer\TiVoTransfer.exe" [2007-05-02 14:12 1193472]
"TivoNotify"="C:\Program Files\TiVo\Desktop\TiVoNotify.exe" [2007-05-02 14:13 373760]
"TivoServer"="C:\Program Files\TiVo\Desktop\TiVoServer.exe" [2007-05-02 14:14 1463296]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-03-28 23:37 413696]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"ezShieldProtector for Px"="C:\WINDOWS\system32\ezSP_Px.exe" [2002-08-20 11:29 40960]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"MediaFace Integration"="C:\Program Files\Fellowes\MediaFACE 4.0\SetHook.exe" [2003-08-18 17:46 53248]
"DIGStream"="C:\Program Files\DIGStream\digstream.exe" [2005-10-31 12:05 278528]
"DIGServices"="C:\Program Files\ESPNRunTime\DIGServices.exe" [2005-10-31 12:18 101888]
"MaxtorOneTouch"="C:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe" [2004-12-22 09:21 823296]
"RetroExpress"="C:\PROGRA~1\Dantz\RETROS~1\RetroExpress.exe" [2004-07-30 16:47 6946816]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-04-01 16:16 5562368]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2005-04-01 16:16 86016]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-05-10 11:12 90112]
"LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam\Quickcam.exe" [2007-10-25 17:37 2178832]
"LogitechCommunicationsManager"="C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-10-25 17:33 563984]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-03-28 23:37 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
"3170 Scan2PC"="C:\WINDOWS\Twain_32\Samsung\CLX3170\Scan2Pc.exe" [2008-01-09 20:23 491520]
"Samsung PanelMgr"="C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe" [2008-05-09 01:59 524288]
"fssui"="C:\Program Files\Windows Live\Family Safety\fssui.exe" [2007-12-17 11:12 243240]

C:\Documents and Settings\Ethan\Start Menu\Programs\Startup\
PowerReg Scheduler V3.exe [2007-03-15 17:02:47 225280]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26 29696]
Perstray.lnk - C:\Program Files\PerSono\perstray.exe [2004-09-21 09:57:14 40960]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Sierra On-Line\\SIGSPat.exe"=
"C:\\Program Files\\BitTorrent\\btdownloadgui.exe"=
"C:\\Program Files\\Valve\\Steam\\Steam.exe"=
"C:\\Program Files\\Valve\\Steam\\SteamApps\\[removed]\\counter-strike\\hl.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Valve\\Steam\\SteamApps\\[removed]\\condition zero\\hl.exe"=
"C:\\Program Files\\Valve\\Steam\\SteamApps\\[removed]\\day of defeat\\hl.exe"=
"C:\\Program Files\\Valve\\Steam\\SteamApps\\[removed]\\counter-strike source\\hl2.exe"=
"C:\\Program Files\\QuickTime\\QuickTimePlayer.exe"=
"C:\\WINDOWS\\system32\\LEXPPS.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\WINDOWS\\twain_32\\Samsung\\CLX3170\\Sscan2io.exe"=
"C:\\WINDOWS\\twain_32\\Samsung\\CLX3170\\Scan2Pc.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

R2 fssfltr;FssFltr;C:\WINDOWS\system32\DRIVERS\fssfltr.sys [2007-10-17 13:53]
R2 fsssvc;Windows Live OneCare Family Safety;C:\Program Files\Windows Live\Family Safety\fsssvc.exe [2007-12-17 11:13]
R2 TivoBeacon2;TiVo Beacon;C:\Program Files\Common Files\TiVo Shared\Beacon\TiVoBeacon.exe [2007-05-02 14:12]
R2 uacFlt;Plantronics USB Audio Adapter EQ Filter Driver;C:\WINDOWS\system32\DRIVERS\uacflt.sys [2002-05-03 17:03]
R4 black;black;C:\WINDOWS\system32\drivers\BlackDrv.sys [2005-03-29 17:04]
S2 SSPORT;SSPORT;C:\WINDOWS\system32\Drivers\SSPORT.sys []
S3 RapFile;RapFile;C:\WINDOWS\System32\drivers\RapFile.sys [2003-06-19 19:40]
S3 RapNet;RapNet;C:\WINDOWS\System32\drivers\RapNet.sys [2003-06-19 19:40]
.
Contents of the 'Scheduled Tasks' folder

2008-08-29 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:57]

2008-08-30 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 11:20]
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-29 19:45:36
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\System32\NavLogon.dll
.
———————— Other Running Processes ————————
.
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Network ICE\BlackICE\blackd.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\CyberPower PowerPanel Personal Edition\ppped.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\LogiShrd\LQCVFX\COCIManager.exe
C:\PROGRA~1\Dantz\RETROS~1\Retrospect.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\PROGRA~1\Dantz\RETROS~1\retrorun.exe
.
**************************************************************************
.
Completion time: 2008-08-29 19:50:38 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-30 00:50:33
ComboFix2.txt 2008-08-29 02:02:59
ComboFix3.txt 2008-08-28 04:53:23

Pre-Run: 68,596,822,016 bytes free
Post-Run: 68,574,113,792 bytes free

329 — E O F — 2008-08-29 23:18:48

- - - - - - - - - - - - - - - - - - - - - - - -

I'm going to run the online virus scan next.

Rorschach112

Post #9August 30, 2008, 12:21 PM UTC

Ok

Do this as well

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\Program Files\temp01

DirLook::
C:\WINDOWS\RY4AHNSZ5BHNTZ6C

Folder::

Registry::

Driver::

bltwmayoonwheat

Post #10August 30, 2008, 12:23 PM UTC

——————————————————————————– KASPERSKY ONLINE SCANNER 7 REPORT Saturday, August 30, 2008 Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Saturday, August 30, 2008 00:59:03 Records in database: 1165344 ——————————————————————————– Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: A:\ C:\ D:\ E:\ Scan statistics: Files scanned: 138700 Threat name: 9 Infected objects: 26 Suspicious objects: 37 Duration of the scan: 03:21:21 File name / Threat name / Threats count C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0A580000.VBN Infected: Trojan-Downloader.JS.Agent.ciw 1 C:\Documents and Settings\Happy Puppy\Application Data\oembios.exe Infected: Trojan-Spy.Win32.Zbot.ekc 1 C:\Documents and Settings\Happy Puppy\Local Settings\Application Data\Microsoft\Outlook\Outlook.pst Suspicious: Trojan-Spy.HTML.Fraud.gen 4 C:\Documents and Settings\Happy Puppy\Local Settings\Application Data\Microsoft\Outlook\Outlook.pst Infected: Trojan-Downloader.Win32.Injecter.ga 1 C:\Documents and Settings\Melissa\Application Data\oembios.exe Infected: Trojan-Spy.Win32.Zbot.ekc 1 C:\Documents and Settings\Melissa\Desktop\Segundo\Old D Drive\data\Outlook\Sent Items.dbx Infected: Email-Worm.VBS.KakWorm 1 C:\Documents and Settings\Melissa\Desktop\Segundo\Old D Drive\Documents and Settings\dvd\Application Data\Identities\{5B015DC0-8C31-11D5-858C-C93EC603157C}\Microsoft\Outlook Express\Inbox.dbx Suspicious: Exploit.HTML.Iframe.FileDownload 4 C:\Documents and Settings\Melissa\Desktop\Segundo\Old D Drive\Documents and Settings\dvd\Application Data\Identities\{5B015DC0-8C31-11D5-858C-C93EC603157C}\Microsoft\Outlook Express\Inbox.dbx Infected: Email-Worm.Win32.Klez.h 4 C:\Documents and Settings\Melissa\Desktop\Segundo\Old D Drive\Documents and Settings\dvd\Application Data\Identities\{5B015DC0-8C31-11D5-858C-C93EC603157C}\Microsoft\Outlook Express\Sent Items.dbx Infected: Email-Worm.VBS.KakWorm 1 C:\Documents and Settings\Melissa\Desktop\Segundo\Old D Drive\Documents and Settings\dvd\Local Settings\Temporary Internet Files\Content.IE5\8H6RKLI3\wbk4.tmp Suspicious: Exploit.HTML.Iframe.FileDownload 1 C:\Documents and Settings\Melissa\Desktop\Segundo\Old D Drive\Documents and Settings\dvd\Local Settings\Temporary Internet Files\Content.IE5\8H6RKLI3\wbkD.tmp Suspicious: Exploit.HTML.Iframe.FileDownload 1 C:\Documents and Settings\Melissa\Desktop\Segundo\Old D Drive\Documents and Settings\dvd\Local Settings\Temporary Internet Files\Content.IE5\I9OJYXQ5\wbk9.tmp Suspicious: Exploit.HTML.Iframe.FileDownload 1 C:\Documents and Settings\Melissa\Desktop\Segundo\Old D Drive\Documents and Settings\dvd\Local Settings\Temporary Internet Files\Content.IE5\OLK5A7G1\wbk80.tmp Suspicious: Exploit.HTML.Iframe.FileDownload 1 C:\Documents and Settings\Melissa\Desktop\Segundo\Old D Drive\Documents and Settings\dvd\Local Settings\Temporary Internet Files\Content.IE5\OLK5A7G1\wbk86.tmp Suspicious: Exploit.HTML.Iframe.FileDownload 1 C:\Documents and Settings\Melissa\Desktop\Segundo\Old D Drive\Documents and Settings\dvd\Local Settings\Temporary Internet Files\Content.IE5\OLK5A7G1\wbkA2.tmp Suspicious: Exploit.HTML.Iframe.FileDownload 1 C:\Documents and Settings\Melissa\Desktop\Segundo\Old D Drive\Documents and Settings\dvd\Local Settings\Temporary Internet Files\Content.IE5\OLK5A7G1\wbkA6.tmp Suspicious: Exploit.HTML.Iframe.FileDownload 1 C:\Documents and Settings\Melissa\Desktop\Segundo\Old D Drive\Documents and Settings\dvd\Local Settings\Temporary Internet Files\Content.IE5\WPY7GHAF\wbk17.tmp Suspicious: Exploit.HTML.Iframe.FileDownload 1 C:\Documents and Settings\Melissa\Desktop\Segundo\Old D Drive\Documents and Settings\dvd\Local Settings\Temporary Internet Files\Content.IE5\WPY7GHAF\wbk19.tmp Suspicious: Exploit.HTML.Iframe.FileDownload 1 C:\Documents and Settings\Melissa\Desktop\Segundo\Outlook\archive.pst Infected: Email-Worm.VBS.KakWorm 2 C:\Documents and Settings\Melissa\Desktop\Segundo\Outlook\Outlook.pst Suspicious: Exploit.HTML.Iframe.FileDownload 4 C:\Documents and Settings\Melissa\Desktop\Segundo\Outlook Express\Inbox.dbx Suspicious: Exploit.HTML.Iframe.FileDownload 4 C:\Documents and Settings\Melissa\Desktop\Segundo\Outlook Express\Inbox.dbx Infected: Email-Worm.Win32.Klez.h 4 C:\Documents and Settings\Melissa\Desktop\Segundo\Outlook Express\Inbox.dbx Infected: Email-Worm.Win32.Mydoom.a 1 C:\Documents and Settings\Melissa\Desktop\Segundo\Outlook Express\Sent Items.dbx Infected: Email-Worm.VBS.KakWorm 2 C:\Documents and Settings\Melissa\Desktop\Segundo\zip drive\Identities\{5B015DC0-8C31-11D5-858C-C93EC603157C}\Microsoft\Outlook Express\Inbox.dbx Suspicious: Exploit.HTML.Iframe.FileDownload 4 C:\Documents and Settings\Melissa\Desktop\Segundo\zip drive\Identities\{5B015DC0-8C31-11D5-858C-C93EC603157C}\Microsoft\Outlook Express\Inbox.dbx Infected: Email-Worm.Win32.Klez.h 4 C:\Documents and Settings\Melissa\Desktop\Segundo\zip drive\Identities\{5B015DC0-8C31-11D5-858C-C93EC603157C}\Microsoft\Outlook Express\Sent Items.dbx Infected: Email-Worm.VBS.KakWorm 1 C:\Documents and Settings\Melissa\Local Settings\Application Data\Microsoft\Outlook\Outlook.pst Suspicious: Exploit.HTML.Iframe.FileDownload 8 C:\QooBox\Quarantine\catchme2008-08-28_194621.31.zip Infected: Trojan-Spy.Win32.Zbot.ekc 1 C:\WINDOWS\system\BHOmod.dll Infected: Trojan-Downloader.Win32.Agent.mk 1 The selected area was scanned.

Rorschach112

Post #11August 30, 2008, 12:33 PM UTC

Ok do my other step there in previous post

bltwmayoonwheat

Post #12August 30, 2008, 3:05 PM UTC

Hello, I've been running ComboFix for several hours now with the last script you provided. Just wanted to give you a heads up. It's currently running the Autoscan at Step 7, the little cursor below is still blinking intermittently so I guess I should just let it keep running. This is a long scan ;-)

Rorschach112

Post #13August 30, 2008, 3:27 PM UTC

It shouldn't take that long

Do this instead

Please download the OTMoveIt2 by OldTimer.

Save it to your desktop.
Please double-click OTMoveIt2.exe to run it.

Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

[kill explorer]
C:\Program Files\temp01
C:\WINDOWS\RY4AHNSZ5BHNTZ6C
C:\Documents and Settings\Happy Puppy\Application Data\oembios.exe
C:\Documents and Settings\Melissa\Application Data\oembios.exe
C:\WINDOWS\system\BHOmod.dll
purity 
EmptyTemp
[start explorer]

Return to OTMoveIt2, right click in the "Paste List of Files/Folders to Move" window (under the light Yellow bar) and choose Paste.
Click the red Moveit! button.
A log of files and folders moved will be created in the c:\_OTMoveIt\MovedFiles folder in the form of Date and Time (mmddyyyy_hhmmss.log). Please open this log in Notepad and post its contents in your next reply.
Close OTMoveIt2

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

bltwmayoonwheat

Post #14August 30, 2008, 4:41 PM UTC

Well, I followed the instructions and OtMoveIt freezes up while trying to move the BHO file. I end up having to end task on the Not-Responding process, log out of the profile (since Explorer was killed) and log back into the profile. I wanted to give you a screenshot of the folder in my c root so you could see what it did/didn't do (attached). It appears it moved the oembios files. However, it doesn't create a log file since it freezes up.

Attachments:

📎2008_08_30_11_38.png

Rorschach112

Post #15August 30, 2008, 6:29 PM UTC

Hmm nasty infection Run ComboFix again normally and post the log here with a new HJT log

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] w32.agent.pz

✨ Ask AI

Ask AI