URL.ADTRGT trouble

I was having trouble with something called url.adtrgt popping things up. Here is my hijack this log and my combofix log. I am running windows vista 32 bit. Any help would be appreciated, thanks.


This is my HijackThis Log.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:48, on 2008-12-02
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\YPOPs\YPOPs.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\Explorer.exe
C:\Windows\system32\notepad.exe
C:\Program Files\Mozilla Firefox 3 Beta 5\firefox.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.facebook.com/home.php?
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Startup: YPOPs.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end; to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - (no file)
O9 - Extra button: (no name) - Cmdmapping - (no file) (HKCU)
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O13 - Gopher Prefix:
O15 - Trusted Zone: http://www2.tellmemorecampus.com
O15 - Trusted Zone: http://www2.tellmemorecampus.com (HKLM)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: avgwlntf - C:\Windows\SYSTEM32\avgwlntf.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG7 Resident Shield Service (AvgCoreSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

–
End of file - 7800 bytes





This is my Combofix Log

ComboFix 08-12-01.03 - Elizabeth 2008-12-02 23:29:13.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.1020 [GMT -5:00]
Running from: c:\program files\combofix.exe
Command switches used :: /killall
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\ShoppingReport
c:\program files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll
c:\program files\ShoppingReport\Uninst.exe
c:\program files\zango
c:\program files\zango\bin\10.3.75.0\HostOE.dll
c:\programdata\Microsoft\Network\Downloader\qmgr0.dat
c:\programdata\Microsoft\Network\Downloader\qmgr1.dat
c:\windows\system32\afiheder.ini
c:\windows\system32\asodiwep.ini
c:\windows\system32\bejowaku.dll
c:\windows\system32\bekozije.dll
c:\windows\system32\besegopa.dll
c:\windows\system32\bogopani.dll
c:\windows\system32\bojapume.dll
c:\windows\system32\dagubawe.dll
c:\windows\system32\danahodo.dll
c:\windows\system32\debiwuju.dll
c:\windows\system32\dehimavi.dll
c:\windows\system32\diripeyi.dll
c:\windows\system32\diveredi.dll
c:\windows\system32\dodeduru.dll
c:\windows\system32\dogebuwe.dll
c:\windows\system32\dorehimo.dll
c:\windows\system32\dudihapi.dll
c:\windows\system32\duhototu.dll
c:\windows\system32\dukopova.dll
c:\windows\system32\dulubidu.dll
c:\windows\system32\dupojapu.dll
c:\windows\system32\dutigoru.dll
c:\windows\system32\ebodadam.ini
c:\windows\system32\egevesud.ini
c:\windows\system32\elinogat.ini
c:\windows\system32\enuhomuf.ini
c:\windows\system32\ewubegod.ini
c:\windows\system32\fesureto.dll
c:\windows\system32\filawuzo.dll
c:\windows\system32\fumohune.dll
c:\windows\system32\gogopuvi.dll
c:\windows\system32\guyuzera.dll
c:\windows\system32\hereporu.dll
c:\windows\system32\hipolugi.dll
c:\windows\system32\hukepoge.dll
c:\windows\system32\ipetihak.ini
c:\windows\system32\irinavih.ini
c:\windows\system32\jegugose.dll
c:\windows\system32\jelurifo.dll
c:\windows\system32\jemajidi.dll
c:\windows\system32\jesikiti.dll
c:\windows\system32\kudasoho.dll
c:\windows\system32\lemukelu.dll
c:\windows\system32\levunana.dll
c:\windows\system32\leyuwuyu.dll
c:\windows\system32\likehiko.dll
c:\windows\system32\linimoto.dll
c:\windows\system32\lovojefu.dll
c:\windows\system32\madadobe.dll
c:\windows\system32\mozubolu.dll
c:\windows\system32\nayitazi.dll
c:\windows\system32\niniyifu.dll
c:\windows\system32\ohetepuv.ini
c:\windows\system32\onijedaw.ini
c:\windows\system32\owolebas.ini
c:\windows\system32\ozuwalif.ini
c:\windows\system32\pewidosa.dll
c:\windows\system32\rivesogo.dll
c:\windows\system32\ronudozi.dll
c:\windows\system32\sabelowo.dll
c:\windows\system32\sajoneku.dll
c:\windows\system32\sapahore.dll
c:\windows\system32\sefofele.dll
c:\windows\system32\siyadoro.dll
c:\windows\system32\sojohehu.dll
c:\windows\system32\sudufipa.dll
c:\windows\system32\suhebino.dll
c:\windows\system32\todolaze.dll
c:\windows\system32\tufamovo.dll
c:\windows\system32\ujuwibed.ini
c:\windows\system32\ulakirow.ini
c:\windows\system32\ulekumel.ini
c:\windows\system32\upajopud.ini
c:\windows\system32\uribiguz.ini
c:\windows\system32\uyuwuyel.ini
c:\windows\system32\uzamusis.ini
c:\windows\system32\vevajusa.dll
c:\windows\system32\vibanula.dll
c:\windows\system32\vogovifi.dll
c:\windows\system32\wadejino.dll
c:\windows\system32\wemeyebi.dll
c:\windows\system32\wilubore.dll
c:\windows\system32\wipotazi.dll
c:\windows\system32\wipoveku.dll
c:\windows\system32\worikalu.dll
c:\windows\system32\wutiviku.dll
c:\windows\system32\yaniwepi.dll
c:\windows\system32\yijajeku.dll
c:\windows\system32\ziloyoya.dll
c:\windows\system32\zofufelo.dll

—– BITS: Possible infected sites —–

hxxp://77.74.48.105
.
((((((((((((((((((((((((( Files Created from 2008-11-03 to 2008-12-03 )))))))))))))))))))))))))))))))
.

2008-12-02 23:25 . 2008-12-02 23:25 3,056,742 -ra—— c:\program files\ComboFix.exe
2008-11-18 01:51 . 2008-11-18 01:51 d——– c:\users\All Users\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-11-18 01:51 . 2008-11-18 01:51 d——– c:\programdata\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-11-18 01:51 . 2008-11-18 01:51 d——– c:\program files\iTunes
2008-11-18 01:51 . 2008-11-18 01:51 d——– c:\program files\iPod
2008-11-17 04:00 . 2008-10-16 16:13 1,809,944 –a—— c:\windows\System32\wuaueng.dll
2008-11-17 04:00 . 2008-10-16 15:56 1,524,736 –a—— c:\windows\System32\wucltux.dll
2008-11-17 04:00 . 2008-10-16 16:09 51,224 –a—— c:\windows\System32\wuauclt.exe
2008-11-17 04:00 . 2008-10-16 16:09 43,544 –a—— c:\windows\System32\wups2.dll
2008-11-17 03:59 . 2008-10-16 14:08 162,064 –a—— c:\windows\System32\wuwebv.dll
2008-11-17 03:59 . 2008-10-16 13:56 31,232 –a—— c:\windows\System32\wuapp.exe
2008-11-11 23:49 . 2008-09-09 22:40 1,334,272 –a—— c:\windows\System32\msxml6.dll
2008-11-11 23:49 . 2008-09-05 00:14 1,191,936 –a—— c:\windows\System32\msxml3.dll
2008-11-11 23:49 . 2008-08-26 20:05 212,480 –a—— c:\windows\System32\drivers\mrxsmb10.sys
2008-11-09 20:53 . 2008-11-09 20:54 202,410,924 –a—— c:\windows\MEMORY.DMP

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-03 04:38 ——— d—–w c:\program files\YPOPs
2008-12-03 04:24 ——— d—–w c:\program files\Mozilla Firefox 3 Beta 5
2008-12-03 04:15 27,715 —-a-w c:\users\Elizabeth\AppData\Roaming\nvModes.dat
2008-12-02 05:40 ——— d—–w c:\program files\Mozilla Firefox 3 Beta 4
2008-12-02 04:15 ——— d—–w c:\users\Elizabeth\AppData\Roaming\Azureus
2008-12-02 04:12 ——— d—–w c:\users\Elizabeth\AppData\Roaming\AVG7
2008-12-01 19:24 ——— d—–w c:\program files\Azureus
2008-11-28 17:46 ——— d—–w c:\users\Elizabeth\AppData\Roaming\.purple
2008-11-12 08:01 ——— d—–w c:\programdata\Microsoft Help
2008-11-06 23:03 ——— d—–w c:\users\Elizabeth\AppData\Roaming\Apple Computer
2008-10-22 20:21 21,248 —-a-w c:\windows\Help\OEM\scripts\HPScript.exe
2008-10-06 15:51 20,224 —-a-w c:\windows\Help\OEM\scripts\HC_checkMUI.dll
2008-10-05 18:59 ——— d—–w c:\program files\Mozilla Thunderbird
2008-07-26 20:42 174 –sha-w c:\program files\desktop.ini
2008-04-05 00:15 691 —-a-w c:\users\Elizabeth\AppData\Roaming\GetValue.vbs
2008-04-05 00:15 35 —-a-w c:\users\Elizabeth\AppData\Roaming\SetValue.bat
2008-01-06 21:00 252,425 —-a-w c:\users\Public\Qs_Vista_RC1_Bin.zip
2007-12-05 23:26 0 —-a-w c:\users\Elizabeth\AppData\Roaming\wklnhst.dat
2007-11-23 19:26 32 —-a-w c:\users\All Users\ezsid.dat
2007-11-23 19:26 32 —-a-w c:\programdata\ezsid.dat
2008-02-18 03:52 16,384 –sha-w c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2008-02-18 03:52 32,768 –sha-w c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
2008-02-18 03:52 16,384 –sha-w c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
2008-08-30 17:22 2,713 –sh–w c:\windows\System32\seyilehu.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AdobeUpdater"="c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2008-02-11 2321600]
"Aim6"="c:\program files\AIM6\aim6.exe" [2008-06-12 50528]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-01-12 827392]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2007-07-08 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-07-08 8433664]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-07-08 81920]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2007-09-19 66816]
"googletalk"="c:\program files\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-10-01 289576]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="c:\progra~1\Grisoft\AVG7\avgw.exe" [2008-04-04 219136]

c:\users\Elizabeth\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
YPOPs.lnk - c:\program files\YPOPs\YPOPs.exe [2008-08-27 1355776]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgwlntf]
2008-04-04 19:27 9216 c:\windows\System32\avgwlntf.dll

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=c:\windows\pss\Adobe Reader Synchronizer.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^Users^Elizabeth^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
path=c:\users\Elizabeth\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnk.Startup
backupExtension=.Startup

[HKLM\~\startupfolder\C:^Users^Elizabeth^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^RKLauncher.lnk]
path=c:\users\Elizabeth\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RKLauncher.lnk
backup=c:\windows\pss\RKLauncher.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC]
–a—— 2008-04-15 07:12 579584 c:\progra~1\Grisoft\AVG7\avgcc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray.exe]
–a—— 2008-01-19 02:33 125952 c:\windows\ehome\ehtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Health Check Scheduler]
–a—— 2007-09-19 16:30 66816 c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
–a—— 2005-02-16 23:11 49152 c:\program files\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPAdvisor]
–a—— 2007-03-20 17:23 1773568 c:\program files\Hewlett-Packard\HP Advisor\HPAdvisor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpWirelessAssistant]
–a—— 2007-03-01 15:18 472776 c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
–a—— 2008-10-01 18:57 289576 c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Launcher]
——— 2006-11-07 19:39 44128 c:\windows\SMINST\Launcher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel]
–a—— 2007-04-19 15:26 484904 c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
–a—— 2007-10-18 10:34 5724184 c:\program files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
–a—— 2007-07-08 21:57 8433664 c:\windows\System32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
–a—— 2007-07-08 21:57 81920 c:\windows\System32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvSvc]
–a—— 2007-07-08 21:57 86016 c:\windows\System32\nvsvc.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QlbCtrl]
–a—— 2007-02-13 13:38 159744 c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QPService]
–a—— 2007-04-23 20:11 176128 c:\program files\HP\QuickPlay\QPService.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
–a—— 2008-09-06 14:09 413696 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar]
–a—— 2008-01-19 02:33 1233920 c:\program files\Windows Sidebar\sidebar.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
–a—— 2008-02-22 03:25 144784 c:\program files\Java\jre1.6.0_05\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Symantec PIF AlertEng]
–a—— 2007-11-28 19:51 583048 c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WAWifiMessage]
–a—— 2007-01-10 18:12 317128 c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
–a—— 2008-01-19 02:38 1008184 c:\program files\Windows Defender\MSASCui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
–a—— 2008-01-19 02:33 202240 c:\program files\Windows Media Player\wmpnscfg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WPCUMI]
–a—— 2006-11-02 07:35 176128 c:\windows\System32\wpcumi.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{DDB79537-BE1B-49D8-9E35-865252F6818E}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{62DAD364-9054-4450-8B64-1E97F59A49D1}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{5BC58A37-88F1-48D7-8BE5-98236F326965}"= c:\program files\HP\QuickPlay\QP.exe:Quick Play
"{977244DC-0C6F-4602-9E5D-F53F4137696A}"= c:\program files\HP\QuickPlay\QPService.exe:Quick Play Resident Program
"{6B76B961-7BC3-47C4-B12A-42CF381A1E0A}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{05F6F3EF-B25C-4001-8372-FE26E6D1B328}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{097692B9-4521-4D1A-9F3E-8E0F924DCDB0}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{F238082B-3978-480D-B122-CF2A1C1231A2}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{C45F953C-C973-4D47-9B6F-8E3786D5C7A2}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{87A0D74F-F719-4D0B-9A9D-EDC91DA7E7E8}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{EB35BB9D-249A-4C0C-9F17-42AD1A6B7185}"= UDP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{5C8B79BB-76FC-4D0F-BF9D-CC71FB471951}"= TCP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{AA302792-FEF0-490A-B639-7748CC80E51C}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{6FDCB978-2C2D-4F39-B4A6-C3EC55B824C3}"= UDP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{AE760E9C-1FFC-485B-B075-E8A33C3F28CE}"= TCP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{7DF9F451-8ABE-4C59-A103-90447FD372C9}"= UDP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{A803C010-4307-4E8E-8334-726909FF8E5A}"= TCP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{A8C1E906-ABFE-4744-B5C1-041D94E12185}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{0F127F68-C458-4C10-BDBA-C77DCB3D2422}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"{76A52B3C-8590-4AFA-9DBB-C4893DDEEBFA}"= UDP:c:\program files\AIM6\aim6.exe:AIM
"{5C44E5DF-3D89-491E-8D4F-E50092E1A3F7}"= TCP:c:\program files\AIM6\aim6.exe:AIM
"TCP Query User{4121914E-B89C-44AA-8EBA-051D1E89553E}c:\\program files\\azureus\\azureus.exe"= UDP:c:\program files\azureus\azureus.exe:Azureus
"UDP Query User{F338FA45-ABB8-4B19-B466-8B09757AA463}c:\\program files\\azureus\\azureus.exe"= TCP:c:\program files\azureus\azureus.exe:Azureus
"TCP Query User{267D1985-CCD8-4E83-A5F1-39B7A30DC09A}c:\\program files\\steam\\steamapps\\[removed]\\counter-strike source\\hl2.exe"= UDP:c:\program files\steam\steamapps\[removed]\counter-strike source\hl2.exe:hl2
"UDP Query User{CBC38F8B-4A0D-49D8-8458-0B023B8BA8AC}c:\\program files\\steam\\steamapps\\[removed]\\counter-strike source\\hl2.exe"= TCP:c:\program files\steam\steamapps\[removed]\counter-strike source\hl2.exe:hl2
"TCP Query User{69DD43BC-C4EC-4A0F-BEF2-0BA09E856445}c:\\program files\\realvnc\\vnc4\\winvnc4.exe"= UDP:c:\program files\realvnc\vnc4\winvnc4.exe:VNC Server Free Edition for Win32
"UDP Query User{899CA3BE-43F0-4F4D-B286-A574A62FA253}c:\\program files\\realvnc\\vnc4\\winvnc4.exe"= TCP:c:\program files\realvnc\vnc4\winvnc4.exe:VNC Server Free Edition for Win32
"{9EE457F5-E6B5-44F4-84BA-902ADE6482CE}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"TCP Query User{16FA2FBD-087D-4D99-B664-437E04DC0E78}c:\\program files\\skype\\phone\\skype.exe"= Disabled:UDP:c:\program files\skype\phone\skype.exe:Skype. Take a deep breath
"UDP Query User{E6083B31-8E31-43A2-8CE8-1ABDD56B74C1}c:\\program files\\skype\\phone\\skype.exe"= Disabled:TCP:c:\program files\skype\phone\skype.exe:Skype. Take a deep breath
"{F61832B2-405F-49CE-A506-77368807C9FE}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"TCP Query User{35B91167-0F3C-4D1F-86BE-8ACC6F2FA91B}c:\\program files\\aim6\\aim6.exe"= UDP:c:\program files\aim6\aim6.exe:AIM
"UDP Query User{7BCE49BE-695B-4E01-BF6C-4591C0B90428}c:\\program files\\aim6\\aim6.exe"= TCP:c:\program files\aim6\aim6.exe:AIM
"TCP Query User{B148EB0B-628F-43D4-A4B9-F6EDBF9F29C9}c:\\program files\\azureus\\azureus.exe"= UDP:c:\program files\azureus\azureus.exe:Azureus
"UDP Query User{30B00573-B2E1-4C71-BDBF-73477C666012}c:\\program files\\azureus\\azureus.exe"= TCP:c:\program files\azureus\azureus.exe:Azureus
"{74A77A99-3303-49D6-8A09-A79D6D501AE4}"= UDP:c:\program files\Google\Google Talk\googletalk.exe:Google Talk
"{72A29686-CE1A-4A76-BAED-D860C680B73A}"= TCP:c:\program files\Google\Google Talk\googletalk.exe:Google Talk
"TCP Query User{237E261F-A056-404D-AB49-709076DD252B}c:\\program files\\pidgin\\pidgin.exe"= UDP:c:\program files\pidgin\pidgin.exe:Pidgin
"UDP Query User{F67C859F-A171-402A-A4AA-DE429510F85F}c:\\program files\\pidgin\\pidgin.exe"= TCP:c:\program files\pidgin\pidgin.exe:Pidgin
"{BC398EE0-7B22-4CA7-9E5D-A98906701473}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{544E1984-4568-4501-9ACB-F3D14A427223}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{59D97C1B-C090-4C3D-A52C-B4658DF068AA}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{07414194-E516-4416-936D-453E95D71EA7}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"{11533981-B193-45CF-85B9-9A2428BE0072}"= UDP:c:\windows\explorer.exe:Explorer
"{8BA89A01-2E0A-4CB0-86FA-F88E21F08E75}"= TCP:c:\windows\explorer.exe:Explorer
"{2C33A13D-7E08-4D14-A10F-B6CD63AA9CEC}"= UDP:c:\windows\System32\wininit.exe:wininit
"{F90FA7C0-E9E6-4F0F-908C-DD762420ACA2}"= TCP:c:\windows\System32\wininit.exe:wininit
"{09777118-12AA-420E-8487-BD459F5A1499}"= UDP:c:\windows\System32\wininit.exe:wininit
"{A6865FC8-1F67-446A-BD11-0588E2F1C025}"= TCP:c:\windows\System32\wininit.exe:wininit
"{DDAD0A35-2D45-495B-92F1-89C71D06E4B5}"= UDP:c:\windows\explorer.exe:Explorer
"{2BBB66AD-D27C-4DB0-8E3C-6BDA24237637}"= TCP:c:\windows\explorer.exe:Explorer

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Program Files\\EarthLink TotalAccess\\TaskPanl.exe"= c:\program files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink

R2 Viewpoint Manager Service;Viewpoint Manager Service;"c:\program files\Viewpoint\Common\ViewpointService.exe" [2007-11-23 24652]
R3 AvgWFP;AVG7 Firewall Driver x86;c:\windows\system32\Drivers\avgwfp.sys [2008-04-04 53768]
S3 Ph3xIB32;Philips 713x Inbox PCI TV Card;c:\windows\system32\DRIVERS\Ph3xIB32.sys [2006-11-02 1083520]
S3 WlanUIB;NETGEAR 802.11b USB Driver;c:\windows\system32\DRIVERS\MA111nd5.sys [2004-03-03 666624]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"c:\program files\Common Files\LightScribe\LSRunOnce.exe"
.
Contents of the 'Scheduled Tasks' folder

2008-12-02 c:\windows\Tasks\User_Feed_Synchronization-{01510134-1F04-41F2-BEBC-46E4DDE06E7E}.job
- c:\windows\system32\msfeedssync.exe [2008-01-19 02:33]
.
- - - - ORPHANS REMOVED - - - -

BHO-{9bd60003-07d2-49e2-8752-631bb0edbc8e} - c:\windows\system32\bekozije.dll
MSConfigStartUp-147fba20 - c:\users\ELIZAB~1\AppData\Local\Temp\glnhqyfb.dll
MSConfigStartUp-cmds - c:\users\ELIZAB~1\AppData\Local\Temp\fccccDvT.dll
MSConfigStartUp-MSServer - c:\users\ELIZAB~1\AppData\Local\Temp\vtUklkJb.dll
MSConfigStartUp-Qbv0dLF2Vp - c:\programdata\yhwjwjyv\qjwdcbib.exe
MSConfigStartUp-RocketDock - c:\program files\RocketDock\RocketDock.exe
MSConfigStartUp-Yahoo! Pager - c:\program files\Yahoo!\Messenger\YahooMessenger.exe


.
——- Supplementary Scan ——-
.
FireFox -: Profile - c:\users\Elizabeth\AppData\Roaming\Mozilla\Firefox\Profiles\ssrobdf3.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.facebook.com/home.php?
FF -: plugin - c:\program files\iTunes\Mozilla Plugins\npitunes.dll
FF -: plugin - c:\program files\Mozilla Firefox 3 Beta 5\plugins\npclntax_ZangoSA.dll
FF -: plugin - c:\program files\Mozilla Firefox 3 Beta 5\plugins\npnul32.dll
FF -: plugin - c:\program files\Mozilla Firefox 3 Beta 5\plugins\npqtplugin.dll
FF -: plugin - c:\program files\Mozilla Firefox 3 Beta 5\plugins\npqtplugin2.dll
FF -: plugin - c:\program files\Mozilla Firefox 3 Beta 5\plugins\npqtplugin3.dll
FF -: plugin - c:\program files\Mozilla Firefox 3 Beta 5\plugins\npqtplugin4.dll
FF -: plugin - c:\program files\Mozilla Firefox 3 Beta 5\plugins\npqtplugin5.dll
FF -: plugin - c:\program files\Mozilla Firefox 3 Beta 5\plugins\npqtplugin6.dll
FF -: plugin - c:\program files\Mozilla Firefox 3 Beta 5\plugins\npqtplugin7.dll
FF -: plugin - c:\program files\Mozilla Firefox 3 Beta 5\plugins\npViewpoint.dll
FF -: plugin - c:\program files\Real\RhapsodyPlayerEngine\nprhapengine.dll
FF -: plugin - c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
FF -: plugin - c:\users\Elizabeth\AppData\Roaming\Mozilla\Firefox\Profiles\ssrobdf3.default\extensions\[removed]\platform\WINNT_x86-msvc\plugins\npmnqmp071101000055.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-02 23:38:02
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
c:\windows\System32\audiodg.exe
c:\program files\Lavasoft\Ad-Aware 2007\aawservice.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Symantec\LiveUpdate\AluSchedulerSvc.exe
c:\progra~1\Grisoft\AVG7\avgamsvr.exe
c:\progra~1\Grisoft\AVG7\avgupsvc.exe
c:\progra~1\Grisoft\AVG7\avgrssvc.exe
c:\progra~1\Grisoft\AVG7\avgemc.exe
c:\progra~1\Grisoft\AVG7\avgrssvc.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\windows\System32\drivers\XAudio.exe
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
c:\windows\System32\rundll32.exe
c:\windows\System32\wbem\unsecapp.exe
c:\program files\AIM6\aolsoftware.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\Hewlett-Packard\HP Health Check\HPHC_Service.exe
c:\windows\System32\wbem\WMIADAP.exe
c:\windows\servicing\TrustedInstaller.exe
.
**************************************************************************
.
Completion time: 2008-12-02 23:43:20 - machine was rebooted
ComboFix-quarantined-files.txt 2008-12-03 04:42:55

Pre-Run: 63,208,509,440 bytes free
Post-Run: 63,290,679,296 bytes free

388 — E O F — 2008-11-21 10:26:44