What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Task Manager greyed out!

20 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
My Task manager is greyed out. I can't click it anymore. It is "disabled by administrator" when I try to open it under run.

There are numerous ad-removal pop-ups now.

There is a windows security alert that pops up once in a while with "Trojan-Downloader.Win32.Agent.bq" being found and prompting me to buy anti-software.

There is also a pop-up regarding Antivirus 2009.

PLEASE HELP….

Here is my script after HiJackThis scan…

Logfile of HijackThis v1.99.1
Scan saved at 7:14:26 PM, on 13/10/2008
Platform: Unknown Windows (WinNT 6.00.1905 SP1)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\RtHDVCpl.exe
C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\Vm_sti.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Windows\system32\taskeng.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\WINDOWS\System32\inmxsjgb.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\conime.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Windows\system32\rundll32.exe
C:\Windows\system32\rundll32.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\rundll32.exe
C:\Windows\system32\rundll32.exe
C:\Windows\system32\rundll32.exe
C:\Windows\system32\rundll32.exe
C:\Windows\system32\rundll32.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {0ADDE28F-8633-45E8-8A00-638BA246C645} - C:\Windows\system32\qoMdaAPJ.dll
O2 - BHO: {575336e0-2ae2-77fb-6d64-2a4508e4ee55} - {55ee4e80-54a2-46d6-bf77-2ea20e633575} - C:\Windows\system32\kmljmx.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Samsung PanelMgr] C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe /autorun
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [BigDogPath] C:\Windows\VM_STI.EXE lebeca web camera driver
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\ljJCuRKC.dll,#1
O4 - HKLM\..\Run: [30fcef01] rundll32.exe "C:\Windows\system32\hefjfyfo.dll",b
O4 - HKCU\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [webencfg] C:\Windows\system32\inmxsjgb.exe
O4 - Global Startup: Install Pending Files.LNK = C:\Program Files\SIFXINST\SIFXINST.EXE
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~3.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~3.0_0\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll/206 (file missing)
O10 - Unknown file in Winsock LSP: c:\windows\system32\nlaapi.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\napinsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O13 - Gopher Prefix:
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/…NPUplden-ca.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - AppInit_DLLs: wzjzaa.dll kmljmx.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: @%SystemRoot%\ehome\ehstart.dll,-101 (ehstart) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %ProgramFiles%\Windows Media Player\wmpnetwk.exe (file missing)
Post #2
Hello

Disable resident protections (Antivirus…); you'll re-enable them after the scan

Download Lop S&D < here

Double-click Lop S&D.exe
Choose the language, then choose Option 1 (Search)
Wait till the end of the scan
Post the log which is created: (%SystemDrive%\lopR.txt)
Post #3
——————–\\ Lop S&D 4.2.4-5 XP/Vista

Microsoft® Windows Vista™ Home Premium ( v6.0.6001 ) Service Pack 1
X86-based PC ( Multiprocessor Free : AMD Athlon™ 64 X2 Dual Core Processor 4200+ )
BIOS : Default System BIOS
USER : NEC1 ( Administrator )
BOOT : Normal boot
Antivirus : avast! antivirus 4.8.1229 [VPS 081014-0] 4.8.1229 (Not Activated)
C:\ (Local Disk) - NTFS - Total : 223 Go Free : 133 Go
D:\ (Local Disk) - NTFS - Total : 9 Go Free : 4 Go
E:\ (CD or DVD)
G:\ (USB)
H:\ (USB)
I:\ (USB)
J:\ (USB)
K:\ (CD or DVD)

"C:\Lop SD" ( MAJ : 02-10-2008|23:42 )
Option : [1] ( 14/10/2008|19:14 )

[ UAC => 1 ]

——————–\\ Listing folders in Local

[09/04/2008|10:36] C:\Users\NEC1\AppData\Local\ Adobe
[20/02/2008|05:02] C:\Users\NEC1\AppData\Local\ Ahead
[14/01/2008|02:01] C:\Users\NEC1\AppData\Local\ Apple
[04/10/2008|12:28] C:\Users\NEC1\AppData\Local\ Apple Computer
[06/12/2007|09:07] C:\Users\NEC1\AppData\Local\ Application Data
[06/12/2007|09:15] C:\Users\NEC1\AppData\Local\ ATI
[06/12/2007|09:07] C:\Users\NEC1\AppData\Local\680 d3d9caps.dat
[12/10/2008|05:33] C:\Users\NEC1\AppData\Local\202,240 DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[09/04/2008|11:06] C:\Users\NEC1\AppData\Local\111,624 GDIPFONTCACHEV1.DAT
[06/12/2007|09:07] C:\Users\NEC1\AppData\Local\ History
[13/10/2008|10:38] C:\Users\NEC1\AppData\Local\2,586,292 IconCache.db
[31/05/2008|12:54] C:\Users\NEC1\AppData\Local\ Microsoft
[27/09/2008|09:10] C:\Users\NEC1\AppData\Local\ Microsoft Games
[23/01/2008|10:57] C:\Users\NEC1\AppData\Local\ Microsoft Help
[26/01/2008|02:00] C:\Users\NEC1\AppData\Local\ Mozilla
[24/01/2008|01:52] C:\Users\NEC1\AppData\Local\ Real
[31/07/2008|11:41] C:\Users\NEC1\AppData\Local\ Sony Ericsson
[14/10/2008|07:12] C:\Users\NEC1\AppData\Local\ Temp
[06/12/2007|09:07] C:\Users\NEC1\AppData\Local\ Temporary Internet Files
[14/12/2007|02:27] C:\Users\NEC1\AppData\Local\ VirtualStore
[20/02/2008|03:49] C:\Users\NEC1\AppData\Local\ WMTools Downloaded Files
[12/03/2008|03:12] C:\Users\NEC1\AppData\Local\ Yahoo

——————–\\ Scheduled Tasks located in C:\Windows\Tasks

[13/10/2008 06:58 PM][–ah—–] C:\Windows\tasks\User_Feed_Synchronization-{31AC1BE1-2A06-4404-9F8C-9E3E33F1FF94}.job
[14/10/2008 07:08 PM][–ah—–] C:\Windows\tasks\SA.DAT
[13/10/2008 10:39 PM][–a——] C:\Windows\tasks\SCHEDLGU.TXT

——————–\\ Listing Folders in C:\ProgramData

[03/10/2008|02:20] C:\ProgramData\ {3276BE95_AF08_429F_A64F_CA64CB79BCF6}
[09/04/2008|10:17] C:\ProgramData\ Adobe
[14/01/2008|02:01] C:\ProgramData\ Apple
[18/09/2008|10:46] C:\ProgramData\ Apple Computer
[06/12/2007|09:02] C:\ProgramData\ Application Data
[17/03/2008|11:48] C:\ProgramData\ avg7
[31/07/2008|11:41] C:\ProgramData\ BVRP Software
[06/12/2007|09:02] C:\ProgramData\ Desktop
[06/12/2007|09:02] C:\ProgramData\ Documents
[16/03/2008|11:22] C:\ProgramData\32 ezsid.dat
[06/12/2007|09:02] C:\ProgramData\ Favorites
[11/03/2008|11:53] C:\ProgramData\ Lavasoft
[11/03/2008|11:41] C:\ProgramData\2,905 LUUnInstall.LiveUpdate
[31/05/2008|12:54] C:\ProgramData\ Microsoft
[10/09/2008|04:32] C:\ProgramData\ Microsoft Help
[20/02/2008|05:26] C:\ProgramData\ Nero
[13/10/2008|06:57] C:\ProgramData\258 ntuser.pol
[29/01/2008|12:51] C:\ProgramData\ Office Genuine Advantage
[21/12/2006|10:12] C:\ProgramData\ Prism Deploy
[21/01/2008|10:59] C:\ProgramData\ QuickTime
[24/01/2008|01:52] C:\ProgramData\ Real
[16/03/2008|08:11] C:\ProgramData\ Skype
[31/07/2008|11:28] C:\ProgramData\ Sony Ericsson
[10/04/2008|04:36] C:\ProgramData\ Spybot - Search & Destroy
[06/12/2007|09:02] C:\ProgramData\ Start Menu
[04/08/2008|05:26] C:\ProgramData\ Symantec
[06/12/2007|09:02] C:\ProgramData\ Templates
[13/10/2008|10:09] C:\ProgramData\ tqnqbgrw
[13/10/2008|10:09] C:\ProgramData\ ulohsvmt
[21/01/2008|09:24] C:\ProgramData\ WLInstaller

——————–\\ Listing Folders in C:\Program Files

[07/12/2007|01:52] C:\Program Files\ ACE Mega CoDecS Pack
[03/09/2008|05:20] C:\Program Files\ Acoustica MP3 To Wave Converter PLUS
[25/06/2008|09:03] C:\Program Files\ Adobe
[18/12/2007|03:42] C:\Program Files\ Ahead
[13/10/2008|10:10] C:\Program Files\ akl
[13/10/2008|08:38] C:\Program Files\ Alwil Software
[18/09/2008|10:42] C:\Program Files\ Apple Software Update
[06/12/2007|08:57] C:\Program Files\ ATI
[06/12/2007|09:12] C:\Program Files\ ATI Technologies
[24/06/2008|10:23] C:\Program Files\ BitComet
[07/12/2007|11:17] C:\Program Files\ BitTorrent_DNA
[18/09/2008|10:45] C:\Program Files\ Bonjour
[21/08/2008|10:30] C:\Program Files\ Common Files
[23/01/2008|10:52] C:\Program Files\ DAEMON Tools Lite
[16/07/2008|02:38] C:\Program Files\ DivX
[27/12/2007|12:47] C:\Program Files\ eREAD6.0
[26/01/2008|01:31] C:\Program Files\ ESTsoft
[08/02/2008|08:09] C:\Program Files\ FLV Player
[24/01/2008|07:46] C:\Program Files\ foobar2000
[03/09/2008|12:56] C:\Program Files\ GoldWave
[17/03/2008|07:17] C:\Program Files\ Grisoft
[13/10/2008|07:14] C:\Program Files\ HijackThis
[13/10/2008|10:10] C:\Program Files\ Inet Delivery
[31/07/2008|11:28] C:\Program Files\ InstallShield Installation Information
[29/06/2008|03:16] C:\Program Files\ Internet Explorer
[03/10/2008|02:20] C:\Program Files\ iPod
[03/10/2008|02:20] C:\Program Files\ iTunes
[10/08/2008|11:03] C:\Program Files\ Java
[11/03/2008|11:53] C:\Program Files\ Lavasoft
[02/11/2006|08:37] C:\Program Files\ Microsoft Games
[23/01/2008|11:03] C:\Program Files\ Microsoft Office
[18/08/2008|09:13] C:\Program Files\ Microsoft Silverlight
[23/01/2008|11:03] C:\Program Files\ Microsoft Visual Studio
[23/01/2008|10:59] C:\Program Files\ Microsoft Visual Studio 8
[23/01/2008|11:04] C:\Program Files\ Microsoft Works
[23/01/2008|11:02] C:\Program Files\ Microsoft.NET
[29/06/2008|03:16] C:\Program Files\ Movie Maker
[20/02/2008|03:46] C:\Program Files\ Movie Maker 2.6
[13/10/2008|07:24] C:\Program Files\ Mozilla Firefox
[23/01/2008|11:04] C:\Program Files\ MSBuild
[21/02/2008|12:53] C:\Program Files\ MSXML 4.0
[11/03/2008|11:37] C:\Program Files\ Norton Security Scan
[18/09/2008|10:44] C:\Program Files\ QuickTime
[07/12/2007|01:45] C:\Program Files\ Real
[24/01/2008|01:52] C:\Program Files\ Real Alternative
[24/01/2008|01:22] C:\Program Files\ Realtek
[02/11/2006|08:37] C:\Program Files\ Reference Assemblies
[03/10/2008|02:15] C:\Program Files\ Safari
[21/01/2008|09:22] C:\Program Files\ Samsung
[21/12/2006|10:13] C:\Program Files\ SIFXINST
[16/04/2008|03:06] C:\Program Files\ Skype
[31/07/2008|11:28] C:\Program Files\ Sony Ericsson
[10/04/2008|04:38] C:\Program Files\ Spybot - Search & Destroy
[11/03/2008|11:41] C:\Program Files\ Symantec
[02/11/2006|09:01] C:\Program Files\ Uninstall Information
[21/08/2008|10:22] C:\Program Files\ Valve
[24/01/2008|01:42] C:\Program Files\ VideoLAN
[23/03/2008|08:39] C:\Program Files\ Vimicro
[29/06/2008|03:16] C:\Program Files\ Windows Calendar
[29/06/2008|03:16] C:\Program Files\ Windows Collaboration
[29/06/2008|03:16] C:\Program Files\ Windows Defender
[29/06/2008|03:16] C:\Program Files\ Windows Journal
[24/01/2008|01:19] C:\Program Files\ Windows Live
[24/01/2008|01:18] C:\Program Files\ Windows Live Toolbar
[15/08/2008|11:17] C:\Program Files\ Windows Mail
[29/06/2008|03:16] C:\Program Files\ Windows Media Player
[02/11/2006|08:37] C:\Program Files\ Windows NT
[29/06/2008|03:16] C:\Program Files\ Windows Photo Gallery
[29/06/2008|03:16] C:\Program Files\ Windows Sidebar
[27/12/2007|01:02] C:\Program Files\ WinRAR
[02/03/2008|10:57] C:\Program Files\ Yahoo!

——————–\\ Listing Folders in C:\Program Files\Common Files

[10/04/2008|04:21] C:\Program Files\Common Files\ Adobe
[18/09/2008|10:44] C:\Program Files\Common Files\ Apple
[23/01/2008|11:03] C:\Program Files\Common Files\ DESIGNER
[31/07/2008|11:22] C:\Program Files\Common Files\ InstallShield
[29/01/2008|08:05] C:\Program Files\Common Files\ Java
[10/03/2008|10:42] C:\Program Files\Common Files\ microsoft shared
[20/02/2008|05:26] C:\Program Files\Common Files\ Nero
[21/12/2006|10:12] C:\Program Files\Common Files\ New Boundary
[21/12/2007|10:03] C:\Program Files\Common Files\ PX Storage Engine
[24/01/2008|01:21] C:\Program Files\Common Files\ Real
[02/11/2006|07:18] C:\Program Files\Common Files\ Services
[16/03/2008|08:11] C:\Program Files\Common Files\ Skype
[02/11/2006|07:18] C:\Program Files\Common Files\ SpeechEngines
[21/08/2008|10:30] C:\Program Files\Common Files\ Steam
[12/03/2008|03:12] C:\Program Files\Common Files\ Symantec Shared
[29/06/2008|03:16] C:\Program Files\Common Files\ System
[21/01/2008|09:28] C:\Program Files\Common Files\ WindowsLiveInstaller
[11/03/2008|11:51] C:\Program Files\Common Files\ Wise Installation Wizard

——————–\\ Process

( 69 Processes )

iexplore.exe ~ [PID:4800]

——————–\\ Searching with S_Lop

No Lop folder found !

——————–\\ Searching for Lop Files - Folders

No Lop folder found !

——————–\\ Searching within the Registry

….. OK !

——————–\\ Checking the Hosts file

Hosts file CLEAN


——————–\\ Searching for hidden files with Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-14 19:14:59
Windows 6.0.6001 Service Pack 1 NTFS
scanning hidden processes …
scanning hidden files …
scan completed successfully
hidden processes: 0
hidden files: 106

——————–\\ Searching for other infections

C:\Windows\system32\JPAadMoq.ini
C:\Windows\system32\JPAadMoq.ini2
==> VUNDO <==

——————–\\ Cracks & Keygens ..

C:\Users\NEC1\AppData\Roaming\BitTorrent\Microsoft Office 2007 FULL + Keygen ( Vista comp.).torrent
C:\Users\NEC1\AppData\Roaming\Microsoft\Windows\Recent\Adobe Photoshop CS3 Extended + Crack.lnk
C:\Users\NEC1\AppData\Roaming\Microsoft\Windows\Recent\Adobe Photoshop CS3 Extended Keygens + Crack [Vista Xp Compatible].lnk
C:\Users\NEC1\AppData\Roaming\Microsoft\Windows\Recent\Adobe Photoshop CS3 Extended Keygens + Crack [Vista Xp Compatible].piece_part.lnk
C:\Users\NEC1\Documents\My Laptop Received Files\keygen.exe
C:\Users\NEC1\Documents\School Documents\My Pictures\nba\new folder\new\166269686-This_Shit_Will_Crack_You_Up17.jpg


[F:3352][D:199]-> C:\Users\NEC1\AppData\Local\Temp
[F:102][D:0]-> C:\Users\NEC1\AppData\Roaming\MICROS~1\Windows\Cookies
[F:1219][D:12]-> C:\Users\NEC1\AppData\Local\MICROS~1\Windows\TEMPOR~1\content.IE5
[F:17][D:16]-> C:\$Recycle.Bin

1 - "C:\Lop SD\LopR_1.txt" - 14/10/2008|19:21 - Option : [1]

——————–\\ Scan completed at 19:21:09
[ UAC => 1 ]
Post #4
You got infected because you downloaded cracks

Please download the OTMoveIt3 by OldTimer.
  • Save it to your desktop.
  • Please double-click OTMoveIt3.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
  • Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

    :Processes
explorer.exe

:Services

:Reg

:Files
C:\Windows\system32\JPAadMoq.ini
C:\Windows\system32\JPAadMoq.ini2
C:\Users\NEC1\AppData\Roaming\BitTorrent\Microsoft Office 2007 FULL + Keygen ( Vista comp.).torrent
C:\Users\NEC1\AppData\Roaming\Microsoft\Windows\Recent\Adobe Photoshop CS3 Extended + Crack.lnk
C:\Users\NEC1\AppData\Roaming\Microsoft\Windows\Recent\Adobe Photoshop CS3 Extended Keygens + Crack [Vista Xp Compatible].lnk
C:\Users\NEC1\AppData\Roaming\Microsoft\Windows\Recent\Adobe Photoshop CS3 Extended Keygens + Crack [Vista Xp Compatible].piece_part.lnk
C:\Users\NEC1\Documents\My Laptop Received Files\keygen.exe

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]
  • Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
  • Click the red Moveit! button.
  • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  • Close OTMoveIt3
Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.




  • Download random's system information tool (RSIT) by random/random from here and save it to your desktop.
  • Double click on RSIT.exe to run RSIT.
  • Click Continue at the disclaimer screen.
  • Once it has finished, two logs will open. Please post the contents of both log.txt (<info.txt (<
Post #5
========== PROCESSES ========== Process explorer.exe killed successfully. ========== SERVICES/DRIVERS ========== ========== REGISTRY ========== ========== FILES ========== C:\Windows\system32\JPAadMoq.ini moved successfully. C:\Windows\system32\JPAadMoq.ini2 moved successfully. File/Folder C:\Users\NEC1\AppData\Roaming\BitTorrent\Microsoft Office 2007 FULL + Keygen ( Vista comp.).torrent not found. File/Folder C:\Users\NEC1\AppData\Roaming\Microsoft\Windows\Recent\Adobe Photoshop CS3 Extended + Crack.lnk not found. C:\Users\NEC1\AppData\Roaming\Microsoft\Windows\Recent\Adobe Photoshop CS3 Extended Keygens + Crack [Vista Xp Compatible].lnk moved successfully. C:\Users\NEC1\AppData\Roaming\Microsoft\Windows\Recent\Adobe Photoshop CS3 Extended Keygens + Crack [Vista Xp Compatible].piece_part.lnk moved successfully. C:\Users\NEC1\Documents\My Laptop Received Files\keygen.exe moved successfully. ========== COMMANDS ========== File delete failed. C:\Users\NEC1\AppData\Local\Temp\etilqs_78kh29jABIbtWLVfXcyS scheduled to be deleted on reboot. File delete failed. C:\Users\NEC1\AppData\Local\Temp\quiuldup.dll scheduled to be deleted on reboot. File delete failed. C:\Users\NEC1\AppData\Local\Temp\~DF164D.tmp scheduled to be deleted on reboot. File delete failed. C:\Users\NEC1\AppData\Local\Temp\~DF48B5.tmp scheduled to be deleted on reboot. File delete failed. C:\Users\NEC1\AppData\Local\Temp\~DF48ED.tmp scheduled to be deleted on reboot. File delete failed. C:\Users\NEC1\AppData\Local\Temp\~DFE6D.tmp scheduled to be deleted on reboot. User's Temp folder emptied. User's Temporary Internet Files folder emptied. User's Internet Explorer cache folder emptied. Local Service Temp folder emptied. Local Service Temporary Internet Files folder emptied. Windows Temp folder emptied. File delete failed. C:\Users\NEC1\AppData\Local\Mozilla\Firefox\Profiles\kar48xfw.default\Cache\_CACHE_001_ scheduled to be deleted on reboot. File delete failed. C:\Users\NEC1\AppData\Local\Mozilla\Firefox\Profiles\kar48xfw.default\Cache\_CACHE_002_ scheduled to be deleted on reboot. File delete failed. C:\Users\NEC1\AppData\Local\Mozilla\Firefox\Profiles\kar48xfw.default\Cache\_CACHE_003_ scheduled to be deleted on reboot. File delete failed. C:\Users\NEC1\AppData\Local\Mozilla\Firefox\Profiles\kar48xfw.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot. File delete failed. C:\Users\NEC1\AppData\Local\Mozilla\Firefox\Profiles\kar48xfw.default\urlclassifier3.sqlite scheduled to be deleted on reboot. File delete failed. C:\Users\NEC1\AppData\Local\Mozilla\Firefox\Profiles\kar48xfw.default\XUL.mfl scheduled to be deleted on reboot. FireFox cache emptied. Temp folders emptied. Explorer started successfully OTMoveIt3 by OldTimer - Version 1.0.5.0 log created on 10142008_192833 Files moved on Reboot… File C:\Users\NEC1\AppData\Local\Temp\etilqs_78kh29jABIbtWLVfXcyS not found! DllUnregisterServer procedure not found in C:\Users\NEC1\AppData\Local\Temp\quiuldup.dll C:\Users\NEC1\AppData\Local\Temp\quiuldup.dll NOT unregistered. C:\Users\NEC1\AppData\Local\Temp\quiuldup.dll moved successfully. File C:\Users\NEC1\AppData\Local\Temp\~DF164D.tmp not found! File C:\Users\NEC1\AppData\Local\Temp\~DF48B5.tmp not found! File C:\Users\NEC1\AppData\Local\Temp\~DF48ED.tmp not found! File C:\Users\NEC1\AppData\Local\Temp\~DFE6D.tmp not found! C:\Users\NEC1\AppData\Local\Mozilla\Firefox\Profiles\kar48xfw.default\Cache\_CACHE_001_ moved successfully. C:\Users\NEC1\AppData\Local\Mozilla\Firefox\Profiles\kar48xfw.default\Cache\_CACHE_002_ moved successfully. C:\Users\NEC1\AppData\Local\Mozilla\Firefox\Profiles\kar48xfw.default\Cache\_CACHE_003_ moved successfully. C:\Users\NEC1\AppData\Local\Mozilla\Firefox\Profiles\kar48xfw.default\Cache\_CACHE_MAP_ moved successfully. C:\Users\NEC1\AppData\Local\Mozilla\Firefox\Profiles\kar48xfw.default\urlclassifier3.sqlite moved successfully. C:\Users\NEC1\AppData\Local\Mozilla\Firefox\Profiles\kar48xfw.default\XUL.mfl moved successfully.
Post #6
after windows startup, two windows popped up saying i was missing.. two files that were named… "C:\Users\NEC1\AppData\Local\Temp\ …" i can't recall which two
Post #7
log.txt :

Logfile of random's system information tool 1.04 (written by random/random)
Run by [removed] at 2008-10-14 21:22:49
Microsoft® Windows Vista™ Home Premium Service Pack 1
System drive C: has 138 GB (60%) free of 229 GB
Total RAM: 895 MB (24% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:23:33 PM, on 14/10/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\RtHDVCpl.exe
C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\WINDOWS\Vm_sti.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Windows\ehome\ehmsas.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\IEUser.exe
C:\Users\NEC1\Downloads\RSIT.exe
C:\Program Files\trend micro\NEC1.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: {575336e0-2ae2-77fb-6d64-2a4508e4ee55} - {55ee4e80-54a2-46d6-bf77-2ea20e633575} - C:\Windows\system32\kmljmx.dll
O2 - BHO: (no name) - {AA22266D-D644-4930-BE8B-1520527667EF} - C:\Windows\system32\qoMdaAPJ.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Samsung PanelMgr] C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe /autorun
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [BigDogPath] C:\Windows\VM_STI.EXE lebeca web camera driver
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\ljJCuRKC.dll,#1
O4 - HKLM\..\Run: [30fcef01] rundll32.exe "C:\Windows\system32\hefjfyfo.dll",b
O4 - HKCU\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [webencfg] C:\Windows\system32\inmxsjgb.exe
O4 - HKCU\..\Run: [MSServer] rundll32.exe C:\Users\NEC1\AppData\Local\Temp\wvUnLcax.dll,#1
O4 - HKCU\..\Run: [30fcef01] rundll32.exe "C:\Users\NEC1\AppData\Local\Temp\snfbcojq.dll",b
O4 - HKLM\..\Policies\Explorer\Run: [pzW5PT3kwf] C:\Users\NEC1\AppData\Local\Temp\windfr.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Global Startup: Install Pending Files.LNK = C:\Program Files\SIFXINST\SIFXINST.EXE
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~3.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~3.0_0\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll/206 (file missing)
O13 - Gopher Prefix:
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/…NPUplden-ca.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: wzjzaa.dll kmljmx.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe

–
End of file - 7330 bytes

======Scheduled tasks folder======

C:\Windows\tasks\User_Feed_Synchronization-{31AC1BE1-2A06-4404-9F8C-9E3E33F1FF94}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{55ee4e80-54a2-46d6-bf77-2ea20e633575}]
C:\Windows\system32\kmljmx.dll [2008-10-13 109568]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA22266D-D644-4930-BE8B-1520527667EF}]
C:\Windows\system32\qoMdaAPJ.dll [2008-10-13 268288]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-19 1008184]
"RtHDVCpl"=C:\Windows\RtHDVCpl.exe [2007-01-11 4321280]
"Samsung PanelMgr"=C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe [2007-01-02 520192]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2007-08-24 33648]
"SunJavaUpdateSched"=C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe [2008-06-10 144784]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-01-11 39792]
"NBKeyScan"=C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe []
"BigDogPath"=C:\Windows\VM_STI.EXE [2003-01-22 40960]
"TkBellExe"=C:\Program Files\Common Files\Real\Update_OB\realsched.exe -osboot []
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2008-09-06 413696]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2008-10-01 289576]
"MSServer"=C:\Windows\system32\ljJCuRKC.dll [2008-10-13 33792]
"30fcef01"=C:\Windows\system32\hefjfyfo.dll [2008-10-13 70144]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
"pzW5PT3kwf"=C:\User [2007-12-06 2]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
""= []
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2006-11-10 90112]
"ehTray.exe"=C:\Windows\ehome\ehTray.exe [2008-01-19 125952]
"MsnMsgr"=C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe [2007-10-18 5724184]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe ASO-616B5711-6DAE-4795-A05F-39A1E5104020 []
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\daemon.exe [2008-01-17 486856]
"WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2008-01-19 202240]
"webencfg"=C:\Windows\system32\inmxsjgb.exe []
"MSServer"=C:\User [2007-12-06 2]
"30fcef01"=C:\User [2007-12-06 2]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent DNA]
C:\User [2007-12-06 2]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Free Download Manager]
C:\Program Files\Free Download Manager\fdm.exe -autorun []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\QTTask.exe [2008-09-06 413696]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Install Pending Files.LNK - C:\Program Files\SIFXINST\SIFXINST.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="wzjzaa.dll kmljmx.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2007-08-24 2212224]
"{36DC214C-02C4-4341-8A84-997F4772E1E5}"=C:\Windows\system32\ljJCuRKC.dll [2008-10-13 33792]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"authentication packages"=msv1_0
C:\Windows\system32\qoMdaAPJ

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\aawservice]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files\BitTorrent\bittorrent.exe"="C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{23076a39-a5b9-11dc-8bab-0019db5cae7a}]
shell\Auto\command - auto.exe
shell\AutoRun\command - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL auto.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5e0609b4-bb2d-11dc-8472-0019db5cae7a}]
shell\AutoRun\command - L:\LaunchU3.exe


======List of files/folders created in the last 1 months======

2008-10-14 21:22:49 —-D—- C:\rsit
2008-10-14 21:22:49 —-D—- C:\Program Files\trend micro
2008-10-14 19:28:33 —-D—- C:\_OTMoveIt
2008-10-14 19:14:40 —-A—- C:\lopR.txt
2008-10-14 19:14:11 —-D—- C:\Lop SD
2008-10-13 20:38:25 —-D—- C:\Program Files\Alwil Software
2008-10-13 19:13:28 —-A—- C:\Windows\system32\vqfmmimd.dll
2008-10-13 19:13:28 —-A—- C:\Windows\system32\kmljmx.dll
2008-10-13 19:10:28 —-SH—- C:\Windows\system32\ofyfjfeh.ini
2008-10-13 19:10:28 —-N—- C:\Windows\system32\hefjfyfo.dll
2008-10-13 19:04:57 —-A—- C:\Windows\system32\whuygw.dll
2008-10-13 19:04:56 —-A—- C:\Windows\system32\iabrtbtl.dll
2008-10-13 19:01:57 —-SH—- C:\Windows\system32\ojmfyvot.ini
2008-10-13 18:54:19 —-A—- C:\Windows\system32\wini104552664.exe
2008-10-13 18:53:45 —-A—- C:\Windows\system32\ljJCuRKC.dll
2008-10-13 14:09:40 —-A—- C:\Windows\system32\wzjzaa.dll
2008-10-13 14:09:37 —-A—- C:\Windows\system32\yulerhwv.dll
2008-10-13 14:09:35 —-SH—- C:\Windows\system32\pscmlsbv.ini
2008-10-13 10:25:29 —-D—- C:\Program Files\HijackThis
2008-10-13 10:20:32 —-SH—- C:\Windows\system32\chvcpvvg.ini
2008-10-13 10:17:56 —-A—- C:\Windows\system32\oycmzj.dll
2008-10-13 10:17:54 —-A—- C:\Windows\system32\canodnqq.dll
2008-10-13 10:17:23 —-A—- C:\Windows\system32\3bdf2b7f-.txt
2008-10-13 10:14:18 —-N—- C:\Windows\system32\qoMdaAPJ.dll
2008-10-13 10:10:05 —-D—- C:\Windows\system32\smp
2008-10-13 10:10:05 —-A—- C:\Windows\zipped.tmp
2008-10-13 10:10:05 —-A—- C:\Windows\zip3.tmp
2008-10-13 10:10:05 —-A—- C:\Windows\zip2.tmp
2008-10-13 10:10:05 —-A—- C:\Windows\zip1.tmp
2008-10-13 10:10:05 —-A—- C:\Windows\userconfig9x.dll
2008-10-13 10:10:05 —-A—- C:\Windows\system32\winlogonpc.exe
2008-10-13 10:10:05 —-A—- C:\Windows\system32\taack.exe
2008-10-13 10:10:05 —-A—- C:\Windows\system32\ssurf022.dll
2008-10-13 10:10:05 —-A—- C:\Windows\system32\sncntr.exe
2008-10-13 10:10:05 —-A—- C:\Windows\system32\psoft1.exe
2008-10-13 10:10:05 —-A—- C:\Windows\system32\psof1.exe
2008-10-13 10:10:05 —-A—- C:\Windows\system32\ps1.exe
2008-10-13 10:10:05 —-A—- C:\Windows\system32\netode.exe
2008-10-13 10:10:05 —-A—- C:\Windows\system32\mwin32.exe
2008-10-13 10:10:05 —-A—- C:\Windows\system32\mtr2.exe
2008-10-13 10:10:05 —-A—- C:\Windows\system32\msnbho.dll
2008-10-13 10:10:05 —-A—- C:\Windows\system32\msgp.exe
2008-10-13 10:10:05 —-A—- C:\Windows\system32\medup020.dll
2008-10-13 10:10:05 —-A—- C:\Windows\system32\medup012.dll
2008-10-13 10:10:05 —-A—- C:\Windows\system32\hxiwlgpm.exe
2008-10-13 10:10:05 —-A—- C:\Windows\system32\hoproxy.dll
2008-10-13 10:10:05 —-A—- C:\Windows\system32\bsva-egihsg52.exe
2008-10-13 10:10:05 —-A—- C:\Windows\iTunesMusic.exe
2008-10-13 10:10:05 —-A—- C:\Windows\FVProtect.exe
2008-10-13 10:10:05 —-A—- C:\Windows\base64.tmp
2008-10-13 10:10:05 —-A—- C:\Windows\a.bat
2008-10-13 10:10:04 —-D—- C:\Windows\mslagent
2008-10-13 10:10:04 —-D—- C:\Program Files\Inet Delivery
2008-10-13 10:10:04 —-D—- C:\Program Files\akl
2008-10-13 10:10:04 —-A—- C:\Windows\winsystem.exe
2008-10-13 10:10:04 —-A—- C:\Windows\system32\WINWGPX.EXE
2008-10-13 10:10:04 —-A—- C:\Windows\system32\winsystem.exe
2008-10-13 10:10:04 —-A—- C:\Windows\system32\vcatchpi.dll
2008-10-13 10:10:04 —-A—- C:\Windows\system32\vbsys2.dll
2008-10-13 10:10:04 —-A—- C:\Windows\system32\thun32.dll
2008-10-13 10:10:04 —-A—- C:\Windows\system32\thun.dll
2008-10-13 10:10:04 —-A—- C:\Windows\system32\temp#01.exe
2008-10-13 10:10:04 —-A—- C:\Windows\system32\sysreq.exe
2008-10-13 10:10:04 —-A—- C:\Windows\system32\ssvchost.exe
2008-10-13 10:10:04 —-A—- C:\Windows\system32\ssvchost.com
2008-10-13 10:10:04 —-A—- C:\Windows\system32\Rundl1.exe
2008-10-13 10:10:04 —-A—- C:\Windows\system32\regm64.dll
2008-10-13 10:10:04 —-A—- C:\Windows\system32\regc64.dll
2008-10-13 10:10:04 —-A—- C:\Windows\system32\newsd32.exe
2008-10-13 10:10:04 —-A—- C:\Windows\system32\msvchost.exe
2008-10-13 10:10:04 —-A—- C:\Windows\system32\mssecu.exe
2008-10-13 10:10:04 —-A—- C:\Windows\system32\h@tkeysh@@k.dll
2008-10-13 10:10:04 —-A—- C:\Windows\system32\emesx.dll
2008-10-13 10:10:04 —-A—- C:\Windows\system32\dpcproxy.exe
2008-10-13 10:10:04 —-A—- C:\Windows\system32\bdn.com
2008-10-13 10:10:04 —-A—- C:\Windows\system32\awtoolb.dll
2008-10-13 10:10:04 —-A—- C:\Windows\system32\anticipator.dll
2008-10-13 10:10:04 —-A—- C:\Windows\system32\akttzn.exe
2008-10-13 10:10:04 —-A—- C:\Windows\mssecu.exe
2008-10-13 10:10:04 —-A—- C:\Windows\bdn.com
2008-10-13 10:09:43 —-D—- C:\ProgramData\ulohsvmt
2008-10-13 10:09:35 —-D—- C:\ProgramData\tqnqbgrw
2008-10-13 10:09:24 —-A—- C:\Windows\system32\tuVnmnMf.dll
2008-10-13 10:09:24 —-A—- C:\Windows\system32\tULCvUoN.dll
2008-10-13 10:09:13 —-A—- C:\Windows\system32\vtuULEUm.dll
2008-10-03 14:20:17 —-D—- C:\ProgramData\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-10-03 14:20:17 —-D—- C:\Program Files\iPod
2008-10-03 14:20:16 —-D—- C:\Program Files\iTunes
2008-10-03 14:15:06 —-D—- C:\Program Files\Safari
2008-09-18 22:46:21 —-A—- C:\Windows\system32\GEARAspi.dll
2008-09-18 22:46:20 —-DC—- C:\Windows\system32\DRVSTORE
2008-09-18 22:45:12 —-D—- C:\Program Files\Bonjour
2008-09-18 22:44:22 —-D—- C:\Program Files\QuickTime
2008-09-18 22:42:33 —-D—- C:\Program Files\Apple Software Update

======List of files/folders modified in the last 1 months======

2008-10-14 21:22:54 —-D—- C:\Windows\Temp
2008-10-14 21:22:49 —-RD—- C:\Program Files
2008-10-14 20:08:58 —-D—- C:\Windows\System32
2008-10-14 20:08:58 —-A—- C:\Windows\system32\PerfStringBackup.INI
2008-10-14 20:08:56 —-D—- C:\Windows\inf
2008-10-14 19:51:35 —-D—- C:\Windows\system32\drivers
2008-10-14 19:21:55 —-D—- C:\Windows\system32\Tasks
2008-10-13 19:24:03 —-D—- C:\Program Files\Mozilla Firefox
2008-10-13 18:59:31 —-SHD—- C:\System Volume Information
2008-10-13 18:57:39 —-HD—- C:\ProgramData
2008-10-13 18:57:38 —-HD—- C:\Windows\system32\GroupPolicy
2008-10-13 14:20:52 —-D—- C:\Downloads
2008-10-13 14:09:45 —-D—- C:\Windows\Prefetch
2008-10-13 10:10:05 —-D—- C:\WINDOWS
2008-10-13 10:10:02 —-SHD—- C:\Windows\Installer
2008-10-10 21:14:36 —-D—- C:\Users\NEC1\AppData\Roaming\foobar2000
2008-10-05 14:59:08 —-D—- C:\Windows\system32\catroot2
2008-10-04 22:41:59 —-D—- C:\Users\NEC1\AppData\Roaming\Apple Computer
2008-10-03 14:19:06 —-D—- C:\Windows\system32\catroot
2008-09-18 22:46:00 —-D—- C:\ProgramData\Apple Computer
2008-09-18 22:44:28 —-D—- C:\Program Files\Common Files\Apple
2008-09-16 16:57:39 —-D—- C:\Users\NEC1\AppData\Roaming\Skype
2008-09-16 16:57:08 —-D—- C:\Users\NEC1\AppData\Roaming\skypePM

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 eeCtrl;Symantec Eraser Control driver; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [2008-01-18 385072]
R2 DgiVecp;DgiVecp; \??\C:\Windows\system32\Drivers\DgiVecp.sys [2007-01-03 41984]
R2 SSPORT;SSPORT; \??\C:\Windows\system32\Drivers\SSPORT.sys [2007-01-03 5120]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\system32\DRIVERS\GEARAspiWDM.sys [2008-04-17 15464]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2007-01-13 1675368]
R3 R300;R300; C:\Windows\system32\DRIVERS\atikmdag.sys [2006-01-27 2364928]
R3 RTL8169;Realtek 8169 NT Driver; C:\Windows\system32\DRIVERS\Rtlh86.sys [2007-01-15 70144]
R3 VST_DPV;VST_DPV; C:\Windows\system32\DRIVERS\VSTDPV3.SYS [2006-11-02 987648]
R3 VSTHWBS2;VSTHWBS2; C:\Windows\system32\DRIVERS\VSTBS23.SYS [2006-11-02 251904]
R3 winachsf;winachsf; C:\Windows\system32\DRIVERS\VSTCNXT3.SYS [2006-11-02 654336]
R3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-19 83328]
S3 ak63dw1k;ak63dw1k; C:\Windows\system32\drivers\ak63dw1k.sys []
S3 drmkaud;Microsoft Kernel DRM Audio Descrambler; C:\Windows\system32\drivers\drmkaud.sys [2008-01-19 5632]
S3 HdAudAddService;Microsoft 1.1 UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
S3 ialm;ialm; C:\Windows\system32\DRIVERS\ialmnt5.sys [2006-11-02 1302492]
S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-19 8192]
S3 MSPCLOCK;Microsoft Streaming Clock Proxy; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-19 5888]
S3 MSPQM;Microsoft Streaming Quality Manager Proxy; C:\Windows\system32\drivers\MSPQM.sys [2008-01-19 5504]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\Windows\system32\drivers\MSTEE.sys [2008-01-19 6016]
S3 RTL8023xp;Realtek 10/100 NIC Family NDIS x86 Driver; C:\Windows\system32\DRIVERS\Rtnicxp.sys [2006-11-02 47104]
S3 s616bus;Sony Ericsson Device 616 driver (WDM); C:\Windows\system32\DRIVERS\s616bus.sys [2007-04-03 83208]
S3 s616mdfl;Sony Ericsson Device 616 USB WMC Modem Filter; C:\Windows\system32\DRIVERS\s616mdfl.sys [2007-04-03 15112]
S3 s616mdm;Sony Ericsson Device 616 USB WMC Modem Driver; C:\Windows\system32\DRIVERS\s616mdm.sys [2007-04-03 108680]
S3 s616mgmt;Sony Ericsson Device 616 USB WMC Device Management Drivers (WDM); C:\Windows\system32\DRIVERS\s616mgmt.sys [2007-04-03 100360]
S3 s616nd5;Sony Ericsson Device 616 USB Ethernet Emulation SEMC616 (NDIS); C:\Windows\system32\DRIVERS\s616nd5.sys [2007-04-03 23176]
S3 s616obex;Sony Ericsson Device 616 USB WMC OBEX Interface; C:\Windows\system32\DRIVERS\s616obex.sys [2007-04-03 98568]
S3 s616unic;Sony Ericsson Device 616 USB Ethernet Emulation SEMC616 (WDM); C:\Windows\system32\DRIVERS\s616unic.sys [2007-04-03 99080]
S3 USBAAPL;Apple Mobile USB Driver; C:\Windows\System32\Drivers\usbaapl.sys [2008-10-01 32000]
S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2008-01-19 39936]
S3 ZSMC301b;Look 312P; C:\Windows\System32\Drivers\usbVM31b.sys [2004-03-19 90968]
S4 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\drivers\wmiacpi.sys [2006-11-02 11264]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aawservice;Ad-Aware 2007 Service; C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe [2008-03-27 607576]
R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-10-01 116040]
R2 Ati External Event Utility;Ati External Event Utility; C:\Windows\system32\Ati2evxx.exe [2006-01-27 561152]
R2 Automatic LiveUpdate Scheduler;Automatic LiveUpdate Scheduler; C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe [2007-09-12 554352]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2008-08-29 238888]
R2 PrismXL;PrismXL; C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS [2007-12-06 65536]
R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2008-10-01 536872]
R3 usnjsvc;Messenger Sharing Folders USN Journal Reader service; C:\Program Files\Windows Live\Messenger\usnsvc.exe [2007-10-18 98328]
S2 CLTNetCnService;Symantec Lic NetConnect service; C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe /h ccCommon []
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [2005-11-14 69632]
S3 LiveUpdate;LiveUpdate; C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE [2007-09-12 2999664]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2007-08-24 68464]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2007-08-24 443776]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 Steam Client Service;Steam Client Service; C:\Program Files\Common Files\Steam\SteamService.exe [2008-08-21 87288]

—————–EOF—————–
Post #8
info.txt : info.txt logfile of random's system information tool 1.04 2008-10-14 21:23:41 ======Uninstall list====== –>C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER 2007 Microsoft Office Suite Service Pack 1 (SP1)–>msiexec /package {90120000-0015-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59} 2007 Microsoft Office Suite Service Pack 1 (SP1)–>msiexec /package {90120000-0016-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59} 2007 Microsoft Office Suite Service Pack 1 (SP1)–>msiexec /package {90120000-0018-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59} 2007 Microsoft Office Suite Service Pack 1 (SP1)–>msiexec /package {90120000-0019-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59} 2007 Microsoft Office Suite Service Pack 1 (SP1)–>msiexec /package {90120000-001A-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59} 2007 Microsoft Office Suite Service Pack 1 (SP1)–>msiexec /package {90120000-001B-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59} 2007 Microsoft Office Suite Service Pack 1 (SP1)–>msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {3EC77D26-799B-4CD8-914F-C1565E796173} 2007 Microsoft Office Suite Service Pack 1 (SP1)–>msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {430971B1-C31E-45DA-81E0-72C095BAB72C} 2007 Microsoft Office Suite Service Pack 1 (SP1)–>msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {F7A31780-33C4-4E39-951A-5EC9B91D7BF1} 2007 Microsoft Office Suite Service Pack 1 (SP1)–>msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {BEE75E01-DD3F-4D5F-B96C-609E6538D419} 2007 Microsoft Office Suite Service Pack 1 (SP1)–>msiexec /package {90120000-0044-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59} 2007 Microsoft Office Suite Service Pack 1 (SP1)–>msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {FAD8A83E-9BAC-4179-9268-A35948034D85} 2007 Microsoft Office Suite Service Pack 1 (SP1)–>msiexec /package {90120000-00A1-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59} 2007 Microsoft Office Suite Service Pack 1 (SP1)–>msiexec /package {90120000-00BA-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59} 2007 Microsoft Office Suite Service Pack 1 (SP1)–>msiexec /package {90120000-0114-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59} 2007 Microsoft Office Suite Service Pack 1 (SP1)–>msiexec /package {90120000-0115-0409-0000-0000000FF1CE} /uninstall {FAD8A83E-9BAC-4179-9268-A35948034D85} 2007 Microsoft Office Suite Service Pack 1 (SP1)–>msiexec /package {90120000-0117-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59} ACE Mega CoDecS Pack–>"C:\Program Files\ACE Mega CoDecS Pack\unins000.exe" Acoustica MP3 To Wave Converter PLUS–>C:\PROGRA~1\ACOUST~1\UNWISE.EXE C:\PROGRA~1\ACOUST~1\INSTALL.LOG Ad-Aware 2007–>MsiExec.exe /I{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF} Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)–>MsiExec.exe /X{6846389C-BAC0-4374-808E-B120F86AF5D7} Adobe Flash Player ActiveX–>C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe Adobe Flash Player Plugin–>C:\Windows\system32\Macromed\Flash\uninstall_plugin.exe Adobe Reader 8.1.2–>MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81200000003} Adobe Shockwave Player–>C:\WINDOWS\System32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\System32\Macromed\SHOCKW~1\Install.log ALZip–>"C:\Program Files\ESTsoft\ALZip\unins000.exe" Apple Mobile Device Support–>MsiExec.exe /I{976C2B2A-CE59-4AB3-83FB-BF895E28F2E6} Apple Software Update–>MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033} BitComet 1.02–>C:\Program Files\BitComet\uninst.exe Bonjour–>MsiExec.exe /I{8A25392D-C5D2-4E79-A2BD-C15DDC5B0959} Counter-Strike™–>MsiExec.exe /I{DF5A03CC-D5AA-43D8-B948-D9903F2AF94A} DivX Codec–>C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC DivX Converter–>C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER DivX Player–>C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER DivX Web Player–>C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN FLV Player 2.0, build 24–>C:\Program Files\FLV Player\uninst.exe foobar2000 v0.9.5–>"C:\Program Files\foobar2000\uninstall.exe" GoldWave v5.23–>"C:\Program Files\GoldWave\unstall.exe" "GoldWave v5.23" "C:\Program Files\GoldWave\unstall.log" HijackThis 2.0.2–>"C:\Program Files\trend micro\HijackThis.exe" /uninstall iTunes–>MsiExec.exe /I{DDDE0BE3-0CBE-4BF6-B75A-E3F69C947843} Java™ 6 Update 3–>MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160030} Java™ 6 Update 5–>MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050} Java™ 6 Update 7–>MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070} lebeca web camera driver–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{41E496B5-47F4-11D6-9BBB-00E0987BB2CD}\Setup.exe" -l0x9 LiveUpdate 3.2 (Symantec Corporation)–>"C:\Program Files\Symantec\LiveUpdate\LSETUP.EXE" /U Microsoft Office Access MUI (English) 2007–>MsiExec.exe /X{90120000-0015-0409-0000-0000000FF1CE} Microsoft Office Access Setup Metadata MUI (English) 2007–>MsiExec.exe /X{90120000-0117-0409-0000-0000000FF1CE} Microsoft Office Enterprise 2007–>"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall ENTERPRISE /dll OSETUP.DLL Microsoft Office Enterprise 2007–>MsiExec.exe /X{90120000-0030-0000-0000-0000000FF1CE} Microsoft Office Excel MUI (English) 2007–>MsiExec.exe /X{90120000-0016-0409-0000-0000000FF1CE} Microsoft Office Groove MUI (English) 2007–>MsiExec.exe /X{90120000-00BA-0409-0000-0000000FF1CE} Microsoft Office Groove Setup Metadata MUI (English) 2007–>MsiExec.exe /X{90120000-0114-0409-0000-0000000FF1CE} Microsoft Office InfoPath MUI (English) 2007–>MsiExec.exe /X{90120000-0044-0409-0000-0000000FF1CE} Microsoft Office OneNote MUI (English) 2007–>MsiExec.exe /X{90120000-00A1-0409-0000-0000000FF1CE} Microsoft Office Outlook MUI (English) 2007–>MsiExec.exe /X{90120000-001A-0409-0000-0000000FF1CE} Microsoft Office PowerPoint MUI (English) 2007–>MsiExec.exe /X{90120000-0018-0409-0000-0000000FF1CE} Microsoft Office Proof (English) 2007–>MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE} Microsoft Office Proof (French) 2007–>MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE} Microsoft Office Proof (Spanish) 2007–>MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE} Microsoft Office Proofing (English) 2007–>MsiExec.exe /X{90120000-002C-0409-0000-0000000FF1CE} Microsoft Office Publisher MUI (English) 2007–>MsiExec.exe /X{90120000-0019-0409-0000-0000000FF1CE} Microsoft Office Shared MUI (English) 2007–>MsiExec.exe /X{90120000-006E-0409-0000-0000000FF1CE} Microsoft Office Shared Setup Metadata MUI (English) 2007–>MsiExec.exe /X{90120000-0115-0409-0000-0000000FF1CE} Microsoft Office Word MUI (English) 2007–>MsiExec.exe /X{90120000-001B-0409-0000-0000000FF1CE} Microsoft Silverlight–>MsiExec.exe /I{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00} Microsoft Visual C++ 2005 Redistributable–>MsiExec.exe /X{A49F249F-0C91-497F-86DF-B2585E8E76B7} Mozilla Firefox (3.0.3)–>C:\Program Files\Mozilla Firefox\uninstall\helper.exe MSXML 4.0 SP2 (KB936181)–>MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF} MSXML 4.0 SP2 (KB941833)–>MsiExec.exe /I{C523D256-313D-4866-B36A-F3DE528246EF} neroxml–>MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B} Norton Security Scan–>MsiExec.exe /I{48B82226-75E3-4E90-92CC-D30F79EA6380} QuickTime–>MsiExec.exe /I{8DC42D05-680B-41B0-8878-6C14D24602DB} Real Alternative 1.7.5–>"C:\Program Files\Real Alternative\unins000.exe" Realtek High Definition Audio Driver–>RtlUpd.exe -r -m Safari–>MsiExec.exe /I{C9D96682-5A4D-45FA-BA3E-DDCB2B0CB868} Samsung ML-1610 Series–>C:\Program Files\Samsung\Samsung ML-1610 Series\Install\Setup.exe /R Security Update for 2007 Microsoft Office System (KB951596)–>msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {1AFF2298-CC00-4A3B-866A-C62B8373794E} Security Update for 2007 Microsoft Office System (KB951944)–>msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {797AE457-BA17-4BBC-B501-25FB3A0103C7} Security Update for Microsoft Office Excel 2007 (KB951546)–>msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {7399DD71-8E24-4E60-B6A8-6CED89C0AC26} Security Update for Microsoft Office OneNote 2007 (KB950130)–>msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {F1B2401C-B610-4BF2-AA1C-52C55827A8F4} Security Update for Microsoft Office PowerPoint 2007 (KB951338)–>msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {558B709B-821B-4FC5-90FC-9A8890641E77} Security Update for Microsoft Office Publisher 2007 (KB950114)–>msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {F9C3CDBA-1F00-4D4D-959D-75C9D3ACDD85} Security Update for Microsoft Office system 2007 (KB951808)–>msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {8F375E11-4FD6-4B89-9E2B-A76D48B51E00} Security Update for Microsoft Office system 2007 (KB954326)–>msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {5F7F6FFF-395D-480E-8450-64F385D82C5F} Security Update for Microsoft Office Word 2007 (KB950113)–>msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {AD72BABE-C733-4FCF-9674-4314466191B9} Security Update for Visio 2007 (KB947590)–>msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {6BAD036C-261F-4BEF-96CF-C20678D07A41} Skype™ 3.6–>MsiExec.exe /X{5C82DAE5-6EB0-4374-9254-BE3319BA4E82} SoftThinks Recovery Center Installer–>MsiExec.exe /X{7F3BCF8A-8E02-4659-AF25-F9AB66BD6718} Steam™–>MsiExec.exe /X{048298C9-A4D3-490B-9FF9-AB023A9238F3} Update for Microsoft Office Outlook 2007 (KB952142)–>msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {4AD3A076-427C-491F-A5B7-7D1DE788A756} Update for Office 2007 (KB946691)–>msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {A420F522-7395-4872-9882-C591B4B92278} Update for Outlook 2007 Junk Email Filter (kb956080)–>msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {96CC215F-3F22-4E1E-A101-F0041934A456} VCRedistSetup–>MsiExec.exe /I{3921A67A-5AB1-4E48-9444-C71814CF3027} VideoLAN VLC media player 0.8.6d–>C:\Program Files\VideoLAN\VLC\uninstall.exe Windows Live Messenger–>MsiExec.exe /X{508CE775-4BA4-4748-82DF-FE28DA9F03B0} Windows Live Sign-in Assistant–>MsiExec.exe /I{AFA4E5FD-ED70-4D92-99D0-162FD56DC986} Windows Media Player Firefox Plugin–>MsiExec.exe /I{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4} Windows Movie Maker 2.6–>MsiExec.exe /X{B3DAF54F-DB25-4586-9EF1-96D24BB14088} ======Hosts File====== 127.0.0.1 www.007guard.com 127.0.0.1 007guard.com 127.0.0.1 008i.com 127.0.0.1 www.008k.com 127.0.0.1 008k.com 127.0.0.1 www.00hq.com 127.0.0.1 00hq.com 127.0.0.1 010402.com 127.0.0.1 www.032439.com 127.0.0.1 032439.com ======Security center information====== AS: Windows Defender (disabled) ======Environment variables====== "ComSpec"=%SystemRoot%\system32\cmd.exe "FP_NO_HOST_CHECK"=NO "OS"=Windows_NT "Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\ATI Technologies\ATI.ACE\Core-Static;C:\Program Files\QuickTime\QTSystem;C:\Program Files\ESTsoft\ALZip;C:\Program Files\QuickTime\QTSystem\ "PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC "PROCESSOR_ARCHITECTURE"=x86 "TEMP"=%SystemRoot%\TEMP "TMP"=%SystemRoot%\TEMP "USERNAME"=SYSTEM "windir"=%SystemRoot% "PROCESSOR_LEVEL"=15 "PROCESSOR_IDENTIFIER"=x86 Family 15 Model 75 Stepping 2, AuthenticAMD "PROCESSOR_REVISION"=4b02 "NUMBER_OF_PROCESSORS"=2 "CLASSPATH"=.;C:\Program Files\Java\jre1.6.0_07\lib\ext\QTJava.zip "QTJAVA"=C:\Program Files\Java\jre1.6.0_07\lib\ext\QTJava.zip —————–EOF—————–
Post #9 last edited
Hello


Please download Malwarebytes' Anti-Malware from Here or Here

Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.



Please click on Start > Control Panel > Add/Remove Programs and uninstall the following programs(if present):

Java™ 6 Update 3–>MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160030}
Java™ 6 Update 5–>MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050}




Also post a new Rsit log
Post #10
Malwarebytes' Anti-Malware 1.28 Database version: 1274 Windows 6.0.6001 Service Pack 1 15/10/2008 2:05:23 PM mbam-log-2008-10-15 (14-05-23).txt Scan type: Quick Scan Objects scanned: 45567 Time elapsed: 6 minute(s), 52 second(s) Memory Processes Infected: 0 Memory Modules Infected: 3 Registry Keys Infected: 32 Registry Values Infected: 6 Registry Data Items Infected: 1 Folders Infected: 4 Files Infected: 93 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: C:\WINDOWS\System32\qoMdaAPJ.dll (Trojan.Vundo) -> Delete on reboot. C:\WINDOWS\System32\hefjfyfo.dll (Trojan.Vundo.H) -> Delete on reboot. C:\Users\NEC1\AppData\Local\Temp\awtqNFvu.dll (Trojan.Vundo) -> Delete on reboot. Registry Keys Infected: HKEY_CLASSES_ROOT\CLSID\{e3524e9d-a525-4357-8e11-972ada5dac5c} (Trojan.Vundo) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e3524e9d-a525-4357-8e11-972ada5dac5c} (Trojan.Vundo) -> Delete on reboot. HKEY_CLASSES_ROOT\CLSID\{36dc214c-02c4-4341-8a84-997f4772e1e5} (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\retnsrp.bgfk (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{9dd4258a-7138-49c4-8d34-587879a5c7a4} (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{c3bcc488-1ae7-11d4-ab82-0010a4ec2338} (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9dd4258a-7138-49c4-8d34-587879a5c7a4} (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b8c0220d-763d-49a4-95f4-61dfdec66ee6} (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c3bcc488-1ae7-11d4-ab82-0010a4ec2338} (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{000000da-0786-4633-87c6-1aa7a4429ef1} (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\dpcproxy (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\logons (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\typelib (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\HOL5_VXIEWER.FULL.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Classes\applications\accessdiver.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\fwbd (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\HolLol (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Inet Delivery (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mslagent (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Golden Palace Casino NEW (Trojan.DNSChanger) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SYSTEM\currentcontrolset\Services\iTunesMusic (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SYSTEM\currentcontrolset\Services\rdriv (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\mwc (Malware.Trace) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\MS Juan (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully. Registry Values Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\30fcef01 (Trojan.Vundo.H) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\30fcef01 (Trojan.Vundo.H) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msserver (Trojan.Vundo) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{36dc214c-02c4-4341-8a84-997f4772e1e5} (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msserver (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\SystemCheck2 (Trojan.Agent) -> Quarantined and deleted successfully. Registry Data Items Infected: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\qomdaapj -> Delete on reboot. Folders Infected: C:\WINDOWS\mslagent (Adware.EGDAccess) -> Quarantined and deleted successfully. C:\Program Files\akl (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\Program Files\Inet Delivery (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\System32\smp (Fake.Dropped.Malware) -> Quarantined and deleted successfully. Files Infected: C:\WINDOWS\System32\hefjfyfo.dll (Trojan.Vundo.H) -> Delete on reboot. C:\WINDOWS\System32\ofyfjfeh.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\WINDOWS\System32\qoMdaAPJ.dll (Trojan.Vundo) -> Delete on reboot. C:\Users\NEC1\AppData\Local\Temp\awtqNFvu.dll (Trojan.Vundo) -> Delete on reboot. C:\WINDOWS\System32\ljJCuRKC.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\System32\canodnqq.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\System32\oycmzj.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\System32\tULCvUoN.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\System32\tuVnmnMf.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\System32\vtuULEUm.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Users\NEC1\AppData\Local\Temp\tmp0001338d (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Users\NEC1\AppData\Local\Temp\tmp0001447e (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Users\NEC1\AppData\Local\Temp\tmp00015688 (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Users\NEC1\AppData\Local\Temp\wowuewgv.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Users\NEC1\AppData\Local\Temp\wyfveguk.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Users\NEC1\AppData\Local\Temp\bnsulmoq.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Users\NEC1\AppData\Local\Temp\efcCrqQG.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Users\NEC1\AppData\Local\Temp\iifgddBr.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Users\NEC1\AppData\Local\Temp\lwiuimmh.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Users\NEC1\AppData\Local\Temp\ommmovwb.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Users\NEC1\AppData\Local\Temp\opnkJDtq.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Users\NEC1\AppData\Local\Temp\pmnoNDwu.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Users\NEC1\AppData\Local\Temp\rqRKEUnO.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Users\NEC1\AppData\Local\Temp\snfbcojq.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Users\NEC1\AppData\Local\Temp\tmp0000d4db (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Users\NEC1\AppData\Local\Temp\tmp0000eb95 (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\mslagent\2_mslagent.dll (Adware.EGDAccess) -> Quarantined and deleted successfully. C:\WINDOWS\mslagent\mslagent.exe (Adware.EGDAccess) -> Quarantined and deleted successfully. C:\WINDOWS\mslagent\uninstall.exe (Adware.EGDAccess) -> Quarantined and deleted successfully. C:\Program Files\akl\akl.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\Program Files\akl\akl.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\Program Files\akl\uninstall.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\Program Files\akl\unsetup.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\Program Files\Inet Delivery\inetdl.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\Program Files\Inet Delivery\intdel.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\System32\smp\msrc.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\a.bat (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\base64.tmp (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\FVProtect.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\userconfig9x.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\winsystem.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\zip1.tmp (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\zip2.tmp (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\zip3.tmp (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\zipped.tmp (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\xmp.bat (Trojan.Downloader) -> Quarantined and deleted successfully. C:\WINDOWS\bdn.com (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\iTunesMusic.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\mssecu.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\System32\akttzn.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\System32\anticipator.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\System32\awtoolb.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\System32\bdn.com (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\System32\bsva-egihsg52.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\System32\dpcproxy.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\System32\emesx.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\System32\h@tkeysh@@k.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\System32\hoproxy.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\System32\hxiwlgpm.dat (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\System32\hxiwlgpm.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\System32\medup012.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\System32\medup020.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\System32\msgp.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\System32\msnbho.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\System32\mssecu.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\System32\msvchost.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\System32\mtr2.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\System32\mwin32.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\System32\netode.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\System32\newsd32.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\System32\ps1.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\System32\psof1.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\System32\psoft1.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\System32\regc64.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\System32\regm64.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\System32\Rundl1.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\System32\sncntr.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\System32\ssurf022.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\System32\ssvchost.com (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\System32\ssvchost.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\System32\sysreq.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\System32\taack.dat (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\System32\taack.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\System32\temp#01.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\System32\thun.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\System32\thun32.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\System32\VBIEWER.OCX (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\System32\vcatchpi.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\System32\winlogonpc.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\System32\winsystem.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\System32\WINWGPX.EXE (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\System32\vbsys2.dll (Trojan.Clicker) -> Quarantined and deleted successfully. C:\WINDOWS\System32\wini104552664.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
Post #11
new RSIT log..

Logfile of random's system information tool 1.04 (written by random/random)
Run by [removed] at 2008-10-15 14:14:25
Microsoft® Windows Vista™ Home Premium Service Pack 1
System drive C: has 138 GB (60%) free of 229 GB
Total RAM: 895 MB (29% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:14:37 PM, on 15/10/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\RtHDVCpl.exe
C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\Vm_sti.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\IEUser.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Windows\system32\conime.exe
C:\Users\NEC1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XC5U6XLL\RSIT[1].exe
C:\Program Files\trend micro\NEC1.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: {575336e0-2ae2-77fb-6d64-2a4508e4ee55} - {55ee4e80-54a2-46d6-bf77-2ea20e633575} - C:\Windows\system32\kmljmx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {E3524E9D-A525-4357-8E11-972ADA5DAC5C} - C:\Windows\system32\qoMdaAPJ.dll (file missing)
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Samsung PanelMgr] C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe /autorun
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [BigDogPath] C:\Windows\VM_STI.EXE lebeca web camera driver
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [webencfg] C:\Windows\system32\inmxsjgb.exe
O4 - HKCU\..\Run: [MSServer] rundll32.exe C:\Users\NEC1\AppData\Local\Temp\awtqNFvu.dll,#1
O4 - HKLM\..\Policies\Explorer\Run: [pzW5PT3kwf] C:\Users\NEC1\AppData\Local\Temp\windfr.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Global Startup: Install Pending Files.LNK = C:\Program Files\SIFXINST\SIFXINST.EXE
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~3.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~3.0_0\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll/206 (file missing)
O13 - Gopher Prefix:
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/…NPUplden-ca.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: wzjzaa.dll kmljmx.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe

–
End of file - 7336 bytes

======Scheduled tasks folder======

C:\Windows\tasks\User_Feed_Synchronization-{31AC1BE1-2A06-4404-9F8C-9E3E33F1FF94}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{55ee4e80-54a2-46d6-bf77-2ea20e633575}]
C:\Windows\system32\kmljmx.dll [2008-10-13 109568]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll [2008-06-10 509328]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E3524E9D-A525-4357-8E11-972ADA5DAC5C}]
C:\Windows\system32\qoMdaAPJ.dll []

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-19 1008184]
"RtHDVCpl"=C:\Windows\RtHDVCpl.exe [2007-01-11 4321280]
"Samsung PanelMgr"=C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe [2007-01-02 520192]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2007-08-24 33648]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-01-11 39792]
"NBKeyScan"=C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe []
"BigDogPath"=C:\Windows\VM_STI.EXE [2003-01-22 40960]
"TkBellExe"=C:\Program Files\Common Files\Real\Update_OB\realsched.exe -osboot []
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2008-09-06 413696]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2008-10-01 289576]
"Malwarebytes Anti-Malware (reboot)"=C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe [2008-09-10 1253040]
"SunJavaUpdateSched"=C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe [2008-06-10 144784]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
"pzW5PT3kwf"=C:\User [2007-12-06 2]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
""= []
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2006-11-10 90112]
"ehTray.exe"=C:\Windows\ehome\ehTray.exe [2008-01-19 125952]
"MsnMsgr"=C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe [2007-10-18 5724184]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe ASO-616B5711-6DAE-4795-A05F-39A1E5104020 []
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\daemon.exe [2008-01-17 486856]
"WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2008-01-19 202240]
"webencfg"=C:\Windows\system32\inmxsjgb.exe []
"MSServer"=C:\User [2007-12-06 2]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent DNA]
C:\User [2007-12-06 2]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Free Download Manager]
C:\Program Files\Free Download Manager\fdm.exe -autorun []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\QTTask.exe [2008-09-06 413696]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Install Pending Files.LNK - C:\Program Files\SIFXINST\SIFXINST.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="wzjzaa.dll kmljmx.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2007-08-24 2212224]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"authentication packages"=msv1_0
C:\Windows\system32\qoMdaAPJ

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\aawservice]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files\BitTorrent\bittorrent.exe"="C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{23076a39-a5b9-11dc-8bab-0019db5cae7a}]
shell\Auto\command - auto.exe
shell\AutoRun\command - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL auto.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5e0609b4-bb2d-11dc-8472-0019db5cae7a}]
shell\AutoRun\command - L:\LaunchU3.exe


======List of files/folders created in the last 1 months======

2008-10-15 14:07:33 —-D—- C:\Avenger
2008-10-15 14:07:33 —-A—- C:\avenger.txt
2008-10-15 13:08:55 —-D—- C:\Users\NEC1\AppData\Roaming\Malwarebytes
2008-10-15 13:08:47 —-D—- C:\ProgramData\Malwarebytes
2008-10-15 13:08:46 —-D—- C:\Program Files\Malwarebytes' Anti-Malware
2008-10-14 21:22:49 —-D—- C:\rsit
2008-10-14 21:22:49 —-D—- C:\Program Files\trend micro
2008-10-14 19:28:33 —-D—- C:\_OTMoveIt
2008-10-14 19:14:40 —-A—- C:\lopR.txt
2008-10-14 19:14:11 —-D—- C:\Lop SD
2008-10-13 20:38:25 —-D—- C:\Program Files\Alwil Software
2008-10-13 19:13:28 —-A—- C:\Windows\system32\vqfmmimd.dll
2008-10-13 19:13:28 —-A—- C:\Windows\system32\kmljmx.dll
2008-10-13 19:04:57 —-A—- C:\Windows\system32\whuygw.dll
2008-10-13 19:04:56 —-A—- C:\Windows\system32\iabrtbtl.dll
2008-10-13 19:01:57 —-SH—- C:\Windows\system32\ojmfyvot.ini
2008-10-13 14:09:40 —-A—- C:\Windows\system32\wzjzaa.dll
2008-10-13 14:09:37 —-A—- C:\Windows\system32\yulerhwv.dll
2008-10-13 14:09:35 —-SH—- C:\Windows\system32\pscmlsbv.ini
2008-10-13 10:25:29 —-D—- C:\Program Files\HijackThis
2008-10-13 10:20:32 —-SH—- C:\Windows\system32\chvcpvvg.ini
2008-10-13 10:17:23 —-A—- C:\Windows\system32\3bdf2b7f-.txt
2008-10-13 10:09:43 —-D—- C:\ProgramData\ulohsvmt
2008-10-13 10:09:35 —-D—- C:\ProgramData\tqnqbgrw
2008-10-03 14:20:17 —-D—- C:\ProgramData\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-10-03 14:20:17 —-D—- C:\Program Files\iPod
2008-10-03 14:20:16 —-D—- C:\Program Files\iTunes
2008-10-03 14:15:06 —-D—- C:\Program Files\Safari
2008-09-18 22:46:21 —-A—- C:\Windows\system32\GEARAspi.dll
2008-09-18 22:46:20 —-DC—- C:\Windows\system32\DRVSTORE
2008-09-18 22:45:12 —-D—- C:\Program Files\Bonjour
2008-09-18 22:44:22 —-D—- C:\Program Files\QuickTime
2008-09-18 22:42:33 —-D—- C:\Program Files\Apple Software Update

======List of files/folders modified in the last 1 months======

2008-10-15 14:14:27 —-D—- C:\Windows\Temp
2008-10-15 14:11:16 —-SHD—- C:\Windows\Installer
2008-10-15 14:11:14 —-D—- C:\Program Files\Java
2008-10-15 14:11:06 —-D—- C:\Windows\System32
2008-10-15 14:10:53 —-SHD—- C:\System Volume Information
2008-10-15 14:07:33 —-RD—- C:\Program Files
2008-10-15 14:07:33 —-D—- C:\Windows\system32\drivers
2008-10-15 14:05:21 —-D—- C:\WINDOWS
2008-10-15 13:08:47 —-HD—- C:\ProgramData
2008-10-15 13:05:23 —-D—- C:\Windows\system32\catroot2
2008-10-14 20:08:58 —-A—- C:\Windows\system32\PerfStringBackup.INI
2008-10-14 20:08:56 —-D—- C:\Windows\inf
2008-10-14 19:21:55 —-D—- C:\Windows\system32\Tasks
2008-10-13 19:24:03 —-D—- C:\Program Files\Mozilla Firefox
2008-10-13 18:57:38 —-HD—- C:\Windows\system32\GroupPolicy
2008-10-13 14:20:52 —-D—- C:\Downloads
2008-10-13 14:09:45 —-D—- C:\Windows\Prefetch
2008-10-10 21:14:36 —-D—- C:\Users\NEC1\AppData\Roaming\foobar2000
2008-10-04 22:41:59 —-D—- C:\Users\NEC1\AppData\Roaming\Apple Computer
2008-10-03 14:19:06 —-D—- C:\Windows\system32\catroot
2008-09-18 22:46:00 —-D—- C:\ProgramData\Apple Computer
2008-09-18 22:44:28 —-D—- C:\Program Files\Common Files\Apple
2008-09-16 16:57:39 —-D—- C:\Users\NEC1\AppData\Roaming\Skype
2008-09-16 16:57:08 —-D—- C:\Users\NEC1\AppData\Roaming\skypePM

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 eeCtrl;Symantec Eraser Control driver; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [2008-01-18 385072]
R2 DgiVecp;DgiVecp; \??\C:\Windows\system32\Drivers\DgiVecp.sys [2007-01-03 41984]
R2 SSPORT;SSPORT; \??\C:\Windows\system32\Drivers\SSPORT.sys [2007-01-03 5120]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\system32\DRIVERS\GEARAspiWDM.sys [2008-04-17 15464]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2007-01-13 1675368]
R3 R300;R300; C:\Windows\system32\DRIVERS\atikmdag.sys [2006-01-27 2364928]
R3 RTL8169;Realtek 8169 NT Driver; C:\Windows\system32\DRIVERS\Rtlh86.sys [2007-01-15 70144]
R3 VST_DPV;VST_DPV; C:\Windows\system32\DRIVERS\VSTDPV3.SYS [2006-11-02 987648]
R3 VSTHWBS2;VSTHWBS2; C:\Windows\system32\DRIVERS\VSTBS23.SYS [2006-11-02 251904]
R3 winachsf;winachsf; C:\Windows\system32\DRIVERS\VSTCNXT3.SYS [2006-11-02 654336]
R3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-19 83328]
S3 ao5uvq9y;ao5uvq9y; C:\Windows\system32\drivers\ao5uvq9y.sys []
S3 drmkaud;Microsoft Kernel DRM Audio Descrambler; C:\Windows\system32\drivers\drmkaud.sys [2008-01-19 5632]
S3 HdAudAddService;Microsoft 1.1 UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
S3 ialm;ialm; C:\Windows\system32\DRIVERS\ialmnt5.sys [2006-11-02 1302492]
S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-19 8192]
S3 MSPCLOCK;Microsoft Streaming Clock Proxy; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-19 5888]
S3 MSPQM;Microsoft Streaming Quality Manager Proxy; C:\Windows\system32\drivers\MSPQM.sys [2008-01-19 5504]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\Windows\system32\drivers\MSTEE.sys [2008-01-19 6016]
S3 RTL8023xp;Realtek 10/100 NIC Family NDIS x86 Driver; C:\Windows\system32\DRIVERS\Rtnicxp.sys [2006-11-02 47104]
S3 s616bus;Sony Ericsson Device 616 driver (WDM); C:\Windows\system32\DRIVERS\s616bus.sys [2007-04-03 83208]
S3 s616mdfl;Sony Ericsson Device 616 USB WMC Modem Filter; C:\Windows\system32\DRIVERS\s616mdfl.sys [2007-04-03 15112]
S3 s616mdm;Sony Ericsson Device 616 USB WMC Modem Driver; C:\Windows\system32\DRIVERS\s616mdm.sys [2007-04-03 108680]
S3 s616mgmt;Sony Ericsson Device 616 USB WMC Device Management Drivers (WDM); C:\Windows\system32\DRIVERS\s616mgmt.sys [2007-04-03 100360]
S3 s616nd5;Sony Ericsson Device 616 USB Ethernet Emulation SEMC616 (NDIS); C:\Windows\system32\DRIVERS\s616nd5.sys [2007-04-03 23176]
S3 s616obex;Sony Ericsson Device 616 USB WMC OBEX Interface; C:\Windows\system32\DRIVERS\s616obex.sys [2007-04-03 98568]
S3 s616unic;Sony Ericsson Device 616 USB Ethernet Emulation SEMC616 (WDM); C:\Windows\system32\DRIVERS\s616unic.sys [2007-04-03 99080]
S3 USBAAPL;Apple Mobile USB Driver; C:\Windows\System32\Drivers\usbaapl.sys [2008-10-01 32000]
S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2008-01-19 39936]
S3 ZSMC301b;Look 312P; C:\Windows\System32\Drivers\usbVM31b.sys [2004-03-19 90968]
S4 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\drivers\wmiacpi.sys [2006-11-02 11264]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aawservice;Ad-Aware 2007 Service; C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe [2008-03-27 607576]
R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-10-01 116040]
R2 Ati External Event Utility;Ati External Event Utility; C:\Windows\system32\Ati2evxx.exe [2006-01-27 561152]
R2 Automatic LiveUpdate Scheduler;Automatic LiveUpdate Scheduler; C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe [2007-09-12 554352]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2008-08-29 238888]
R2 PrismXL;PrismXL; C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS [2007-12-06 65536]
R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2008-10-01 536872]
R3 usnjsvc;Messenger Sharing Folders USN Journal Reader service; C:\Program Files\Windows Live\Messenger\usnsvc.exe [2007-10-18 98328]
S2 CLTNetCnService;Symantec Lic NetConnect service; C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe /h ccCommon []
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [2005-11-14 69632]
S3 LiveUpdate;LiveUpdate; C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE [2007-09-12 2999664]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2007-08-24 68464]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2007-08-24 443776]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 Steam Client Service;Steam Client Service; C:\Program Files\Common Files\Steam\SteamService.exe [2008-08-21 87288]

—————–EOF—————–
Post #12
Hello

Please download the OTMoveIt3 by OldTimer.
  • Save it to your desktop.
  • Please double-click OTMoveIt3.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
  • Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

    :Processes
explorer.exe

:Services
ao5uvq9y

:Reg

:Files
C:\Windows\system32\vqfmmimd.dll
C:\Windows\system32\kmljmx.dll
C:\Windows\system32\whuygw.dll
C:\Windows\system32\iabrtbtl.dll
C:\Windows\system32\ojmfyvot.ini
C:\Windows\system32\wzjzaa.dll
C:\Windows\system32\yulerhwv.dll
C:\Windows\system32\pscmlsbv.ini
C:\Windows\system32\chvcpvvg.ini
C:\Windows\system32\3bdf2b7f-.txt
C:\ProgramData\ulohsvmt
C:\ProgramData\tqnqbgrw

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]
  • Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
  • Click the red Moveit! button.
  • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  • Close OTMoveIt3
Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.



Also post a new Rsit log
Post #13
========== PROCESSES ========== Process explorer.exe killed successfully. ========== SERVICES/DRIVERS ========== Unable to stop service ao5uvq9y . ========== REGISTRY ========== ========== FILES ========== DllUnregisterServer procedure not found in C:\Windows\system32\vqfmmimd.dll C:\Windows\system32\vqfmmimd.dll NOT unregistered. C:\Windows\system32\vqfmmimd.dll moved successfully. DllUnregisterServer procedure not found in C:\Windows\system32\kmljmx.dll C:\Windows\system32\kmljmx.dll NOT unregistered. C:\Windows\system32\kmljmx.dll moved successfully. DllUnregisterServer procedure not found in C:\Windows\system32\whuygw.dll C:\Windows\system32\whuygw.dll NOT unregistered. C:\Windows\system32\whuygw.dll moved successfully. DllUnregisterServer procedure not found in C:\Windows\system32\iabrtbtl.dll C:\Windows\system32\iabrtbtl.dll NOT unregistered. C:\Windows\system32\iabrtbtl.dll moved successfully. C:\Windows\system32\ojmfyvot.ini moved successfully. DllUnregisterServer procedure not found in C:\Windows\system32\wzjzaa.dll C:\Windows\system32\wzjzaa.dll NOT unregistered. C:\Windows\system32\wzjzaa.dll moved successfully. DllUnregisterServer procedure not found in C:\Windows\system32\yulerhwv.dll C:\Windows\system32\yulerhwv.dll NOT unregistered. C:\Windows\system32\yulerhwv.dll moved successfully. C:\Windows\system32\pscmlsbv.ini moved successfully. C:\Windows\system32\chvcpvvg.ini moved successfully. C:\Windows\system32\3bdf2b7f-.txt moved successfully. C:\ProgramData\ulohsvmt moved successfully. C:\ProgramData\tqnqbgrw moved successfully. ========== COMMANDS ========== File delete failed. C:\Users\NEC1\AppData\Local\Temp\~DF3E22.tmp scheduled to be deleted on reboot. File delete failed. C:\Users\NEC1\AppData\Local\Temp\~DF3E2B.tmp scheduled to be deleted on reboot. File delete failed. C:\Users\NEC1\AppData\Local\Temp\~DF7D9.tmp scheduled to be deleted on reboot. File delete failed. C:\Users\NEC1\AppData\Local\Temp\~DFFD.tmp scheduled to be deleted on reboot. User's Temp folder emptied. User's Temporary Internet Files folder emptied. User's Internet Explorer cache folder emptied. Local Service Temp folder emptied. Local Service Temporary Internet Files folder emptied. File delete failed. C:\Windows\temp\TMP00000046AE6DB47DA45C2327 scheduled to be deleted on reboot. Windows Temp folder emptied. FireFox cache emptied. Temp folders emptied. Explorer started successfully OTMoveIt3 by OldTimer - Version 1.0.5.0 log created on 10152008_165006 Files moved on Reboot… File C:\Users\NEC1\AppData\Local\Temp\~DF3E22.tmp not found! File C:\Users\NEC1\AppData\Local\Temp\~DF3E2B.tmp not found! File C:\Users\NEC1\AppData\Local\Temp\~DF7D9.tmp not found! File C:\Users\NEC1\AppData\Local\Temp\~DFFD.tmp not found! File C:\Windows\temp\TMP00000046AE6DB47DA45C2327 not found!
Post #15
Logfile of random's system information tool 1.04 (written by random/random)
Run by [removed] at 2008-10-15 17:01:23
Microsoft® Windows Vista™ Home Premium Service Pack 1
System drive C: has 135 GB (59%) free of 229 GB
Total RAM: 895 MB (26% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:01:35 PM, on 15/10/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\RtHDVCpl.exe
C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
C:\WINDOWS\Vm_sti.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Windows\ehome\ehmsas.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\IEUser.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\NEC1\Desktop\Unused Desktop Icons\RSIT.exe
C:\Program Files\trend micro\NEC1.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: {575336e0-2ae2-77fb-6d64-2a4508e4ee55} - {55ee4e80-54a2-46d6-bf77-2ea20e633575} - C:\Windows\system32\kmljmx.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {E3524E9D-A525-4357-8E11-972ADA5DAC5C} - C:\Windows\system32\qoMdaAPJ.dll (file missing)
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Samsung PanelMgr] C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe /autorun
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [BigDogPath] C:\Windows\VM_STI.EXE lebeca web camera driver
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [webencfg] C:\Windows\system32\inmxsjgb.exe
O4 - HKCU\..\Run: [MSServer] rundll32.exe C:\Users\NEC1\AppData\Local\Temp\awtqNFvu.dll,#1
O4 - HKLM\..\Policies\Explorer\Run: [pzW5PT3kwf] C:\Users\NEC1\AppData\Local\Temp\windfr.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Global Startup: Install Pending Files.LNK = C:\Program Files\SIFXINST\SIFXINST.EXE
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~3.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~3.0_0\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll/206 (file missing)
O13 - Gopher Prefix:
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/…NPUplden-ca.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: wzjzaa.dll kmljmx.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe

–
End of file - 7414 bytes

======Scheduled tasks folder======

C:\Windows\tasks\User_Feed_Synchronization-{31AC1BE1-2A06-4404-9F8C-9E3E33F1FF94}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{55ee4e80-54a2-46d6-bf77-2ea20e633575}]
C:\Windows\system32\kmljmx.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll [2008-06-10 509328]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E3524E9D-A525-4357-8E11-972ADA5DAC5C}]
C:\Windows\system32\qoMdaAPJ.dll []

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-19 1008184]
"RtHDVCpl"=C:\Windows\RtHDVCpl.exe [2007-01-11 4321280]
"Samsung PanelMgr"=C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe [2007-01-02 520192]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2007-08-24 33648]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-01-11 39792]
"NBKeyScan"=C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe []
"BigDogPath"=C:\Windows\VM_STI.EXE [2003-01-22 40960]
"TkBellExe"=C:\Program Files\Common Files\Real\Update_OB\realsched.exe -osboot []
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2008-09-06 413696]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2008-10-01 289576]
"Malwarebytes Anti-Malware (reboot)"=C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe [2008-09-10 1253040]
"SunJavaUpdateSched"=C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe [2008-06-10 144784]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
"pzW5PT3kwf"=C:\User [2007-12-06 2]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
""= []
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2006-11-10 90112]
"ehTray.exe"=C:\Windows\ehome\ehTray.exe [2008-01-19 125952]
"MsnMsgr"=C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe [2007-10-18 5724184]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe ASO-616B5711-6DAE-4795-A05F-39A1E5104020 []
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\daemon.exe [2008-01-17 486856]
"WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2008-01-19 202240]
"webencfg"=C:\Windows\system32\inmxsjgb.exe []
"MSServer"=C:\User [2007-12-06 2]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent DNA]
C:\User [2007-12-06 2]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Free Download Manager]
C:\Program Files\Free Download Manager\fdm.exe -autorun []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\QTTask.exe [2008-09-06 413696]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Install Pending Files.LNK - C:\Program Files\SIFXINST\SIFXINST.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="wzjzaa.dll kmljmx.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2007-08-24 2212224]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"authentication packages"=msv1_0
C:\Windows\system32\qoMdaAPJ

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\aawservice]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files\BitTorrent\bittorrent.exe"="C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{23076a39-a5b9-11dc-8bab-0019db5cae7a}]
shell\Auto\command - auto.exe
shell\AutoRun\command - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL auto.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5e0609b4-bb2d-11dc-8472-0019db5cae7a}]
shell\AutoRun\command - L:\LaunchU3.exe


======List of files/folders created in the last 1 months======

2008-10-15 14:07:33 —-D—- C:\Avenger
2008-10-15 14:07:33 —-A—- C:\avenger.txt
2008-10-15 13:08:55 —-D—- C:\Users\NEC1\AppData\Roaming\Malwarebytes
2008-10-15 13:08:47 —-D—- C:\ProgramData\Malwarebytes
2008-10-15 13:08:46 —-D—- C:\Program Files\Malwarebytes' Anti-Malware
2008-10-14 21:22:49 —-D—- C:\rsit
2008-10-14 21:22:49 —-D—- C:\Program Files\trend micro
2008-10-14 19:28:33 —-D—- C:\_OTMoveIt
2008-10-14 19:14:40 —-A—- C:\lopR.txt
2008-10-14 19:14:11 —-D—- C:\Lop SD
2008-10-13 20:38:25 —-D—- C:\Program Files\Alwil Software
2008-10-13 10:25:29 —-D—- C:\Program Files\HijackThis
2008-10-03 14:20:17 —-D—- C:\ProgramData\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-10-03 14:20:17 —-D—- C:\Program Files\iPod
2008-10-03 14:20:16 —-D—- C:\Program Files\iTunes
2008-10-03 14:15:06 —-D—- C:\Program Files\Safari
2008-09-18 22:46:21 —-A—- C:\Windows\system32\GEARAspi.dll
2008-09-18 22:46:20 —-DC—- C:\Windows\system32\DRVSTORE
2008-09-18 22:45:12 —-D—- C:\Program Files\Bonjour
2008-09-18 22:44:22 —-D—- C:\Program Files\QuickTime
2008-09-18 22:42:33 —-D—- C:\Program Files\Apple Software Update

======List of files/folders modified in the last 1 months======

2008-10-15 17:01:25 —-D—- C:\Windows\Temp
2008-10-15 16:50:08 —-HD—- C:\ProgramData
2008-10-15 16:50:08 —-D—- C:\Windows\System32
2008-10-15 14:11:16 —-SHD—- C:\Windows\Installer
2008-10-15 14:11:14 —-D—- C:\Program Files\Java
2008-10-15 14:10:53 —-SHD—- C:\System Volume Information
2008-10-15 14:07:33 —-RD—- C:\Program Files
2008-10-15 14:07:33 —-D—- C:\Windows\system32\drivers
2008-10-15 14:05:21 —-D—- C:\WINDOWS
2008-10-15 13:05:23 —-D—- C:\Windows\system32\catroot2
2008-10-14 20:08:58 —-A—- C:\Windows\system32\PerfStringBackup.INI
2008-10-14 20:08:56 —-D—- C:\Windows\inf
2008-10-14 19:21:55 —-D—- C:\Windows\system32\Tasks
2008-10-13 19:24:03 —-D—- C:\Program Files\Mozilla Firefox
2008-10-13 18:57:38 —-HD—- C:\Windows\system32\GroupPolicy
2008-10-13 14:20:52 —-D—- C:\Downloads
2008-10-13 14:09:45 —-D—- C:\Windows\Prefetch
2008-10-10 21:14:36 —-D—- C:\Users\NEC1\AppData\Roaming\foobar2000
2008-10-04 22:41:59 —-D—- C:\Users\NEC1\AppData\Roaming\Apple Computer
2008-10-03 14:19:06 —-D—- C:\Windows\system32\catroot
2008-09-18 22:46:00 —-D—- C:\ProgramData\Apple Computer
2008-09-18 22:44:28 —-D—- C:\Program Files\Common Files\Apple
2008-09-16 16:57:39 —-D—- C:\Users\NEC1\AppData\Roaming\Skype
2008-09-16 16:57:08 —-D—- C:\Users\NEC1\AppData\Roaming\skypePM

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 eeCtrl;Symantec Eraser Control driver; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [2008-01-18 385072]
R2 DgiVecp;DgiVecp; \??\C:\Windows\system32\Drivers\DgiVecp.sys [2007-01-03 41984]
R2 SSPORT;SSPORT; \??\C:\Windows\system32\Drivers\SSPORT.sys [2007-01-03 5120]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\system32\DRIVERS\GEARAspiWDM.sys [2008-04-17 15464]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2007-01-13 1675368]
R3 R300;R300; C:\Windows\system32\DRIVERS\atikmdag.sys [2006-01-27 2364928]
R3 RTL8169;Realtek 8169 NT Driver; C:\Windows\system32\DRIVERS\Rtlh86.sys [2007-01-15 70144]
R3 VST_DPV;VST_DPV; C:\Windows\system32\DRIVERS\VSTDPV3.SYS [2006-11-02 987648]
R3 VSTHWBS2;VSTHWBS2; C:\Windows\system32\DRIVERS\VSTBS23.SYS [2006-11-02 251904]
R3 winachsf;winachsf; C:\Windows\system32\DRIVERS\VSTCNXT3.SYS [2006-11-02 654336]
R3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-19 83328]
S3 aiqrvlw0;aiqrvlw0; C:\Windows\system32\drivers\aiqrvlw0.sys []
S3 drmkaud;Microsoft Kernel DRM Audio Descrambler; C:\Windows\system32\drivers\drmkaud.sys [2008-01-19 5632]
S3 HdAudAddService;Microsoft 1.1 UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
S3 ialm;ialm; C:\Windows\system32\DRIVERS\ialmnt5.sys [2006-11-02 1302492]
S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-19 8192]
S3 MSPCLOCK;Microsoft Streaming Clock Proxy; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-19 5888]
S3 MSPQM;Microsoft Streaming Quality Manager Proxy; C:\Windows\system32\drivers\MSPQM.sys [2008-01-19 5504]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\Windows\system32\drivers\MSTEE.sys [2008-01-19 6016]
S3 RTL8023xp;Realtek 10/100 NIC Family NDIS x86 Driver; C:\Windows\system32\DRIVERS\Rtnicxp.sys [2006-11-02 47104]
S3 s616bus;Sony Ericsson Device 616 driver (WDM); C:\Windows\system32\DRIVERS\s616bus.sys [2007-04-03 83208]
S3 s616mdfl;Sony Ericsson Device 616 USB WMC Modem Filter; C:\Windows\system32\DRIVERS\s616mdfl.sys [2007-04-03 15112]
S3 s616mdm;Sony Ericsson Device 616 USB WMC Modem Driver; C:\Windows\system32\DRIVERS\s616mdm.sys [2007-04-03 108680]
S3 s616mgmt;Sony Ericsson Device 616 USB WMC Device Management Drivers (WDM); C:\Windows\system32\DRIVERS\s616mgmt.sys [2007-04-03 100360]
S3 s616nd5;Sony Ericsson Device 616 USB Ethernet Emulation SEMC616 (NDIS); C:\Windows\system32\DRIVERS\s616nd5.sys [2007-04-03 23176]
S3 s616obex;Sony Ericsson Device 616 USB WMC OBEX Interface; C:\Windows\system32\DRIVERS\s616obex.sys [2007-04-03 98568]
S3 s616unic;Sony Ericsson Device 616 USB Ethernet Emulation SEMC616 (WDM); C:\Windows\system32\DRIVERS\s616unic.sys [2007-04-03 99080]
S3 USBAAPL;Apple Mobile USB Driver; C:\Windows\System32\Drivers\usbaapl.sys [2008-10-01 32000]
S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2008-01-19 39936]
S3 ZSMC301b;Look 312P; C:\Windows\System32\Drivers\usbVM31b.sys [2004-03-19 90968]
S4 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\drivers\wmiacpi.sys [2006-11-02 11264]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aawservice;Ad-Aware 2007 Service; C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe [2008-03-27 607576]
R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-10-01 116040]
R2 Ati External Event Utility;Ati External Event Utility; C:\Windows\system32\Ati2evxx.exe [2006-01-27 561152]
R2 Automatic LiveUpdate Scheduler;Automatic LiveUpdate Scheduler; C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe [2007-09-12 554352]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2008-08-29 238888]
R2 PrismXL;PrismXL; C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS [2007-12-06 65536]
R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2008-10-01 536872]
R3 usnjsvc;Messenger Sharing Folders USN Journal Reader service; C:\Program Files\Windows Live\Messenger\usnsvc.exe [2007-10-18 98328]
S2 CLTNetCnService;Symantec Lic NetConnect service; C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe /h ccCommon []
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [2005-11-14 69632]
S3 LiveUpdate;LiveUpdate; C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE [2007-09-12 2999664]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2007-08-24 68464]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2007-08-24 443776]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 Steam Client Service;Steam Client Service; C:\Program Files\Common Files\Steam\SteamService.exe [2008-08-21 87288]

—————–EOF—————–

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI