Spyware / Malware / Virus Removal

[Resolved] I think my computer has a problem!

12 min read

Looking for the outcome? Ask AI

tonyli9323 Topic Starter

Post #1October 7, 2008, 3:20 AM UTC

Here is my Hi-Jack This Log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:19, on 2008-10-06
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Maxtor\Maxtor Backup\MaxBackServiceInt.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\Maxtor\OneTouch\Utils\SyncServices.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Linksys\WUSB300N\WLService.exe
C:\Program Files\Linksys\WUSB300N\WUSB300N.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\zHotkey.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\eMachines Bay Reader\shwiconem.exe
C:\WINDOWS\VM_STI.EXE
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\WINDOWS\Samsung\LaserSMMgr\ssmmgr.exe
C:\Program Files\Samsung\SmarThru\PORTCTRL.EXE
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe
C:\Program Files\Lexmark 2400 Series\ezprint.exe
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\WINDOWS\system32\lxcrcoms.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\ojibcnaf.exe
C:\Documents and Settings\All Users\Application Data\dmhypwva\fwtarohq.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O2 - BHO: (no name) - {15aebfcf-0e11-4770-8ad7-6bda64968432} - (no file)
O2 - BHO: (no name) - {17F75949-1435-4CBE-950C-15E05B512FB1} - (no file)
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: (no name) - {3BB76123-87E8-4D9D-A2E5-AB229AF59E54} - (no file)
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) - {3F1068B2-358B-4CBE-BE2F-AA187FF35EF2} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5FE2DBA6-ED5D-49E2-B6DE-35977B2BB66C} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {7FCD5BB7-CBAA-4700-8BAE-A3B7B3B66448} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {9C3E6932-287A-4F2C-AF57-389B5441AD16} - (no file)
O2 - BHO: (no name) - {AB4F5182-B759-4798-B5ED-C8A0431BA00D} - (no file)
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.509.6972\swg.dll
O2 - BHO: (no name) - {B9AACCBB-41A7-4308-B0BB-8B2D51CFBFBD} - (no file)
O2 - BHO: CPub Object - {CC1EFA62-AF16-4DB2-ABBB-BFA89740CB45} - C:\Program Files\Internet Explorer\PLUGINS\West_ACU.dll
O2 - BHO: (no name) - {F13B7681-D949-4A61-BA09-AC8C7A4B066A} - (no file)
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r
O4 - HKLM\..\Run: [CHotkey] zHotkey.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\eMachines Bay Reader\shwiconem.exe
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE USB PC Camera 301P
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [Samsung LBP SM] "C:\WINDOWS\Samsung\LaserSMMgr\ssmmgr.exe" /autorun
O4 - HKLM\..\Run: [GW Port Controller] C:\Program Files\Samsung\SmarThru\PORTCTRL.EXE
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [MaxtorOneTouch] C:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe
O4 - HKLM\..\Run: [mxomssmenu] "C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe"
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [lxcrmon.exe] "C:\Program Files\Lexmark 2400 Series\lxcrmon.exe"
O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 2400 Series\ezprint.exe"
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [LXCRCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCRtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\RunOnce: [SpybotDeletingA5669] command /c del "C:\WINDOWS\system32\smp\msrc.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingC2173] cmd /c del "C:\WINDOWS\system32\smp\msrc.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\eMule.exe -AutoStart
O4 - HKCU\..\Run: [TypingSatellite] "C:\Program Files\TypingMaster\KBOOST.EXE"
O4 - HKCU\..\Run: [foxy] "C:\Program Files\Foxy\Foxy.exe" -tray
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\RunOnce: [SpybotDeletingB8377] command /c del "C:\WINDOWS\system32\smp\msrc.exe"
O4 - HKCU\..\RunOnce: [SpybotDeletingD9358] cmd /c del "C:\WINDOWS\system32\smp\msrc.exe"
O4 - HKLM\..\Policies\Explorer\Run: [5n6st6s8sN] C:\Documents and Settings\All Users\Application Data\dmhypwva\fwtarohq.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = %SystemRoot%\Installer\{AC76BA86-1033-0000-BA7E-000000000002}\SC_Acrobat.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - (no file)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: WinAVI FLV Manager - {DE365254-2F9B-4908-9E3A-7AAA6EC90BCC} - C:\Program Files\WinAVI FLV Converter\FLVTune.dll
O9 - Extra 'Tools' menuitem: WinAVI FLV Manager - {DE365254-2F9B-4908-9E3A-7AAA6EC90BCC} - C:\Program Files\WinAVI FLV Converter\FLVTune.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - Cmdmapping - (no file) (HKCU)
O15 - ESC Trusted Zone: http://*.update.microsoft.com
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2B36F775-8CF5-4489-B454-2D1B80984CF2} (FXPluginCtl Object) - http://www.powerflasher.de/plugin/powerres.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by122fd.bay122.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/ZH-HK/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) - http://www.acclaim.com/cabs/acclaim_v4.cab
O16 - DPF: {81449547-EB5D-422E-8730-932DC5E412C8} (UVUPlayer Control) - http://www.howardstern.com/install/uvuplayer.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {C228AEDD-FC47-11D3-AF87-D128A9381404} (LSICapture Control) - http://www.link-systems.com/~sdk/SDK/paste/lsiw2k.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS…er.cab56986.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: cBSJaBSj - C:\WINDOWS\
O20 - Winlogon Notify: mlJDutsP - C:\WINDOWS\
O20 - Winlogon Notify: rqRiGxvU - C:\WINDOWS\
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Amazon Unbox Video Service (ADVService) - Unknown owner - C:\Program Files\Amazon\Amazon Unbox Video\ADVWindowsClientService.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: C-DillaCdaC11BA - Unknown owner - C:\WINDOWS\system32\drivers\CDAC11BA.EXE (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - AHEAD Software - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: iPod Service iPodShellHWDetection (iPodShellHWDetection) - Unknown owner - c:\tbsrqet.exe (file missing)
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Unknown owner - C:\Program Files\Norton AntiVirus\isPwdSvc.exe (file missing)
O23 - Service: LexBce Server (LexBceS) - Unknown owner - C:\WINDOWS\system32\LEXBCES.EXE (file missing)
O23 - Service: LiveUpdate - Unknown owner - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE (file missing)
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe (file missing)
O23 - Service: lxcr_device - - C:\WINDOWS\system32\lxcrcoms.exe
O23 - Service: MaxBackServiceInt - Unknown owner - C:\Program Files\Maxtor\Maxtor Backup\MaxBackServiceInt.exe
O23 - Service: MaxSyncService (NTService1) - - C:\Program Files\Maxtor\OneTouch\Utils\SyncServices.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: WUSB300NSvc - Unknown owner - C:\Program Files\Linksys\WUSB300N\WLService.exe

–
End of file - 15786 bytes

Thank You For your time!

Tomk

Post #2October 7, 2008, 4:13 AM UTC

Hi tonyli9323,

My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for the issues on this machine.
Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.

AVG
Please open the AVG Control Center program -> double-click on the "AVG Resident Shield" component (looks like this: [external image: Posted Image]) -> deselect the "Turn on AVG Resident Shield" checkmark and save the setting.
When you need to enable the AVG Resident Shield, ( I will let you know when) just open the AVG Control Center program -> double-click on the "AVG Resident Shield" component -> select the "Turn on AVG Resident Shield" checkmark and save the setting.

SPYBOT TEATIMER

Launch Spybot S&D, go to the Mode menu and make sure "Advanced Mode" is selected.
On the left hand side, click on Tools, then click on the Resident Icon in the list.
Uncheck the "Resident "TeaTimer" (Protection of overall system settings) active." box.
Click on the "System Startup" icon in the List
Uncheck the "TeaTimer" box and "OK" any prompts.
If Teatimer gives you a warning that changes were made, click the "Allow Change" box when prompted.
Exit Spybot S&D when done.
(When we are done, you can re-enable Teatimer using the same steps but this time place a check next to "Resident TeaTimer" and check the "TeaTimer" box in System Startup.]

Download Lop S&D < here

Double-click Lop S&D.exe
Choose the language, then choose Option 1 (Search)
Wait till the end of the scan
Post the log which is created: (%SystemDrive%\lopR.txt)

tonyli9323

Post #3October 7, 2008, 5:40 AM UTC last edited October 7, 2008, 5:41 AM UTC

I also did a ComboFix, here is my ComboFix log my lop log is below:

ComboFix 08-08-13.02 - james macy 2008-08-14 9:37:22.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.[removed].18.438 [GMT -7:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\FlashGetBHO
C:\Documents and Settings\All Users\Application Data\FlashGetBHO\FlashGetBHO.dll
C:\Documents and Settings\All Users\Application Data\FlashGetBHO\FlvDetector.exe
C:\Documents and Settings\All Users\Application Data\FlashGetBHO\FlvDetector.ini
C:\Documents and Settings\All Users\Application Data\FlashGetBHO\LiveQuery.exe
C:\Documents and Settings\All Users\Application Data\FlashGetBHO\LiveQuery.ini
C:\Documents and Settings\All Users\Application Data\FlashGetBHO\LiveSupport.exe
C:\Documents and Settings\All Users\Application Data\FlashGetBHO\zlib.dll
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CnsMin.zip
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CnsMin1.zip
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CnsMin2.zip
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CnsMin3.zip
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CnsMin4.zip
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CnsMin5.zip
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CnsMin6.zip
C:\Documents and Settings\james macy\Application Data\BITS
C:\Documents and Settings\james macy\Application Data\BITS\BITS.ini
C:\Documents and Settings\james macy\Application Data\BITS\DHTTable.dat
C:\Documents and Settings\james macy\Application Data\BITS\ProxyList.ini
C:\Documents and Settings\james macy\Application Data\BITS\UPnP.ini
C:\Documents and Settings\james macy\Application Data\macromedia\Flash Player\#SharedObjects\MS7T8FW9\interclick.com
C:\Documents and Settings\james macy\Application Data\macromedia\Flash Player\#SharedObjects\MS7T8FW9\interclick.com\ud.sol
C:\Documents and Settings\james macy\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com
C:\Documents and Settings\james macy\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com\settings.sol
C:\Program Files\FlashGet Network
C:\Program Files\FlashGet Network\Flashget\Bhocfg.ini
C:\Program Files\FlashGet Network\Flashget\dbtrans_verbose.log
C:\Program Files\FlashGet Network\Flashget\fgoption.ini
C:\Program Files\FlashGet Network\Flashget\Flvdetector.htm
C:\Program Files\FlashGet Network\Flashget\FlvDetector.ini
C:\Program Files\FlashGet Network\Flashget\InmediaInfo.ini
C:\Program Files\FlashGet Network\Flashget\JCCHS.INI
C:\Program Files\FlashGet Network\Flashget\modules\garage\Headers\0.bmp
C:\Program Files\FlashGet Network\Flashget\modules\garage\Headers\1.bmp
C:\Program Files\FlashGet Network\Flashget\modules\garage\Headers\10.bmp
C:\Program Files\FlashGet Network\Flashget\modules\garage\Headers\11.bmp
C:\Program Files\FlashGet Network\Flashget\modules\garage\Headers\12.bmp
C:\Program Files\FlashGet Network\Flashget\modules\garage\Headers\13.bmp
C:\Program Files\FlashGet Network\Flashget\modules\garage\Headers\14.bmp
C:\Program Files\FlashGet Network\Flashget\modules\garage\Headers\15.bmp
C:\Program Files\FlashGet Network\Flashget\modules\garage\Headers\16.bmp
C:\Program Files\FlashGet Network\Flashget\modules\garage\Headers\17.bmp
C:\Program Files\FlashGet Network\Flashget\modules\garage\Headers\18.bmp
C:\Program Files\FlashGet Network\Flashget\modules\garage\Headers\19.bmp
C:\Program Files\FlashGet Network\Flashget\modules\garage\Headers\2.bmp
C:\Program Files\FlashGet Network\Flashget\modules\garage\Headers\20.bmp
C:\Program Files\FlashGet Network\Flashget\modules\garage\Headers\21.bmp
C:\Program Files\FlashGet Network\Flashget\modules\garage\Headers\3.bmp
C:\Program Files\FlashGet Network\Flashget\modules\garage\Headers\4.bmp
C:\Program Files\FlashGet Network\Flashget\modules\garage\Headers\5.bmp
C:\Program Files\FlashGet Network\Flashget\modules\garage\Headers\6.bmp
C:\Program Files\FlashGet Network\Flashget\modules\garage\Headers\7.bmp
C:\Program Files\FlashGet Network\Flashget\modules\garage\Headers\8.bmp
C:\Program Files\FlashGet Network\Flashget\modules\garage\Headers\9.bmp
C:\Program Files\FlashGet Network\Flashget\modules\garage\Headers\nologin.bmp
C:\Program Files\FlashGet Network\Flashget\P2PCfg.ini
C:\Program Files\FlashGet Network\Flashget\p2spmgr.ini
C:\Program Files\FlashGet Network\Flashget\P4PClientInfo.ini
C:\Program Files\FlashGet Network\Flashget\p4spmgr.ini
C:\Program Files\FlashGet Network\Flashget\Profiles\config.dat
C:\Program Files\FlashGet Network\Flashget\Profiles\tasks.dat
C:\Program Files\FlashGet Network\Flashget\StatInfo.ini
C:\Program Files\FlashGet Network\Flashget\transaction.log
C:\Program Files\lingtu
C:\Program Files\lingtu\51ditu\bin\Analysis.ini
C:\Program Files\lingtu\51ditu\user\anonymous\pin\offline.xml
C:\Program Files\lingtu\51ditu\user\pin\pos.dat
C:\Program Files\uusee
C:\Program Files\uusee\UUTV_LIB.XML
C:\Program Files\uusee\UUTV_MY.xml
C:\WINDOWS\51ditu.ini
C:\WINDOWS\BMe333d2f0.txt
C:\WINDOWS\BMe333d2f0.xml
C:\WINDOWS\struct~.ini
C:\WINDOWS\system32\admshare.dat
C:\WINDOWS\system32\bfogkdak.dll
C:\WINDOWS\system32\ebwiecow.dll
C:\WINDOWS\system32\eysjpryy.dll
C:\WINDOWS\system32\FgjRBcdd.ini
C:\WINDOWS\system32\FgjRBcdd.ini2
C:\WINDOWS\system32\fhkmp.bak1
C:\WINDOWS\system32\fhkmp.bak2
C:\WINDOWS\system32\fhkmp.ini
C:\WINDOWS\system32\fhkmp.ini2
C:\WINDOWS\system32\fhkmp.tmp
C:\WINDOWS\system32\FOYJSvut.ini
C:\WINDOWS\system32\FOYJSvut.ini2
C:\WINDOWS\system32\gjexidlt.ini
C:\WINDOWS\system32\hglbffdp.dll
C:\WINDOWS\system32\hGVOHYQJ.dll
C:\WINDOWS\system32\hGvtronM.dll
C:\WINDOWS\system32\lkcaeprk.dll
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\nbxlzd.dll
C:\WINDOWS\system32\pkvtvj.dll
C:\WINDOWS\system32\psCfPXbc.ini
C:\WINDOWS\system32\psCfPXbc.ini2
C:\WINDOWS\system32\qjchdf.dll
C:\WINDOWS\system32\REGOBJ.DLL
C:\WINDOWS\system32\rrqss.bak1
C:\WINDOWS\system32\rrqss.bak2
C:\WINDOWS\system32\rrqss.ini
C:\WINDOWS\system32\rrqss.ini2
C:\WINDOWS\system32\rrqss.tmp
C:\WINDOWS\system32\rrqss.tmp2
C:\WINDOWS\system32\simtoblf.dll
C:\WINDOWS\system32\tldixejg.dll
C:\WINDOWS\system32\tpdghqci.dll
C:\WINDOWS\system32\trbamitj.dll
C:\WINDOWS\system32\vblallmg.dll
C:\WINDOWS\system32\vxvlibut.dll
C:\WINDOWS\system32\wHPVvFhk.ini
C:\WINDOWS\system32\wHPVvFhk.ini2
C:\WINDOWS\system32\wuowsl.dll
C:\WINDOWS\system32\xetzsd.dll
C:\WINDOWS\system32\xwsgjl.dll
C:\WINDOWS\system32\xxntfano.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_NNSERV
——-\Legacy_WSCSVCIPODSHELLHWDETECTION
——-\Service_NNServ
——-\Service_wscsvciPodShellHWDetection

((((((((((((((((((((((((( Files Created from 2008-07-14 to 2008-08-14 )))))))))))))))))))))))))))))))
.

2008-08-14 09:45 . 2008-08-14 09:45 268 –ah—– C:\sqmdata07.sqm
2008-08-14 09:45 . 2008-08-14 09:45 244 –ah—– C:\sqmnoopt07.sqm
2008-08-14 09:30 . 2008-08-14 09:30 76,040 –a—— C:\WINDOWS\system32\drivers\avgtdix.sys
2008-08-14 09:30 . 2008-08-14 09:30 10,520 –a—— C:\WINDOWS\system32\avgrsstx.dll
2008-08-14 09:29 . 2008-08-14 09:32 d——– C:\WINDOWS\system32\drivers\Avg
2008-08-14 09:29 . 2008-08-14 09:29 96,520 –a—— C:\WINDOWS\system32\drivers\avgldx86.sys
2008-08-14 09:22 . 2008-08-14 09:22 268 –ah—– C:\sqmdata06.sqm
2008-08-14 09:22 . 2008-08-14 09:22 244 –ah—– C:\sqmnoopt06.sqm
2008-08-14 09:00 . 2008-08-14 09:00 268 –ah—– C:\sqmdata05.sqm
2008-08-14 09:00 . 2008-08-14 09:00 244 –ah—– C:\sqmnoopt05.sqm
2008-08-14 08:46 . 2008-08-14 08:46 268 –ah—– C:\sqmdata04.sqm
2008-08-14 08:46 . 2008-08-14 08:46 244 –ah—– C:\sqmnoopt04.sqm
2008-08-14 08:21 . 2008-08-14 08:21 268 –ah—– C:\sqmdata03.sqm
2008-08-14 08:21 . 2008-08-14 08:21 244 –ah—– C:\sqmnoopt03.sqm
2008-08-12 22:00 . 2008-08-12 22:01 d——– C:\Program Files\iTunes
2008-08-11 13:27 . 2008-08-11 13:27 d——– C:\Program Files\Common Files\xing shared
2008-08-09 23:45 . 2008-08-09 23:47 d——– C:\Program Files\PPLiveVA
2008-08-09 23:45 . 2008-08-09 23:45 d——– C:\Documents and Settings\james macy\Application Data\PPLiveVA
2008-08-09 23:45 . 2008-08-09 23:47 d——– C:\Documents and Settings\All Users\Application Data\PPLiveVAPPLiveVAShareFlv
2008-08-09 23:45 . 2008-08-09 23:47 d——– C:\Documents and Settings\All Users\Application Data\PPLiveVA
2008-08-09 23:44 . 2008-08-09 23:44 d——– C:\Documents and Settings\All Users\Application Data\PPLive
2008-08-09 23:44 . 2008-08-09 23:44 1,073,741,824 –a—— C:\pfsvoddata.bbv
2008-08-06 09:35 . 2008-08-06 09:35 2,048 –a—— C:\WINDOWS\system32\vtfkronk.exe
2008-08-06 09:32 . 2008-08-14 09:25 1,466,955 —hs—- C:\WINDOWS\system32\jtimabrt.ini
2008-08-05 23:41 . 2008-08-05 23:41 2,048 –a—— C:\WINDOWS\system32\wdvcbxoe.exe
2008-08-05 23:21 . 2008-08-14 09:32 d–h—– C:\$AVG8.VAULT$
2008-08-05 23:16 . 2008-08-05 23:16 d——– C:\Program Files\AVG
2008-08-05 23:16 . 2008-08-14 09:29 d——– C:\Documents and Settings\All Users\Application Data\avg8
2008-08-05 18:20 . 2006-08-16 04:58 100,352 —–c— C:\WINDOWS\system32\dllcache\6to4svc.dll
2008-08-05 07:07 . 2008-08-05 07:07 d——– C:\Program Files\Malwarebytes' Anti-Malware
2008-08-05 07:07 . 2008-08-05 07:07 d——– C:\Documents and Settings\james macy\Application Data\Malwarebytes
2008-08-05 07:07 . 2008-08-05 07:07 d——– C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-05 07:07 . 2008-07-30 20:07 38,472 –a—— C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-08-05 07:07 . 2008-07-30 20:07 17,144 –a—— C:\WINDOWS\system32\drivers\mbam.sys
2008-08-04 23:47 . 2008-08-04 23:47 577,536 –a–c— C:\WINDOWS\system32\dllcache\user32.dll
2008-08-04 23:29 . 2008-08-04 23:29 d——– C:\WINDOWS\ERUNT
2008-08-04 23:28 . 2008-08-06 10:38 d——– C:\SDFix
2008-08-04 22:49 . 2008-08-05 23:18 8,192 –a—— C:\Documents and Settings\Home
2008-08-04 22:41 . 2008-08-04 22:41 d——– C:\Documents and Settings\james macy\Application Data\Grisoft
2008-08-04 22:41 . 2008-08-05 19:53 d——– C:\Documents and Settings\All Users\Application Data\Grisoft
2008-08-04 18:36 . 2008-08-04 22:23 1,382,215 –ahs—- C:\WINDOWS\system32\qwhtsnov.ini
2008-08-03 08:48 . 2008-08-03 15:13 1,386,291 –ahs—- C:\WINDOWS\system32\eeadgigo.ini
2008-08-02 21:43 . 2008-08-03 08:46 1,382,035 –ahs—- C:\WINDOWS\system32\dwdooueh.ini
2008-08-01 21:44 . 2008-08-01 21:44 129,920 –a—— C:\WINDOWS\system32\jbnbnqra.dll
2008-07-31 21:45 . 2008-08-01 21:49 1,386,111 –ahs—- C:\WINDOWS\system32\prmweina.ini
2008-07-31 20:41 . 2008-07-31 21:39 1,382,035 –ahs—- C:\WINDOWS\system32\amqsqsuw.ini
2008-07-29 20:40 . 2008-07-29 20:41 1,381,975 –ahs—- C:\WINDOWS\system32\eotrppsi.ini
2008-07-28 15:34 . 2008-07-31 20:41 1,382,515 –ahs—- C:\WINDOWS\system32\qfluknho.ini
2008-07-27 15:29 . 2008-07-27 21:48 1,531,636 –ahs—- C:\WINDOWS\system32\rsodbiph.ini
2008-07-22 20:06 . 2008-07-23 20:07 645,307 –ahs—- C:\WINDOWS\system32\ixjawnml.ini
2008-07-21 20:03 . 2008-07-21 22:18 43,581 –ahs—- C:\WINDOWS\system32\uqghfdvo.ini
2008-07-20 22:40 . 2008-07-20 22:40 d——– C:\Documents and Settings\james macy\Application Data\Broderbund
2008-07-20 22:39 . 2008-07-20 22:39 d——– C:\Program Files\Broderbund
2008-07-20 11:54 . 2008-07-22 20:05 43,701 –ahs—- C:\WINDOWS\system32\camsaipa.ini
2008-07-19 11:54 . 2008-07-20 09:28 787,123 –ahs—- C:\WINDOWS\system32\eooqxxml.ini
2008-07-18 11:52 . 2008-07-19 11:53 786,934 –ahs—- C:\WINDOWS\system32\fxiymdke.ini
2008-07-17 21:38 . 2008-07-18 11:54 754,592 –ahs—- C:\WINDOWS\system32\iiyuolnm.ini
2008-07-17 21:36 . 2008-07-17 21:33 754,163 –ahs—- C:\WINDOWS\system32\esssyljw.ini
2008-07-16 21:40 . 2008-07-17 10:31 737,785 –ahs—- C:\WINDOWS\system32\lcmxmsyd.ini
2008-07-15 21:34 . 2008-07-15 21:35 608,734 –ahs—- C:\WINDOWS\system32\uelblueq.ini
2008-07-14 19:15 . 2008-07-16 21:37 737,596 –ahs—- C:\WINDOWS\system32\llrrftpa.ini
2008-07-14 10:03 . 2008-07-14 10:03 d——– C:\Program Files\Game Copy Pro

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-13 05:02 ——— d—–w C:\Program Files\Apple Software Update
2008-08-13 05:00 ——— d—–w C:\Program Files\iPod
2008-08-13 02:01 ——— d—–w C:\Program Files\Mozilla Thunderbird
2008-08-11 20:27 ——— d—–w C:\Program Files\Real
2008-08-11 20:27 ——— d—–w C:\Program Files\Common Files\Real
2008-08-11 07:32 ——— d—–w C:\Program Files\PPStream
2008-08-11 07:32 ——— d—–w C:\Documents and Settings\james macy\Application Data\ppStream
2008-08-11 07:27 ——— d—–w C:\Program Files\MSN Messenger
2008-08-05 04:09 ——— d—–w C:\Documents and Settings\All Users\Application Data\Symantec
2008-08-05 02:52 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-08-05 02:46 ——— d—–w C:\Program Files\Spybot - Search & Destroy
2008-08-03 19:50 ——— d—–w C:\Program Files\Lx_cats
2008-07-24 17:47 ——— d—–w C:\Program Files\Google
2008-07-24 17:45 ——— d–h–r C:\Documents and Settings\james macy\Application Data\yahoo!
2008-07-24 17:45 ——— d—–w C:\Documents and Settings\All Users\Application Data\Yahoo!
2008-07-21 05:40 ——— d—–w C:\Documents and Settings\All Users\Application Data\Broderbund
2008-07-21 01:37 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-07-16 05:10 ——— d—–w C:\Program Files\QuickTime
2008-07-14 16:54 ——— d—–w C:\Program Files\BitComet
2008-07-12 05:17 ——— d—–w C:\Program Files\Java
2008-06-23 01:34 ——— d—–w C:\Documents and Settings\james macy\Application Data\Nokia Multimedia Player
2008-06-20 10:45 360,320 —-a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:44 138,368 —-a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 09:52 225,920 —-a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-19 02:16 ——— d—–w C:\Program Files\Trend Micro
2008-06-18 20:14 ——— d—–w C:\Program Files\Yahoo!
2008-06-14 03:54 ——— d—–w C:\Program Files\Xilisoft
2008-04-25 00:28 0 —-a-w C:\Program Files\temp01
2008-04-04 23:08 165,568 —-a-w C:\Documents and Settings\james macy\Application Data\GDIPFONTCACHEV1.DAT
2007-04-06 05:10 37,376 —-a-w C:\Documents and Settings\james macy\Update.exe
2007-04-06 05:09 229,912 —-a-w C:\Documents and Settings\james macy\channels.dat
2005-01-20 02:19 207 —-a-w C:\Documents and Settings\james macy\J.BAT
2004-08-02 22:38 135,168 ——w C:\Program Files\internet explorer\plugins\West_ACU.dll
2005-05-14 00:12 217,073 –sha-r C:\WINDOWS\meta4.exe
2005-10-24 18:13 66,560 –sha-r C:\WINDOWS\MOTA113.exe
2005-10-14 04:27 422,400 –sha-r C:\WINDOWS\x2.64.exe
2007-05-28 03:00 109 –sha-w C:\WINDOWS\system32\3758154179.dat
2005-10-08 02:14 308,224 –sha-r C:\WINDOWS\system32\avisynth.dll
2005-07-14 19:31 27,648 –sha-r C:\WINDOWS\system32\AVSredirect.dll
2005-06-26 22:32 616,448 –sha-r C:\WINDOWS\system32\cygwin1.dll
2005-06-22 05:37 45,568 –sha-r C:\WINDOWS\system32\cygz.dll
2007-02-20 02:45 8 –sha-r C:\WINDOWS\system32\D27C083E86.dll
2004-01-25 07:00 70,656 –sha-r C:\WINDOWS\system32\i420vfw.dll
2006-04-27 17:24 2,945,024 –sha-r C:\WINDOWS\system32\Smab.dll
2005-02-28 20:16 240,128 –sha-r C:\WINDOWS\system32\x.264.exe
2004-01-25 07:00 70,656 –sha-r C:\WINDOWS\system32\yv12vfw.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CC1EFA62-AF16-4DB2-ABBB-BFA89740CB45}]
2004-08-02 15:38 135168 ——— C:\Program Files\Internet Explorer\PLUGINS\West_ACU.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56 15360]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 13:55 5674352]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 21:05 204288]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 09:42 2156368]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2004-03-04 14:29 2904064]
"NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2004-03-04 14:29 46080]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-10 07:50 155648]
"InCD"="C:\Program Files\Ahead\InCD\InCD.exe" [2003-12-18 07:40 1241138]
"SunKistEM"="C:\Program Files\eMachines Bay Reader\shwiconem.exe" [2004-03-12 19:18 135168]
"BigDogPath"="C:\WINDOWS\VM_STI.EXE" [2003-01-21 00:19 40960]
"OpwareSE2"="C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" [2003-05-08 13:00 49152]
"Samsung LBP SM"="C:\WINDOWS\Samsung\LaserSMMgr\ssmmgr.exe" [2003-04-03 17:40 266240]
"GW Port Controller"="C:\Program Files\Samsung\SmarThru\PORTCTRL.EXE" [2003-01-30 14:12 163840]
"Microsoft Works Update Detection"="C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2003-06-08 00:32 50688]
"Acrobat Assistant 7.0"="C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2005-09-23 21:30 483328]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"MaxtorOneTouch"="C:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe" [2006-03-01 12:58 712704]
"mxomssmenu"="C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe" [2005-10-17 17:24 81920]
"FaxCenterServer"="C:\Program Files\Lexmark Fax Solutions\fm3032.exe" [2006-02-02 01:11 290816]
"lxcrmon.exe"="C:\Program Files\Lexmark 2400 Series\lxcrmon.exe" [2006-03-06 10:48 286720]
"EzPrint"="C:\Program Files\Lexmark 2400 Series\ezprint.exe" [2006-02-06 22:10 98304]
"PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 16:10 271360]
"AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-10 09:47 116040]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-05-27 10:50 413696]
"LXCRCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCRtime.dll" [2006-02-24 04:54 65536]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-08-11 13:27 185896]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-07-30 10:47 289064]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-08-14 09:29 1232152]
"nwiz"="nwiz.exe" [2004-03-04 14:29 782336 C:\WINDOWS\system32\nwiz.exe]
"nForce Tray Options"="sstray.exe" [2003-09-03 22:25 73728 C:\WINDOWS\system32\sstray.exe]
"CHotkey"="zHotkey.exe" [2003-06-04 15:01 496640 C:\WINDOWS\zHotkey.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 00:56 15360]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 09:24 1694208]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 11:17 1241088]

C:\Documents and Settings\james macy\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 19:16:50 113664]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-0000-BA7E-000000000002}\SC_Acrobat.exe [2005-10-16 13:44:30 25214]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-12 10:01:04 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"=hex(2):76,69,73,74,61,75,69,2e,65,78,65,00

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.aflc"= flccodec32.dll
"vidc.afli"= flccodec32.dll
"vidc.aasc"= aasc32.dll
"vidc.yv12"= yv12vfw.dll
"msacm.mpegacm"= mpegacm.acm
"msacm.ulmp3acm"= ulmp3acm.acm
"VIDC.LGIF"= lgif.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Sierra\\Empire Earth\\Empire Earth.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"135:TCP"= 135:TCP:TCP Port 135
"5000:TCP"= 5000:TCP:TCP Port 5000
"5001:TCP"= 5001:TCP:TCP Port 5001
"5002:TCP"= 5002:TCP:TCP Port 5002
"5003:TCP"= 5003:TCP:TCP Port 5003
"5004:TCP"= 5004:TCP:TCP Port 5004
"5005:TCP"= 5005:TCP:TCP Port 5005
"5006:TCP"= 5006:TCP:TCP Port 5006
"5007:TCP"= 5007:TCP:TCP Port 5007
"5008:TCP"= 5008:TCP:TCP Port 5008
"5009:TCP"= 5009:TCP:TCP Port 5009
"5010:TCP"= 5010:TCP:TCP Port 5010
"5011:TCP"= 5011:TCP:TCP Port 5011
"5012:TCP"= 5012:TCP:TCP Port 5012
"5013:TCP"= 5013:TCP:TCP Port 5013
"5014:TCP"= 5014:TCP:TCP Port 5014
"5015:TCP"= 5015:TCP:TCP Port 5015
"5016:TCP"= 5016:TCP:TCP Port 5016
"5017:TCP"= 5017:TCP:TCP Port 5017
"5018:TCP"= 5018:TCP:TCP Port 5018
"5019:TCP"= 5019:TCP:TCP Port 5019
"5020:TCP"= 5020:TCP:TCP Port 5020

R0 sonypvl2;sonypvl2;C:\WINDOWS\system32\drivers\sonypvl2.sys [2003-07-25 15:02]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-08-14 09:29]
R1 sonypvf2;sonypvf2;C:\WINDOWS\system32\drivers\sonypvf2.sys [2003-08-20 10:51]
R1 sonypvt2;sonypvt2;C:\WINDOWS\system32\drivers\sonypvt2.sys [2003-08-20 10:44]
R2 avg8emc;AVG Free8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-08-14 09:29]
R2 avg8wd;AVG Free8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-08-14 09:29]
R2 AvgTdiX;AVG Free8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-08-14 09:30]
R2 WUSB300NSvc;WUSB300NSvc;C:\Program Files\Linksys\WUSB300N\WLService.exe WUSB300N.exe []
S1 sonypvd2;sonypvd2;C:\WINDOWS\system32\DRIVERS\sonypvd2.sys [2003-06-24 10:29]
S2 iPodShellHWDetection;iPod Service iPodShellHWDetection;c:\tbsrqet.exe []
S3 ASPI;Advanced SCSI Programming Interface Driver;C:\WINDOWS\System32\DRIVERS\ASPI32.sys [2002-07-17 08:05]
S3 MD8300;GSL MD8300 Electronic Dictionary;C:\WINDOWS\system32\Drivers\MD8300.sys [2004-09-14 20:49]
S3 P1130VID;Creative WebCam NX Pro;C:\WINDOWS\system32\DRIVERS\P1130Vid.sys [2003-05-07 18:00]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\Shell\AutoRun\command - E:\autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{164e0c55-9949-11db-a5c9-0040ca7f7cc9}]
\Shell\AutoRun\command - F:\ONSPCLCK.exe
.
Contents of the 'Scheduled Tasks' folder
.
- - - - ORPHANS REMOVED - - - -

BHO-{15aebfcf-0e11-4770-8ad7-6bda64968432} - C:\WINDOWS\system32\xcrjki.dll
BHO-{17F75949-1435-4CBE-950C-15E05B512FB1} - (no file)
BHO-{3BB76123-87E8-4D9D-A2E5-AB229AF59E54} - C:\WINDOWS\system32\chnwryqu.dll
BHO-{3F1068B2-358B-4CBE-BE2F-AA187FF35EF2} - (no file)
BHO-{5FE2DBA6-ED5D-49E2-B6DE-35977B2BB66C} - C:\WINDOWS\system32\ssqrr.dll
BHO-{7FCD5BB7-CBAA-4700-8BAE-A3B7B3B66448} - C:\WINDOWS\system32\cbXPfCsp.dll
BHO-{9C3E6932-287A-4F2C-AF57-389B5441AD16} - C:\WINDOWS\system32\ddcBRjgF.dll
BHO-{AB4F5182-B759-4798-B5ED-C8A0431BA00D} - C:\WINDOWS\system32\tuvSJYOF.dll
BHO-{B9AACCBB-41A7-4308-B0BB-8B2D51CFBFBD} - (no file)
BHO-{E243A8E7-6244-49E0-A361-22DBF30FD46C} - (no file)
BHO-{F13B7681-D949-4A61-BA09-AC8C7A4B066A} - C:\WINDOWS\system32\khFvVPHw.dll
ShellIconOverlayIdentifiers-hex(2):7b,38,41,34,32,44,46,42,46,2d,37,38,36,38,2d,34,30,32,39,2d,39,35,38,\ - (no file)
HKCU-Run-eMuleAutoStart - C:\Program Files\eMule\eMule.exe
HKCU-Run-TypingSatellite - C:\Program Files\TypingMaster\KBOOST.EXE
HKCU-Run-foxy - C:\Program Files\Foxy\Foxy.exe
HKLM-Run-Adobe Photo Downloader - C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
HKLM-Run-ccApp - C:\Program Files\Common Files\Symantec Shared\ccApp.exe
HKLM-Run-LClock - C:\Program Files\LClock\LClock.exe
HKLM-Run-VisualTooltip - C:\Program Files\VisualTooltip\VisualToolTip.exe
HKLM-Run-Blaero Start Orb - C:\Program Files\Blaero Start Orb\Blaero Start Orb.exe
HKLM-Run-Symantec PIF AlertEng - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
HKLM-Run-osCheck - C:\Program Files\Norton AntiVirus\osCheck.exe
HKLM-Run-e000e16c - C:\WINDOWS\system32\trbamitj.dll
HKLM-Run-BMe333d2f0 - C:\WINDOWS\system32\djqdqeds.dll
HKLM-Run-DNSE - C:\Program Files\Common Files\SystemDoctor\DNSE.exe
HKLM-Run-ipmon - ipmon.exe
Notify-cBSJaBSj - cBSJaBSj.dll
Notify-mlJDutsP - (no file)
Notify-rqRiGxvU - (no file)

.
——- Supplementary Scan ——-
.
FireFox -: Profile - C:\Documents and Settings\james macy\Application Data\Mozilla\Firefox\Profiles\0zk2lzf6.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1231307&SearchSource=3&q=
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.com/advanced_search?hl=en
FF -: plugin - C:\Program Files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll
FF -: plugin - C:\Program Files\DivX\DivX Content Uploader\npUpload.dll
FF -: plugin - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\npmozax.dll
FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\npqtplugin8.dll
FF -: plugin - C:\Program Files\QuickTime\Plugins\npqtplugin8.dll
FF -: plugin - C:\Program Files\Unity\WebPlayer\loader\npUnity3D32.dll
FF -: plugin - C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
FF -: plugin - C:\Program Files\Yahoo!\Shared\npYState.dll

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-14 09:53:43
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\Program Files\Ahead\InCD\incdsrv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTSVCCDA.EXE
C:\Program Files\Maxtor\Maxtor Backup\MaxBackServiceInt.exe
C:\Program Files\Maxtor\OneTouch\Utils\SyncServices.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Linksys\WUSB300N\WLService.exe
C:\Program Files\Linksys\WUSB300N\WUSB300N.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\system32\conime.exe
C:\WINDOWS\system32\lxcrcoms.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2008-08-14 10:08:27 - machine was rebooted [james macy]
ComboFix-quarantined-files.txt 2008-08-14 17:08:15

Pre-Run: 13,429,882,880 bytes free
Post-Run: 16,600,670,208 bytes free

444 — E O F — 2008-08-08 01:24:29

tonyli9323

Post #4October 7, 2008, 5:42 AM UTC

Here is my Lop Log:

——————–\\ Lop S&D 4.2.4-5 XP/Vista

Microsoft Windows XP Home Edition ( v5.1.2600 ) Service Pack 2
X86-based PC ( Uniprocessor Free : AMD Athlon™ XP 3000+ )
BIOS : Phoenix - AwardBIOS v6.00PG
USER : james macy ( Administrator )
BOOT : Normal boot
Antivirus : Norton AntiVirus 2007 (Not Activated)
Firewall : Norton AntiVirus 2007 (Activated)
C:\ (Local Disk) - NTFS - Total : 153 Go Free : 30 Go
D:\ (CD or DVD)
E:\ (CD or DVD) - CDFS - Total : 0 Go Free : 0 Go
F:\ (USB)
G:\ (USB)
H:\ (USB)
I:\ (USB)
K:\ (Local Disk) - NTFS - Total : 149 Go Free : 11 Go

"C:\Lop SD" ( MAJ : 02-10-2008|23:42 )
Option : [1] ( Mon 10/06/2008|22:36 )

——————–\\ Listing folders in APPLIC~1

[09/11/2008|05:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ {3276BE95_AF08_429F_A64F_CA64CB79BCF6}
[07/31/2007|06:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Adobe
[10/16/2005|01:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Adobe Systems
[11/17/2006|10:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Amazon
[12/23/2004|12:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ AOL
[07/04/2007|01:20] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Apple
[10/15/2006|03:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Apple Computer
[08/14/2008|09:29] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ avg8
[03/20/2008|09:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ AVS4YOU
[07/20/2008|10:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Broderbund
[05/05/2004|12:19] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ CyberLink
[11/30/2007|07:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Disney Imagineering
[10/06/2008|07:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ dmhypwva
[04/21/2008|07:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ eGames
[08/22/2007|09:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ FaxCtr
[07/30/2007|06:20] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ FLEXnet
[10/25/2007|05:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Google
[10/05/2008|11:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Google Updater
[08/05/2008|07:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Grisoft
[09/03/2008|05:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Installations
[04/16/2006|07:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ InstallShield
[10/30/2005|03:34] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Knowledge Adventure
[11/30/2005|06:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Macromedia
[03/24/2007|03:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Macrovision
[08/05/2008|07:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Malwarebytes
[02/16/2007|07:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Maxtor
[01/06/2008|09:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Microsoft
[11/12/2005|10:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ MSN6
[10/20/2007|02:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ NFS Underground
[01/06/2008|10:12] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Nokia
[05/06/2004|12:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ nView_Profiles
[01/06/2008|09:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ PC Suite
[10/01/2005|08:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ PopCap
[08/09/2008|11:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ PPLive
[08/09/2008|11:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ PPLiveVA
[08/09/2008|11:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ PPLiveVAPPLiveVAShareFlv
[02/19/2007|07:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Protexis
[05/05/2004|12:19] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ QuickTime
[01/21/2005|01:27] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ ScanSoft
[08/29/2008|06:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Spybot - Search & Destroy
[01/21/2005|01:18] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ SSScanAppDataDir
[01/21/2005|01:19] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ SSScanWizard
[08/04/2008|09:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Symantec
[05/27/2007|08:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ TEMP
[03/01/2007|08:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Trymedia
[05/29/2007|07:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Ulead Systems
[05/05/2004|12:19] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Viewpoint
[01/10/2006|06:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Windows Genuine Advantage
[07/24/2008|10:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Yahoo!

[11/23/2007|10:23] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ Apple Computer
[05/06/2004|12:52] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ CyberLink
[05/05/2004|12:19] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ Identities
[05/05/2004|12:19] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ Microsoft
[05/05/2004|12:19] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ Sun

[02/25/2006|01:42] C:\DOCUME~1\JAMESM~1\APPLIC~1\ .bittorrent
[05/07/2008|06:35] C:\DOCUME~1\JAMESM~1\APPLIC~1\ Adobe
[11/23/2005|09:41] C:\DOCUME~1\JAMESM~1\APPLIC~1\ AdobeAUM
[12/10/2005|12:46] C:\DOCUME~1\JAMESM~1\APPLIC~1\ AdobeUM
[09/05/2004|10:33] C:\DOCUME~1\JAMESM~1\APPLIC~1\ Ahead
[07/29/2007|01:58] C:\DOCUME~1\JAMESM~1\APPLIC~1\ Apple Computer
[11/23/2005|11:06] C:\DOCUME~1\JAMESM~1\APPLIC~1\ ArcSoft
[07/20/2008|10:40] C:\DOCUME~1\JAMESM~1\APPLIC~1\ Broderbund
[08/29/2008|05:35] C:\DOCUME~1\JAMESM~1\APPLIC~1\ Corel
[12/30/2005|09:11] C:\DOCUME~1\JAMESM~1\APPLIC~1\ Creative
[05/06/2004|12:52] C:\DOCUME~1\JAMESM~1\APPLIC~1\ CyberLink
[05/27/2007|05:09] C:\DOCUME~1\JAMESM~1\APPLIC~1\ dvdcss
[04/21/2008|07:24] C:\DOCUME~1\JAMESM~1\APPLIC~1\ eGames
[08/22/2007|09:51] C:\DOCUME~1\JAMESM~1\APPLIC~1\ FaxCtr
[06/02/2008|05:05] C:\DOCUME~1\JAMESM~1\APPLIC~1\ Google
[08/04/2008|10:41] C:\DOCUME~1\JAMESM~1\APPLIC~1\ Grisoft
[12/30/2004|08:46] C:\DOCUME~1\JAMESM~1\APPLIC~1\ Help
[12/03/2005|12:57] C:\DOCUME~1\JAMESM~1\APPLIC~1\ ICQ
[05/05/2004|12:19] C:\DOCUME~1\JAMESM~1\APPLIC~1\ Identities
[12/15/2007|06:55] C:\DOCUME~1\JAMESM~1\APPLIC~1\ InstallShield
[01/25/2005|07:42] C:\DOCUME~1\JAMESM~1\APPLIC~1\ InterTrust
[05/01/2006|07:51] C:\DOCUME~1\JAMESM~1\APPLIC~1\ Jasc
[04/16/2006|07:26] C:\DOCUME~1\JAMESM~1\APPLIC~1\ Jasc Software Inc
[01/25/2005|05:50] C:\DOCUME~1\JAMESM~1\APPLIC~1\ Lavasoft
[11/23/2005|09:51] C:\DOCUME~1\JAMESM~1\APPLIC~1\ Leadertech
[03/01/2006|08:46] C:\DOCUME~1\JAMESM~1\APPLIC~1\ Macromedia
[08/05/2008|07:07] C:\DOCUME~1\JAMESM~1\APPLIC~1\ Malwarebytes
[02/04/2008|10:39] C:\DOCUME~1\JAMESM~1\APPLIC~1\ Microsoft
[06/18/2008|11:33] C:\DOCUME~1\JAMESM~1\APPLIC~1\ Mozilla
[02/09/2007|05:51] C:\DOCUME~1\JAMESM~1\APPLIC~1\ MSN6
[01/21/2005|05:03] C:\DOCUME~1\JAMESM~1\APPLIC~1\ NewSoft
[03/20/2008|09:27] C:\DOCUME~1\JAMESM~1\APPLIC~1\ Nokia
[06/22/2008|06:34] C:\DOCUME~1\JAMESM~1\APPLIC~1\ Nokia Multimedia Player
[01/21/2005|05:32] C:\DOCUME~1\JAMESM~1\APPLIC~1\ NSBackup
[08/11/2007|09:29] C:\DOCUME~1\JAMESM~1\APPLIC~1\ Opera
[04/15/2008|09:19] C:\DOCUME~1\JAMESM~1\APPLIC~1\ Orbit
[01/06/2008|09:45] C:\DOCUME~1\JAMESM~1\APPLIC~1\ PC Suite
[08/09/2008|11:45] C:\DOCUME~1\JAMESM~1\APPLIC~1\ PPLiveVA
[08/11/2008|12:32] C:\DOCUME~1\JAMESM~1\APPLIC~1\ ppStream
[08/11/2008|01:28] C:\DOCUME~1\JAMESM~1\APPLIC~1\ Real
[01/21/2005|01:27] C:\DOCUME~1\JAMESM~1\APPLIC~1\ ScanSoft
[06/12/2005|12:10] C:\DOCUME~1\JAMESM~1\APPLIC~1\ School Zone Preferences
[08/21/2006|09:45] C:\DOCUME~1\JAMESM~1\APPLIC~1\ Scooter Software
[06/21/2007|03:00] C:\DOCUME~1\JAMESM~1\APPLIC~1\ Stardock
[05/05/2004|12:19] C:\DOCUME~1\JAMESM~1\APPLIC~1\ Sun
[05/27/2007|01:38] C:\DOCUME~1\JAMESM~1\APPLIC~1\ SystemRequirementsLab
[01/24/2005|06:57] C:\DOCUME~1\JAMESM~1\APPLIC~1\ Talkback
[08/31/2004|06:48] C:\DOCUME~1\JAMESM~1\APPLIC~1\ Template
[01/22/2005|08:50] C:\DOCUME~1\JAMESM~1\APPLIC~1\ Thunderbird
[05/22/2007|05:33] C:\DOCUME~1\JAMESM~1\APPLIC~1\ Ulead Systems
[10/04/2008|10:34] C:\DOCUME~1\JAMESM~1\APPLIC~1\ uTorrent
[04/16/2008|06:37] C:\DOCUME~1\JAMESM~1\APPLIC~1\ WinAVI
[03/31/2007|10:10] C:\DOCUME~1\JAMESM~1\APPLIC~1\ WinRAR
[07/24/2008|10:45] C:\DOCUME~1\JAMESM~1\APPLIC~1\ yahoo!

[12/09/2005|04:24] C:\DOCUME~1\LOCALS~1\APPLIC~1\ Adobe
[01/24/2007|07:41] C:\DOCUME~1\LOCALS~1\APPLIC~1\ Help
[11/23/2005|06:24] C:\DOCUME~1\LOCALS~1\APPLIC~1\ Macromedia
[08/14/2008|09:28] C:\DOCUME~1\LOCALS~1\APPLIC~1\ Microsoft
[11/23/2005|06:30] C:\DOCUME~1\LOCALS~1\APPLIC~1\ Mozilla
[09/05/2007|03:06] C:\DOCUME~1\LOCALS~1\APPLIC~1\ PPStream
[08/15/2006|06:39] C:\DOCUME~1\LOCALS~1\APPLIC~1\ Symantec
[11/23/2005|06:30] C:\DOCUME~1\LOCALS~1\APPLIC~1\ Talkback

[08/14/2008|09:28] C:\DOCUME~1\NETWOR~1\APPLIC~1\ Microsoft
[11/11/2004|06:48] C:\DOCUME~1\NETWOR~1\APPLIC~1\ Symantec

[08/22/2004|12:45] C:\DOCUME~1\Owner\APPLIC~1\ Symantec

——————–\\ Scheduled Tasks located in C:\WINDOWS\Tasks

[09/29/2008 01:24 PM][–a——] C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[10/06/2008 09:53 PM][–ah—–] C:\WINDOWS\tasks\SA.DAT
[03/31/2003 12:00 PM][-r-h—–] C:\WINDOWS\tasks\desktop.ini

——————–\\ Listing Folders in C:\Program Files

[03/25/2007|09:30] C:\Program Files\ 21cn
[10/09/2007|09:45] C:\Program Files\ Abbyy FineReader 6.0 Sprint
[11/24/2007|07:23] C:\Program Files\ Activision
[08/15/2007|09:34] C:\Program Files\ Adobe
[05/06/2004|12:54] C:\Program Files\ Ahead
[08/12/2008|10:02] C:\Program Files\ Apple Software Update
[11/23/2005|11:06] C:\Program Files\ ArcSoft
[12/26/2005|09:43] C:\Program Files\ Audible
[08/05/2008|11:16] C:\Program Files\ AVG
[09/17/2006|08:54] C:\Program Files\ AviSynth 2.5
[03/20/2008|09:55] C:\Program Files\ AVSMedia
[11/15/2005|07:11] C:\Program Files\ AWS
[08/21/2006|09:45] C:\Program Files\ Beyond Compare 2
[05/05/2004|12:21] C:\Program Files\ BigFix
[07/14/2008|09:54] C:\Program Files\ BitComet
[09/11/2008|05:14] C:\Program Files\ Bonjour
[03/25/2007|09:25] C:\Program Files\ BoontyGames
[02/28/2007|11:30] C:\Program Files\ Britannica Profiles
[07/20/2008|10:39] C:\Program Files\ Broderbund
[01/02/2005|09:01] C:\Program Files\ Canon
[10/06/2008|09:42] C:\Program Files\ Common Files
[07/05/2007|06:23] C:\Program Files\ CompuChess 2004
[05/06/2004|02:19] C:\Program Files\ CONEXANT
[12/26/2005|09:44] C:\Program Files\ Creative
[05/05/2004|12:23] C:\Program Files\ CyberLink
[12/15/2007|06:57] C:\Program Files\ DB CIF Cam
[01/06/2008|09:38] C:\Program Files\ DIFX
[01/28/2005|04:57] C:\Program Files\ directx
[07/30/2007|03:29] C:\Program Files\ DivX
[02/28/2007|11:33] C:\Program Files\ DNA
[10/01/2007|10:27] C:\Program Files\ Dobermann
[05/06/2004|02:24] C:\Program Files\ eMachines Bay Reader
[11/05/2005|06:53] C:\Program Files\ EuroTalk
[03/01/2007|08:47] C:\Program Files\ FileSmile
[07/14/2008|10:03] C:\Program Files\ Game Copy Pro
[07/30/2007|08:40] C:\Program Files\ GenieSoft
[01/22/2005|12:29] C:\Program Files\ Ghostscript
[12/31/2007|11:40] C:\Program Files\ GoldWave
[09/16/2008|04:26] C:\Program Files\ Google
[12/21/2004|04:48] C:\Program Files\ Grammatik5
[08/14/2008|07:47] C:\Program Files\ Grisoft
[09/11/2004|12:25] C:\Program Files\ HighMAT CD Writing Wizard
[11/11/2005|11:10] C:\Program Files\ homeworkhelp
[07/05/2007|06:23] C:\Program Files\ ICQ
[11/26/2005|08:58] C:\Program Files\ ICQLite
[10/16/2005|07:32] C:\Program Files\ ICQToolbar
[02/25/2006|12:35] C:\Program Files\ Illustrate
[07/20/2008|06:37] C:\Program Files\ InstallShield Installation Information
[11/20/2006|10:39] C:\Program Files\ InterActual
[08/15/2008|05:23] C:\Program Files\ Internet Explorer
[09/26/2004|02:37] C:\Program Files\ Intuit
[09/11/2008|05:17] C:\Program Files\ iPod
[05/27/2007|05:16] C:\Program Files\ iSofter
[09/11/2008|05:17] C:\Program Files\ iTunes
[04/16/2006|07:26] C:\Program Files\ Jasc Software Inc
[07/11/2008|10:17] C:\Program Files\ Java
[08/22/2006|10:32] C:\Program Files\ JavaSoft
[01/11/2007|05:54] C:\Program Files\ JOE
[06/24/2007|08:43] C:\Program Files\ Kingsoft
[06/12/2005|09:45] C:\Program Files\ Knowledge Adventure
[07/22/2005|03:11] C:\Program Files\ Lavasoft
[05/05/2004|12:24] C:\Program Files\ Learn2.com
[10/11/2007|06:34] C:\Program Files\ LegendGo
[11/23/2005|06:26] C:\Program Files\ Lexmark
[09/04/2007|05:52] C:\Program Files\ Lexmark 2400 Series
[08/22/2007|09:09] C:\Program Files\ Lexmark Fax Solutions
[09/04/2007|05:48] C:\Program Files\ Lexmark Toolbar
[02/01/2007|03:35] C:\Program Files\ Linksys
[09/25/2008|07:38] C:\Program Files\ Lx_cats
[09/14/2008|12:11] C:\Program Files\ Malwarebytes' Anti-Malware
[11/26/2006|07:09] C:\Program Files\ Maxis
[02/16/2007|07:39] C:\Program Files\ Maxtor
[08/15/2008|05:30] C:\Program Files\ Messenger
[09/23/2005|05:51] C:\Program Files\ Microsoft ActiveSync
[05/05/2004|12:24] C:\Program Files\ microsoft frontpage
[11/26/2006|07:09] C:\Program Files\ Microsoft Office
[10/16/2005|08:27] C:\Program Files\ Microsoft Picture It! 9
[08/22/2008|06:50] C:\Program Files\ Microsoft Silverlight
[05/05/2004|12:27] C:\Program Files\ Microsoft Works
[05/28/2007|12:54] C:\Program Files\ MOVAVI
[05/28/2007|12:54] C:\Program Files\ Movavi Video Converter 5.4
[09/10/2004|06:24] C:\Program Files\ Movie Maker
[10/06/2008|10:35] C:\Program Files\ Mozilla Firefox
[09/28/2008|08:27] C:\Program Files\ Mozilla Thunderbird
[05/05/2004|12:27] C:\Program Files\ MSN
[05/05/2004|12:27] C:\Program Files\ MSN Encarta Plus
[05/05/2004|12:27] C:\Program Files\ MSN Gaming Zone
[08/11/2008|12:27] C:\Program Files\ MSN Messenger
[01/07/2008|07:36] C:\Program Files\ MSXML 4.0
[09/03/2008|05:50] C:\Program Files\ MSXML 6.0
[10/06/2008|10:25] C:\Program Files\ mzbntbe
[09/10/2004|06:21] C:\Program Files\ NetMeeting
[05/05/2004|12:28] C:\Program Files\ Netscape
[07/04/2007|02:39] C:\Program Files\ NextLink
[07/05/2007|06:23] C:\Program Files\ NJStar Communicator
[11/05/2005|05:40] C:\Program Files\ Nodtronics
[09/03/2008|05:50] C:\Program Files\ Nokia
[05/05/2004|12:28] C:\Program Files\ Online Services
[06/22/2007|01:49] C:\Program Files\ Outlook Express
[01/06/2008|09:38] C:\Program Files\ PC Connectivity Solution
[09/03/2004|08:10] C:\Program Files\ PIXELA
[01/21/2005|11:47] C:\Program Files\ PlotSoft
[08/09/2008|11:47] C:\Program Files\ PPLiveVA
[08/11/2008|12:32] C:\Program Files\ PPStream
[05/06/2004|01:27] C:\Program Files\ Program Shortcuts
[09/11/2008|05:13] C:\Program Files\ QuickTime
[01/28/2006|09:22] C:\Program Files\ Rand McNally
[08/11/2008|01:27] C:\Program Files\ Real
[02/11/2008|07:14] C:\Program Files\ ReflexiveArcade
[07/05/2007|06:14] C:\Program Files\ RegCure
[01/21/2005|10:10] C:\Program Files\ Samsung
[01/10/2005|08:46] C:\Program Files\ Samsung ML-1740 Series
[01/02/2005|09:04] C:\Program Files\ ScanSoft
[02/23/2008|12:03] C:\Program Files\ sgsm
[11/30/2007|05:49] C:\Program Files\ Sierra
[10/04/2008|10:35] C:\Program Files\ Spybot - Search & Destroy
[11/30/2007|05:52] C:\Program Files\ SSI
[06/20/2007|10:50] C:\Program Files\ Stardock
[07/05/2007|06:23] C:\Program Files\ sz8083
[10/05/2008|08:36] C:\Program Files\ The KMPlayer
[08/26/2004|05:41] C:\Program Files\ The Learning Company
[01/19/2007|12:17] C:\Program Files\ Thunder Network
[01/25/2005|08:06] C:\Program Files\ TIMESLIP
[06/18/2008|07:16] C:\Program Files\ Trend Micro
[12/23/2005|06:03] C:\Program Files\ TypingMaster
[05/28/2007|07:58] C:\Program Files\ Ulead Systems
[05/05/2004|12:28] C:\Program Files\ Uninstall Information
[03/12/2008|06:28] C:\Program Files\ Unity
[08/17/2008|11:59] C:\Program Files\ uTorrent
[05/05/2004|12:28] C:\Program Files\ Viewpoint
[10/01/2007|05:22] C:\Program Files\ Virtual Earth 3D
[02/11/2008|07:23] C:\Program Files\ War Chess
[01/25/2005|05:52] C:\Program Files\ Web Publish
[12/20/2004|09:35] C:\Program Files\ West Group
[08/01/2005|10:14] C:\Program Files\ Winamp
[04/16/2008|06:37] C:\Program Files\ WinAVI FLV Converter
[01/07/2008|12:45] C:\Program Files\ WinAVI MP4 Converter
[09/11/2004|02:25] C:\Program Files\ Windows Journal Viewer
[05/22/2007|05:30] C:\Program Files\ Windows Media Components
[02/03/2006|11:58] C:\Program Files\ Windows Media Connect
[12/28/2006|10:00] C:\Program Files\ Windows Media Connect 2
[06/22/2007|11:44] C:\Program Files\ Windows Media Player
[09/10/2004|06:21] C:\Program Files\ Windows NT
[09/11/2004|10:27] C:\Program Files\ WindowsUpdate
[01/24/2007|05:52] C:\Program Files\ WinMX
[12/09/2006|04:56] C:\Program Files\ WinMX Speed Up Pro
[07/15/2008|09:31] C:\Program Files\ WinRAR
[05/27/2007|04:34] C:\Program Files\ Womble MPEG Editor
[09/29/2007|11:29] C:\Program Files\ WordPerfect Office 12
[07/29/2007|01:15] C:\Program Files\ WorldNet
[05/05/2004|12:28] C:\Program Files\ xerox
[06/13/2008|08:54] C:\Program Files\ Xilisoft
[06/18/2008|01:14] C:\Program Files\ Yahoo!
[02/28/2007|06:59] C:\Program Files\ YAMAHA
[02/28/2007|11:30] C:\Program Files\ Zero G Registry

——————–\\ Listing Folders in C:\Program Files\Common Files

[07/31/2007|06:43] C:\Program Files\Common Files\ Adobe
[10/16/2005|01:44] C:\Program Files\Common Files\ Adobe Systems Shared
[05/06/2004|12:52] C:\Program Files\Common Files\ Ahead
[05/05/2004|12:21] C:\Program Files\Common Files\ AOL
[09/11/2008|05:13] C:\Program Files\Common Files\ Apple
[03/20/2008|09:55] C:\Program Files\Common Files\ AVSMedia
[09/04/2004|05:28] C:\Program Files\Common Files\ Borland Shared
[09/29/2007|11:29] C:\Program Files\Common Files\ Corel
[09/23/2005|05:49] C:\Program Files\Common Files\ Designer
[10/20/2007|02:06] C:\Program Files\Common Files\ DirectX
[03/20/2008|09:35] C:\Program Files\Common Files\ Download Manager
[09/04/2004|05:32] C:\Program Files\Common Files\ InstallShield
[04/16/2006|07:28] C:\Program Files\Common Files\ Jasc Software Inc
[05/05/2004|12:21] C:\Program Files\Common Files\ Java
[10/30/2005|03:28] C:\Program Files\Common Files\ Knowledge Adventure
[07/30/2007|06:01] C:\Program Files\Common Files\ Macrovision Shared
[01/06/2008|10:08] C:\Program Files\Common Files\ Microsoft Shared
[05/05/2004|12:21] C:\Program Files\Common Files\ MSSoap
[09/03/2008|05:49] C:\Program Files\Common Files\ Nokia
[05/05/2004|12:22] C:\Program Files\Common Files\ Nullsoft
[05/05/2004|12:22] C:\Program Files\Common Files\ ODBC
[01/06/2008|09:39] C:\Program Files\Common Files\ PCSuite
[10/01/2008|09:43] C:\Program Files\Common Files\ Real
[02/27/2005|04:40] C:\Program Files\Common Files\ ScanSoft Shared
[05/06/2004|01:23] C:\Program Files\Common Files\ Services
[05/22/2007|05:29] C:\Program Files\Common Files\ SONY Digital Images
[05/05/2004|12:22] C:\Program Files\Common Files\ SpeechEngines
[03/01/2006|08:59] C:\Program Files\Common Files\ SWF Studio
[06/22/2007|01:49] C:\Program Files\Common Files\ System
[05/22/2007|05:31] C:\Program Files\Common Files\ Ulead Systems
[10/01/2008|09:43] C:\Program Files\Common Files\ xing shared

——————–\\ Process

( 63 Processes )

… OK !

——————–\\ Searching with S_Lop

No Lop folder found !

——————–\\ Searching for Lop Files - Folders

C:\DOCUME~1\JAMESM~1\Cookies\james_macy@adultfriendfinder[2].txt

——————–\\ Searching within the Registry

….. OK !

——————–\\ Checking the Hosts file

Hosts file CLEAN

——————–\\ Searching for hidden files with Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-06 22:37:11
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes …
scanning hidden files …
scan completed successfully
hidden processes: 0
hidden files: 10

——————–\\ Searching for other infections

——————–\\ Cracks & Keygens ..

C:\DOCUME~1\JAMESM~1\Application Data\ppStream\MyMedia\Fat Joe\Fat Joe - The Crackhouse.ppsl
C:\DOCUME~1\JAMESM~1\Desktop\TONY\Fat_Joe-The_Elephant_In_The_Room-(RapGodFathers.Com)\03-Fat Joe-The Crackhouse (feat. Lil' Wayne)-RGF.mp3
C:\DOCUME~1\JAMESM~1\My Documents\My Music\Joe's MP3's\Kanye West\Late Registration\08 Crack Music.mp3
C:\DOCUME~1\JAMESM~1\Recent\=[SUMOTorrent.com]=_Corel_Paint_Shop_Pro_Photo_X2_Incl_Crack.torrent.lnk
C:\DOCUME~1\JAMESM~1\Recent\Corel Paint Shop Pro Photo X2 Incl Crack.torrent.lnk
C:\DOCUME~1\JAMESM~1\Recent\Corel_Paint_Shop_Pro_Photo_XI_v11_with_Keygen.lnk
C:\DOCUME~1\JAMESM~1\Recent\Keygen-CFF.lnk
C:\DOCUME~1\JAMESM~1\Recent\Keygen-CRD.lnk
C:\DOCUME~1\JAMESM~1\Recent\keygen.rar.lnk

[F:6][D:1]-> C:\DOCUME~1\JAMESM~1\LOCALS~1\Temp
[F:171][D:0]-> C:\DOCUME~1\JAMESM~1\Cookies
[F:63][D:4]-> C:\DOCUME~1\JAMESM~1\LOCALS~1\TEMPOR~1\content.IE5

1 - "C:\Lop SD\LopR_1.txt" - Mon 10/06/2008|22:40 - Option : [1]

——————–\\ Scan completed at 22:40:29

Tomk

Post #5October 7, 2008, 6:37 AM UTC

tonyli9323,

If you want my help, you must run the tools I request in the order I request. It is your computer, so you are free to do with it what you want, however you will do so on your own.

Your computer contains cracked software. This is most likely the source of your infections.

Your computer appears to have been infected by a backdoor trojan. These programs have the ability to steal passwords and other information from your system. If you use your computer for sensitive purposes such as internet banking then I recommend you take the following steps immediately:

Use another, uninfected computer to change all your internet passwords, especially ones with financial implications such as banks, paypal, ebay, etc. You should also change the passwords for any other site you use.
Call your bank(s), credit card company or any other institution which may be affected and advise them that your login/password or credit card information may have been stolen and ask what steps to take with regard to your account.
Consider what other private information could possibly have been taken from your computer and take appropriate steps

This infection can almost certainly be cleaned, but as the malware could be configured to run any program a remote attacker requires, it will be impossible to be 100% sure that the machine is clean, if this is unacceptable to you then you should consider reformatting the system partition and reinstalling Windows as this is the only 100% sure answer.

If you wish to reformat then please let me know in your next response, I'll now continue with instructions for cleaning.

COMBOFIX-Script

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

KILLALL::

File::
C:\Documents and Settings\james macy\Application Data\ppStream\MyMedia\Fat Joe\Fat Joe - The Crackhouse.ppsl
C:\Documents and Settings\james macy\Desktop\TONY\Fat_Joe-The_Elephant_In_The_Room-(RapGodFathers.Com)\03-Fat Joe-The Crackhouse (feat. Lil' Wayne)-RGF.mp3
C:\Documents and Settings\james macy\My Documents\My Music\Joe's MP3's\Kanye West\Late Registration\08 Crack Music.mp3
C:\Documents and Settings\james macy\Recent\=[SUMOTorrent.com]=_Corel_Paint_Shop_Pro_Photo_X2_Incl_Crack.torrent.lnk
C:\Documents and Settings\james macy\Recent\Corel Paint Shop Pro Photo X2 Incl Crack.torrent.lnk
C:\Documents and Settings\james macy\Recent\Corel_Paint_Shop_Pro_Photo_XI_v11_with_Keygen.lnk
C:\Documents and Settings\james macy\Recent\Keygen-CFF.lnk
C:\Documents and Settings\james macy\Recent\Keygen-CRD.lnk
C:\Documents and Settings\james macy\Recent\keygen.rar.lnk
C:\pfsvoddata.bbv
C:\WINDOWS\system32\vtfkronk.exe
C:\WINDOWS\system32\wdvcbxoe.exe
C:\WINDOWS\system32\jbnbnqra.dll
C:\Program Files\temp01
C:\Documents and Settings\james macy\Update.exe

Rootkit::
C:\sqmdata07.sqm
C:\sqmnoopt07.sqm
C:\sqmdata06.sqm
C:\sqmnoopt06.sqm
C:\sqmdata05.sqm
C:\sqmnoopt05.sqm
C:\sqmdata04.sqm
C:\sqmnoopt04.sqm
C:\sqmdata03.sqm
C:\sqmnoopt03.sqm
C:\WINDOWS\system32\jtimabrt.ini
C:\WINDOWS\system32\qwhtsnov.ini
C:\WINDOWS\system32\eeadgigo.ini
C:\WINDOWS\system32\dwdooueh.ini
C:\WINDOWS\system32\prmweina.ini
C:\WINDOWS\system32\amqsqsuw.ini
C:\WINDOWS\system32\eotrppsi.ini
C:\WINDOWS\system32\qfluknho.ini
C:\WINDOWS\system32\rsodbiph.ini
C:\WINDOWS\system32\ixjawnml.ini
C:\WINDOWS\system32\uqghfdvo.ini
C:\WINDOWS\system32\camsaipa.ini
C:\WINDOWS\system32\eooqxxml.ini
C:\WINDOWS\system32\fxiymdke.ini
C:\WINDOWS\system32\iiyuolnm.ini
C:\WINDOWS\system32\esssyljw.ini
C:\WINDOWS\system32\lcmxmsyd.ini
C:\WINDOWS\system32\uelblueq.ini
C:\WINDOWS\system32\llrrftpa.ini
C:\WINDOWS\system32\3758154179.dat
C:\WINDOWS\system32\D27C083E86.dll
C:\WINDOWS\system32\Smab.dll

Driver::
WUSB300NSvc
iPodShellHWDetection

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{164e0c55-9949-11db-a5c9-0040ca7f7cc9}]

Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

[external image: Posted Image]
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

Then

Please go to Kaspersky website and perform an online antivirus scan.

Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
- Spyware, Adware, Dialers, and other potentially dangerous programs
  Archives
  Mail databases
Click on My Computer under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As….
Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
Please post this log in your next reply.

In your next reply please provide:

ComboFix.txt
Kaspersky report
New HijackThis log taken after everything else completed

tonyli9323

Post #6October 8, 2008, 3:46 AM UTC

ComboFix:

ComboFix 08-10-07.06 - james macy 2008-10-07 17:30:14.3 - NTFSx86
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\james macy\Desktop\CFScript.txt
* Created a new restore point
* Resident AV is active

FILE ::
C:\Documents and Settings\james macy\Application Data\ppStream\MyMedia\Fat Joe\Fat Joe - The Crackhouse.ppsl
C:\Documents and Settings\james macy\Desktop\TONY\Fat_Joe-The_Elephant_In_The_Room-(RapGodFathers.Com)\03-Fat Joe-The Crackhouse (feat. Lil' Wayne)-RGF.mp3
C:\Documents and Settings\james macy\My Documents\My Music\Joe's MP3's\Kanye West\Late Registration\08 Crack Music.mp3
C:\Documents and Settings\james macy\Recent\=[SUMOTorrent.com]=_Corel_Paint_Shop_Pro_Photo_X2_Incl_Crack.torrent.lnk
C:\Documents and Settings\james macy\Recent\Corel Paint Shop Pro Photo X2 Incl Crack.torrent.lnk
C:\Documents and Settings\james macy\Recent\Corel_Paint_Shop_Pro_Photo_XI_v11_with_Keygen.lnk
C:\Documents and Settings\james macy\Recent\Keygen-CFF.lnk
C:\Documents and Settings\james macy\Recent\Keygen-CRD.lnk
C:\Documents and Settings\james macy\Recent\keygen.rar.lnk
C:\Documents and Settings\james macy\Update.exe
C:\pfsvoddata.bbv
C:\Program Files\temp01
C:\WINDOWS\system32\jbnbnqra.dll
C:\WINDOWS\system32\vtfkronk.exe
C:\WINDOWS\system32\wdvcbxoe.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\james macy\Application Data\ppStream\MyMedia\Fat Joe\Fat Joe - The Crackhouse.ppsl
C:\Documents and Settings\james macy\Desktop\TONY\Fat_Joe-The_Elephant_In_The_Room-(RapGodFathers.Com)\03-Fat Joe-The Crackhouse (feat. Lil' Wayne)-RGF.mp3
C:\Documents and Settings\james macy\My Documents\My Music\Joe's MP3's\Kanye West\Late Registration\08 Crack Music.mp3
C:\Documents and Settings\james macy\Recent\=[SUMOTorrent.com]=_Corel_Paint_Shop_Pro_Photo_X2_Incl_Crack.torrent.lnk
C:\Documents and Settings\james macy\Recent\Corel Paint Shop Pro Photo X2 Incl Crack.torrent.lnk
C:\Documents and Settings\james macy\Recent\Corel_Paint_Shop_Pro_Photo_XI_v11_with_Keygen.lnk
C:\Documents and Settings\james macy\Recent\Keygen-CFF.lnk
C:\Documents and Settings\james macy\Recent\Keygen-CRD.lnk
C:\Documents and Settings\james macy\Recent\keygen.rar.lnk
C:\Documents and Settings\james macy\Update.exe
C:\pfsvoddata.bbv
C:\Program Files\temp01
C:\sqmdata03.sqm
C:\sqmdata04.sqm
C:\sqmdata05.sqm
C:\sqmdata06.sqm
C:\sqmdata07.sqm
C:\sqmnoopt03.sqm
C:\sqmnoopt04.sqm
C:\sqmnoopt05.sqm
C:\sqmnoopt06.sqm
C:\sqmnoopt07.sqm
C:\test.txt
C:\WINDOWS\system32\3758154179.dat
C:\WINDOWS\system32\amqsqsuw.ini
C:\WINDOWS\system32\camsaipa.ini
C:\WINDOWS\system32\D27C083E86.dll
C:\WINDOWS\system32\dwdooueh.ini
C:\WINDOWS\system32\eeadgigo.ini
C:\WINDOWS\system32\eooqxxml.ini
C:\WINDOWS\system32\eotrppsi.ini
C:\WINDOWS\system32\esssyljw.ini
C:\WINDOWS\system32\fxiymdke.ini
C:\WINDOWS\system32\iiyuolnm.ini
C:\WINDOWS\system32\ixjawnml.ini
C:\WINDOWS\system32\jtimabrt.ini
C:\WINDOWS\system32\lcmxmsyd.ini
C:\WINDOWS\system32\llrrftpa.ini
C:\WINDOWS\system32\prmweina.ini
C:\WINDOWS\system32\qfluknho.ini
C:\WINDOWS\system32\qwhtsnov.ini
C:\WINDOWS\system32\rsodbiph.ini
C:\WINDOWS\system32\Smab.dll
C:\WINDOWS\system32\uelblueq.ini
C:\WINDOWS\system32\uqghfdvo.ini

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_IPODSHELLHWDETECTION
——-\Legacy_WUSB300NSVC
——-\Service_iPodShellHWDetection
——-\Service_WUSB300NSvc

((((((((((((((((((((((((( Files Created from 2008-09-08 to 2008-10-08 )))))))))))))))))))))))))))))))
.

2008-10-06 22:43 . 2008-10-06 22:43 268 –ah—– C:\sqmdata18.sqm
2008-10-06 22:43 . 2008-10-06 22:43 244 –ah—– C:\sqmnoopt18.sqm
2008-10-06 22:35 . 2008-10-06 22:40 d——– C:\Lop SD
2008-10-06 22:25 . 2008-10-06 22:25 122,880 –a—— C:\WINDOWS\system32\jstodizm.exe
2008-10-06 19:38 . 2008-10-06 22:25 d——– C:\Program Files\mzbntbe
2008-10-06 19:38 . 2008-10-06 19:38 d——– C:\Documents and Settings\All Users\Application Data\dmhypwva
2008-10-06 19:38 . 2008-10-06 19:38 122,880 –a—— C:\WINDOWS\system32\ojibcnaf.exe
2008-10-06 00:06 . 2008-10-06 00:06 268 –ah—– C:\sqmdata17.sqm
2008-10-06 00:06 . 2008-10-06 00:06 244 –ah—– C:\sqmnoopt17.sqm
2008-10-05 20:35 . 2008-10-05 20:36 d——– C:\Program Files\The KMPlayer
2008-10-05 01:00 . 2008-10-05 01:00 268 –ah—– C:\sqmdata16.sqm
2008-10-05 01:00 . 2008-10-05 01:00 244 –ah—– C:\sqmnoopt16.sqm
2008-10-03 23:26 . 2008-10-03 23:26 268 –ah—– C:\sqmdata15.sqm
2008-10-03 23:26 . 2008-10-03 23:26 244 –ah—– C:\sqmnoopt15.sqm
2008-10-01 21:43 . 2008-10-01 21:43 d——– C:\Program Files\Common Files\xing shared
2008-09-17 23:37 . 2008-09-17 23:37 268 –ah—– C:\sqmdata14.sqm
2008-09-17 23:37 . 2008-09-17 23:37 244 –ah—– C:\sqmnoopt14.sqm
2008-09-16 22:36 . 2008-09-16 22:36 268 –ah—– C:\sqmdata13.sqm
2008-09-16 22:36 . 2008-09-16 22:36 244 –ah—– C:\sqmnoopt13.sqm
2008-09-15 23:26 . 2008-09-15 23:26 268 –ah—– C:\sqmdata12.sqm
2008-09-15 23:26 . 2008-09-15 23:26 244 –ah—– C:\sqmnoopt12.sqm
2008-09-11 17:17 . 2008-09-11 17:17 d——– C:\Program Files\iTunes
2008-09-11 17:17 . 2008-09-11 17:17 d——– C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-09-11 17:14 . 2008-09-11 17:14 d——– C:\Program Files\Bonjour
2008-09-09 17:06 . 2008-09-09 17:06 0 –a—— C:\WINDOWS\Textart.INI

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-07 23:14 ——— d—–w C:\Documents and Settings\All Users\Application Data\Google Updater
2008-10-04 17:35 ——— d—–w C:\Program Files\Spybot - Search & Destroy
2008-10-04 17:34 ——— d—–w C:\Documents and Settings\james macy\Application Data\uTorrent
2008-10-02 04:43 ——— d—–w C:\Program Files\Common Files\Real
2008-09-29 03:27 ——— d—–w C:\Program Files\Mozilla Thunderbird
2008-09-25 14:38 ——— d—–w C:\Program Files\Lx_cats
2008-09-16 23:26 ——— d—–w C:\Program Files\Google
2008-09-14 07:11 ——— d—–w C:\Program Files\Malwarebytes' Anti-Malware
2008-09-12 00:17 ——— d—–w C:\Program Files\iPod
2008-09-12 00:13 ——— d—–w C:\Program Files\QuickTime
2008-09-12 00:13 ——— d—–w C:\Program Files\Common Files\Apple
2008-09-10 07:04 38,528 —-a-w C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-09-10 07:03 17,200 —-a-w C:\WINDOWS\system32\drivers\mbam.sys
2008-09-04 00:58 0 —ha-w C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-09-04 00:58 0 —ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf
2008-09-04 00:51 ——— d—–w C:\Documents and Settings\All Users\Application Data\Installations
2008-09-04 00:50 ——— d—–w C:\Program Files\Nokia
2008-09-04 00:50 ——— d—–w C:\Program Files\MSXML 6.0
2008-09-04 00:49 ——— d—–w C:\Program Files\Common Files\Nokia
2008-08-30 00:35 ——— d—–w C:\Documents and Settings\james macy\Application Data\Corel
2008-08-29 16:49 97,928 —-a-w C:\WINDOWS\system32\drivers\avgldx86.sys
2008-08-29 13:51 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-08-22 13:50 ——— d—–w C:\Program Files\Microsoft Silverlight
2008-08-17 18:59 ——— d—–w C:\Program Files\uTorrent
2008-08-14 16:30 76,040 —-a-w C:\WINDOWS\system32\drivers\avgtdix.sys
2008-08-14 16:29 ——— d—–w C:\Documents and Settings\All Users\Application Data\avg8
2008-08-13 05:02 ——— d—–w C:\Program Files\Apple Software Update
2008-08-11 20:27 ——— d—–w C:\Program Files\Real
2008-08-11 07:32 ——— d—–w C:\Program Files\PPStream
2008-08-11 07:32 ——— d—–w C:\Documents and Settings\james macy\Application Data\ppStream
2008-08-11 07:27 ——— d—–w C:\Program Files\MSN Messenger
2008-08-10 06:47 ——— d—–w C:\Program Files\PPLiveVA
2008-08-10 06:47 ——— d—–w C:\Documents and Settings\All Users\Application Data\PPLiveVAPPLiveVAShareFlv
2008-08-10 06:47 ——— d—–w C:\Documents and Settings\All Users\Application Data\PPLiveVA
2008-08-10 06:45 ——— d—–w C:\Documents and Settings\james macy\Application Data\PPLiveVA
2008-08-10 06:44 ——— d—–w C:\Documents and Settings\All Users\Application Data\PPLive
2008-04-04 23:08 165,568 —-a-w C:\Documents and Settings\james macy\Application Data\GDIPFONTCACHEV1.DAT
2007-04-06 05:09 229,912 —-a-w C:\Documents and Settings\james macy\channels.dat
2005-01-20 02:19 207 —-a-w C:\Documents and Settings\james macy\J.BAT
2004-08-02 22:38 135,168 ——w C:\Program Files\internet explorer\plugins\West_ACU.dll
2005-05-14 00:12 217,073 –sha-r C:\WINDOWS\meta4.exe
2005-10-24 18:13 66,560 –sha-r C:\WINDOWS\MOTA113.exe
2005-10-14 04:27 422,400 –sha-r C:\WINDOWS\x2.64.exe
2005-10-08 02:14 308,224 –sha-r C:\WINDOWS\system32\avisynth.dll
2005-07-14 19:31 27,648 –sha-r C:\WINDOWS\system32\AVSredirect.dll
2005-06-26 22:32 616,448 –sha-r C:\WINDOWS\system32\cygwin1.dll
2005-06-22 05:37 45,568 –sha-r C:\WINDOWS\system32\cygz.dll
2004-01-25 07:00 70,656 –sha-r C:\WINDOWS\system32\i420vfw.dll
2005-02-28 20:16 240,128 –sha-r C:\WINDOWS\system32\x.264.exe
2004-01-25 07:00 70,656 –sha-r C:\WINDOWS\system32\yv12vfw.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CC1EFA62-AF16-4DB2-ABBB-BFA89740CB45}]
2004-08-02 15:38 135168 ——— C:\Program Files\Internet Explorer\PLUGINS\West_ACU.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 5674352]
"eMuleAutoStart"="C:\Program Files\eMule\eMule.exe" [BU]
"TypingSatellite"="C:\Program Files\TypingMaster\KBOOST.EXE" [BU]
"foxy"="C:\Program Files\Foxy\Foxy.exe" [BU]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 204288]
"dscmon"="C:\WINDOWS\system32\jstodizm.exe" [2008-10-06 122880]
"shgen"="C:\WINDOWS\system32\rudunaxc.exe" [2008-10-07 114688]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2004-03-04 2904064]
"NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2004-03-04 46080]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-10 155648]
"InCD"="C:\Program Files\Ahead\InCD\InCD.exe" [2003-12-18 1241138]
"SunKistEM"="C:\Program Files\eMachines Bay Reader\shwiconem.exe" [2004-03-12 135168]
"BigDogPath"="C:\WINDOWS\VM_STI.EXE" [2003-01-21 40960]
"OpwareSE2"="C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" [2003-05-08 49152]
"Samsung LBP SM"="C:\WINDOWS\Samsung\LaserSMMgr\ssmmgr.exe" [2003-04-03 266240]
"GW Port Controller"="C:\Program Files\Samsung\SmarThru\PORTCTRL.EXE" [2003-01-30 163840]
"Microsoft Works Update Detection"="C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2003-06-08 50688]
"Acrobat Assistant 7.0"="C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2005-09-23 483328]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"MaxtorOneTouch"="C:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe" [2006-03-01 712704]
"mxomssmenu"="C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe" [2005-10-17 81920]
"FaxCenterServer"="C:\Program Files\Lexmark Fax Solutions\fm3032.exe" [2006-02-02 290816]
"lxcrmon.exe"="C:\Program Files\Lexmark 2400 Series\lxcrmon.exe" [2006-03-06 286720]
"EzPrint"="C:\Program Files\Lexmark 2400 Series\ezprint.exe" [2006-02-06 98304]
"PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 271360]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-09-29 1234712]
"LXCRCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCRtime.dll" [2006-02-24 65536]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-09-06 413696]
"AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-09-03 111936]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-09-10 289576]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-10-01 185872]
"nwiz"="nwiz.exe" [2004-03-04 C:\WINDOWS\system32\nwiz.exe]
"nForce Tray Options"="sstray.exe" [2003-09-03 C:\WINDOWS\system32\sstray.exe]
"CHotkey"="zHotkey.exe" [2003-06-04 C:\WINDOWS\zHotkey.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 15360]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 1241088]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run]
"5n6st6s8sN"="C:\Documents and Settings\All Users\Application Data\dmhypwva\fwtarohq.exe" [2008-10-06 69632]

C:\Documents and Settings\james macy\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 113664]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-0000-BA7E-000000000002}\SC_Acrobat.exe [2005-10-16 25214]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-12 83360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"aplcmd"= {3953FFB0-B7FB-632D-7B69-08DB3D8E8A4A} - C:\Program Files\grxeqib\aplcmd.dll [2008-10-07 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"=hex(2):76,69,73,74,61,75,69,2e,65,78,65,00

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cBSJaBSj]
[BU]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\mlJDutsP]
[BU]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\rqRiGxvU]
[BU]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.aflc"= flccodec32.dll
"vidc.afli"= flccodec32.dll
"vidc.aasc"= aasc32.dll
"vidc.yv12"= yv12vfw.dll
"msacm.mpegacm"= mpegacm.acm
"msacm.ulmp3acm"= ulmp3acm.acm
"VIDC.LGIF"= lgif.dll

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Sierra\\Empire Earth\\Empire Earth.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"C:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"C:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"135:TCP"= 135:TCP:TCP Port 135
"5000:TCP"= 5000:TCP:TCP Port 5000
"5001:TCP"= 5001:TCP:TCP Port 5001
"5002:TCP"= 5002:TCP:TCP Port 5002
"5003:TCP"= 5003:TCP:TCP Port 5003
"5004:TCP"= 5004:TCP:TCP Port 5004
"5005:TCP"= 5005:TCP:TCP Port 5005
"5006:TCP"= 5006:TCP:TCP Port 5006
"5007:TCP"= 5007:TCP:TCP Port 5007
"5008:TCP"= 5008:TCP:TCP Port 5008
"5009:TCP"= 5009:TCP:TCP Port 5009
"5010:TCP"= 5010:TCP:TCP Port 5010
"5011:TCP"= 5011:TCP:TCP Port 5011
"5012:TCP"= 5012:TCP:TCP Port 5012
"5013:TCP"= 5013:TCP:TCP Port 5013
"5014:TCP"= 5014:TCP:TCP Port 5014
"5015:TCP"= 5015:TCP:TCP Port 5015
"5016:TCP"= 5016:TCP:TCP Port 5016
"5017:TCP"= 5017:TCP:TCP Port 5017
"5018:TCP"= 5018:TCP:TCP Port 5018
"5019:TCP"= 5019:TCP:TCP Port 5019
"5020:TCP"= 5020:TCP:TCP Port 5020

R0 sonypvl2;sonypvl2;C:\WINDOWS\system32\drivers\sonypvl2.sys [2003-07-25 19478]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-08-29 97928]
R1 sonypvf2;sonypvf2;C:\WINDOWS\system32\drivers\sonypvf2.sys [2003-08-20 635012]
R1 sonypvt2;sonypvt2;C:\WINDOWS\system32\drivers\sonypvt2.sys [2003-08-20 431236]
R2 avg8emc;AVG Free8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-08-29 875288]
R2 avg8wd;AVG Free8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-08-29 231704]
R2 AvgTdiX;AVG Free8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-08-14 76040]
S1 sonypvd2;sonypvd2;C:\WINDOWS\system32\DRIVERS\sonypvd2.sys [2003-06-24 64093]
S3 ASPI;Advanced SCSI Programming Interface Driver;C:\WINDOWS\System32\DRIVERS\ASPI32.sys [2002-07-17 16512]
S3 MD8300;GSL MD8300 Electronic Dictionary;C:\WINDOWS\system32\Drivers\MD8300.sys [2004-09-14 33792]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;C:\WINDOWS\system32\drivers\nmwcdnsu.sys [2008-02-01 138112]
S3 nmwcdnsuc;Nokia USB Flashing Generic;C:\WINDOWS\system32\drivers\nmwcdnsuc.sys [2008-02-01 8320]
S3 P1130VID;Creative WebCam NX Pro;C:\WINDOWS\system32\DRIVERS\P1130Vid.sys [2003-05-07 90357]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{164e0c55-9949-11db-a5c9-0040ca7f7cc9}]
\Shell\AutoRun\command - F:\ONSPCLCK.exe
.
Contents of the 'Scheduled Tasks' folder

2008-09-29 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
.
- - - - ORPHANS REMOVED - - - -

BHO-{15aebfcf-0e11-4770-8ad7-6bda64968432} - (no file)
BHO-{3BB76123-87E8-4D9D-A2E5-AB229AF59E54} - (no file)
BHO-{3F1068B2-358B-4CBE-BE2F-AA187FF35EF2} - (no file)
BHO-{5FE2DBA6-ED5D-49E2-B6DE-35977B2BB66C} - (no file)
BHO-{7FCD5BB7-CBAA-4700-8BAE-A3B7B3B66448} - (no file)
BHO-{9C3E6932-287A-4F2C-AF57-389B5441AD16} - (no file)
BHO-{AB4F5182-B759-4798-B5ED-C8A0431BA00D} - (no file)
BHO-{B9AACCBB-41A7-4308-B0BB-8B2D51CFBFBD} - (no file)
BHO-{F13B7681-D949-4A61-BA09-AC8C7A4B066A} - (no file)

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-07 17:38:39
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

C:\WINDOWS\system32\rudunaxc.exe 114688 bytes executable

scan completed successfully
hidden files: 1

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\Program Files\Ahead\InCD\incdsrv.exe
C:\WINDOWS\system32\conime.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTSVCCDA.EXE
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Maxtor\Maxtor Backup\MaxBackServiceInt.exe
C:\Program Files\Maxtor\OneTouch\Utils\SyncServices.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\WINDOWS\system32\lxcrcoms.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
.
**************************************************************************
.
Completion time: 2008-10-07 17:53:51 - machine was rebooted
ComboFix-quarantined-files.txt 2008-10-08 00:53:40
ComboFix2.txt 2008-10-07 04:50:15
ComboFix3.txt 2008-08-14 17:08:32

Pre-Run: 32,789,798,912 bytes free
Post-Run: 32,754,831,360 bytes free

343 — E O F — 2008-09-10 06:28:33

Kaspersky:
——————————————————————————–
KASPERSKY ONLINE SCANNER 7 REPORT
Tuesday, October 7, 2008
Operating System: Microsoft Windows XP Home Edition Service Pack 2 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Wednesday, October 08, 2008 02:16:15
Records in database: 1298673
——————————————————————————–

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\
F:\
G:\
H:\
I:\
K:\

Scan statistics:
Files scanned: 86563
Threat name: 10
Infected objects: 19
Suspicious objects: 4
Duration of the scan: 02:23:21

File name / Threat name / Threats count
C:\WINDOWS\system32\rudunaxc.exe/C:\WINDOWS\system32\rudunaxc.exe Infected: Trojan.Win32.Obfuscated.gx 1
C:\Program Files\grxeqib\aplcmd.dll/C:\Program Files\grxeqib\aplcmd.dll Infected: Trojan.Win32.Obfuscated.gx 1
C:\Documents and Settings\All Users\Application Data\avg8\update\backup\avgtoolbar.dll Infected: not-a-virus:AdWare.Win32.MegaSearch.ad 1
C:\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\From Laptop-Sarah\Deleted Items.dbx Infected: Trojan-Spy.HTML.Bayfraud.em 1
C:\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\From Office-Sarah\Deleted Items.dbx Suspicious: Trojan-Spy.HTML.Fraud.gen 2
C:\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\From Office-Sarah\Deleted Items.dbx Infected: Trojan-Spy.HTML.Bayfraud.g 1
C:\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\From Office-Sarah\Deleted Items.dbx Infected: Trojan-Spy.HTML.Bayfraud.h 1
C:\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\From Office-Sarah\Deleted Items.dbx Infected: Trojan-Spy.HTML.Bayfraud.em 1
C:\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\From Office-Sarah\Deleted Items.dbx Infected: Trojan-Spy.HTML.Citifraud.ac 1
C:\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\From Office-Sarah\Spam.dbx Infected: Trojan-Spy.HTML.Paylap.bg 1
C:\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\When started Thund 1-25-05\Deleted Items.dbx Infected: Trojan-Spy.HTML.Citifraud.ac 1
C:\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\When started Thund 1-25-05\Deleted Items.dbx Infected: Trojan-Spy.HTML.Bayfraud.em 1
C:\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\When started Thund 1-25-05\Spam.dbx Infected: Trojan-Spy.HTML.Bayfraud.p 1
C:\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\When started Thund 1-25-05\Spam.dbx Infected: Trojan-Spy.HTML.Paylap.bg 1
C:\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\When started Thund 1-25-05\Spam.dbx Infected: Trojan-Spy.HTML.Bayfraud.em 1
C:\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\When started Thund 1-25-05\Spam.dbx Infected: Trojan-Spy.HTML.Bayfraud.h 1
C:\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\When started Thund 1-25-05\Spam.dbx Infected: Trojan-Spy.HTML.Bayfraud.g 1
C:\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\When started Thund 1-25-05\XXDONTKNOW.dbx Suspicious: Trojan-Spy.HTML.Fraud.gen 2
C:\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\When started Thund 1-25-05\XXDONTKNOW.dbx Infected: Trojan-Spy.HTML.Paylap.bg 1
C:\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\When started Thund 1-25-05\XXDONTKNOW.dbx Infected: Trojan-Spy.HTML.Paylap.n 1
C:\Program Files\grxeqib\aplcmd.dll Infected: Trojan.Win32.Obfuscated.gx 1

The scan was stopped by the user.

Hijackthis:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:44:56 PM, on 10/7/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\conime.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Maxtor\Maxtor Backup\MaxBackServiceInt.exe
C:\Program Files\Maxtor\OneTouch\Utils\SyncServices.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\All Users\Application Data\dmhypwva\fwtarohq.exe
C:\WINDOWS\zHotkey.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\eMachines Bay Reader\shwiconem.exe
C:\WINDOWS\VM_STI.EXE
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\WINDOWS\Samsung\LaserSMMgr\ssmmgr.exe
C:\Program Files\Samsung\SmarThru\PORTCTRL.EXE
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\WINDOWS\system32\rudunaxc.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe
C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe
C:\Program Files\Lexmark 2400 Series\lxcrmon.exe
C:\Program Files\Lexmark 2400 Series\ezprint.exe
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\WINDOWS\system32\lxcrcoms.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\explorer.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.509.6972\swg.dll
O2 - BHO: CPub Object - {CC1EFA62-AF16-4DB2-ABBB-BFA89740CB45} - C:\Program Files\Internet Explorer\PLUGINS\West_ACU.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r
O4 - HKLM\..\Run: [CHotkey] zHotkey.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\eMachines Bay Reader\shwiconem.exe
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE USB PC Camera 301P
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [Samsung LBP SM] "C:\WINDOWS\Samsung\LaserSMMgr\ssmmgr.exe" /autorun
O4 - HKLM\..\Run: [GW Port Controller] C:\Program Files\Samsung\SmarThru\PORTCTRL.EXE
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [MaxtorOneTouch] C:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe
O4 - HKLM\..\Run: [mxomssmenu] "C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe"
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [lxcrmon.exe] "C:\Program Files\Lexmark 2400 Series\lxcrmon.exe"
O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 2400 Series\ezprint.exe"
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [LXCRCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCRtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\eMule.exe -AutoStart
O4 - HKCU\..\Run: [TypingSatellite] "C:\Program Files\TypingMaster\KBOOST.EXE"
O4 - HKCU\..\Run: [foxy] "C:\Program Files\Foxy\Foxy.exe" -tray
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [dscmon] C:\WINDOWS\system32\jstodizm.exe
O4 - HKCU\..\Run: [shgen] C:\WINDOWS\system32\rudunaxc.exe
O4 - HKLM\..\Policies\Explorer\Run: [5n6st6s8sN] C:\Documents and Settings\All Users\Application Data\dmhypwva\fwtarohq.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = %SystemRoot%\Installer\{AC76BA86-1033-0000-BA7E-000000000002}\SC_Acrobat.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - (no file)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: WinAVI FLV Manager - {DE365254-2F9B-4908-9E3A-7AAA6EC90BCC} - C:\Program Files\WinAVI FLV Converter\FLVTune.dll
O9 - Extra 'Tools' menuitem: WinAVI FLV Manager - {DE365254-2F9B-4908-9E3A-7AAA6EC90BCC} - C:\Program Files\WinAVI FLV Converter\FLVTune.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - Cmdmapping - (no file) (HKCU)
O15 - ESC Trusted Zone: http://*.update.microsoft.com
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2B36F775-8CF5-4489-B454-2D1B80984CF2} (FXPluginCtl Object) - http://www.powerflasher.de/plugin/powerres.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by122fd.bay122.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/ZH-HK/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) - http://www.acclaim.com/cabs/acclaim_v4.cab
O16 - DPF: {81449547-EB5D-422E-8730-932DC5E412C8} (UVUPlayer Control) - http://www.howardstern.com/install/uvuplayer.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {C228AEDD-FC47-11D3-AF87-D128A9381404} (LSICapture Control) - http://www.link-systems.com/~sdk/SDK/paste/lsiw2k.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS…er.cab56986.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O20 - Winlogon Notify: cBSJaBSj - C:\WINDOWS\
O20 - Winlogon Notify: mlJDutsP - C:\WINDOWS\
O20 - Winlogon Notify: rqRiGxvU - C:\WINDOWS\
O21 - SSODL: aplcmd - {3953FFB0-B7FB-632D-7B69-08DB3D8E8A4A} - C:\Program Files\grxeqib\aplcmd.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Amazon Unbox Video Service (ADVService) - Unknown owner - C:\Program Files\Amazon\Amazon Unbox Video\ADVWindowsClientService.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: C-DillaCdaC11BA - Unknown owner - C:\WINDOWS\system32\drivers\CDAC11BA.EXE (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - AHEAD Software - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Unknown owner - C:\Program Files\Norton AntiVirus\isPwdSvc.exe (file missing)
O23 - Service: LexBce Server (LexBceS) - Unknown owner - C:\WINDOWS\system32\LEXBCES.EXE (file missing)
O23 - Service: LiveUpdate - Unknown owner - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE (file missing)
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe (file missing)
O23 - Service: lxcr_device - - C:\WINDOWS\system32\lxcrcoms.exe
O23 - Service: MaxBackServiceInt - Unknown owner - C:\Program Files\Maxtor\Maxtor Backup\MaxBackServiceInt.exe
O23 - Service: MaxSyncService (NTService1) - - C:\Program Files\Maxtor\OneTouch\Utils\SyncServices.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

–
End of file - 14441 bytes

P.S. I will scan Kaspersky again later!

Tomk

Post #7October 8, 2008, 4:58 AM UTC

tonyli9323,

COMBOFIX-Script

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

KILLALL::

File::
C:\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\From Laptop-Sarah\Deleted Items.dbx
C:\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\From Office-Sarah\Deleted Items.dbx
C:\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\From Office-Sarah\Spam.dbx
C:\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\When started Thund 1-25-05\Deleted Items.dbx
C:\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\When started Thund 1-25-05\Spam.dbx
C:\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\When started Thund 1-25-05\XXDONTKNOW.dbx
C:\Program Files\grxeqib\aplcmd.dll
C:\WINDOWS\system32\jstodizm.exe
C:\WINDOWS\system32\ojibcnaf.exe

Folder::
C:\Documents and Settings\All Users\Application Data\dmhypwva
C:\Program Files\mzbntbe

Rootkit::
C:\sqmdata18.sqm
C:\sqmnoopt18.sqm
C:\sqmdata17.sqm
C:\sqmnoopt17.sqm
C:\sqmdata16.sqm
C:\sqmnoopt16.sqm
C:\sqmdata15.sqm
C:\sqmnoopt15.sqm
C:\sqmdata14.sqm
C:\sqmnoopt14.sqm
C:\sqmdata13.sqm
C:\sqmnoopt13.sqm
C:\sqmdata12.sqm
C:\sqmnoopt12.sqm
C:\WINDOWS\system32\rudunaxc.exe

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run]
"5n6st6s8sN"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"aplcmd"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cBSJaBSj]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\rqRiGxvU]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\mlJDutsP]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{164e0c55-9949-11db-a5c9-0040ca7f7cc9}]

Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

[external image: Posted Image]
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

Then

Please go to Kaspersky website and perform an online antivirus scan.

Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
- Spyware, Adware, Dialers, and other potentially dangerous programs
  Archives
  Mail databases
Click on My Computer under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As….
Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
Please post this log in your next reply.

In your next reply please provide:

ComboFix.txt
Kaspersky report
New HijackThis log taken after everything else completed

tonyli9323

Post #8October 8, 2008, 1:58 PM UTC last edited October 8, 2008, 2:00 PM UTC

Before I did everything else (from your previous post), let's me give you the online scan that took me 6 hours, this one is completed:

——————————————————————————–
KASPERSKY ONLINE SCANNER 7 REPORT
Wednesday, October 8, 2008
Operating System: Microsoft Windows XP Home Edition Service Pack 2 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Wednesday, October 08, 2008 04:47:35
Records in database: 1298977
——————————————————————————–

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\
F:\
G:\
H:\
I:\
K:\

Scan statistics:
Files scanned: 161796
Threat name: 21
Infected objects: 48
Suspicious objects: 4
Duration of the scan: 04:08:13

File name / Threat name / Threats count
C:\WINDOWS\system32\rudunaxc.exe/C:\WINDOWS\system32\rudunaxc.exe Infected: Trojan.Win32.Obfuscated.gx 1
C:\Program Files\grxeqib\aplcmd.dll/C:\Program Files\grxeqib\aplcmd.dll Infected: Trojan.Win32.Obfuscated.gx 1
C:\Documents and Settings\All Users\Application Data\avg8\update\backup\avgtoolbar.dll Infected: not-a-virus:AdWare.Win32.MegaSearch.ad 1
C:\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\From Laptop-Sarah\Deleted Items.dbx Infected: Trojan-Spy.HTML.Bayfraud.em 1
C:\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\From Office-Sarah\Deleted Items.dbx Suspicious: Trojan-Spy.HTML.Fraud.gen 2
C:\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\From Office-Sarah\Deleted Items.dbx Infected: Trojan-Spy.HTML.Bayfraud.g 1
C:\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\From Office-Sarah\Deleted Items.dbx Infected: Trojan-Spy.HTML.Bayfraud.h 1
C:\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\From Office-Sarah\Deleted Items.dbx Infected: Trojan-Spy.HTML.Bayfraud.em 1
C:\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\From Office-Sarah\Deleted Items.dbx Infected: Trojan-Spy.HTML.Citifraud.ac 1
C:\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\From Office-Sarah\Spam.dbx Infected: Trojan-Spy.HTML.Paylap.bg 1
C:\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\When started Thund 1-25-05\Deleted Items.dbx Infected: Trojan-Spy.HTML.Citifraud.ac 1
C:\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\When started Thund 1-25-05\Deleted Items.dbx Infected: Trojan-Spy.HTML.Bayfraud.em 1
C:\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\When started Thund 1-25-05\Spam.dbx Infected: Trojan-Spy.HTML.Bayfraud.p 1
C:\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\When started Thund 1-25-05\Spam.dbx Infected: Trojan-Spy.HTML.Paylap.bg 1
C:\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\When started Thund 1-25-05\Spam.dbx Infected: Trojan-Spy.HTML.Bayfraud.em 1
C:\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\When started Thund 1-25-05\Spam.dbx Infected: Trojan-Spy.HTML.Bayfraud.h 1
C:\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\When started Thund 1-25-05\Spam.dbx Infected: Trojan-Spy.HTML.Bayfraud.g 1
C:\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\When started Thund 1-25-05\XXDONTKNOW.dbx Suspicious: Trojan-Spy.HTML.Fraud.gen 2
C:\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\When started Thund 1-25-05\XXDONTKNOW.dbx Infected: Trojan-Spy.HTML.Paylap.bg 1
C:\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\When started Thund 1-25-05\XXDONTKNOW.dbx Infected: Trojan-Spy.HTML.Paylap.n 1
C:\Program Files\grxeqib\aplcmd.dll Infected: Trojan.Win32.Obfuscated.gx 1
C:\Program Files\mzbntbe\chkmonapl.dll Infected: Trojan.Win32.Obfuscated.gx 1
C:\Program Files\mzbntbe\webapi.dll Infected: Trojan.Win32.Obfuscated.gx 1
C:\QooBox\Quarantine\C\WINDOWS\system32\bfogkdak.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cdy 1
C:\QooBox\Quarantine\C\WINDOWS\system32\ebwiecow.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cdy 1
C:\QooBox\Quarantine\C\WINDOWS\system32\eysjpryy.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.coi 1
C:\QooBox\Quarantine\C\WINDOWS\system32\hglbffdp.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cfn 1
C:\QooBox\Quarantine\C\WINDOWS\system32\hGVOHYQJ.dll.vir Infected: Trojan-Downloader.Win32.Agent.xxa 1
C:\QooBox\Quarantine\C\WINDOWS\system32\hGvtronM.dll.vir Infected: Trojan-Downloader.Win32.Agent.xxa 1
C:\QooBox\Quarantine\C\WINDOWS\system32\lkcaeprk.dll.vir Infected: Trojan.Win32.Monder.dlr 1
C:\QooBox\Quarantine\C\WINDOWS\system32\nbxlzd.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.coi 1
C:\QooBox\Quarantine\C\WINDOWS\system32\pkvtvj.dll.vir Infected: Trojan.Win32.Monder.amg 1
C:\QooBox\Quarantine\C\WINDOWS\system32\qjchdf.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cdy 1
C:\QooBox\Quarantine\C\WINDOWS\system32\simtoblf.dll.vir Infected: Trojan.Win32.Monder.amg 1
C:\QooBox\Quarantine\C\WINDOWS\system32\tldixejg.dll.vir Infected: Trojan.Win32.Monder.dkd 1
C:\QooBox\Quarantine\C\WINDOWS\system32\tpdghqci.dll.vir Infected: Trojan.Win32.Monderb.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\trbamitj.dll.vir Infected: Trojan.Win32.Monder.dmj 1
C:\QooBox\Quarantine\C\WINDOWS\system32\vblallmg.dll.vir Infected: Trojan.Win32.Monderb.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\vxvlibut.dll.vir Infected: Trojan.Win32.Monder.dlr 1
C:\QooBox\Quarantine\C\WINDOWS\system32\wuowsl.dll.vir Infected: Trojan.Win32.Monderb.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\xetzsd.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cdy 1
C:\QooBox\Quarantine\C\WINDOWS\system32\xwsgjl.dll.vir Infected: Trojan.Win32.Monderb.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\xxntfano.dll.vir Infected: Trojan.Win32.Monder.dlr 1
C:\SDFix\backups\backups.zip Infected: Trojan-Downloader.Win32.ConHook.pr 1
C:\SDFix\backups_old\backups.zip Infected: Trojan-Downloader.Win32.ConHook.bet 1
C:\VundoFix Backups\jtvxnowd.dll.bad Infected: Trojan.Win32.Monderb.gen 1
C:\VundoFix Backups\pfnagcpd.dll.bad Infected: Trojan.Win32.Monderb.gen 1
C:\WINDOWS\system32\jstodizm.exe Infected: Trojan.Win32.Obfuscated.gx 1
C:\WINDOWS\system32\ojibcnaf.exe Infected: Trojan.Win32.Obfuscated.gx 1
C:\WINDOWS\system32\rudunaxc.exe Infected: Trojan.Win32.Obfuscated.gx 1

The selected area was scanned.

Here is the new HJT:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:00:03 AM, on 10/8/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\conime.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Maxtor\Maxtor Backup\MaxBackServiceInt.exe
C:\Program Files\Maxtor\OneTouch\Utils\SyncServices.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\All Users\Application Data\dmhypwva\fwtarohq.exe
C:\WINDOWS\zHotkey.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\eMachines Bay Reader\shwiconem.exe
C:\WINDOWS\VM_STI.EXE
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\WINDOWS\Samsung\LaserSMMgr\ssmmgr.exe
C:\Program Files\Samsung\SmarThru\PORTCTRL.EXE
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\WINDOWS\system32\rudunaxc.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe
C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe
C:\Program Files\Lexmark 2400 Series\lxcrmon.exe
C:\Program Files\Lexmark 2400 Series\ezprint.exe
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\WINDOWS\system32\lxcrcoms.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\explorer.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\james macy\Local Settings\temp\jkos-james macy\binaries\ScanningProcess.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.509.6972\swg.dll
O2 - BHO: CPub Object - {CC1EFA62-AF16-4DB2-ABBB-BFA89740CB45} - C:\Program Files\Internet Explorer\PLUGINS\West_ACU.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r
O4 - HKLM\..\Run: [CHotkey] zHotkey.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\eMachines Bay Reader\shwiconem.exe
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE USB PC Camera 301P
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [Samsung LBP SM] "C:\WINDOWS\Samsung\LaserSMMgr\ssmmgr.exe" /autorun
O4 - HKLM\..\Run: [GW Port Controller] C:\Program Files\Samsung\SmarThru\PORTCTRL.EXE
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [MaxtorOneTouch] C:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe
O4 - HKLM\..\Run: [mxomssmenu] "C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe"
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [lxcrmon.exe] "C:\Program Files\Lexmark 2400 Series\lxcrmon.exe"
O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 2400 Series\ezprint.exe"
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [LXCRCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCRtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\eMule.exe -AutoStart
O4 - HKCU\..\Run: [TypingSatellite] "C:\Program Files\TypingMaster\KBOOST.EXE"
O4 - HKCU\..\Run: [foxy] "C:\Program Files\Foxy\Foxy.exe" -tray
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [dscmon] C:\WINDOWS\system32\jstodizm.exe
O4 - HKCU\..\Run: [shgen] C:\WINDOWS\system32\rudunaxc.exe
O4 - HKCU\..\Run: [DbUtil] C:\WINDOWS\system32\otgpydqn.exe
O4 - HKLM\..\Policies\Explorer\Run: [5n6st6s8sN] C:\Documents and Settings\All Users\Application Data\dmhypwva\fwtarohq.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = %SystemRoot%\Installer\{AC76BA86-1033-0000-BA7E-000000000002}\SC_Acrobat.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - (no file)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: WinAVI FLV Manager - {DE365254-2F9B-4908-9E3A-7AAA6EC90BCC} - C:\Program Files\WinAVI FLV Converter\FLVTune.dll
O9 - Extra 'Tools' menuitem: WinAVI FLV Manager - {DE365254-2F9B-4908-9E3A-7AAA6EC90BCC} - C:\Program Files\WinAVI FLV Converter\FLVTune.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - Cmdmapping - (no file) (HKCU)
O15 - ESC Trusted Zone: http://*.update.microsoft.com
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2B36F775-8CF5-4489-B454-2D1B80984CF2} (FXPluginCtl Object) - http://www.powerflasher.de/plugin/powerres.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by122fd.bay122.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/ZH-HK/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) - http://www.acclaim.com/cabs/acclaim_v4.cab
O16 - DPF: {81449547-EB5D-422E-8730-932DC5E412C8} (UVUPlayer Control) - http://www.howardstern.com/install/uvuplayer.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {C228AEDD-FC47-11D3-AF87-D128A9381404} (LSICapture Control) - http://www.link-systems.com/~sdk/SDK/paste/lsiw2k.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS…er.cab56986.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O20 - Winlogon Notify: cBSJaBSj - C:\WINDOWS\
O20 - Winlogon Notify: mlJDutsP - C:\WINDOWS\
O20 - Winlogon Notify: rqRiGxvU - C:\WINDOWS\
O21 - SSODL: aplcmd - {3953FFB0-B7FB-632D-7B69-08DB3D8E8A4A} - C:\Program Files\grxeqib\aplcmd.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Amazon Unbox Video Service (ADVService) - Unknown owner - C:\Program Files\Amazon\Amazon Unbox Video\ADVWindowsClientService.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: C-DillaCdaC11BA - Unknown owner - C:\WINDOWS\system32\drivers\CDAC11BA.EXE (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - AHEAD Software - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Unknown owner - C:\Program Files\Norton AntiVirus\isPwdSvc.exe (file missing)
O23 - Service: LexBce Server (LexBceS) - Unknown owner - C:\WINDOWS\system32\LEXBCES.EXE (file missing)
O23 - Service: LiveUpdate - Unknown owner - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE (file missing)
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe (file missing)
O23 - Service: lxcr_device - - C:\WINDOWS\system32\lxcrcoms.exe
O23 - Service: MaxBackServiceInt - Unknown owner - C:\Program Files\Maxtor\Maxtor Backup\MaxBackServiceInt.exe
O23 - Service: MaxSyncService (NTService1) - - C:\Program Files\Maxtor\OneTouch\Utils\SyncServices.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

–
End of file - 14605 bytes

Tomk

Post #9October 8, 2008, 2:48 PM UTC

tonyli9323, That scan agrees with what the one you posted earlier told me. Directions are correct. Please continue.

tonyli9323

Post #10October 9, 2008, 2:02 PM UTC

Combo Fix:
ComboFix 08-10-08.02 - james macy 2008-10-08 16:21:01.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.[removed].18.570 [GMT -7:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\james macy\Desktop\CFScript.txt
* Created a new restore point

FILE ::
C:\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\From Laptop-Sarah\Deleted Items.dbx
C:\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\From Office-Sarah\Deleted Items.dbx
C:\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\From Office-Sarah\Spam.dbx
C:\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\When started Thund 1-25-05\Deleted Items.dbx
C:\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\When started Thund 1-25-05\Spam.dbx
C:\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\When started Thund 1-25-05\XXDONTKNOW.dbx
C:\Program Files\grxeqib\aplcmd.dll
C:\WINDOWS\system32\jstodizm.exe
C:\WINDOWS\system32\ojibcnaf.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\dmhypwva
C:\Documents and Settings\All Users\Application Data\dmhypwva\fwtarohq.exe
C:\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\From Laptop-Sarah\Deleted Items.dbx
C:\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\From Office-Sarah\Deleted Items.dbx
C:\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\From Office-Sarah\Spam.dbx
C:\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\When started Thund 1-25-05\Deleted Items.dbx
C:\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\When started Thund 1-25-05\Spam.dbx
C:\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\When started Thund 1-25-05\XXDONTKNOW.dbx
C:\Program Files\grxeqib\aplcmd.dll
C:\Program Files\mzbntbe
C:\Program Files\mzbntbe\chkmonapl.dll
C:\Program Files\mzbntbe\webapi.dll
C:\sqmdata12.sqm
C:\sqmdata13.sqm
C:\sqmdata14.sqm
C:\sqmdata15.sqm
C:\sqmdata16.sqm
C:\sqmdata17.sqm
C:\sqmdata18.sqm
C:\sqmnoopt12.sqm
C:\sqmnoopt13.sqm
C:\sqmnoopt14.sqm
C:\sqmnoopt15.sqm
C:\sqmnoopt16.sqm
C:\sqmnoopt17.sqm
C:\sqmnoopt18.sqm
C:\WINDOWS\system32\jstodizm.exe
C:\WINDOWS\system32\ojibcnaf.exe
C:\WINDOWS\system32\rudunaxc.exe

.
((((((((((((((((((((((((( Files Created from 2008-09-08 to 2008-10-08 )))))))))))))))))))))))))))))))
.

2008-10-08 05:43 . 2008-10-08 05:43 114,688 –a—— C:\WINDOWS\system32\otgpydqn.exe
2008-10-07 17:44 . 2008-10-08 16:23 d——– C:\Program Files\grxeqib
2008-10-06 22:35 . 2008-10-06 22:40 d——– C:\Lop SD
2008-10-05 20:35 . 2008-10-05 20:36 d——– C:\Program Files\The KMPlayer
2008-10-01 21:43 . 2008-10-01 21:43 d——– C:\Program Files\Common Files\xing shared
2008-09-11 17:17 . 2008-09-11 17:17 d——– C:\Program Files\iTunes
2008-09-11 17:17 . 2008-09-11 17:17 d——– C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-09-11 17:14 . 2008-09-11 17:14 d——– C:\Program Files\Bonjour
2008-09-09 17:06 . 2008-09-09 17:06 0 –a—— C:\WINDOWS\Textart.INI

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-07 23:14 ——— d—–w C:\Documents and Settings\All Users\Application Data\Google Updater
2008-10-04 17:35 ——— d—–w C:\Program Files\Spybot - Search & Destroy
2008-10-04 17:34 ——— d—–w C:\Documents and Settings\james macy\Application Data\uTorrent
2008-10-02 04:43 ——— d—–w C:\Program Files\Common Files\Real
2008-09-29 03:27 ——— d—–w C:\Program Files\Mozilla Thunderbird
2008-09-25 14:38 ——— d—–w C:\Program Files\Lx_cats
2008-09-16 23:26 ——— d—–w C:\Program Files\Google
2008-09-14 07:11 ——— d—–w C:\Program Files\Malwarebytes' Anti-Malware
2008-09-12 00:17 ——— d—–w C:\Program Files\iPod
2008-09-12 00:13 ——— d—–w C:\Program Files\QuickTime
2008-09-12 00:13 ——— d—–w C:\Program Files\Common Files\Apple
2008-09-10 07:04 38,528 —-a-w C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-09-10 07:03 17,200 —-a-w C:\WINDOWS\system32\drivers\mbam.sys
2008-09-04 00:58 0 —ha-w C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-09-04 00:58 0 —ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf
2008-09-04 00:51 ——— d—–w C:\Documents and Settings\All Users\Application Data\Installations
2008-09-04 00:50 ——— d—–w C:\Program Files\Nokia
2008-09-04 00:50 ——— d—–w C:\Program Files\MSXML 6.0
2008-09-04 00:49 ——— d—–w C:\Program Files\Common Files\Nokia
2008-08-30 00:35 ——— d—–w C:\Documents and Settings\james macy\Application Data\Corel
2008-08-29 17:18 87,336 —-a-w C:\WINDOWS\system32\dns-sd.exe
2008-08-29 16:53 61,440 —-a-w C:\WINDOWS\system32\dnssd.dll
2008-08-29 16:49 97,928 —-a-w C:\WINDOWS\system32\drivers\avgldx86.sys
2008-08-29 13:51 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-08-22 13:50 ——— d—–w C:\Program Files\Microsoft Silverlight
2008-08-17 18:59 ——— d—–w C:\Program Files\uTorrent
2008-08-14 16:30 76,040 —-a-w C:\WINDOWS\system32\drivers\avgtdix.sys
2008-08-14 16:30 10,520 —-a-w C:\WINDOWS\system32\avgrsstx.dll
2008-08-14 16:29 ——— d—–w C:\Documents and Settings\All Users\Application Data\avg8
2008-08-13 05:02 ——— d—–w C:\Program Files\Apple Software Update
2008-08-11 20:27 ——— d—–w C:\Program Files\Real
2008-08-11 07:32 ——— d—–w C:\Program Files\PPStream
2008-08-11 07:32 ——— d—–w C:\Documents and Settings\james macy\Application Data\ppStream
2008-08-11 07:27 ——— d—–w C:\Program Files\MSN Messenger
2008-08-10 06:47 ——— d—–w C:\Program Files\PPLiveVA
2008-08-10 06:47 ——— d—–w C:\Documents and Settings\All Users\Application Data\PPLiveVAPPLiveVAShareFlv
2008-08-10 06:47 ——— d—–w C:\Documents and Settings\All Users\Application Data\PPLiveVA
2008-08-10 06:45 ——— d—–w C:\Documents and Settings\james macy\Application Data\PPLiveVA
2008-08-10 06:44 ——— d—–w C:\Documents and Settings\All Users\Application Data\PPLive
2008-07-19 05:10 94,920 —-a-w C:\WINDOWS\system32\cdm.dll
2008-07-19 05:10 53,448 —-a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-19 05:10 45,768 —-a-w C:\WINDOWS\system32\wups2.dll
2008-07-19 05:10 36,552 —-a-w C:\WINDOWS\system32\wups.dll
2008-07-19 05:09 563,912 —-a-w C:\WINDOWS\system32\wuapi.dll
2008-07-19 05:09 325,832 —-a-w C:\WINDOWS\system32\wucltui.dll
2008-07-19 05:09 205,000 —-a-w C:\WINDOWS\system32\wuweb.dll
2008-07-19 05:09 1,811,656 —-a-w C:\WINDOWS\system32\wuaueng.dll
2008-04-04 23:08 165,568 —-a-w C:\Documents and Settings\james macy\Application Data\GDIPFONTCACHEV1.DAT
2007-04-06 05:09 229,912 —-a-w C:\Documents and Settings\james macy\channels.dat
2005-01-20 02:19 207 —-a-w C:\Documents and Settings\james macy\J.BAT
2002-10-04 22:09 204,800 —-a-w C:\WINDOWS\inf\FXPlugin.dll
2004-08-02 22:38 135,168 ——w C:\Program Files\internet explorer\plugins\West_ACU.dll
2005-05-14 00:12 217,073 –sha-r C:\WINDOWS\meta4.exe
2005-10-24 18:13 66,560 –sha-r C:\WINDOWS\MOTA113.exe
2005-10-14 04:27 422,400 –sha-r C:\WINDOWS\x2.64.exe
2005-10-08 02:14 308,224 –sha-r C:\WINDOWS\system32\avisynth.dll
2005-07-14 19:31 27,648 –sha-r C:\WINDOWS\system32\AVSredirect.dll
2005-06-26 22:32 616,448 –sha-r C:\WINDOWS\system32\cygwin1.dll
2005-06-22 05:37 45,568 –sha-r C:\WINDOWS\system32\cygz.dll
2004-01-25 07:00 70,656 –sha-r C:\WINDOWS\system32\i420vfw.dll
2005-02-28 20:16 240,128 –sha-r C:\WINDOWS\system32\x.264.exe
2004-01-25 07:00 70,656 –sha-r C:\WINDOWS\system32\yv12vfw.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CC1EFA62-AF16-4DB2-ABBB-BFA89740CB45}]
2004-08-02 15:38 135168 ——— C:\Program Files\Internet Explorer\PLUGINS\West_ACU.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 5674352]
"eMuleAutoStart"="C:\Program Files\eMule\eMule.exe" [BU]
"TypingSatellite"="C:\Program Files\TypingMaster\KBOOST.EXE" [BU]
"foxy"="C:\Program Files\Foxy\Foxy.exe" [BU]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 204288]
"DbUtil"="C:\WINDOWS\system32\otgpydqn.exe" [2008-10-08 114688]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2004-03-04 2904064]
"NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2004-03-04 46080]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-10 155648]
"InCD"="C:\Program Files\Ahead\InCD\InCD.exe" [2003-12-18 1241138]
"SunKistEM"="C:\Program Files\eMachines Bay Reader\shwiconem.exe" [2004-03-12 135168]
"BigDogPath"="C:\WINDOWS\VM_STI.EXE" [2003-01-21 40960]
"OpwareSE2"="C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" [2003-05-08 49152]
"Samsung LBP SM"="C:\WINDOWS\Samsung\LaserSMMgr\ssmmgr.exe" [2003-04-03 266240]
"GW Port Controller"="C:\Program Files\Samsung\SmarThru\PORTCTRL.EXE" [2003-01-30 163840]
"Microsoft Works Update Detection"="C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2003-06-08 50688]
"Acrobat Assistant 7.0"="C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2005-09-23 483328]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"MaxtorOneTouch"="C:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe" [2006-03-01 712704]
"mxomssmenu"="C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe" [2005-10-17 81920]
"FaxCenterServer"="C:\Program Files\Lexmark Fax Solutions\fm3032.exe" [2006-02-02 290816]
"lxcrmon.exe"="C:\Program Files\Lexmark 2400 Series\lxcrmon.exe" [2006-03-06 286720]
"EzPrint"="C:\Program Files\Lexmark 2400 Series\ezprint.exe" [2006-02-06 98304]
"PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 271360]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-09-29 1234712]
"LXCRCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCRtime.dll" [2006-02-24 65536]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-09-06 413696]
"AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-09-03 111936]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-09-10 289576]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-10-01 185872]
"nwiz"="nwiz.exe" [2004-03-04 C:\WINDOWS\system32\nwiz.exe]
"nForce Tray Options"="sstray.exe" [2003-09-03 C:\WINDOWS\system32\sstray.exe]
"CHotkey"="zHotkey.exe" [2003-06-04 C:\WINDOWS\zHotkey.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 15360]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 1241088]

C:\Documents and Settings\james macy\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 113664]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-0000-BA7E-000000000002}\SC_Acrobat.exe [2005-10-16 25214]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-12 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"=hex(2):76,69,73,74,61,75,69,2e,65,78,65,00

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.aflc"= flccodec32.dll
"vidc.afli"= flccodec32.dll
"vidc.aasc"= aasc32.dll
"vidc.yv12"= yv12vfw.dll
"msacm.mpegacm"= mpegacm.acm
"msacm.ulmp3acm"= ulmp3acm.acm
"VIDC.LGIF"= lgif.dll

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Sierra\\Empire Earth\\Empire Earth.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"C:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"C:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"135:TCP"= 135:TCP:TCP Port 135
"5000:TCP"= 5000:TCP:TCP Port 5000
"5001:TCP"= 5001:TCP:TCP Port 5001
"5002:TCP"= 5002:TCP:TCP Port 5002
"5003:TCP"= 5003:TCP:TCP Port 5003
"5004:TCP"= 5004:TCP:TCP Port 5004
"5005:TCP"= 5005:TCP:TCP Port 5005
"5006:TCP"= 5006:TCP:TCP Port 5006
"5007:TCP"= 5007:TCP:TCP Port 5007
"5008:TCP"= 5008:TCP:TCP Port 5008
"5009:TCP"= 5009:TCP:TCP Port 5009
"5010:TCP"= 5010:TCP:TCP Port 5010
"5011:TCP"= 5011:TCP:TCP Port 5011
"5012:TCP"= 5012:TCP:TCP Port 5012
"5013:TCP"= 5013:TCP:TCP Port 5013
"5014:TCP"= 5014:TCP:TCP Port 5014
"5015:TCP"= 5015:TCP:TCP Port 5015
"5016:TCP"= 5016:TCP:TCP Port 5016
"5017:TCP"= 5017:TCP:TCP Port 5017
"5018:TCP"= 5018:TCP:TCP Port 5018
"5019:TCP"= 5019:TCP:TCP Port 5019
"5020:TCP"= 5020:TCP:TCP Port 5020

R0 sonypvl2;sonypvl2;C:\WINDOWS\system32\drivers\sonypvl2.sys [2003-07-25 19478]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-08-29 97928]
R1 sonypvf2;sonypvf2;C:\WINDOWS\system32\drivers\sonypvf2.sys [2003-08-20 635012]
R1 sonypvt2;sonypvt2;C:\WINDOWS\system32\drivers\sonypvt2.sys [2003-08-20 431236]
R2 avg8emc;AVG Free8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-08-29 875288]
R2 avg8wd;AVG Free8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-08-29 231704]
R2 AvgTdiX;AVG Free8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-08-14 76040]
S1 sonypvd2;sonypvd2;C:\WINDOWS\system32\DRIVERS\sonypvd2.sys [2003-06-24 64093]
S3 ASPI;Advanced SCSI Programming Interface Driver;C:\WINDOWS\System32\DRIVERS\ASPI32.sys [2002-07-17 16512]
S3 MD8300;GSL MD8300 Electronic Dictionary;C:\WINDOWS\system32\Drivers\MD8300.sys [2004-09-14 33792]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;C:\WINDOWS\system32\drivers\nmwcdnsu.sys [2008-02-01 138112]
S3 nmwcdnsuc;Nokia USB Flashing Generic;C:\WINDOWS\system32\drivers\nmwcdnsuc.sys [2008-02-01 8320]
S3 P1130VID;Creative WebCam NX Pro;C:\WINDOWS\system32\DRIVERS\P1130Vid.sys [2003-05-07 90357]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{164e0c55-9949-11db-a5c9-0040ca7f7cc9}]
\Shell\AutoRun\command - F:\ONSPCLCK.exe
.
Contents of the 'Scheduled Tasks' folder

2008-09-29 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-dscmon - C:\WINDOWS\system32\jstodizm.exe
HKCU-Run-shgen - C:\WINDOWS\system32\rudunaxc.exe

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-08 16:31:19
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\Program Files\Ahead\InCD\incdsrv.exe
C:\WINDOWS\system32\conime.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTSVCCDA.EXE
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Maxtor\Maxtor Backup\MaxBackServiceInt.exe
C:\Program Files\Maxtor\OneTouch\Utils\SyncServices.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\WINDOWS\system32\lxcrcoms.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
.
**************************************************************************
.
Completion time: 2008-10-08 16:47:17 - machine was rebooted
ComboFix-quarantined-files.txt 2008-10-08 23:47:05
ComboFix2.txt 2008-10-08 00:54:01
ComboFix3.txt 2008-10-07 04:50:15
ComboFix4.txt 2008-08-14 17:08:32

Pre-Run: 32,464,699,392 bytes free
Post-Run: 32,493,162,496 bytes free

293 — E O F — 2008-09-10 06:28:33

Online Scan:
——————————————————————————–
KASPERSKY ONLINE SCANNER 7 REPORT
Thursday, October 9, 2008
Operating System: Microsoft Windows XP Home Edition Service Pack 2 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Wednesday, October 08, 2008 16:55:28
Records in database: 1299861
——————————————————————————–

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\
F:\
G:\
H:\
I:\
K:\

Scan statistics:
Files scanned: 162058
Threat name: 21
Infected objects: 49
Suspicious objects: 4
Duration of the scan: 04:15:16

File name / Threat name / Threats count
C:\WINDOWS\system32\otgpydqn.exe/C:\WINDOWS\system32\otgpydqn.exe Infected: Trojan.Win32.Obfuscated.gx 1
C:\Documents and Settings\All Users\Application Data\avg8\update\backup\avgtoolbar.dll Infected: not-a-virus:AdWare.Win32.MegaSearch.ad 1
C:\QooBox\Quarantine\C\Documents and Settings\All Users\Application Data\dmhypwva\fwtarohq.exe.vir Infected: Trojan.Win32.Obfuscated.gx 1
C:\QooBox\Quarantine\C\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\From Laptop-Sarah\Deleted Items.dbx.vir Infected: Trojan-Spy.HTML.Bayfraud.em 1
C:\QooBox\Quarantine\C\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\From Office-Sarah\Deleted Items.dbx.vir Suspicious: Trojan-Spy.HTML.Fraud.gen 2
C:\QooBox\Quarantine\C\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\From Office-Sarah\Deleted Items.dbx.vir Infected: Trojan-Spy.HTML.Bayfraud.g 1
C:\QooBox\Quarantine\C\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\From Office-Sarah\Deleted Items.dbx.vir Infected: Trojan-Spy.HTML.Bayfraud.h 1
C:\QooBox\Quarantine\C\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\From Office-Sarah\Deleted Items.dbx.vir Infected: Trojan-Spy.HTML.Bayfraud.em 1
C:\QooBox\Quarantine\C\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\From Office-Sarah\Deleted Items.dbx.vir Infected: Trojan-Spy.HTML.Citifraud.ac 1
C:\QooBox\Quarantine\C\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\From Office-Sarah\Spam.dbx.vir Infected: Trojan-Spy.HTML.Paylap.bg 1
C:\QooBox\Quarantine\C\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\When started Thund 1-25-05\Deleted Items.dbx.vir Infected: Trojan-Spy.HTML.Citifraud.ac 1
C:\QooBox\Quarantine\C\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\When started Thund 1-25-05\Deleted Items.dbx.vir Infected: Trojan-Spy.HTML.Bayfraud.em 1
C:\QooBox\Quarantine\C\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\When started Thund 1-25-05\Spam.dbx.vir Infected: Trojan-Spy.HTML.Bayfraud.p 1
C:\QooBox\Quarantine\C\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\When started Thund 1-25-05\Spam.dbx.vir Infected: Trojan-Spy.HTML.Paylap.bg 1
C:\QooBox\Quarantine\C\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\When started Thund 1-25-05\Spam.dbx.vir Infected: Trojan-Spy.HTML.Bayfraud.em 1
C:\QooBox\Quarantine\C\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\When started Thund 1-25-05\Spam.dbx.vir Infected: Trojan-Spy.HTML.Bayfraud.h 1
C:\QooBox\Quarantine\C\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\When started Thund 1-25-05\Spam.dbx.vir Infected: Trojan-Spy.HTML.Bayfraud.g 1
C:\QooBox\Quarantine\C\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\When started Thund 1-25-05\XXDONTKNOW.dbx.vir Suspicious: Trojan-Spy.HTML.Fraud.gen 2
C:\QooBox\Quarantine\C\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\When started Thund 1-25-05\XXDONTKNOW.dbx.vir Infected: Trojan-Spy.HTML.Paylap.bg 1
C:\QooBox\Quarantine\C\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\When started Thund 1-25-05\XXDONTKNOW.dbx.vir Infected: Trojan-Spy.HTML.Paylap.n 1
C:\QooBox\Quarantine\C\Program Files\grxeqib\aplcmd.dll.vir Infected: Trojan.Win32.Obfuscated.gx 1
C:\QooBox\Quarantine\C\Program Files\mzbntbe\chkmonapl.dll.vir Infected: Trojan.Win32.Obfuscated.gx 1
C:\QooBox\Quarantine\C\Program Files\mzbntbe\webapi.dll.vir Infected: Trojan.Win32.Obfuscated.gx 1
C:\QooBox\Quarantine\C\WINDOWS\system32\bfogkdak.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cdy 1
C:\QooBox\Quarantine\C\WINDOWS\system32\ebwiecow.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cdy 1
C:\QooBox\Quarantine\C\WINDOWS\system32\eysjpryy.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.coi 1
C:\QooBox\Quarantine\C\WINDOWS\system32\hglbffdp.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cfn 1
C:\QooBox\Quarantine\C\WINDOWS\system32\hGVOHYQJ.dll.vir Infected: Trojan-Downloader.Win32.Agent.xxa 1
C:\QooBox\Quarantine\C\WINDOWS\system32\hGvtronM.dll.vir Infected: Trojan-Downloader.Win32.Agent.xxa 1
C:\QooBox\Quarantine\C\WINDOWS\system32\jstodizm.exe.vir Infected: Trojan.Win32.Obfuscated.gx 1
C:\QooBox\Quarantine\C\WINDOWS\system32\lkcaeprk.dll.vir Infected: Trojan.Win32.Monder.dlr 1
C:\QooBox\Quarantine\C\WINDOWS\system32\nbxlzd.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.coi 1
C:\QooBox\Quarantine\C\WINDOWS\system32\ojibcnaf.exe.vir Infected: Trojan.Win32.Obfuscated.gx 1
C:\QooBox\Quarantine\C\WINDOWS\system32\pkvtvj.dll.vir Infected: Trojan.Win32.Monder.amg 1
C:\QooBox\Quarantine\C\WINDOWS\system32\qjchdf.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cdy 1
C:\QooBox\Quarantine\C\WINDOWS\system32\simtoblf.dll.vir Infected: Trojan.Win32.Monder.amg 1
C:\QooBox\Quarantine\C\WINDOWS\system32\tldixejg.dll.vir Infected: Trojan.Win32.Monder.dkd 1
C:\QooBox\Quarantine\C\WINDOWS\system32\tpdghqci.dll.vir Infected: Trojan.Win32.Monderb.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\trbamitj.dll.vir Infected: Trojan.Win32.Monder.dmj 1
C:\QooBox\Quarantine\C\WINDOWS\system32\vblallmg.dll.vir Infected: Trojan.Win32.Monderb.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\vxvlibut.dll.vir Infected: Trojan.Win32.Monder.dlr 1
C:\QooBox\Quarantine\C\WINDOWS\system32\wuowsl.dll.vir Infected: Trojan.Win32.Monderb.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\xetzsd.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cdy 1
C:\QooBox\Quarantine\C\WINDOWS\system32\xwsgjl.dll.vir Infected: Trojan.Win32.Monderb.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\xxntfano.dll.vir Infected: Trojan.Win32.Monder.dlr 1
C:\QooBox\Quarantine\catchme2008-10-08_162749.36.zip Infected: Trojan.Win32.Obfuscated.gx 1
C:\SDFix\backups\backups.zip Infected: Trojan-Downloader.Win32.ConHook.pr 1
C:\SDFix\backups_old\backups.zip Infected: Trojan-Downloader.Win32.ConHook.bet 1
C:\VundoFix Backups\jtvxnowd.dll.bad Infected: Trojan.Win32.Monderb.gen 1
C:\VundoFix Backups\pfnagcpd.dll.bad Infected: Trojan.Win32.Monderb.gen 1
C:\WINDOWS\system32\otgpydqn.exe Infected: Trojan.Win32.Obfuscated.gx 1

The selected area was scanned.

Hijackthis:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:59:57 AM, on 10/9/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\conime.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Maxtor\Maxtor Backup\MaxBackServiceInt.exe
C:\Program Files\Maxtor\OneTouch\Utils\SyncServices.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\zHotkey.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\eMachines Bay Reader\shwiconem.exe
C:\WINDOWS\VM_STI.EXE
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\WINDOWS\Samsung\LaserSMMgr\ssmmgr.exe
C:\Program Files\Samsung\SmarThru\PORTCTRL.EXE
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe
C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe
C:\Program Files\Lexmark 2400 Series\lxcrmon.exe
C:\Program Files\Lexmark 2400 Series\ezprint.exe
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\WINDOWS\system32\otgpydqn.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\WINDOWS\system32\lxcrcoms.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\explorer.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\james macy\Local Settings\temp\jkos-james macy\binaries\ScanningProcess.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\otgpydqn.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.509.6972\swg.dll
O2 - BHO: CPub Object - {CC1EFA62-AF16-4DB2-ABBB-BFA89740CB45} - C:\Program Files\Internet Explorer\PLUGINS\West_ACU.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r
O4 - HKLM\..\Run: [CHotkey] zHotkey.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\eMachines Bay Reader\shwiconem.exe
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE USB PC Camera 301P
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [Samsung LBP SM] "C:\WINDOWS\Samsung\LaserSMMgr\ssmmgr.exe" /autorun
O4 - HKLM\..\Run: [GW Port Controller] C:\Program Files\Samsung\SmarThru\PORTCTRL.EXE
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [MaxtorOneTouch] C:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe
O4 - HKLM\..\Run: [mxomssmenu] "C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe"
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [lxcrmon.exe] "C:\Program Files\Lexmark 2400 Series\lxcrmon.exe"
O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 2400 Series\ezprint.exe"
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [LXCRCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCRtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\eMule.exe -AutoStart
O4 - HKCU\..\Run: [TypingSatellite] "C:\Program Files\TypingMaster\KBOOST.EXE"
O4 - HKCU\..\Run: [foxy] "C:\Program Files\Foxy\Foxy.exe" -tray
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [DbUtil] C:\WINDOWS\system32\otgpydqn.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = %SystemRoot%\Installer\{AC76BA86-1033-0000-BA7E-000000000002}\SC_Acrobat.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - (no file)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: WinAVI FLV Manager - {DE365254-2F9B-4908-9E3A-7AAA6EC90BCC} - C:\Program Files\WinAVI FLV Converter\FLVTune.dll
O9 - Extra 'Tools' menuitem: WinAVI FLV Manager - {DE365254-2F9B-4908-9E3A-7AAA6EC90BCC} - C:\Program Files\WinAVI FLV Converter\FLVTune.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - Cmdmapping - (no file) (HKCU)
O15 - ESC Trusted Zone: http://*.update.microsoft.com
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2B36F775-8CF5-4489-B454-2D1B80984CF2} (FXPluginCtl Object) - http://www.powerflasher.de/plugin/powerres.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by122fd.bay122.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/ZH-HK/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) - http://www.acclaim.com/cabs/acclaim_v4.cab
O16 - DPF: {81449547-EB5D-422E-8730-932DC5E412C8} (UVUPlayer Control) - http://www.howardstern.com/install/uvuplayer.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {C228AEDD-FC47-11D3-AF87-D128A9381404} (LSICapture Control) - http://www.link-systems.com/~sdk/SDK/paste/lsiw2k.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS…er.cab56986.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Amazon Unbox Video Service (ADVService) - Unknown owner - C:\Program Files\Amazon\Amazon Unbox Video\ADVWindowsClientService.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: C-DillaCdaC11BA - Unknown owner - C:\WINDOWS\system32\drivers\CDAC11BA.EXE (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - AHEAD Software - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Unknown owner - C:\Program Files\Norton AntiVirus\isPwdSvc.exe (file missing)
O23 - Service: LexBce Server (LexBceS) - Unknown owner - C:\WINDOWS\system32\LEXBCES.EXE (file missing)
O23 - Service: LiveUpdate - Unknown owner - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE (file missing)
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe (file missing)
O23 - Service: lxcr_device - - C:\WINDOWS\system32\lxcrcoms.exe
O23 - Service: MaxBackServiceInt - Unknown owner - C:\Program Files\Maxtor\Maxtor Backup\MaxBackServiceInt.exe
O23 - Service: MaxSyncService (NTService1) - - C:\Program Files\Maxtor\OneTouch\Utils\SyncServices.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

–
End of file - 14190 bytes

Tomk

Post #11October 9, 2008, 3:39 PM UTC

tonyli9323,

Use the link below to see how to run the Norton Removal Tool
http://service1.symantec.com/SUPPORT/tsgen…005033108162039

Disable your protection programs as we did before.

Please open HijackThis and run Do a system scan only
Check the boxes next to ONLY the entries listed below(if present):
- O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
  O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\eMule.exe -AutoStart
  O9 - Extra button: (no name) - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - (no file)
  O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
  O9 - Extra button: (no name) - Cmdmapping - (no file) (HKCU)
  O16 - DPF: {2B36F775-8CF5-4489-B454-2D1B80984CF2} (FXPluginCtl Object) - http://www.powerflasher.de/plugin/powerres.cab
  O23 - Service: Amazon Unbox Video Service (ADVService) - Unknown owner - C:\Program Files\Amazon\Amazon Unbox Video\ADVWindowsClientService.exe (file missing)
  O23 - Service: C-DillaCdaC11BA - Unknown owner - C:\WINDOWS\system32\drivers\CDAC11BA.EXE (file missing)
  O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
  O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
  O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Unknown owner - C:\Program Files\Norton AntiVirus\isPwdSvc.exe (file missing)
  O23 - Service: LexBce Server (LexBceS) - Unknown owner - C:\WINDOWS\system32\LEXBCES.EXE (file missing)
  O23 - Service: LiveUpdate - Unknown owner - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE (file missing)
  O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
  O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe (file missing)
Close all programs except for HijackThis.
Click on Fix checked
A box will pop up asking you if you wish to fix the selected items. Please choose YES.
Once it has fixed them, please exit/close HijackThis.

Next

COMBOFIX-Script

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

KILLALL::

File::
C:\Documents and Settings\All Users\Application Data\avg8\update\backup\avgtoolbar.dll
C:\WINDOWS\system32\otgpydqn.exe

Folder::
C:\SDFix\backups
C:\VundoFix Backups
C:\Program Files\grxeqib
C:\Documents and Settings\james macy\Application Data\uTorrent
C:\Program Files\uTorrent

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DbUtil"=-

Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

[external image: Posted Image]
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

Then

Please go to Kaspersky website and perform an online antivirus scan.

Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
- Spyware, Adware, Dialers, and other potentially dangerous programs
  Archives
  Mail databases
Click on My Computer under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As….
Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
Please post this log in your next reply.

In your next reply please provide:

ComboFix.txt
Kaspersky report
New HijackThis log taken after everything else completed

tonyli9323

Post #12October 10, 2008, 2:02 PM UTC

ComboFix:

ComboFix 08-10-08.05 - james macy 2008-10-09 14:48:20.5 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.[removed].18.606 [GMT -7:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\james macy\Desktop\CFScript.txt
* Created a new restore point

FILE ::
C:\Documents and Settings\All Users\Application Data\avg8\update\backup\avgtoolbar.dll
C:\WINDOWS\system32\otgpydqn.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\avg8\update\backup\avgtoolbar.dll
C:\Documents and Settings\james macy\Application Data\uTorrent
C:\Documents and Settings\james macy\Application Data\uTorrent\dht.dat
C:\Documents and Settings\james macy\Application Data\uTorrent\dht.dat.old
C:\Documents and Settings\james macy\Application Data\uTorrent\Glen Campbell - Very Best Of.torrent
C:\Documents and Settings\james macy\Application Data\uTorrent\Kanye West - Late Registration.torrent
C:\Documents and Settings\james macy\Application Data\uTorrent\Linkin Park Discography - [removed]
C:\Documents and Settings\james macy\Application Data\uTorrent\Linkin Park Discography - [removed]
C:\Documents and Settings\james macy\Application Data\uTorrent\Linkin Park Discography.torrent
C:\Documents and Settings\james macy\Application Data\uTorrent\Miley Cyrus - Breakout (2008) - Pop.torrent
C:\Documents and Settings\james macy\Application Data\uTorrent\RapidLeecher.Latest.Version.2008.zip.torrent
C:\Documents and Settings\james macy\Application Data\uTorrent\resume.dat
C:\Documents and Settings\james macy\Application Data\uTorrent\resume.dat.old
C:\Documents and Settings\james macy\Application Data\uTorrent\RonyaSoft ProPoster v2.02.07 +2KgN[h33t][rupliham].torrent
C:\Documents and Settings\james macy\Application Data\uTorrent\rss.dat
C:\Documents and Settings\james macy\Application Data\uTorrent\rss.dat.old
C:\Documents and Settings\james macy\Application Data\uTorrent\settings.dat
C:\Documents and Settings\james macy\Application Data\uTorrent\settings.dat.old
C:\Documents and Settings\james macy\Application Data\uTorrent\Soulja Boy-Souljaboytellem.Com (2007) Rap & Hip-Hop.torrent
C:\Documents and Settings\james macy\Application Data\uTorrent\The_Game_-_L.A.X._[Explicit_Retail_08]-FOZZYDABEAR.torrent
C:\Documents and Settings\james macy\Application Data\uTorrent\TOP 125 HipHop RnB 2008-06-21 Billboard - Torrent Tatty Feat RIAA Stars @224.torrent
C:\Documents and Settings\james macy\Application Data\uTorrent\Young Jeezy-The Recession (SReggin) 2008LeakGrouprip.torrent
C:\Documents and Settings\james macy\Application Data\uTorrent\Young Jeezy - I Put On (Ft. Jay-Z & Kanye West).torrent
C:\Documents and Settings\james macy\Application Data\uTorrent\Young Jeezy - The Recession (2008-Full-Album).torrent
C:\Documents and Settings\james macy\Application Data\uTorrent\Young Jeezy - The Recession[2008][MP3@320kbps]-antecho.torrent
C:\Documents and Settings\james macy\Application Data\uTorrent\Young Jeezy The Recession [GeneGeter.com].torrent
C:\Documents and Settings\james macy\Application Data\uTorrent\Young.Jeezy-The.Recession-Retail-2008-[NoFS].torrent
C:\Documents and Settings\james macy\Application Data\uTorrent\Young_Jeezy-The_Recession-2008-RAGEMP3-Retail Version+Covers.rar.torrent
C:\Documents and Settings\james macy\Application Data\uTorrent\Young_Jeezy-The_Recession-2008-RAGEMP3{Real Retail!}.rar.torrent
C:\Program Files\grxeqib
C:\Program Files\uTorrent
C:\Program Files\uTorrent\uTorrent.exe
C:\SDFix\backups
C:\SDFix\backups\backupreg.zip
C:\SDFix\backups\backups.zip
C:\VundoFix Backups
C:\VundoFix Backups\awtqo.dll.bad
C:\VundoFix Backups\awtsp.dll.bad
C:\VundoFix Backups\awtss.dll.bad
C:\VundoFix Backups\awtst.dll.bad
C:\VundoFix Backups\awvtq.dll.bad
C:\VundoFix Backups\awvts.dll.bad
C:\VundoFix Backups\awvtt.dll.bad
C:\VundoFix Backups\awvtu.dll.bad
C:\VundoFix Backups\awvvs.dll.bad
C:\VundoFix Backups\awvvu.dll.bad
C:\VundoFix Backups\awvvv.dll.bad
C:\VundoFix Backups\awvvw.dll.bad
C:\VundoFix Backups\ddaba.dll.bad
C:\VundoFix Backups\ddabb.dll.bad
C:\VundoFix Backups\ddaby.dll.bad
C:\VundoFix Backups\ddayx.dll.bad
C:\VundoFix Backups\ddayy.dll.bad
C:\VundoFix Backups\ddccc.dll.bad
C:\VundoFix Backups\ddccd.dll.bad
C:\VundoFix Backups\ddcyw.dll.bad
C:\VundoFix Backups\ddcyx.dll.bad
C:\VundoFix Backups\gebcc.dll.bad
C:\VundoFix Backups\gebcy.dll.bad
C:\VundoFix Backups\gebya.dll.bad
C:\VundoFix Backups\gebyw.dll.bad
C:\VundoFix Backups\gebyy.dll.bad
C:\VundoFix Backups\geebx.dll.bad
C:\VundoFix Backups\geeby.dll.bad
C:\VundoFix Backups\geeda.dll.bad
C:\VundoFix Backups\geedb.dll.bad
C:\VundoFix Backups\jkhfc.dll.bad
C:\VundoFix Backups\jkhfe.dll.bad
C:\VundoFix Backups\jkhff.dll.bad
C:\VundoFix Backups\jkhhf.dll.bad
C:\VundoFix Backups\jkhhi.dll.bad
C:\VundoFix Backups\jkkjg.dll.bad
C:\VundoFix Backups\jkkjh.dll.bad
C:\VundoFix Backups\jkkji.dll.bad
C:\VundoFix Backups\jkkjj.dll.bad
C:\VundoFix Backups\jkklj.dll.bad
C:\VundoFix Backups\jkklk.dll.bad
C:\VundoFix Backups\jkklm.dll.bad
C:\VundoFix Backups\jtvxnowd.dll.bad
C:\VundoFix Backups\mljgd.dll.bad
C:\VundoFix Backups\mljjg.dll.bad
C:\VundoFix Backups\mljjj.dll.bad
C:\VundoFix Backups\mljjk.dll.bad
C:\VundoFix Backups\mllji.dll.bad
C:\VundoFix Backups\mllmk.dll.bad
C:\VundoFix Backups\mllml.dll.bad
C:\VundoFix Backups\mllmm.dll.bad
C:\VundoFix Backups\mllmn.dll.bad
C:\VundoFix Backups\pfnagcpd.dll.bad
C:\VundoFix Backups\pmkhe.dll.bad
C:\VundoFix Backups\pmkhi.dll.bad
C:\VundoFix Backups\pmkjg.dll.bad
C:\VundoFix Backups\pmkjh.dll.bad
C:\VundoFix Backups\pmkjk.dll.bad
C:\VundoFix Backups\pmnli.dll.bad
C:\VundoFix Backups\pmnlj.dll.bad
C:\VundoFix Backups\pmnno.dll.bad
C:\VundoFix Backups\ssqpo.dll.bad
C:\VundoFix Backups\ssqpq.dll.bad
C:\VundoFix Backups\ssqrq.dll.bad
C:\VundoFix Backups\ssqrs.dll.bad
C:\VundoFix Backups\sstqo.dll.bad
C:\VundoFix Backups\sstqp.dll.bad
C:\VundoFix Backups\ssttq.dll.bad
C:\VundoFix Backups\ssttt.dll.bad
C:\VundoFix Backups\vtsqp.dll.bad
C:\VundoFix Backups\vtsqq.dll.bad
C:\VundoFix Backups\vtsqr.dll.bad
C:\VundoFix Backups\vtstq.dll.bad
C:\VundoFix Backups\vtstu.dll.bad
C:\VundoFix Backups\vturq.dll.bad
C:\VundoFix Backups\vturr.dll.bad
C:\VundoFix Backups\vturs.dll.bad
C:\VundoFix Backups\vtutt.dll.bad
C:\WINDOWS\system32\otgpydqn.exe

.
((((((((((((((((((((((((( Files Created from 2008-09-09 to 2008-10-09 )))))))))))))))))))))))))))))))
.

2008-10-09 14:37 . 2008-10-09 14:37 268 –ah—– C:\sqmdata03.sqm
2008-10-09 14:37 . 2008-10-09 14:37 244 –ah—– C:\sqmnoopt03.sqm
2008-10-06 22:35 . 2008-10-06 22:40 d——– C:\Lop SD
2008-10-05 20:35 . 2008-10-05 20:36 d——– C:\Program Files\The KMPlayer
2008-10-01 21:43 . 2008-10-01 21:43 d——– C:\Program Files\Common Files\xing shared
2008-09-11 17:17 . 2008-09-11 17:17 d——– C:\Program Files\iTunes
2008-09-11 17:17 . 2008-09-11 17:17 d——– C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-09-11 17:14 . 2008-09-11 17:14 d——– C:\Program Files\Bonjour
2008-09-09 17:06 . 2008-09-09 17:06 0 –a—— C:\WINDOWS\Textart.INI

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-09 00:14 ——— d—–w C:\Documents and Settings\All Users\Application Data\Google Updater
2008-10-04 17:35 ——— d—–w C:\Program Files\Spybot - Search & Destroy
2008-10-02 04:43 ——— d—–w C:\Program Files\Common Files\Real
2008-09-29 03:27 ——— d—–w C:\Program Files\Mozilla Thunderbird
2008-09-25 14:38 ——— d—–w C:\Program Files\Lx_cats
2008-09-16 23:26 ——— d—–w C:\Program Files\Google
2008-09-14 07:11 ——— d—–w C:\Program Files\Malwarebytes' Anti-Malware
2008-09-12 00:17 ——— d—–w C:\Program Files\iPod
2008-09-12 00:13 ——— d—–w C:\Program Files\QuickTime
2008-09-12 00:13 ——— d—–w C:\Program Files\Common Files\Apple
2008-09-10 07:04 38,528 —-a-w C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-09-10 07:03 17,200 —-a-w C:\WINDOWS\system32\drivers\mbam.sys
2008-09-04 00:58 0 —ha-w C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-09-04 00:58 0 —ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf
2008-09-04 00:51 ——— d—–w C:\Documents and Settings\All Users\Application Data\Installations
2008-09-04 00:50 ——— d—–w C:\Program Files\Nokia
2008-09-04 00:50 ——— d—–w C:\Program Files\MSXML 6.0
2008-09-04 00:49 ——— d—–w C:\Program Files\Common Files\Nokia
2008-08-30 00:35 ——— d—–w C:\Documents and Settings\james macy\Application Data\Corel
2008-08-29 16:49 97,928 —-a-w C:\WINDOWS\system32\drivers\avgldx86.sys
2008-08-29 13:51 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-08-22 13:50 ——— d—–w C:\Program Files\Microsoft Silverlight
2008-08-14 16:30 76,040 —-a-w C:\WINDOWS\system32\drivers\avgtdix.sys
2008-08-14 16:29 ——— d—–w C:\Documents and Settings\All Users\Application Data\avg8
2008-08-13 05:02 ——— d—–w C:\Program Files\Apple Software Update
2008-08-11 20:27 ——— d—–w C:\Program Files\Real
2008-08-11 07:32 ——— d—–w C:\Program Files\PPStream
2008-08-11 07:32 ——— d—–w C:\Documents and Settings\james macy\Application Data\ppStream
2008-08-11 07:27 ——— d—–w C:\Program Files\MSN Messenger
2008-08-10 06:47 ——— d—–w C:\Program Files\PPLiveVA
2008-08-10 06:47 ——— d—–w C:\Documents and Settings\All Users\Application Data\PPLiveVAPPLiveVAShareFlv
2008-08-10 06:47 ——— d—–w C:\Documents and Settings\All Users\Application Data\PPLiveVA
2008-08-10 06:45 ——— d—–w C:\Documents and Settings\james macy\Application Data\PPLiveVA
2008-08-10 06:44 ——— d—–w C:\Documents and Settings\All Users\Application Data\PPLive
2008-04-04 23:08 165,568 —-a-w C:\Documents and Settings\james macy\Application Data\GDIPFONTCACHEV1.DAT
2007-04-06 05:09 229,912 —-a-w C:\Documents and Settings\james macy\channels.dat
2005-01-20 02:19 207 —-a-w C:\Documents and Settings\james macy\J.BAT
2002-10-04 22:09 204,800 —-a-w C:\WINDOWS\inf\FXPlugin.dll
2004-08-02 22:38 135,168 ——w C:\Program Files\internet explorer\plugins\West_ACU.dll
2005-05-14 00:12 217,073 –sha-r C:\WINDOWS\meta4.exe
2005-10-24 18:13 66,560 –sha-r C:\WINDOWS\MOTA113.exe
2005-10-14 04:27 422,400 –sha-r C:\WINDOWS\x2.64.exe
2005-10-08 02:14 308,224 –sha-r C:\WINDOWS\system32\avisynth.dll
2005-07-14 19:31 27,648 –sha-r C:\WINDOWS\system32\AVSredirect.dll
2005-06-26 22:32 616,448 –sha-r C:\WINDOWS\system32\cygwin1.dll
2005-06-22 05:37 45,568 –sha-r C:\WINDOWS\system32\cygz.dll
2004-01-25 07:00 70,656 –sha-r C:\WINDOWS\system32\i420vfw.dll
2005-02-28 20:16 240,128 –sha-r C:\WINDOWS\system32\x.264.exe
2004-01-25 07:00 70,656 –sha-r C:\WINDOWS\system32\yv12vfw.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CC1EFA62-AF16-4DB2-ABBB-BFA89740CB45}]
2004-08-02 15:38 135168 ——— C:\Program Files\Internet Explorer\PLUGINS\West_ACU.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 5674352]
"TypingSatellite"="C:\Program Files\TypingMaster\KBOOST.EXE" [BU]
"foxy"="C:\Program Files\Foxy\Foxy.exe" [BU]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 204288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2004-03-04 2904064]
"NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2004-03-04 46080]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-10 155648]
"InCD"="C:\Program Files\Ahead\InCD\InCD.exe" [2003-12-18 1241138]
"SunKistEM"="C:\Program Files\eMachines Bay Reader\shwiconem.exe" [2004-03-12 135168]
"BigDogPath"="C:\WINDOWS\VM_STI.EXE" [2003-01-21 40960]
"OpwareSE2"="C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" [2003-05-08 49152]
"Samsung LBP SM"="C:\WINDOWS\Samsung\LaserSMMgr\ssmmgr.exe" [2003-04-03 266240]
"GW Port Controller"="C:\Program Files\Samsung\SmarThru\PORTCTRL.EXE" [2003-01-30 163840]
"Microsoft Works Update Detection"="C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2003-06-08 50688]
"Acrobat Assistant 7.0"="C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2005-09-23 483328]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"MaxtorOneTouch"="C:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe" [2006-03-01 712704]
"mxomssmenu"="C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe" [2005-10-17 81920]
"FaxCenterServer"="C:\Program Files\Lexmark Fax Solutions\fm3032.exe" [2006-02-02 290816]
"lxcrmon.exe"="C:\Program Files\Lexmark 2400 Series\lxcrmon.exe" [2006-03-06 286720]
"EzPrint"="C:\Program Files\Lexmark 2400 Series\ezprint.exe" [2006-02-06 98304]
"PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 271360]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-09-29 1234712]
"LXCRCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCRtime.dll" [2006-02-24 65536]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-09-06 413696]
"AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-09-03 111936]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-09-10 289576]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-10-01 185872]
"nwiz"="nwiz.exe" [2004-03-04 C:\WINDOWS\system32\nwiz.exe]
"nForce Tray Options"="sstray.exe" [2003-09-03 C:\WINDOWS\system32\sstray.exe]
"CHotkey"="zHotkey.exe" [2003-06-04 C:\WINDOWS\zHotkey.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 15360]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 1241088]

C:\Documents and Settings\james macy\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 113664]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-0000-BA7E-000000000002}\SC_Acrobat.exe [2005-10-16 25214]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-12 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"=hex(2):76,69,73,74,61,75,69,2e,65,78,65,00

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.aflc"= flccodec32.dll
"vidc.afli"= flccodec32.dll
"vidc.aasc"= aasc32.dll
"vidc.yv12"= yv12vfw.dll
"msacm.mpegacm"= mpegacm.acm
"msacm.ulmp3acm"= ulmp3acm.acm
"VIDC.LGIF"= lgif.dll

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Sierra\\Empire Earth\\Empire Earth.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"C:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"C:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"135:TCP"= 135:TCP:TCP Port 135
"5000:TCP"= 5000:TCP:TCP Port 5000
"5001:TCP"= 5001:TCP:TCP Port 5001
"5002:TCP"= 5002:TCP:TCP Port 5002
"5003:TCP"= 5003:TCP:TCP Port 5003
"5004:TCP"= 5004:TCP:TCP Port 5004
"5005:TCP"= 5005:TCP:TCP Port 5005
"5006:TCP"= 5006:TCP:TCP Port 5006
"5007:TCP"= 5007:TCP:TCP Port 5007
"5008:TCP"= 5008:TCP:TCP Port 5008
"5009:TCP"= 5009:TCP:TCP Port 5009
"5010:TCP"= 5010:TCP:TCP Port 5010
"5011:TCP"= 5011:TCP:TCP Port 5011
"5012:TCP"= 5012:TCP:TCP Port 5012
"5013:TCP"= 5013:TCP:TCP Port 5013
"5014:TCP"= 5014:TCP:TCP Port 5014
"5015:TCP"= 5015:TCP:TCP Port 5015
"5016:TCP"= 5016:TCP:TCP Port 5016
"5017:TCP"= 5017:TCP:TCP Port 5017
"5018:TCP"= 5018:TCP:TCP Port 5018
"5019:TCP"= 5019:TCP:TCP Port 5019
"5020:TCP"= 5020:TCP:TCP Port 5020

R0 sonypvl2;sonypvl2;C:\WINDOWS\system32\drivers\sonypvl2.sys [2003-07-25 19478]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-08-29 97928]
R1 sonypvf2;sonypvf2;C:\WINDOWS\system32\drivers\sonypvf2.sys [2003-08-20 635012]
R1 sonypvt2;sonypvt2;C:\WINDOWS\system32\drivers\sonypvt2.sys [2003-08-20 431236]
R2 avg8emc;AVG Free8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-08-29 875288]
R2 avg8wd;AVG Free8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-08-29 231704]
R2 AvgTdiX;AVG Free8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-08-14 76040]
S1 sonypvd2;sonypvd2;C:\WINDOWS\system32\DRIVERS\sonypvd2.sys [2003-06-24 64093]
S3 ASPI;Advanced SCSI Programming Interface Driver;C:\WINDOWS\System32\DRIVERS\ASPI32.sys [2002-07-17 16512]
S3 MD8300;GSL MD8300 Electronic Dictionary;C:\WINDOWS\system32\Drivers\MD8300.sys [2004-09-14 33792]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;C:\WINDOWS\system32\drivers\nmwcdnsu.sys [2008-02-01 138112]
S3 nmwcdnsuc;Nokia USB Flashing Generic;C:\WINDOWS\system32\drivers\nmwcdnsuc.sys [2008-02-01 8320]
S3 P1130VID;Creative WebCam NX Pro;C:\WINDOWS\system32\DRIVERS\P1130Vid.sys [2003-05-07 90357]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{164e0c55-9949-11db-a5c9-0040ca7f7cc9}]
\Shell\AutoRun\command - F:\ONSPCLCK.exe
.
Contents of the 'Scheduled Tasks' folder

2008-09-29 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-09 15:02:07
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\Program Files\Ahead\InCD\incdsrv.exe
C:\WINDOWS\system32\conime.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTSVCCDA.EXE
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Maxtor\Maxtor Backup\MaxBackServiceInt.exe
C:\Program Files\Maxtor\OneTouch\Utils\SyncServices.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\lxcrcoms.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
.
**************************************************************************
.
Completion time: 2008-10-09 15:17:41 - machine was rebooted
ComboFix-quarantined-files.txt 2008-10-09 22:17:24
ComboFix2.txt 2008-10-08 23:47:25
ComboFix3.txt 2008-10-08 00:54:01
ComboFix4.txt 2008-10-07 04:50:15
ComboFix5.txt 2008-10-09 21:47:13

Pre-Run: 32,203,935,744 bytes free
Post-Run: 32,239,140,864 bytes free

355 — E O F — 2008-09-10 06:28:33

Online Scan:

——————————————————————————–
KASPERSKY ONLINE SCANNER 7 REPORT
Friday, October 10, 2008
Operating System: Microsoft Windows XP Home Edition Service Pack 2 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Friday, October 10, 2008 05:13:27
Records in database: 1302715
——————————————————————————–

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\
F:\
G:\
H:\
I:\
K:\

Scan statistics:
Files scanned: 163187
Threat name: 21
Infected objects: 48
Suspicious objects: 4
Duration of the scan: 04:10:13

File name / Threat name / Threats count
C:\QooBox\Quarantine\C\Documents and Settings\All Users\Application Data\avg8\update\backup\avgtoolbar.dll.vir Infected: not-a-virus:AdWare.Win32.MegaSearch.ad 1
C:\QooBox\Quarantine\C\Documents and Settings\All Users\Application Data\dmhypwva\fwtarohq.exe.vir Infected: Trojan.Win32.Obfuscated.gx 1
C:\QooBox\Quarantine\C\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\From Laptop-Sarah\Deleted Items.dbx.vir Infected: Trojan-Spy.HTML.Bayfraud.em 1
C:\QooBox\Quarantine\C\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\From Office-Sarah\Deleted Items.dbx.vir Suspicious: Trojan-Spy.HTML.Fraud.gen 2
C:\QooBox\Quarantine\C\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\From Office-Sarah\Deleted Items.dbx.vir Infected: Trojan-Spy.HTML.Bayfraud.g 1
C:\QooBox\Quarantine\C\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\From Office-Sarah\Deleted Items.dbx.vir Infected: Trojan-Spy.HTML.Bayfraud.h 1
C:\QooBox\Quarantine\C\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\From Office-Sarah\Deleted Items.dbx.vir Infected: Trojan-Spy.HTML.Bayfraud.em 1
C:\QooBox\Quarantine\C\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\From Office-Sarah\Deleted Items.dbx.vir Infected: Trojan-Spy.HTML.Citifraud.ac 1
C:\QooBox\Quarantine\C\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\From Office-Sarah\Spam.dbx.vir Infected: Trojan-Spy.HTML.Paylap.bg 1
C:\QooBox\Quarantine\C\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\When started Thund 1-25-05\Deleted Items.dbx.vir Infected: Trojan-Spy.HTML.Citifraud.ac 1
C:\QooBox\Quarantine\C\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\When started Thund 1-25-05\Deleted Items.dbx.vir Infected: Trojan-Spy.HTML.Bayfraud.em 1
C:\QooBox\Quarantine\C\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\When started Thund 1-25-05\Spam.dbx.vir Infected: Trojan-Spy.HTML.Bayfraud.p 1
C:\QooBox\Quarantine\C\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\When started Thund 1-25-05\Spam.dbx.vir Infected: Trojan-Spy.HTML.Paylap.bg 1
C:\QooBox\Quarantine\C\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\When started Thund 1-25-05\Spam.dbx.vir Infected: Trojan-Spy.HTML.Bayfraud.em 1
C:\QooBox\Quarantine\C\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\When started Thund 1-25-05\Spam.dbx.vir Infected: Trojan-Spy.HTML.Bayfraud.h 1
C:\QooBox\Quarantine\C\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\When started Thund 1-25-05\Spam.dbx.vir Infected: Trojan-Spy.HTML.Bayfraud.g 1
C:\QooBox\Quarantine\C\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\When started Thund 1-25-05\XXDONTKNOW.dbx.vir Suspicious: Trojan-Spy.HTML.Fraud.gen 2
C:\QooBox\Quarantine\C\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\When started Thund 1-25-05\XXDONTKNOW.dbx.vir Infected: Trojan-Spy.HTML.Paylap.bg 1
C:\QooBox\Quarantine\C\Documents and Settings\james macy\Local Settings\Application Data\Identities\{83336FEA-ECA8-4FFC-9B9D-EA0E97685FCA}\Microsoft\Outlook Express\When started Thund 1-25-05\XXDONTKNOW.dbx.vir Infected: Trojan-Spy.HTML.Paylap.n 1
C:\QooBox\Quarantine\C\Program Files\grxeqib\aplcmd.dll.vir Infected: Trojan.Win32.Obfuscated.gx 1
C:\QooBox\Quarantine\C\Program Files\mzbntbe\chkmonapl.dll.vir Infected: Trojan.Win32.Obfuscated.gx 1
C:\QooBox\Quarantine\C\Program Files\mzbntbe\webapi.dll.vir Infected: Trojan.Win32.Obfuscated.gx 1
C:\QooBox\Quarantine\C\SDFix\backups\backups.zip.vir Infected: Trojan-Downloader.Win32.ConHook.pr 1
C:\QooBox\Quarantine\C\VundoFix Backups\jtvxnowd.dll.bad.vir Infected: Trojan.Win32.Monderb.gen 1
C:\QooBox\Quarantine\C\VundoFix Backups\pfnagcpd.dll.bad.vir Infected: Trojan.Win32.Monderb.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\bfogkdak.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cdy 1
C:\QooBox\Quarantine\C\WINDOWS\system32\ebwiecow.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cdy 1
C:\QooBox\Quarantine\C\WINDOWS\system32\eysjpryy.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.coi 1
C:\QooBox\Quarantine\C\WINDOWS\system32\hglbffdp.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cfn 1
C:\QooBox\Quarantine\C\WINDOWS\system32\hGVOHYQJ.dll.vir Infected: Trojan-Downloader.Win32.Agent.xxa 1
C:\QooBox\Quarantine\C\WINDOWS\system32\hGvtronM.dll.vir Infected: Trojan-Downloader.Win32.Agent.xxa 1
C:\QooBox\Quarantine\C\WINDOWS\system32\jstodizm.exe.vir Infected: Trojan.Win32.Obfuscated.gx 1
C:\QooBox\Quarantine\C\WINDOWS\system32\lkcaeprk.dll.vir Infected: Trojan.Win32.Monder.dlr 1
C:\QooBox\Quarantine\C\WINDOWS\system32\nbxlzd.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.coi 1
C:\QooBox\Quarantine\C\WINDOWS\system32\ojibcnaf.exe.vir Infected: Trojan.Win32.Obfuscated.gx 1
C:\QooBox\Quarantine\C\WINDOWS\system32\otgpydqn.exe.vir Infected: Trojan.Win32.Obfuscated.gx 1
C:\QooBox\Quarantine\C\WINDOWS\system32\pkvtvj.dll.vir Infected: Trojan.Win32.Monder.amg 1
C:\QooBox\Quarantine\C\WINDOWS\system32\qjchdf.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cdy 1
C:\QooBox\Quarantine\C\WINDOWS\system32\simtoblf.dll.vir Infected: Trojan.Win32.Monder.amg 1
C:\QooBox\Quarantine\C\WINDOWS\system32\tldixejg.dll.vir Infected: Trojan.Win32.Monder.dkd 1
C:\QooBox\Quarantine\C\WINDOWS\system32\tpdghqci.dll.vir Infected: Trojan.Win32.Monderb.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\trbamitj.dll.vir Infected: Trojan.Win32.Monder.dmj 1
C:\QooBox\Quarantine\C\WINDOWS\system32\vblallmg.dll.vir Infected: Trojan.Win32.Monderb.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\vxvlibut.dll.vir Infected: Trojan.Win32.Monder.dlr 1
C:\QooBox\Quarantine\C\WINDOWS\system32\wuowsl.dll.vir Infected: Trojan.Win32.Monderb.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\xetzsd.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cdy 1
C:\QooBox\Quarantine\C\WINDOWS\system32\xwsgjl.dll.vir Infected: Trojan.Win32.Monderb.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\xxntfano.dll.vir Infected: Trojan.Win32.Monder.dlr 1
C:\QooBox\Quarantine\catchme2008-10-08_162749.36.zip Infected: Trojan.Win32.Obfuscated.gx 1
C:\SDFix\backups_old\backups.zip Infected: Trojan-Downloader.Win32.ConHook.bet 1

The selected area was scanned.

HiJackThis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:01:03 AM, on 10/10/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\conime.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Maxtor\Maxtor Backup\MaxBackServiceInt.exe
C:\Program Files\Maxtor\OneTouch\Utils\SyncServices.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\zHotkey.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\eMachines Bay Reader\shwiconem.exe
C:\WINDOWS\VM_STI.EXE
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\WINDOWS\Samsung\LaserSMMgr\ssmmgr.exe
C:\Program Files\Samsung\SmarThru\PORTCTRL.EXE
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe
C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe
C:\Program Files\Lexmark 2400 Series\lxcrmon.exe
C:\Program Files\Lexmark 2400 Series\ezprint.exe
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\lxcrcoms.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\explorer.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\Program Files\Sierra\Empire Earth\Empire Earth.exe
C:\Program Files\Sierra\Empire Earth\Empire Earth.exe
C:\Program Files\Sierra\Empire Earth\Empire Earth.exe
C:\Program Files\Sierra\Empire Earth\Empire Earth.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\james macy\Local Settings\temp\jkos-james macy\binaries\ScanningProcess.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.509.6972\swg.dll
O2 - BHO: CPub Object - {CC1EFA62-AF16-4DB2-ABBB-BFA89740CB45} - C:\Program Files\Internet Explorer\PLUGINS\West_ACU.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r
O4 - HKLM\..\Run: [CHotkey] zHotkey.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\eMachines Bay Reader\shwiconem.exe
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE USB PC Camera 301P
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [Samsung LBP SM] "C:\WINDOWS\Samsung\LaserSMMgr\ssmmgr.exe" /autorun
O4 - HKLM\..\Run: [GW Port Controller] C:\Program Files\Samsung\SmarThru\PORTCTRL.EXE
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [MaxtorOneTouch] C:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe
O4 - HKLM\..\Run: [mxomssmenu] "C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe"
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [lxcrmon.exe] "C:\Program Files\Lexmark 2400 Series\lxcrmon.exe"
O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 2400 Series\ezprint.exe"
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [LXCRCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCRtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [TypingSatellite] "C:\Program Files\TypingMaster\KBOOST.EXE"
O4 - HKCU\..\Run: [foxy] "C:\Program Files\Foxy\Foxy.exe" -tray
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = %SystemRoot%\Installer\{AC76BA86-1033-0000-BA7E-000000000002}\SC_Acrobat.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: WinAVI FLV Manager - {DE365254-2F9B-4908-9E3A-7AAA6EC90BCC} - C:\Program Files\WinAVI FLV Converter\FLVTune.dll
O9 - Extra 'Tools' menuitem: WinAVI FLV Manager - {DE365254-2F9B-4908-9E3A-7AAA6EC90BCC} - C:\Program Files\WinAVI FLV Converter\FLVTune.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - ESC Trusted Zone: http://*.update.microsoft.com
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by122fd.bay122.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/ZH-HK/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) - http://www.acclaim.com/cabs/acclaim_v4.cab
O16 - DPF: {81449547-EB5D-422E-8730-932DC5E412C8} (UVUPlayer Control) - http://www.howardstern.com/install/uvuplayer.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {C228AEDD-FC47-11D3-AF87-D128A9381404} (LSICapture Control) - http://www.link-systems.com/~sdk/SDK/paste/lsiw2k.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS…er.cab56986.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Amazon Unbox Video Service (ADVService) - Unknown owner - C:\Program Files\Amazon\Amazon Unbox Video\ADVWindowsClientService.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - AHEAD Software - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Unknown owner - C:\Program Files\Norton AntiVirus\isPwdSvc.exe (file missing)
O23 - Service: LexBce Server (LexBceS) - Unknown owner - C:\WINDOWS\system32\LEXBCES.EXE (file missing)
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: lxcr_device - - C:\WINDOWS\system32\lxcrcoms.exe
O23 - Service: MaxBackServiceInt - Unknown owner - C:\Program Files\Maxtor\Maxtor Backup\MaxBackServiceInt.exe
O23 - Service: MaxSyncService (NTService1) - - C:\Program Files\Maxtor\OneTouch\Utils\SyncServices.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

–
End of file - 13357 bytes

Tomk

Post #13October 10, 2008, 3:20 PM UTC

tonyli9323,

Congratulations, Log looks good

Time for some housekeeping

Click START then RUN
Now type Combofix /u in the runbox and click OK
Note the space between the X and the U, it needs to be there.
[external image: Posted Image]

The above procedure will:

Delete the following:
- ComboFix and its associated files and folders.
- VundoFix backups, if present
- The C:\Deckard folder, if present
- The C:_OtMoveIt folder, if present
Reset the clock settings.
Hide file extensions, if required.
Hide System/Hidden files, if required.
Reset System Restore.

Please re-enable any security that was disabled.

Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week
(Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.

Use a Firewall - I can not stress how important it is that you use a Firewall on your computer.
Without a firewall your computer is succeptible to being hacked and taken over.
I am very serious about this and see it happen almost every day with my clients.
Simply using a Firewall in its default configuration can lower your risk greatly.

For a tutorial on Firewalls and a listing of some available ones see the link below:

Understanding and Using Firewalls

Keep Microsoft Windows Updated - This will ensure your computer has always the latest security updates available installed on your computer. The easiest way to do this is to turn on Automatic Updates. Do this by:

From your desktop, right-click on My Computer,
click on Properties
Select the Automatic Updates tab
Click on Automatic
Click on Apply button
Click on OK to exit.

If there are new updates to install, install them immediately, until there are no more critical updates.

Install SpywareBlaster - SpywareBlaster will add a large list of programs and sites into your Internet Explorer
settings that will protect you from running and downloading known malicious programs.

A tutorial on installing & using this product can be found here:

Using SpywareBlaster to protect your computer from Spyware and Malware

Download and install the free version of WinPatrol - This program protects your computer in a variety of ways and will work well with your existing security software.
Winpatrol

Update all these programs regularly - Make sure you update all the programs I have listed regularly.
Without regular updates you WILL NOT be protected when new malicious programs are released.

Only run one Anti-Virus and Firewall program.

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein

Please respond back that you understand the above and let me know if you have any questions. Otherwise, this thread will be closed Resolved.