Spyware / Malware / Virus Removal

[Resolved] xp antispyware 2009

20 min read

Looking for the outcome? Ask AI

LDTate

Post #16October 26, 2008, 10:55 PM UTC

While I'm woking on the fix, please do this

Please go to http://virusscan.jotti.org , click on Browse, and upload the following file for analysis:

C:\WINDOWS\SYSTEM32\jyxwdavq.exe

Then click Submit. Allow the file to be scanned, and then please copy and paste the results here for me to see.

If Jotti is too busy you can try these.

http://www.kaspersky.com/scanforvirus.html

http://www.virustotal.com/en/indexf.html

LDTate

Post #17October 26, 2008, 11:10 PM UTC last edited October 27, 2008, 12:10 AM UTC

Copy/paste the text in the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text.

File::
C:\WINDOWS\SYSTEM32\psdclupk.exe
C:\WINDOWS\SYSTEM32\rslkrcto.exe
C:\WINDOWS\yhoguh.dl
C:\WINDOWS\myfyqawop.inf
C:\Program Files\Common Files\bafa.bat
C:\WINDOWS\titec.vbs
C:\WINDOWS\SYSTEM32\lepak.bin
C:\WINDOWS\yzocujijo.dll
C:\WINDOWS\bizafopod._sy
C:\WINDOWS\SYSTEM32\ifasohes.sys
C:\Program Files\Common Files\ylev.vbs
C:\WINDOWS\SYSTEM32\gunujeg.dll
C:\WINDOWS\hapa.com
C:\WINDOWS\SYSTEM32\yzenabub.exe
C:\WINDOWS\SYSTEM32\hkvczylq.exe
C:\WINDOWS\SYSTEM32\hatqranq.exe
C:\WINDOWS\SYSTEM32\idgnupkf.exe
C:\WINDOWS\SYSTEM32\itirmpsl.exe
C:\WINDOWS\SYSTEM32\jyxwdavq.exe
C:\WINDOWS\SYSTEM32\gdyvgvur.exe
C:\WINDOWS\SYSTEM32\enetqrgx.exe
C:\WINDOWS\SYSTEM32\ritonori.exe
C:\WINDOWS\SYSTEM32\ncxsrqhg.exe
C:\WINDOWS\SYSTEM32\shsxgtoj.exe
C:\WINDOWS\SYSTEM32\wrslytqp.exe
C:\WINDOWS\SYSTEM32\zkpixork.exe
C:\WINDOWS\SYSTEM32\jezipmvq.exe
C:\WINDOWS\SYSTEM32\jwponuza.exe
C:\WINDOWS\SYSTEM32\fulgjqjw.exe
C:\WINDOWS\SYSTEM32\gnedwncv.exe
C:\WINDOWS\SYSTEM32\lyhuxqne.exe
C:\WINDOWS\SYSTEM32\xgjulkjk.exe
C:\WINDOWS\SYSTEM32\gzstslwh.exe
C:\WINDOWS\SYSTEM32\nctinybq.exe
C:\WINDOWS\SYSTEM32\srijwpqx.exe
C:\WINDOWS\SYSTEM32\lyryvuva.exe
C:\WINDOWS\SYSTEM32\nmxerkji.exe
C:\WINDOWS\SYSTEM32\tufivghe.exe
C:\WINDOWS\SYSTEM32\wfuxshyx.exe
C:\WINDOWS\SYSTEM32\lctchsbi.exe
C:\WINDOWS\SYSTEM32\qdwfolyl.exe
C:\WINDOWS\SYSTEM32\adkbizkr.exe
C:\WINDOWS\SYSTEM32\uxmvipex.exe
C:\WINDOWS\SYSTEM32\abobezex.exe
C:\WINDOWS\SYSTEM32\mhitudif.exe
C:\WINDOWS\SYSTEM32\alyjezaz.exe
C:\WINDOWS\SYSTEM32\ifebylqr.exe
C:\WINDOWS\SYSTEM32\klytalmb.exe
C:\WINDOWS\SYSTEM32\gbgdmfit.exe
C:\WINDOWS\SYSTEM32\rwtolwvw.exe
C:\WINDOWS\SYSTEM32\ylovojav.exe
C:\WINDOWS\SYSTEM32\tqbmtqdw.exe
C:\WINDOWS\SYSTEM32\xoxixszw.exe
C:\WINDOWS\SYSTEM32\tshmnije.exe
C:\WINDOWS\SYSTEM32\zgnavyte.exe
C:\WINDOWS\SYSTEM32\ovctshul.exe
C:\WINDOWS\SYSTEM32\mvanspwt.exe
C:\WINDOWS\SYSTEM32\rwbkjalw.exe
C:\WINDOWS\SYSTEM32\dqlqhale.exe
C:\WINDOWS\SYSTEM32\xitqtmvk.exe
C:\WINDOWS\SYSTEM32\lilktkrq.exe
C:\WINDOWS\SYSTEM32\ovopapot.exe
C:\WINDOWS\SYSTEM32\ypkdudux.exe
C:\WINDOWS\SYSTEM32\fqhgpgvy.exe
C:\WINDOWS\SYSTEM32\wzihklkr.exe
C:\WINDOWS\SYSTEM32\obqxqzah.exe
C:\WINDOWS\SYSTEM32\ijstupmz.exe
C:\WINDOWS\SYSTEM32\xahwnuhc.exe
C:\WINDOWS\SYSTEM32\mlsxsfex.exe
C:\WINDOWS\SYSTEM32\rmvmrmvy.exe
C:\WINDOWS\SYSTEM32\titoxmzo.exe
C:\WINDOWS\SYSTEM32\vaxkxips.exe
C:\WINDOWS\SYSTEM32\fybgjopy.exe
C:\WINDOWS\SYSTEM32\lqvwryxy.exe
C:\WINDOWS\SYSTEM32\zqtqzels.exe
C:\WINDOWS\SYSTEM32\rqzmlkfk.exe
C:\WINDOWS\SYSTEM32\upqtengb.exe
C:\WINDOWS\SYSTEM32\lilyhubs.exe
C:\WINDOWS\SYSTEM32\dmjatkng.exe
C:\WINDOWS\SYSTEM32\fafynqhc.exe
C:\WINDOWS\SYSTEM32\vcloperg.exe
C:\WINDOWS\SYSTEM32\itwjydkt.exe
C:\WINDOWS\SYSTEM32\ebkxwvgj.exe
C:\WINDOWS\SYSTEM32\hqhahkpa.exe
C:\WINDOWS\SYSTEM32\dmpaxgxi.exe
C:\WINDOWS\SYSTEM32\ktodexwv.exe
C:\WINDOWS\SYSTEM32\jydwpmly.exe
C:\WINDOWS\SYSTEM32\zqvorqni.exe
C:\WINDOWS\SYSTEM32\qrgfgziz.exe
C:\WINDOWS\SYSTEM32\ebeparyf.exe
C:\WINDOWS\SYSTEM32\bcfqzezw.exe

Collect::
C:\WINDOWS\SYSTEM32\ynqvcpkd.exe
C:\WINDOWS\SYSTEM32\wbkbwdsr.exe

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:
1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]

Drag CFScript.txt into ComboFix.exe

Then post the results log and a new HijackThis log.

Also please describe how your computer behaves at the moment.

kurdyj00

Post #18October 27, 2008, 12:36 AM UTC

Hi again,

When I ran Combofix , all icons on the desktop vanished. Restarted the PC and ran Combofix. It began then the error window came up

NIRCmdC.efexe-Application arreo The application failed to initialize properly (0xc0000142) click on OK to terminate the application

However I could see Combofix still loading in the background so I closed the error application window. Combofix continued to run (at one point the desktop went white but it came back and combofix was still running) When the scan was complete, all icons were gone from desktop.

Here are the logs

ComboFix 08-10-24.02 - Jeff 2008-10-26 19:47:04.5 - NTFSx86
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Jeff\Desktop\CFScript.txt
* Created a new restore point

FILE ::
C:\Program Files\Common Files\bafa.bat
C:\Program Files\Common Files\ylev.vbs
C:\WINDOWS\bizafopod._sy
C:\WINDOWS\hapa.com
C:\WINDOWS\myfyqawop.inf
C:\WINDOWS\SYSTEM32\abobezex.exe
C:\WINDOWS\SYSTEM32\adkbizkr.exe
C:\WINDOWS\SYSTEM32\alyjezaz.exe
C:\WINDOWS\SYSTEM32\bcfqzezw.exe
C:\WINDOWS\SYSTEM32\dmjatkng.exe
C:\WINDOWS\SYSTEM32\dmpaxgxi.exe
C:\WINDOWS\SYSTEM32\dqlqhale.exe
C:\WINDOWS\SYSTEM32\ebeparyf.exe
C:\WINDOWS\SYSTEM32\ebkxwvgj.exe
C:\WINDOWS\SYSTEM32\enetqrgx.exe
C:\WINDOWS\SYSTEM32\fafynqhc.exe
C:\WINDOWS\SYSTEM32\fqhgpgvy.exe
C:\WINDOWS\SYSTEM32\fulgjqjw.exe
C:\WINDOWS\SYSTEM32\fybgjopy.exe
C:\WINDOWS\SYSTEM32\gbgdmfit.exe
C:\WINDOWS\SYSTEM32\gdyvgvur.exe
C:\WINDOWS\SYSTEM32\gnedwncv.exe
C:\WINDOWS\SYSTEM32\gunujeg.dll
C:\WINDOWS\SYSTEM32\gzstslwh.exe
C:\WINDOWS\SYSTEM32\hatqranq.exe
C:\WINDOWS\SYSTEM32\hkvczylq.exe
C:\WINDOWS\SYSTEM32\hqhahkpa.exe
C:\WINDOWS\SYSTEM32\idgnupkf.exe
C:\WINDOWS\SYSTEM32\ifasohes.sys
C:\WINDOWS\SYSTEM32\ifebylqr.exe
C:\WINDOWS\SYSTEM32\ijstupmz.exe
C:\WINDOWS\SYSTEM32\itirmpsl.exe
C:\WINDOWS\SYSTEM32\itwjydkt.exe
C:\WINDOWS\SYSTEM32\jezipmvq.exe
C:\WINDOWS\SYSTEM32\jwponuza.exe
C:\WINDOWS\SYSTEM32\jydwpmly.exe
C:\WINDOWS\SYSTEM32\jyxwdavq.exe
C:\WINDOWS\SYSTEM32\klytalmb.exe
C:\WINDOWS\SYSTEM32\ktodexwv.exe
C:\WINDOWS\SYSTEM32\lctchsbi.exe
C:\WINDOWS\SYSTEM32\lepak.bin
C:\WINDOWS\SYSTEM32\lilktkrq.exe
C:\WINDOWS\SYSTEM32\lilyhubs.exe
C:\WINDOWS\SYSTEM32\lqvwryxy.exe
C:\WINDOWS\SYSTEM32\lyhuxqne.exe
C:\WINDOWS\SYSTEM32\lyryvuva.exe
C:\WINDOWS\SYSTEM32\mhitudif.exe
C:\WINDOWS\SYSTEM32\mlsxsfex.exe
C:\WINDOWS\SYSTEM32\mvanspwt.exe
C:\WINDOWS\SYSTEM32\nctinybq.exe
C:\WINDOWS\SYSTEM32\ncxsrqhg.exe
C:\WINDOWS\SYSTEM32\nmxerkji.exe
C:\WINDOWS\SYSTEM32\obqxqzah.exe
C:\WINDOWS\SYSTEM32\ovctshul.exe
C:\WINDOWS\SYSTEM32\ovopapot.exe
C:\WINDOWS\SYSTEM32\psdclupk.exe
C:\WINDOWS\SYSTEM32\qdwfolyl.exe
C:\WINDOWS\SYSTEM32\qrgfgziz.exe
C:\WINDOWS\SYSTEM32\ritonori.exe
C:\WINDOWS\SYSTEM32\rmvmrmvy.exe
C:\WINDOWS\SYSTEM32\rqzmlkfk.exe
C:\WINDOWS\SYSTEM32\rslkrcto.exe
C:\WINDOWS\SYSTEM32\rwbkjalw.exe
C:\WINDOWS\SYSTEM32\rwtolwvw.exe
C:\WINDOWS\SYSTEM32\shsxgtoj.exe
C:\WINDOWS\SYSTEM32\srijwpqx.exe
C:\WINDOWS\SYSTEM32\titoxmzo.exe
C:\WINDOWS\SYSTEM32\tqbmtqdw.exe
C:\WINDOWS\SYSTEM32\tshmnije.exe
C:\WINDOWS\SYSTEM32\tufivghe.exe
C:\WINDOWS\SYSTEM32\upqtengb.exe
C:\WINDOWS\SYSTEM32\uxmvipex.exe
C:\WINDOWS\SYSTEM32\vaxkxips.exe
C:\WINDOWS\SYSTEM32\vcloperg.exe
C:\WINDOWS\SYSTEM32\wbkbwdsr.exe
C:\WINDOWS\SYSTEM32\wfuxshyx.exe
C:\WINDOWS\SYSTEM32\wrslytqp.exe
C:\WINDOWS\SYSTEM32\wzihklkr.exe
C:\WINDOWS\SYSTEM32\xahwnuhc.exe
C:\WINDOWS\SYSTEM32\xgjulkjk.exe
C:\WINDOWS\SYSTEM32\xitqtmvk.exe
C:\WINDOWS\SYSTEM32\xoxixszw.exe
C:\WINDOWS\SYSTEM32\ylovojav.exe
C:\WINDOWS\SYSTEM32\ynqvcpkd.exe
C:\WINDOWS\SYSTEM32\ypkdudux.exe
C:\WINDOWS\SYSTEM32\yzenabub.exe
C:\WINDOWS\SYSTEM32\zgnavyte.exe
C:\WINDOWS\SYSTEM32\zkpixork.exe
C:\WINDOWS\SYSTEM32\zqtqzels.exe
C:\WINDOWS\SYSTEM32\zqvorqni.exe
C:\WINDOWS\titec.vbs
C:\WINDOWS\yhoguh.dl
C:\WINDOWS\yzocujijo.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\Common Files\bafa.bat
C:\Program Files\Common Files\ylev.vbs
C:\WINDOWS\bizafopod._sy
C:\WINDOWS\hapa.com
C:\WINDOWS\myfyqawop.inf
C:\WINDOWS\SYSTEM32\abobezex.exe
C:\WINDOWS\SYSTEM32\adkbizkr.exe
C:\WINDOWS\SYSTEM32\alyjezaz.exe
C:\WINDOWS\SYSTEM32\bcfqzezw.exe
C:\WINDOWS\SYSTEM32\dmjatkng.exe
C:\WINDOWS\SYSTEM32\dmpaxgxi.exe
C:\WINDOWS\SYSTEM32\dqlqhale.exe
C:\WINDOWS\SYSTEM32\ebeparyf.exe
C:\WINDOWS\SYSTEM32\ebkxwvgj.exe
C:\WINDOWS\SYSTEM32\enetqrgx.exe
C:\WINDOWS\SYSTEM32\fafynqhc.exe
C:\WINDOWS\SYSTEM32\fqhgpgvy.exe
C:\WINDOWS\SYSTEM32\fulgjqjw.exe
C:\WINDOWS\SYSTEM32\fybgjopy.exe
C:\WINDOWS\SYSTEM32\gbgdmfit.exe
C:\WINDOWS\SYSTEM32\gdyvgvur.exe
C:\WINDOWS\SYSTEM32\gnedwncv.exe
C:\WINDOWS\SYSTEM32\gunujeg.dll
C:\WINDOWS\SYSTEM32\gzstslwh.exe
C:\WINDOWS\SYSTEM32\hatqranq.exe
C:\WINDOWS\SYSTEM32\hkvczylq.exe
C:\WINDOWS\SYSTEM32\hqhahkpa.exe
C:\WINDOWS\SYSTEM32\idgnupkf.exe
C:\WINDOWS\SYSTEM32\ifasohes.sys
C:\WINDOWS\SYSTEM32\ifebylqr.exe
C:\WINDOWS\SYSTEM32\ijstupmz.exe
C:\WINDOWS\SYSTEM32\itirmpsl.exe
C:\WINDOWS\SYSTEM32\itwjydkt.exe
C:\WINDOWS\SYSTEM32\jezipmvq.exe
C:\WINDOWS\SYSTEM32\jwponuza.exe
C:\WINDOWS\SYSTEM32\jydwpmly.exe
C:\WINDOWS\SYSTEM32\jyxwdavq.exe
C:\WINDOWS\SYSTEM32\klytalmb.exe
C:\WINDOWS\SYSTEM32\ktodexwv.exe
C:\WINDOWS\SYSTEM32\lctchsbi.exe
C:\WINDOWS\SYSTEM32\lepak.bin
C:\WINDOWS\SYSTEM32\lilktkrq.exe
C:\WINDOWS\SYSTEM32\lilyhubs.exe
C:\WINDOWS\SYSTEM32\lqvwryxy.exe
C:\WINDOWS\SYSTEM32\lyhuxqne.exe
C:\WINDOWS\SYSTEM32\lyryvuva.exe
C:\WINDOWS\SYSTEM32\mhitudif.exe
C:\WINDOWS\SYSTEM32\mlsxsfex.exe
C:\WINDOWS\SYSTEM32\mvanspwt.exe
C:\WINDOWS\SYSTEM32\nctinybq.exe
C:\WINDOWS\SYSTEM32\ncxsrqhg.exe
C:\WINDOWS\SYSTEM32\nmxerkji.exe
C:\WINDOWS\SYSTEM32\obqxqzah.exe
C:\WINDOWS\SYSTEM32\ovctshul.exe
C:\WINDOWS\SYSTEM32\ovopapot.exe
C:\WINDOWS\SYSTEM32\psdclupk.exe
C:\WINDOWS\SYSTEM32\qdwfolyl.exe
C:\WINDOWS\SYSTEM32\qrgfgziz.exe
C:\WINDOWS\SYSTEM32\ritonori.exe
C:\WINDOWS\SYSTEM32\rmvmrmvy.exe
C:\WINDOWS\SYSTEM32\rqzmlkfk.exe
C:\WINDOWS\SYSTEM32\rslkrcto.exe
C:\WINDOWS\SYSTEM32\rwbkjalw.exe
C:\WINDOWS\SYSTEM32\rwtolwvw.exe
C:\WINDOWS\SYSTEM32\shsxgtoj.exe
C:\WINDOWS\SYSTEM32\srijwpqx.exe
C:\WINDOWS\SYSTEM32\titoxmzo.exe
C:\WINDOWS\SYSTEM32\tqbmtqdw.exe
C:\WINDOWS\SYSTEM32\tshmnije.exe
C:\WINDOWS\SYSTEM32\tufivghe.exe
C:\WINDOWS\SYSTEM32\upqtengb.exe
C:\WINDOWS\SYSTEM32\uxmvipex.exe
C:\WINDOWS\SYSTEM32\vaxkxips.exe
C:\WINDOWS\SYSTEM32\vcloperg.exe
C:\WINDOWS\SYSTEM32\wbkbwdsr.exe
C:\WINDOWS\SYSTEM32\wfuxshyx.exe
C:\WINDOWS\SYSTEM32\wrslytqp.exe
C:\WINDOWS\SYSTEM32\wzihklkr.exe
C:\WINDOWS\SYSTEM32\xahwnuhc.exe
C:\WINDOWS\SYSTEM32\xgjulkjk.exe
C:\WINDOWS\SYSTEM32\xitqtmvk.exe
C:\WINDOWS\SYSTEM32\xoxixszw.exe
C:\WINDOWS\SYSTEM32\ylovojav.exe
C:\WINDOWS\SYSTEM32\ynqvcpkd.exe
C:\WINDOWS\SYSTEM32\ypkdudux.exe
C:\WINDOWS\SYSTEM32\yzenabub.exe
C:\WINDOWS\SYSTEM32\zgnavyte.exe
C:\WINDOWS\SYSTEM32\zkpixork.exe
C:\WINDOWS\SYSTEM32\zqtqzels.exe
C:\WINDOWS\SYSTEM32\zqvorqni.exe
C:\WINDOWS\titec.vbs
C:\WINDOWS\yhoguh.dl
C:\WINDOWS\yzocujijo.dll

.
((((((((((((((((((((((((( Files Created from 2008-09-26 to 2008-10-26 )))))))))))))))))))))))))))))))
.

2008-10-24 19:37 . 2008-10-24 19:37 8,627 –a—— C:\WINDOWS\SYSTEM32\PAV_FOG.OPC
2008-10-24 19:24 . 2008-10-26 19:38 13,880 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\COMFiltr.sys
2008-10-24 19:22 . 2008-04-28 11:35 84,024 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\pavdrv51.sys
2008-10-24 19:22 . 2008-10-24 19:22 249 –a—— C:\WINDOWS\SYSTEM32\PavCPL.dat
2008-10-24 19:21 . 2007-03-15 19:38 54,832 –a—— C:\WINDOWS\SYSTEM32\pavcpl.cpl
2008-10-24 19:20 . 2008-06-18 18:03 520,448 –a—— C:\WINDOWS\SYSTEM32\PavSHook.dll
2008-10-24 19:20 . 2003-10-22 18:23 446,464 –a—— C:\WINDOWS\SYSTEM32\HHActiveX.dll
2008-10-24 19:20 . 2008-06-24 14:48 193,280 –a—— C:\WINDOWS\SYSTEM32\TpUtil.dll
2008-10-24 19:20 . 2007-02-08 11:53 107,568 –a—— C:\WINDOWS\SYSTEM32\SYSTOOLS.DLL
2008-10-24 19:20 . 2008-06-18 18:03 87,296 –a—— C:\WINDOWS\SYSTEM32\PavLspHook.dll
2008-10-24 19:20 . 2008-06-18 18:03 55,552 –a—— C:\WINDOWS\SYSTEM32\pavipc.dll
2008-10-24 19:19 . 2008-10-24 19:19 d——– C:\WINDOWS\SYSTEM32\PAV
2008-10-24 19:19 . 2008-10-24 19:19 d——– C:\Program Files\Panda Security
2008-10-24 19:19 . 2008-10-24 19:19 d——– C:\Documents and Settings\Jeff\Application Data\Panda Security
2008-10-24 19:19 . 2008-10-24 19:19 d——– C:\Documents and Settings\All Users\Application Data\Panda Security
2008-10-24 19:19 . 2008-03-18 16:58 58,672 –a—— C:\WINDOWS\SYSTEM32\avldr.dll
2008-10-24 19:18 . 2008-06-19 17:24 28,544 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\pavboot.sys
2008-10-24 19:17 . 2008-10-24 19:17 d——– C:\Program Files\Common Files\Panda Security
2008-10-24 19:17 . 2008-02-07 06:03 179,640 -ra—— C:\WINDOWS\SYSTEM32\DRIVERS\PavProc.sys
2008-10-24 19:17 . 2008-03-04 09:59 41,144 -ra—— C:\WINDOWS\SYSTEM32\DRIVERS\ShlDrv51.sys
2008-10-23 18:44 . 2008-10-23 18:44 d——– C:\Program Files\Malwarebytes' Anti-Malware
2008-10-23 18:44 . 2008-10-23 18:44 d——– C:\Documents and Settings\Jeff\Application Data\Malwarebytes
2008-10-23 18:44 . 2008-10-23 18:44 d——– C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-10-23 18:44 . 2008-10-22 16:10 38,496 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\mbamswissarmy.sys
2008-10-23 18:44 . 2008-10-22 16:10 15,504 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\mbam.sys
2008-10-15 03:03 . 2008-10-15 03:03 118 –a—— C:\WINDOWS\SYSTEM32\MRT.INI
2008-10-09 19:27 . 2008-10-09 19:27 d——– C:\Documents and Settings\TEMP\Application Data\Motive
2008-10-09 19:20 . 2008-10-09 19:20 d——– C:\Documents and Settings\TEMP\Application Data\Verizon
2008-10-09 19:20 . 2008-10-09 19:34 d——– C:\Documents and Settings\TEMP\Application Data\GTek
2008-10-09 19:16 . 2008-10-09 19:20 d——– C:\Documents and Settings\TEMP\Application Data\Symantec
2008-10-09 19:16 . 2008-10-09 19:52 d——– C:\Documents and Settings\TEMP
2008-10-09 03:11 . 2008-10-09 03:11 d——– C:\WINDOWS\SYSTEM32\LogFiles
2008-10-08 05:28 . 2008-10-08 05:28 98,304 –a—— C:\WINDOWS\SYSTEM32\ytgbwfol.exe
2008-10-08 05:23 . 2008-10-08 05:23 98,304 –a—— C:\WINDOWS\SYSTEM32\crwjwpyj.exe
2008-10-08 05:18 . 2008-10-08 05:18 98,304 –a—— C:\WINDOWS\SYSTEM32\nujyfgfa.exe
2008-10-08 05:13 . 2008-10-08 05:13 98,304 –a—— C:\WINDOWS\SYSTEM32\khyvqdot.exe
2008-10-08 05:08 . 2008-10-08 05:08 98,304 –a—— C:\WINDOWS\SYSTEM32\hmjatuxo.exe
2008-10-06 17:02 . 2008-10-06 17:02 98,304 –a—— C:\WINDOWS\SYSTEM32\pynclgjm.exe
2008-10-03 21:40 . 2008-10-23 18:58 d——– C:\Program Files\yjfcjyb
2008-10-03 21:40 . 2008-10-23 18:56 d——– C:\Documents and Settings\All Users\Application Data\tsdkbezi
2008-10-03 21:40 . 2008-10-03 21:40 102,400 –a—— C:\WINDOWS\SYSTEM32\lgtmfixi.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-25 20:55 ——— d—–w C:\Program Files\PhoneTools
2008-10-24 23:19 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-10-24 00:13 ——— d—–w C:\Program Files\Symantec
2008-10-24 00:11 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2008-10-23 02:01 ——— d—–w C:\Program Files\Norton SystemWorks
2008-10-23 01:58 ——— d—–w C:\Program Files\Spybot - Search & Destroy
2008-10-23 01:58 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-10-22 23:23 ——— d—–w C:\Documents and Settings\All Users\Application Data\Symantec
2008-10-10 02:55 ——— d—–w C:\Program Files\Common Files\Scanner
2008-10-10 02:55 ——— d—–w C:\Documents and Settings\All Users\Application Data\IEService
2008-09-28 17:41 ——— d—–w C:\Program Files\EA Games
2008-09-01 03:50 ——— d—–w C:\Program Files\TeaTimer (Spybot - Search & Destroy)
2008-09-01 02:15 ——— d—–w C:\Program Files\Riven
2008-09-01 02:13 ——— d—–w C:\Program Files\Disney Interactive
2008-08-28 10:04 333,056 —-a-w C:\WINDOWS\system32\drivers\srv.sys
2007-01-26 02:57 61,992 —-a-w C:\Documents and Settings\Jeff\Application Data\GDIPFONTCACHEV1.DAT
2007-01-19 22:56 774,144 —-a-w C:\Program Files\RngInterstitial.dll
2004-12-22 19:21 389,120 –sh–r C:\WINDOWS\SYSTEM32\?ttrib.exe
.

((((((((((((((((((((((((((((( snapshot_2008-10-24_20.10.51.73 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-10-24 22:29:25 12,288 —-a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
+ 2008-10-26 22:27:53 12,288 —-a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
- 2008-10-24 22:29:25 135,168 —-a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\misc.exe
+ 2008-10-26 22:27:53 135,168 —-a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\misc.exe
- 2008-10-24 22:29:25 11,264 —-a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
+ 2008-10-26 22:27:53 11,264 —-a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
- 2008-10-24 22:29:25 27,136 —-a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
+ 2008-10-26 22:27:53 27,136 —-a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
- 2008-10-24 22:29:25 4,096 —-a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
+ 2008-10-26 22:27:53 4,096 —-a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
- 2008-10-24 22:29:25 794,624 —-a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\outicon.exe
+ 2008-10-26 22:27:53 794,624 —-a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\outicon.exe
- 2008-10-24 22:29:25 249,856 —-a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\pptico.exe
+ 2008-10-26 22:27:53 249,856 —-a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\pptico.exe
- 2008-10-24 22:29:25 23,040 —-a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
+ 2008-10-26 22:27:53 23,040 —-a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
- 2008-10-24 22:29:25 286,720 —-a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
+ 2008-10-26 22:27:52 286,720 —-a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
- 2008-10-24 22:29:25 409,600 —-a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
+ 2008-10-26 22:27:52 409,600 —-a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
- 2008-10-21 21:09:48 102,400 —-a-r C:\WINDOWS\Installer\{9F70BF98-003C-491D-81FC-FF9792206AF0}\iTunesIco.exe
+ 2008-10-25 15:48:45 102,400 —-a-r C:\WINDOWS\Installer\{9F70BF98-003C-491D-81FC-FF9792206AF0}\iTunesIco.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"EasyLinkAdvisor"="C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" [2007-03-15 454784]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Microsoft Works Update Detection"="C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2001-08-16 28738]
"RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [2002-07-17 26112]
"MMTray"="C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe" [2002-02-27 90112]
"Dell|Alert"="C:\Program Files\Dell\Support\Alert\bin\DAMon.exe" [2002-04-03 282624]
"AdaptecDirectCD"="C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe" [2002-09-06 684032]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2003-10-06 5058560]
"SsAAD.exe"="C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe" [2006-01-07 81920]
"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe" [2006-01-13 196608]
"HPHmon03"="C:\WINDOWS\system32\hphmon03.exe" [2006-01-13 311296]
"Smart Start UP"="C:\Program Files\NewSoft\Smart Start UP\PnPDetect.exe" [2003-01-21 98304]
"SansaDispatch"="C:\Program Files\SanDisk\Sansa Updater\SansaDispatch.exe" [2007-10-22 75584]
"Verizon_McciTrayApp"="C:\Program Files\Verizon\McciTrayApp.exe" [2007-09-28 936960]
"VerizonServicepoint.exe"="C:\Program Files\Verizon\VSP\VerizonServicepoint.exe" [2007-05-11 2061816]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-05-27 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-06-02 267048]
"APVXDWIN"="C:\Program Files\Panda Security\Panda Antivirus Pro 2009\APVXDWIN.EXE" [2008-07-16 857344]
"SCANINICIO"="C:\Program Files\Panda Security\Panda Antivirus Pro 2009\Inicio.exe" [2008-07-07 50432]
"TraySantaCruz"="C:\WINDOWS\SYSTEM32\tbctray.exe" [2002-04-03 290816]
"nwiz"="nwiz.exe" [2003-10-06 C:\WINDOWS\SYSTEM32\nwiz.exe]
"LTWinModem1"="ltmsg.exe" [2001-04-03 C:\WINDOWS\SYSTEM32\ltmsg.exe]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avldr]
2008-03-18 16:58 58672 C:\WINDOWS\SYSTEM32\avldr.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.iv32"= C:\WINDOWS\system32\ir32_32.dll
"vidc.iv31"= C:\WINDOWS\system32\ir32_32.dll
"VIDC.NSVI"= NSVIDEO.DLL

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, zwebauth.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PskSvcRetail]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\WINDOWS\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=

R3 MusCDriverV32;MusCDriverV32;C:\WINDOWS\system32\drivers\MusCDriverV32.sys [2007-12-14 18:07]
R3 MusCVideo32;MusCVideo32;C:\WINDOWS\system32\DRIVERS\MusCVideo32.sys [2007-12-14 18:07]
R3 Radialpoint Security Services;Radialpoint Security Services;C:\WINDOWS\system32\dllhost.exe [2004-08-04 03:56]
R4 hpt3xx;hpt3xx;C:\WINDOWS\System32\DRIVERS\hpt3xx.sys [2001-08-17 14:52]
S0 pavboot;Panda boot driver;C:\WINDOWS\system32\Drivers\pavboot.sys [2008-06-19 17:24]
S1 ShldDrv;Panda File Shield Driver;C:\WINDOWS\system32\DRIVERS\ShlDrv51.sys [2008-03-04 09:59]
S2 Gwmsrv;Panda Goodware Cache Manager;C:\WINDOWS\system32\svchost []
S2 PavProc;Panda Process Protection Driver;C:\WINDOWS\system32\DRIVERS\PavProc.sys [2008-02-07 06:03]
S2 PskSvcRetail;Panda PSK service;C:\Program Files\Panda Security\Panda Antivirus Pro 2009\PskSvc.exe [2008-06-25 16:43]
S3 ComFiltr;Panda Anti-Dialer;C:\WINDOWS\system32\DRIVERS\COMFiltr.sys [2008-10-26 19:38]
S3 PavTPK.sys;PavTPK.sys;C:\WINDOWS\system32\PavTPK.sys []
S3 tbcspud;Santa Cruz Driver;C:\WINDOWS\system32\drivers\tbcspud.sys [2002-04-03 16:51]
S3 tbcwdm;Santa Cruz WDM Driver;C:\WINDOWS\system32\drivers\tbcwdm.sys [2002-04-03 16:51]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
panda REG_MULTI_SZ Gwmsrv
.
Contents of the 'Scheduled Tasks' folder

2008-10-22 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:57]
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-26 19:59:18
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-10-26 20:16:02
ComboFix-quarantined-files.txt 2008-10-27 00:15:51
ComboFix2.txt 2008-10-26 21:55:22
ComboFix3.txt 2008-10-25 03:28:18
ComboFix4.txt 2008-10-25 00:11:34
ComboFix5.txt 2008-10-26 23:42:58

Pre-Run: 11,544,526,848 bytes free
Post-Run: 11,588,911,104 bytes free

373 — E O F — 2008-10-24 07:01:41

Logfile of HijackThis v1.99.1
Scan saved at 8:20:05 PM, on 10/26/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Security\Panda Antivirus Pro 2009\TPSrv.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\PROGRAM FILES\PANDA SECURITY\PANDA ANTIVIRUS PRO 2009\WebProxy.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Panda Security\Panda Antivirus Pro 2009\PsCtrls.exe
C:\Program Files\Panda Security\Panda Antivirus Pro 2009\PavFnSvr.exe
C:\Program Files\Common Files\Panda Security\PavShld\pavprsrv.exe
C:\Program Files\Panda Security\Panda Antivirus Pro 2009\PsImSvc.exe
C:\Program Files\Panda Security\Panda Antivirus Pro 2009\PskSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Panda Security\Panda Antivirus Pro 2009\pavsrv51.exe
C:\Program Files\Panda Security\Panda Antivirus Pro 2009\AVENGINE.EXE
C:\Program Files\Panda Security\Panda Antivirus Pro 2009\ApvxdWin.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\system32\ltmsg.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
C:\Program Files\SanDisk\Sansa Updater\SansaDispatch.exe
C:\Program Files\Verizon\McciTrayApp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\SYSTEM32\tbctray.exe
C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe
C:\Program Files\Dell Computer\Dell Image Expert\IXApplet.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Panda Security\Panda Antivirus Pro 2009\PavJobs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://www.dellnet.com/
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-8CB0-AB60BB9AAE22} - C:\PROGRA~1\VOL_TO~1\VOL_TO~1.DLL
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [Dell|Alert] C:\Program Files\Dell\Support\Alert\bin\DAMon.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [LTWinModem1] ltmsg.exe 9
O4 - HKLM\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [HPHmon03] C:\WINDOWS\system32\hphmon03.exe
O4 - HKLM\..\Run: [Smart Start UP] C:\Program Files\NewSoft\Smart Start UP\PnPDetect.exe /Automation
O4 - HKLM\..\Run: [SansaDispatch] C:\Program Files\SanDisk\Sansa Updater\SansaDispatch.exe
O4 - HKLM\..\Run: [Verizon_McciTrayApp] C:\Program Files\Verizon\McciTrayApp.exe
O4 - HKLM\..\Run: [VerizonServicepoint.exe] "C:\Program Files\Verizon\VSP\VerizonServicepoint.exe" /AUTORUN
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Security\Panda Antivirus Pro 2009\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [SCANINICIO] "C:\Program Files\Panda Security\Panda Antivirus Pro 2009\Inicio.exe"
O4 - HKLM\..\Run: [TraySantaCruz] C:\WINDOWS\SYSTEM32\tbctray.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [EasyLinkAdvisor] "C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Registration Myst V
O4 - Global Startup: Camio Viewer.lnk = C:\Program Files\Dell Computer\Dell Image Expert\IXApplet.exe
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: Yahoo! Hearts - http://download.games.yahoo.com/games/clients/y/ht1_x.cab
O16 - DPF: Yahoo! MahJong Solitaire - http://download.games.yahoo.com/games/clients/y/mjst3_x.cab
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - https://activatemyfios.verizon.net/sdcCommo…IOS/tgctlcm.cab
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab46479.cab
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (ZoneBuddy Class) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab32846.cab
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab32846.cab
O16 - DPF: {95B5D20C-BD31-4489-8ABF-F8C8BE748463} (ZPA_HRTZ Object) - http://zone.msn.com/bingame/zpagames/zpa_hrtz.cab40641.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (StadiumProxy Class) - http://zone.msn.com/binframework/v10/StProxy.cab41227.cab
O20 - Winlogon Notify: avldr - C:\WINDOWS\SYSTEM32\avldr.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: DvpApi (dvpapi) - Authentium, Inc. - C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Unknown owner - C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - Unknown owner - C:\WINDOWS\System32\nvsvc32.exe (file missing)
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Panda Software Controller - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Antivirus Pro 2009\PsCtrls.exe
O23 - Service: Panda Function Service (PAVFNSVR) - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Antivirus Pro 2009\PavFnSvr.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Security, S.L. - C:\Program Files\Common Files\Panda Security\PavShld\pavprsrv.exe
O23 - Service: Panda On-Access Anti-Malware Service (PAVSRV) - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Antivirus Pro 2009\pavsrv51.exe
O23 - Service: Pml Driver - HP - C:\WINDOWS\system32\HPHipm09.exe
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Security S.L. - C:\Program Files\Panda Security\Panda Antivirus Pro 2009\PsImSvc.exe
O23 - Service: Panda PSK service (PskSvcRetail) - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Antivirus Pro 2009\PskSvc.exe
O23 - Service: Radialpoint Unicorn Update Service (RPSUpdaterR) - Radialpoint Inc. - C:\Program Files\Verizon\PC Security Checkup\rpsupdaterR.exe
O23 - Service: ScriptBlocking Service (SBService) - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe (file missing)
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Panda TPSrv (TPSrv) - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Antivirus Pro 2009\TPSrv.exe

kurdyj00

Post #19October 27, 2008, 12:46 AM UTC

Hi, Sorry but I just noticed 2 replies from yesterday night that weren't addressed. they are the ?ttrib.exe one and the next. Is this going to creat a problem? I'll do them now. Thanks and sorry again, Jeff

LDTate

Post #20October 27, 2008, 12:47 AM UTC

We still have work to do.

Copy/paste the text in the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text.

File::
C:\WINDOWS\SYSTEM32\ytgbwfol.exe
C:\WINDOWS\SYSTEM32\crwjwpyj.exe
C:\WINDOWS\SYSTEM32\nujyfgfa.exe
C:\WINDOWS\SYSTEM32\khyvqdot.exe
C:\WINDOWS\SYSTEM32\hmjatuxo.exe
C:\WINDOWS\SYSTEM32\pynclgjm.exe
C:\Program Files\yjfcjyb
C:\WINDOWS\SYSTEM32\lgtmfixi.exe


Folder::
C:\Documents and Settings\All Users\Application Data\tsdkbezi

kurdyj00

Post #21October 27, 2008, 2:35 AM UTC

Hi prior to the most recent scans I tried looking for the below files as per your pervious posts (that I missed). Could not find either file.

C:\WINDOWS\SYSTEM32\?ttrib.exe

C:\WINDOWS\SYSTEM32\jyxwdavq.exe

This time when combofix ran, I was prompted (asked) if I wanted to update combofix. I had done that earlier today at a previous scan and was surprised to be asked again. This time the desktop stayed the same. No lost icons. When I went to IE7, again got the runonce.msn.com.

Here are the logs

ComboFix 08-10-24.02 - Jeff 2008-10-26 21:56:24.6 - NTFSx86
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Jeff\Desktop\CFScript.txt
* Created a new restore point

FILE ::
C:\Program Files\yjfcjyb
C:\WINDOWS\SYSTEM32\crwjwpyj.exe
C:\WINDOWS\SYSTEM32\hmjatuxo.exe
C:\WINDOWS\SYSTEM32\khyvqdot.exe
C:\WINDOWS\SYSTEM32\lgtmfixi.exe
C:\WINDOWS\SYSTEM32\nujyfgfa.exe
C:\WINDOWS\SYSTEM32\pynclgjm.exe
C:\WINDOWS\SYSTEM32\ytgbwfol.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\tsdkbezi

.
((((((((((((((((((((((((( Files Created from 2008-09-27 to 2008-10-27 )))))))))))))))))))))))))))))))
.

2008-10-24 19:37 . 2008-10-24 19:37 8,627 –a—— C:\WINDOWS\SYSTEM32\PAV_FOG.OPC
2008-10-24 19:24 . 2008-10-26 21:04 13,880 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\COMFiltr.sys
2008-10-24 19:22 . 2008-04-28 11:35 84,024 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\pavdrv51.sys
2008-10-24 19:22 . 2008-10-24 19:22 249 –a—— C:\WINDOWS\SYSTEM32\PavCPL.dat
2008-10-24 19:21 . 2007-03-15 19:38 54,832 –a—— C:\WINDOWS\SYSTEM32\pavcpl.cpl
2008-10-24 19:20 . 2008-06-18 18:03 520,448 –a—— C:\WINDOWS\SYSTEM32\PavSHook.dll
2008-10-24 19:20 . 2003-10-22 18:23 446,464 –a—— C:\WINDOWS\SYSTEM32\HHActiveX.dll
2008-10-24 19:20 . 2008-06-24 14:48 193,280 –a—— C:\WINDOWS\SYSTEM32\TpUtil.dll
2008-10-24 19:20 . 2007-02-08 11:53 107,568 –a—— C:\WINDOWS\SYSTEM32\SYSTOOLS.DLL
2008-10-24 19:20 . 2008-06-18 18:03 87,296 –a—— C:\WINDOWS\SYSTEM32\PavLspHook.dll
2008-10-24 19:20 . 2008-06-18 18:03 55,552 –a—— C:\WINDOWS\SYSTEM32\pavipc.dll
2008-10-24 19:19 . 2008-10-24 19:19 d——– C:\WINDOWS\SYSTEM32\PAV
2008-10-24 19:19 . 2008-10-24 19:19 d——– C:\Program Files\Panda Security
2008-10-24 19:19 . 2008-10-24 19:19 d——– C:\Documents and Settings\Jeff\Application Data\Panda Security
2008-10-24 19:19 . 2008-10-24 19:19 d——– C:\Documents and Settings\All Users\Application Data\Panda Security
2008-10-24 19:19 . 2008-03-18 16:58 58,672 –a—— C:\WINDOWS\SYSTEM32\avldr.dll
2008-10-24 19:18 . 2008-06-19 17:24 28,544 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\pavboot.sys
2008-10-24 19:17 . 2008-10-24 19:17 d——– C:\Program Files\Common Files\Panda Security
2008-10-24 19:17 . 2008-02-07 06:03 179,640 -ra—— C:\WINDOWS\SYSTEM32\DRIVERS\PavProc.sys
2008-10-24 19:17 . 2008-03-04 09:59 41,144 -ra—— C:\WINDOWS\SYSTEM32\DRIVERS\ShlDrv51.sys
2008-10-23 18:44 . 2008-10-23 18:44 d——– C:\Program Files\Malwarebytes' Anti-Malware
2008-10-23 18:44 . 2008-10-23 18:44 d——– C:\Documents and Settings\Jeff\Application Data\Malwarebytes
2008-10-23 18:44 . 2008-10-23 18:44 d——– C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-10-23 18:44 . 2008-10-22 16:10 38,496 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\mbamswissarmy.sys
2008-10-23 18:44 . 2008-10-22 16:10 15,504 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\mbam.sys
2008-10-15 03:03 . 2008-10-15 03:03 118 –a—— C:\WINDOWS\SYSTEM32\MRT.INI
2008-10-09 19:27 . 2008-10-09 19:27 d——– C:\Documents and Settings\TEMP\Application Data\Motive
2008-10-09 19:20 . 2008-10-09 19:20 d——– C:\Documents and Settings\TEMP\Application Data\Verizon
2008-10-09 19:20 . 2008-10-09 19:34 d——– C:\Documents and Settings\TEMP\Application Data\GTek
2008-10-09 19:16 . 2008-10-09 19:20 d——– C:\Documents and Settings\TEMP\Application Data\Symantec
2008-10-09 19:16 . 2008-10-09 19:52 d——– C:\Documents and Settings\TEMP
2008-10-09 03:11 . 2008-10-09 03:11 d——– C:\WINDOWS\SYSTEM32\LogFiles
2008-10-03 21:40 . 2008-10-23 18:58 d——– C:\Program Files\yjfcjyb

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-25 20:55 ——— d—–w C:\Program Files\PhoneTools
2008-10-24 23:19 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-10-24 00:13 ——— d—–w C:\Program Files\Symantec
2008-10-24 00:11 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2008-10-23 02:01 ——— d—–w C:\Program Files\Norton SystemWorks
2008-10-23 01:58 ——— d—–w C:\Program Files\Spybot - Search & Destroy
2008-10-23 01:58 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-10-22 23:23 ——— d—–w C:\Documents and Settings\All Users\Application Data\Symantec
2008-10-10 02:55 ——— d—–w C:\Program Files\Common Files\Scanner
2008-10-10 02:55 ——— d—–w C:\Documents and Settings\All Users\Application Data\IEService
2008-09-28 17:41 ——— d—–w C:\Program Files\EA Games
2008-09-01 03:50 ——— d—–w C:\Program Files\TeaTimer (Spybot - Search & Destroy)
2008-09-01 02:15 ——— d—–w C:\Program Files\Riven
2008-09-01 02:13 ——— d—–w C:\Program Files\Disney Interactive
2008-08-28 10:04 333,056 —-a-w C:\WINDOWS\system32\drivers\srv.sys
2007-01-26 02:57 61,992 —-a-w C:\Documents and Settings\Jeff\Application Data\GDIPFONTCACHEV1.DAT
2007-01-19 22:56 774,144 —-a-w C:\Program Files\RngInterstitial.dll
.

((((((((((((((((((((((((((((( snapshot_2008-10-24_20.10.51.73 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-10-24 22:29:25 12,288 —-a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
+ 2008-10-26 22:27:53 12,288 —-a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
- 2008-10-24 22:29:25 135,168 —-a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\misc.exe
+ 2008-10-26 22:27:53 135,168 —-a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\misc.exe
- 2008-10-24 22:29:25 11,264 —-a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
+ 2008-10-26 22:27:53 11,264 —-a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
- 2008-10-24 22:29:25 27,136 —-a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
+ 2008-10-26 22:27:53 27,136 —-a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
- 2008-10-24 22:29:25 4,096 —-a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
+ 2008-10-26 22:27:53 4,096 —-a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
- 2008-10-24 22:29:25 794,624 —-a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\outicon.exe
+ 2008-10-26 22:27:53 794,624 —-a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\outicon.exe
- 2008-10-24 22:29:25 249,856 —-a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\pptico.exe
+ 2008-10-26 22:27:53 249,856 —-a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\pptico.exe
- 2008-10-24 22:29:25 23,040 —-a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
+ 2008-10-26 22:27:53 23,040 —-a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
- 2008-10-24 22:29:25 286,720 —-a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
+ 2008-10-26 22:27:52 286,720 —-a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
- 2008-10-24 22:29:25 409,600 —-a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
+ 2008-10-26 22:27:52 409,600 —-a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
- 2008-10-21 21:09:48 102,400 —-a-r C:\WINDOWS\Installer\{9F70BF98-003C-491D-81FC-FF9792206AF0}\iTunesIco.exe
+ 2008-10-25 15:48:45 102,400 —-a-r C:\WINDOWS\Installer\{9F70BF98-003C-491D-81FC-FF9792206AF0}\iTunesIco.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"EasyLinkAdvisor"="C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" [2007-03-15 454784]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Microsoft Works Update Detection"="C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2001-08-16 28738]
"RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [2002-07-17 26112]
"MMTray"="C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe" [2002-02-27 90112]
"Dell|Alert"="C:\Program Files\Dell\Support\Alert\bin\DAMon.exe" [2002-04-03 282624]
"AdaptecDirectCD"="C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe" [2002-09-06 684032]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2003-10-06 5058560]
"SsAAD.exe"="C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe" [2006-01-07 81920]
"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe" [2006-01-13 196608]
"HPHmon03"="C:\WINDOWS\system32\hphmon03.exe" [2006-01-13 311296]
"Smart Start UP"="C:\Program Files\NewSoft\Smart Start UP\PnPDetect.exe" [2003-01-21 98304]
"SansaDispatch"="C:\Program Files\SanDisk\Sansa Updater\SansaDispatch.exe" [2007-10-22 75584]
"Verizon_McciTrayApp"="C:\Program Files\Verizon\McciTrayApp.exe" [2007-09-28 936960]
"VerizonServicepoint.exe"="C:\Program Files\Verizon\VSP\VerizonServicepoint.exe" [2007-05-11 2061816]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-05-27 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-06-02 267048]
"APVXDWIN"="C:\Program Files\Panda Security\Panda Antivirus Pro 2009\APVXDWIN.EXE" [2008-07-16 857344]
"SCANINICIO"="C:\Program Files\Panda Security\Panda Antivirus Pro 2009\Inicio.exe" [2008-07-07 50432]
"TraySantaCruz"="C:\WINDOWS\SYSTEM32\tbctray.exe" [2002-04-03 290816]
"nwiz"="nwiz.exe" [2003-10-06 C:\WINDOWS\SYSTEM32\nwiz.exe]
"LTWinModem1"="ltmsg.exe" [2001-04-03 C:\WINDOWS\SYSTEM32\ltmsg.exe]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avldr]
2008-03-18 16:58 58672 C:\WINDOWS\SYSTEM32\avldr.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.iv32"= C:\WINDOWS\system32\ir32_32.dll
"vidc.iv31"= C:\WINDOWS\system32\ir32_32.dll
"VIDC.NSVI"= NSVIDEO.DLL

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, zwebauth.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PskSvcRetail]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\WINDOWS\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=

R3 MusCDriverV32;MusCDriverV32;C:\WINDOWS\system32\drivers\MusCDriverV32.sys [2007-12-14 18:07]
R3 MusCVideo32;MusCVideo32;C:\WINDOWS\system32\DRIVERS\MusCVideo32.sys [2007-12-14 18:07]
R3 Radialpoint Security Services;Radialpoint Security Services;C:\WINDOWS\system32\dllhost.exe [2004-08-04 03:56]
R4 hpt3xx;hpt3xx;C:\WINDOWS\System32\DRIVERS\hpt3xx.sys [2001-08-17 14:52]
S0 pavboot;Panda boot driver;C:\WINDOWS\system32\Drivers\pavboot.sys [2008-06-19 17:24]
S1 ShldDrv;Panda File Shield Driver;C:\WINDOWS\system32\DRIVERS\ShlDrv51.sys [2008-03-04 09:59]
S2 Gwmsrv;Panda Goodware Cache Manager;C:\WINDOWS\system32\svchost []
S2 PavProc;Panda Process Protection Driver;C:\WINDOWS\system32\DRIVERS\PavProc.sys [2008-02-07 06:03]
S2 PskSvcRetail;Panda PSK service;C:\Program Files\Panda Security\Panda Antivirus Pro 2009\PskSvc.exe [2008-06-25 16:43]
S3 ComFiltr;Panda Anti-Dialer;C:\WINDOWS\system32\DRIVERS\COMFiltr.sys [2008-10-26 21:04]
S3 PavTPK.sys;PavTPK.sys;C:\WINDOWS\system32\PavTPK.sys []
S3 tbcspud;Santa Cruz Driver;C:\WINDOWS\system32\drivers\tbcspud.sys [2002-04-03 16:51]
S3 tbcwdm;Santa Cruz WDM Driver;C:\WINDOWS\system32\drivers\tbcwdm.sys [2002-04-03 16:51]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
panda REG_MULTI_SZ Gwmsrv
.
Contents of the 'Scheduled Tasks' folder

2008-10-22 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:57]
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-26 22:03:46
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-10-26 22:14:08
ComboFix-quarantined-files.txt 2008-10-27 02:13:53
ComboFix2.txt 2008-10-27 00:16:07
ComboFix3.txt 2008-10-26 21:55:22
ComboFix4.txt 2008-10-25 03:28:18
ComboFix5.txt 2008-10-27 01:26:38

Pre-Run: 11,576,549,376 bytes free
Post-Run: 11,568,074,752 bytes free

187 — E O F — 2008-10-24 07:01:41

Logfile of HijackThis v1.99.1
Scan saved at 10:25:12 PM, on 10/26/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Security\Panda Antivirus Pro 2009\TPSrv.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\PROGRAM FILES\PANDA SECURITY\PANDA ANTIVIRUS PRO 2009\WebProxy.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Panda Security\Panda Antivirus Pro 2009\PsCtrls.exe
C:\Program Files\Panda Security\Panda Antivirus Pro 2009\PavFnSvr.exe
C:\Program Files\Common Files\Panda Security\PavShld\pavprsrv.exe
C:\Program Files\Panda Security\Panda Antivirus Pro 2009\PsImSvc.exe
C:\Program Files\Panda Security\Panda Antivirus Pro 2009\PskSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Panda Security\Panda Antivirus Pro 2009\pavsrv51.exe
C:\Program Files\Panda Security\Panda Antivirus Pro 2009\AVENGINE.EXE
C:\Program Files\Panda Security\Panda Antivirus Pro 2009\ApvxdWin.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\system32\ltmsg.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\SanDisk\Sansa Updater\SansaDispatch.exe
C:\Program Files\Verizon\McciTrayApp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\SYSTEM32\tbctray.exe
C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe
C:\Program Files\Dell Computer\Dell Image Expert\IXApplet.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\SYSTEM32\notepad.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://www.dellnet.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-8CB0-AB60BB9AAE22} - C:\PROGRA~1\VOL_TO~1\VOL_TO~1.DLL
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [Dell|Alert] C:\Program Files\Dell\Support\Alert\bin\DAMon.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [LTWinModem1] ltmsg.exe 9
O4 - HKLM\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [HPHmon03] C:\WINDOWS\system32\hphmon03.exe
O4 - HKLM\..\Run: [Smart Start UP] C:\Program Files\NewSoft\Smart Start UP\PnPDetect.exe /Automation
O4 - HKLM\..\Run: [SansaDispatch] C:\Program Files\SanDisk\Sansa Updater\SansaDispatch.exe
O4 - HKLM\..\Run: [Verizon_McciTrayApp] C:\Program Files\Verizon\McciTrayApp.exe
O4 - HKLM\..\Run: [VerizonServicepoint.exe] "C:\Program Files\Verizon\VSP\VerizonServicepoint.exe" /AUTORUN
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Security\Panda Antivirus Pro 2009\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [SCANINICIO] "C:\Program Files\Panda Security\Panda Antivirus Pro 2009\Inicio.exe"
O4 - HKLM\..\Run: [TraySantaCruz] C:\WINDOWS\SYSTEM32\tbctray.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [EasyLinkAdvisor] "C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Registration Myst V
O4 - Global Startup: Camio Viewer.lnk = C:\Program Files\Dell Computer\Dell Image Expert\IXApplet.exe
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: Yahoo! Hearts - http://download.games.yahoo.com/games/clients/y/ht1_x.cab
O16 - DPF: Yahoo! MahJong Solitaire - http://download.games.yahoo.com/games/clients/y/mjst3_x.cab
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - https://activatemyfios.verizon.net/sdcCommo…IOS/tgctlcm.cab
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab46479.cab
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (ZoneBuddy Class) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab32846.cab
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab32846.cab
O16 - DPF: {95B5D20C-BD31-4489-8ABF-F8C8BE748463} (ZPA_HRTZ Object) - http://zone.msn.com/bingame/zpagames/zpa_hrtz.cab40641.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (StadiumProxy Class) - http://zone.msn.com/binframework/v10/StProxy.cab41227.cab
O20 - Winlogon Notify: avldr - C:\WINDOWS\SYSTEM32\avldr.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: DvpApi (dvpapi) - Authentium, Inc. - C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Unknown owner - C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - Unknown owner - C:\WINDOWS\System32\nvsvc32.exe (file missing)
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Panda Software Controller - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Antivirus Pro 2009\PsCtrls.exe
O23 - Service: Panda Function Service (PAVFNSVR) - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Antivirus Pro 2009\PavFnSvr.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Security, S.L. - C:\Program Files\Common Files\Panda Security\PavShld\pavprsrv.exe
O23 - Service: Panda On-Access Anti-Malware Service (PAVSRV) - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Antivirus Pro 2009\pavsrv51.exe
O23 - Service: Pml Driver - HP - C:\WINDOWS\system32\HPHipm09.exe
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Security S.L. - C:\Program Files\Panda Security\Panda Antivirus Pro 2009\PsImSvc.exe
O23 - Service: Panda PSK service (PskSvcRetail) - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Antivirus Pro 2009\PskSvc.exe
O23 - Service: Radialpoint Unicorn Update Service (RPSUpdaterR) - Radialpoint Inc. - C:\Program Files\Verizon\PC Security Checkup\rpsupdaterR.exe
O23 - Service: ScriptBlocking Service (SBService) - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe (file missing)
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Panda TPSrv (TPSrv) - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Antivirus Pro 2009\TPSrv.exe

LDTate

Post #22October 27, 2008, 11:38 AM UTC

C:\WINDOWS\SYSTEM32\?ttrib.exe
C:\WINDOWS\SYSTEM32\jyxwdavq.exe
They're gone

We're almost finished, but stay with me until I give you the all clear post.

Copy/paste the text in the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text.

Folder::
C:\Program Files\yjfcjyb

kurdyj00

Post #23October 27, 2008, 11:23 PM UTC

Here're the logs. Things seem to be working alright. Can't report anything wierd.

ComboFix 08-10-24.02 - Jeff 2008-10-27 18:57:23.7 - NTFSx86
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Jeff\Desktop\CFScript.txt
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Jeff\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
C:\Program Files\yjfcjyb

.
((((((((((((((((((((((((( Files Created from 2008-09-27 to 2008-10-27 )))))))))))))))))))))))))))))))
.

2008-10-24 19:37 . 2008-10-24 19:37 8,627 –a—— C:\WINDOWS\SYSTEM32\PAV_FOG.OPC
2008-10-24 19:24 . 2008-10-26 21:04 13,880 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\COMFiltr.sys
2008-10-24 19:22 . 2008-04-28 11:35 84,024 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\pavdrv51.sys
2008-10-24 19:22 . 2008-10-24 19:22 249 –a—— C:\WINDOWS\SYSTEM32\PavCPL.dat
2008-10-24 19:21 . 2007-03-15 19:38 54,832 –a—— C:\WINDOWS\SYSTEM32\pavcpl.cpl
2008-10-24 19:20 . 2008-06-18 18:03 520,448 –a—— C:\WINDOWS\SYSTEM32\PavSHook.dll
2008-10-24 19:20 . 2003-10-22 18:23 446,464 –a—— C:\WINDOWS\SYSTEM32\HHActiveX.dll
2008-10-24 19:20 . 2008-06-24 14:48 193,280 –a—— C:\WINDOWS\SYSTEM32\TpUtil.dll
2008-10-24 19:20 . 2007-02-08 11:53 107,568 –a—— C:\WINDOWS\SYSTEM32\SYSTOOLS.DLL
2008-10-24 19:20 . 2008-06-18 18:03 87,296 –a—— C:\WINDOWS\SYSTEM32\PavLspHook.dll
2008-10-24 19:20 . 2008-06-18 18:03 55,552 –a—— C:\WINDOWS\SYSTEM32\pavipc.dll
2008-10-24 19:19 . 2008-10-24 19:19 d——– C:\WINDOWS\SYSTEM32\PAV
2008-10-24 19:19 . 2008-10-24 19:19 d——– C:\Program Files\Panda Security
2008-10-24 19:19 . 2008-10-24 19:19 d——– C:\Documents and Settings\Jeff\Application Data\Panda Security
2008-10-24 19:19 . 2008-10-24 19:19 d——– C:\Documents and Settings\All Users\Application Data\Panda Security
2008-10-24 19:19 . 2008-03-18 16:58 58,672 –a—— C:\WINDOWS\SYSTEM32\avldr.dll
2008-10-24 19:18 . 2008-06-19 17:24 28,544 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\pavboot.sys
2008-10-24 19:17 . 2008-10-24 19:17 d——– C:\Program Files\Common Files\Panda Security
2008-10-24 19:17 . 2008-02-07 06:03 179,640 -ra—— C:\WINDOWS\SYSTEM32\DRIVERS\PavProc.sys
2008-10-24 19:17 . 2008-03-04 09:59 41,144 -ra—— C:\WINDOWS\SYSTEM32\DRIVERS\ShlDrv51.sys
2008-10-23 18:44 . 2008-10-23 18:44 d——– C:\Program Files\Malwarebytes' Anti-Malware
2008-10-23 18:44 . 2008-10-23 18:44 d——– C:\Documents and Settings\Jeff\Application Data\Malwarebytes
2008-10-23 18:44 . 2008-10-23 18:44 d——– C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-10-23 18:44 . 2008-10-22 16:10 38,496 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\mbamswissarmy.sys
2008-10-23 18:44 . 2008-10-22 16:10 15,504 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\mbam.sys
2008-10-15 03:03 . 2008-10-15 03:03 118 –a—— C:\WINDOWS\SYSTEM32\MRT.INI
2008-10-09 19:27 . 2008-10-09 19:27 d——– C:\Documents and Settings\TEMP\Application Data\Motive
2008-10-09 19:20 . 2008-10-09 19:20 d——– C:\Documents and Settings\TEMP\Application Data\Verizon
2008-10-09 19:20 . 2008-10-09 19:34 d——– C:\Documents and Settings\TEMP\Application Data\GTek
2008-10-09 19:16 . 2008-10-09 19:20 d——– C:\Documents and Settings\TEMP\Application Data\Symantec
2008-10-09 19:16 . 2008-10-09 19:52 d——– C:\Documents and Settings\TEMP
2008-10-09 03:11 . 2008-10-09 03:11 d——– C:\WINDOWS\SYSTEM32\LogFiles

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-25 20:55 ——— d—–w C:\Program Files\PhoneTools
2008-10-24 23:19 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-10-24 00:13 ——— d—–w C:\Program Files\Symantec
2008-10-24 00:11 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2008-10-23 02:01 ——— d—–w C:\Program Files\Norton SystemWorks
2008-10-23 01:58 ——— d—–w C:\Program Files\Spybot - Search & Destroy
2008-10-23 01:58 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-10-22 23:23 ——— d—–w C:\Documents and Settings\All Users\Application Data\Symantec
2008-10-10 02:55 ——— d—–w C:\Program Files\Common Files\Scanner
2008-10-10 02:55 ——— d—–w C:\Documents and Settings\All Users\Application Data\IEService
2008-09-28 17:41 ——— d—–w C:\Program Files\EA Games
2008-09-01 03:50 ——— d—–w C:\Program Files\TeaTimer (Spybot - Search & Destroy)
2008-09-01 02:15 ——— d—–w C:\Program Files\Riven
2008-09-01 02:13 ——— d—–w C:\Program Files\Disney Interactive
2008-08-28 10:04 333,056 —-a-w C:\WINDOWS\system32\drivers\srv.sys
2007-01-26 02:57 61,992 —-a-w C:\Documents and Settings\Jeff\Application Data\GDIPFONTCACHEV1.DAT
2007-01-19 22:56 774,144 —-a-w C:\Program Files\RngInterstitial.dll
.

((((((((((((((((((((((((((((( snapshot_2008-10-24_20.10.51.73 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-10-24 22:29:25 12,288 —-a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
+ 2008-10-26 22:27:53 12,288 —-a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
- 2008-10-24 22:29:25 135,168 —-a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\misc.exe
+ 2008-10-26 22:27:53 135,168 —-a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\misc.exe
- 2008-10-24 22:29:25 11,264 —-a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
+ 2008-10-26 22:27:53 11,264 —-a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
- 2008-10-24 22:29:25 27,136 —-a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
+ 2008-10-26 22:27:53 27,136 —-a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
- 2008-10-24 22:29:25 4,096 —-a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
+ 2008-10-26 22:27:53 4,096 —-a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
- 2008-10-24 22:29:25 794,624 —-a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\outicon.exe
+ 2008-10-26 22:27:53 794,624 —-a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\outicon.exe
- 2008-10-24 22:29:25 249,856 —-a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\pptico.exe
+ 2008-10-26 22:27:53 249,856 —-a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\pptico.exe
- 2008-10-24 22:29:25 23,040 —-a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
+ 2008-10-26 22:27:53 23,040 —-a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
- 2008-10-24 22:29:25 286,720 —-a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
+ 2008-10-26 22:27:52 286,720 —-a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
- 2008-10-24 22:29:25 409,600 —-a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
+ 2008-10-26 22:27:52 409,600 —-a-r C:\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
- 2008-10-21 21:09:48 102,400 —-a-r C:\WINDOWS\Installer\{9F70BF98-003C-491D-81FC-FF9792206AF0}\iTunesIco.exe
+ 2008-10-25 15:48:45 102,400 —-a-r C:\WINDOWS\Installer\{9F70BF98-003C-491D-81FC-FF9792206AF0}\iTunesIco.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"EasyLinkAdvisor"="C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" [2007-03-15 454784]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Microsoft Works Update Detection"="C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2001-08-16 28738]
"RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [2002-07-17 26112]
"MMTray"="C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe" [2002-02-27 90112]
"Dell|Alert"="C:\Program Files\Dell\Support\Alert\bin\DAMon.exe" [2002-04-03 282624]
"AdaptecDirectCD"="C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe" [2002-09-06 684032]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2003-10-06 5058560]
"SsAAD.exe"="C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe" [2006-01-07 81920]
"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe" [2006-01-13 196608]
"HPHmon03"="C:\WINDOWS\system32\hphmon03.exe" [2006-01-13 311296]
"Smart Start UP"="C:\Program Files\NewSoft\Smart Start UP\PnPDetect.exe" [2003-01-21 98304]
"SansaDispatch"="C:\Program Files\SanDisk\Sansa Updater\SansaDispatch.exe" [2007-10-22 75584]
"Verizon_McciTrayApp"="C:\Program Files\Verizon\McciTrayApp.exe" [2007-09-28 936960]
"VerizonServicepoint.exe"="C:\Program Files\Verizon\VSP\VerizonServicepoint.exe" [2007-05-11 2061816]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-05-27 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-06-02 267048]
"APVXDWIN"="C:\Program Files\Panda Security\Panda Antivirus Pro 2009\APVXDWIN.EXE" [2008-07-16 857344]
"SCANINICIO"="C:\Program Files\Panda Security\Panda Antivirus Pro 2009\Inicio.exe" [2008-07-07 50432]
"TraySantaCruz"="C:\WINDOWS\SYSTEM32\tbctray.exe" [2002-04-03 290816]
"nwiz"="nwiz.exe" [2003-10-06 C:\WINDOWS\SYSTEM32\nwiz.exe]
"LTWinModem1"="ltmsg.exe" [2001-04-03 C:\WINDOWS\SYSTEM32\ltmsg.exe]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avldr]
2008-03-18 16:58 58672 C:\WINDOWS\SYSTEM32\avldr.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.iv32"= C:\WINDOWS\system32\ir32_32.dll
"vidc.iv31"= C:\WINDOWS\system32\ir32_32.dll
"VIDC.NSVI"= NSVIDEO.DLL

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, zwebauth.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PskSvcRetail]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\WINDOWS\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=

R3 MusCDriverV32;MusCDriverV32;C:\WINDOWS\system32\drivers\MusCDriverV32.sys [2007-12-14 18:07]
R3 MusCVideo32;MusCVideo32;C:\WINDOWS\system32\DRIVERS\MusCVideo32.sys [2007-12-14 18:07]
R3 Radialpoint Security Services;Radialpoint Security Services;C:\WINDOWS\system32\dllhost.exe [2004-08-04 03:56]
R4 hpt3xx;hpt3xx;C:\WINDOWS\System32\DRIVERS\hpt3xx.sys [2001-08-17 14:52]
S0 pavboot;Panda boot driver;C:\WINDOWS\system32\Drivers\pavboot.sys [2008-06-19 17:24]
S1 ShldDrv;Panda File Shield Driver;C:\WINDOWS\system32\DRIVERS\ShlDrv51.sys [2008-03-04 09:59]
S2 Gwmsrv;Panda Goodware Cache Manager;C:\WINDOWS\system32\svchost []
S2 PavProc;Panda Process Protection Driver;C:\WINDOWS\system32\DRIVERS\PavProc.sys [2008-02-07 06:03]
S2 PskSvcRetail;Panda PSK service;C:\Program Files\Panda Security\Panda Antivirus Pro 2009\PskSvc.exe [2008-06-25 16:43]
S3 ComFiltr;Panda Anti-Dialer;C:\WINDOWS\system32\DRIVERS\COMFiltr.sys [2008-10-26 21:04]
S3 PavTPK.sys;PavTPK.sys;C:\WINDOWS\system32\PavTPK.sys []
S3 tbcspud;Santa Cruz Driver;C:\WINDOWS\system32\drivers\tbcspud.sys [2002-04-03 16:51]
S3 tbcwdm;Santa Cruz WDM Driver;C:\WINDOWS\system32\drivers\tbcwdm.sys [2002-04-03 16:51]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
panda REG_MULTI_SZ Gwmsrv
.
Contents of the 'Scheduled Tasks' folder

2008-10-22 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:57]
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-27 19:06:37
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-10-27 19:15:51
ComboFix-quarantined-files.txt 2008-10-27 23:15:46
ComboFix2.txt 2008-10-27 02:14:11
ComboFix3.txt 2008-10-27 00:16:07
ComboFix4.txt 2008-10-26 21:55:22
ComboFix5.txt 2008-10-27 22:56:00

Pre-Run: 11,435,397,120 bytes free
Post-Run: 11,540,107,264 bytes free

178 — E O F — 2008-10-24 07:01:41

Logfile of HijackThis v1.99.1
Scan saved at 7:18:35 PM, on 10/27/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Security\Panda Antivirus Pro 2009\TPSrv.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\PROGRAM FILES\PANDA SECURITY\PANDA ANTIVIRUS PRO 2009\WebProxy.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Panda Security\Panda Antivirus Pro 2009\PsCtrls.exe
C:\Program Files\Panda Security\Panda Antivirus Pro 2009\PavFnSvr.exe
C:\Program Files\Common Files\Panda Security\PavShld\pavprsrv.exe
C:\Program Files\Panda Security\Panda Antivirus Pro 2009\PsImSvc.exe
C:\Program Files\Panda Security\Panda Antivirus Pro 2009\PskSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Panda Security\Panda Antivirus Pro 2009\pavsrv51.exe
C:\Program Files\Panda Security\Panda Antivirus Pro 2009\AVENGINE.EXE
C:\Program Files\Panda Security\Panda Antivirus Pro 2009\ApvxdWin.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\system32\ltmsg.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
C:\Program Files\SanDisk\Sansa Updater\SansaDispatch.exe
C:\Program Files\Verizon\McciTrayApp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\SYSTEM32\tbctray.exe
C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe
C:\Program Files\Dell Computer\Dell Image Expert\IXApplet.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-8CB0-AB60BB9AAE22} - C:\PROGRA~1\VOL_TO~1\VOL_TO~1.DLL
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [Dell|Alert] C:\Program Files\Dell\Support\Alert\bin\DAMon.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [LTWinModem1] ltmsg.exe 9
O4 - HKLM\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [HPHmon03] C:\WINDOWS\system32\hphmon03.exe
O4 - HKLM\..\Run: [Smart Start UP] C:\Program Files\NewSoft\Smart Start UP\PnPDetect.exe /Automation
O4 - HKLM\..\Run: [SansaDispatch] C:\Program Files\SanDisk\Sansa Updater\SansaDispatch.exe
O4 - HKLM\..\Run: [Verizon_McciTrayApp] C:\Program Files\Verizon\McciTrayApp.exe
O4 - HKLM\..\Run: [VerizonServicepoint.exe] "C:\Program Files\Verizon\VSP\VerizonServicepoint.exe" /AUTORUN
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Security\Panda Antivirus Pro 2009\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [SCANINICIO] "C:\Program Files\Panda Security\Panda Antivirus Pro 2009\Inicio.exe"
O4 - HKLM\..\Run: [TraySantaCruz] C:\WINDOWS\SYSTEM32\tbctray.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [EasyLinkAdvisor] "C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Registration Myst V
O4 - Global Startup: Camio Viewer.lnk = C:\Program Files\Dell Computer\Dell Image Expert\IXApplet.exe
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: Yahoo! Hearts - http://download.games.yahoo.com/games/clients/y/ht1_x.cab
O16 - DPF: Yahoo! MahJong Solitaire - http://download.games.yahoo.com/games/clients/y/mjst3_x.cab
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - https://activatemyfios.verizon.net/sdcCommo…IOS/tgctlcm.cab
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab46479.cab
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (ZoneBuddy Class) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab32846.cab
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab32846.cab
O16 - DPF: {95B5D20C-BD31-4489-8ABF-F8C8BE748463} (ZPA_HRTZ Object) - http://zone.msn.com/bingame/zpagames/zpa_hrtz.cab40641.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (StadiumProxy Class) - http://zone.msn.com/binframework/v10/StProxy.cab41227.cab
O20 - Winlogon Notify: avldr - C:\WINDOWS\SYSTEM32\avldr.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: DvpApi (dvpapi) - Authentium, Inc. - C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Unknown owner - C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - Unknown owner - C:\WINDOWS\System32\nvsvc32.exe (file missing)
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Panda Software Controller - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Antivirus Pro 2009\PsCtrls.exe
O23 - Service: Panda Function Service (PAVFNSVR) - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Antivirus Pro 2009\PavFnSvr.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Security, S.L. - C:\Program Files\Common Files\Panda Security\PavShld\pavprsrv.exe
O23 - Service: Panda On-Access Anti-Malware Service (PAVSRV) - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Antivirus Pro 2009\pavsrv51.exe
O23 - Service: Pml Driver - HP - C:\WINDOWS\system32\HPHipm09.exe
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Security S.L. - C:\Program Files\Panda Security\Panda Antivirus Pro 2009\PsImSvc.exe
O23 - Service: Panda PSK service (PskSvcRetail) - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Antivirus Pro 2009\PskSvc.exe
O23 - Service: Radialpoint Unicorn Update Service (RPSUpdaterR) - Radialpoint Inc. - C:\Program Files\Verizon\PC Security Checkup\rpsupdaterR.exe
O23 - Service: ScriptBlocking Service (SBService) - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe (file missing)
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Panda TPSrv (TPSrv) - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Antivirus Pro 2009\TPSrv.exe

LDTate

Post #24October 27, 2008, 11:35 PM UTC

Just a little cleanup

Run hijackthis. Hit None of the above, Click Do a System Scan Only. Put a checkmark/tick in the box on the left side on these:

O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

Close ALL windows and browsers except HijackThis and click "Fix checked"

After the above:

Good job

Click START then RUN
Now type Combofix /u in the runbox and click OK. Note the space between the X and the U, it needs to be there.
- [external image: Posted Image]
Here's my usual all clean post

Log looks good
- Make your Internet Explorer more secure - This can be done by following these simple instructions:
  - From within Internet Explorer click on the Tools menu and then click on Options.
  - Click once on the Security tab
  - Click once on the Internet icon so it becomes highlighted.
  - Click once on the Custom Level button.
  - Change the Download signed ActiveX controls to Prompt
  - Change the Download unsigned ActiveX controls to Disable
  - Change the Initialize and script ActiveX controls not marked as safe to Disable
  - Change the Installation of desktop items to Prompt
  - Change the Launching programs and files in an IFRAME to Prompt
  - Change the Navigate sub-frames across different domains to Prompt
  - When all these settings have been made, click on the OK button.
  - If it prompts you as to whether or not you want to save the settings, press the Yes button.
- Next press the Apply button and then the OK to exit the Internet Properties page.
Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week
(Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
Use a Firewall - I can not stress how important it is that you use a Firewall on your computer.
Without a firewall your computer is succeptible to being hacked and taken over.
I am very serious about this and see it happen almost every day with my clients.
Simply using a Firewall in its default configuration can lower your risk greatly.

For a tutorial on Firewalls and a listing of some available ones see the link below:
Note: I no longer suggest Zone Alarm

Understanding and Using Firewalls
Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly.
This will ensure your computer has always the latest security updates available installed on your computer.
If there are new updates to install, install them immediately, reboot your computer, and revisit the site
until there are no more critical updates.
MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.
Winpatrol
Update all these programs regularly - Make sure you update all the programs I have listed regularly.
Without regular updates you WILL NOT be protected when new malicious programs are released.

Only run one Anti-Virus and Firewall program.

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein

Also: "How to prevent malware"

If you would like to [external image: Posted Image] for the help you received.

kurdyj00

Post #25October 28, 2008, 12:18 AM UTC

Hi and thanks again for all your help. One more thing…should I uninstall the malwarebytes' , ATF cleaner, and the mbamp-setup icon ? Also if I have a question or 2 about this exercise (or is workout a better term) in a couple of days, should I post onto this thread or find a general forum and begin anew? I've finished all final prompts from your last post. Thanks again for all your patience and work. Best regards, Jeff

LDTate

Post #26October 28, 2008, 12:27 AM UTC

I would keep both those programs and run them once a week. I'll keep this topic open for a couple days

LDTate

Post #27November 4, 2008, 2:33 AM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] xp antispyware 2009

✨ Ask AI

Ask AI