Spyware / Malware / Virus Removal

[Resolved] Flipping out computer.

10 min read

Looking for the outcome? Ask AI

Gorga53 Topic Starter

Post #1December 5, 2008, 2:17 AM UTC

First of all, I'd like to thank whoever helps me in advance. Moving on, around a week ago my computer began to completely flip out. Now I'm getting funky random restarts, can't edit the registry, and nod32 is coming up saying a bunch of things are infected. Here's a HJT log.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:07:20 PM, on 12/4/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe
C:\Program Files\AIM\aim.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Gorga!\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\Atomic Alarm Clock\AtomicAlarmClock.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\Portrait Displays\Shared\HookManager.exe
C:\Program Files\Portrait Displays\Pivot Software\floater.exe
C:\WINDOWS\system32\oodag.exe
C:\Program Files\Common Files\Portrait Displays\Drivers\pdisrvc.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Mozilla Firefox 3 Beta 5\firefox.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\9129837.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\WINDOWS\TEMP\csrssc.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files\Replay Media Catcher\MediaCatcher.exe
C:\WINDOWS\system32\notepad.exe
C:\Documents and Settings\Gorga!\Desktop\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: C:\WINDOWS\system32\jsdf8j3dgf.dll - {C5BF49A2-94F3-42BD-F434-3604812C897D} - C:\WINDOWS\system32\jsdf8j3dgf.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [DeadAIM] rundll32.exe "C:\Program Files\AIM\\DeadAIM.ocm",ExportedCheckODLs
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [OODefragTray] C:\WINDOWS\system32\oodtray.exe
O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Asus Probe\AsusProb.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [PivotSoftware] "C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe"
O4 - HKLM\..\Run: [DT ACR] C:\Program Files\Common Files\Portrait Displays\Shared\DT_startup.exe -ACR
O4 - HKLM\..\Run: [Mwakuq] rundll32.exe "C:\WINDOWS\Rlunejiqaluhe.dll",e
O4 - HKLM\..\Run: [Ipehidac] rundll32.exe "C:\WINDOWS\ovewijehulalihoc.dll",e
O4 - HKLM\..\RunServices: [iesetup.exe] iesetup.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [igndlm.exe] C:\Program Files\IGN\Download Manager\dlm.exe /windowsstart /startifwork
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Gorga!\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [SkinClock] C:\Program Files\Atomic Alarm Clock\AtomicAlarmClock.exe
O4 - HKCU\..\Run: [Jnskdfmf9eldfd] C:\WINDOWS\TEMP\csrssc.exe
O4 - HKCU\..\Run: [ttool] C:\WINDOWS\9129837.exe
O4 - HKLM\..\Policies\Explorer\Run: [Lsass Service] C:\Documents and Settings\Gorga!\Application Data\Microsoft\Windows\lsass.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\Microsoft Office\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\Microsoft Office\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\Microsoft Office\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\Microsoft Office\Office12\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.amaena.com
O15 - Trusted Zone: *.avsystemcare.com
O15 - Trusted Zone: *.onerateld.com
O15 - Trusted Zone: *.safetydownload.com
O15 - Trusted Zone: *.trustedantivirus.com
O15 - Trusted Zone: *.virusremover2008.com
O15 - Trusted Zone: *.virusschlacht.com
O15 - Trusted Zone: *.amaena.com (HKLM)
O15 - Trusted Zone: *.avsystemcare.com (HKLM)
O15 - Trusted Zone: *.onerateld.com (HKLM)
O15 - Trusted Zone: *.safetydownload.com (HKLM)
O15 - Trusted Zone: *.trustedantivirus.com (HKLM)
O15 - Trusted Zone: *.virusremover2008.com (HKLM)
O15 - Trusted Zone: *.virusschlacht.com (HKLM)
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15030/CTSUEng.cab
O16 - DPF: {483EB14D-AF1C-4951-81B0-4E2B41829FF6} (QOLCheck Control) - https://www.select2perform.com/cabs/QOLCheck.ocx
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1188267067278
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1188267051153
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {DA758BB1-5F89-4465-975F-8D7179A4BCF3} (WheelofFortune Object) - http://messenger.zone.msn.com/binary/WoF.cab57176.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15033/CTPID.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\Microsoft Office\Office12\GrooveSystemServices.dll
O22 - SharedTaskScheduler: mcb7uehuj3n8weuhejsw - {C5BF49A2-94F3-42BD-F434-3604812C897D} - C:\WINDOWS\system32\jsdf8j3dgf.dll
O23 - Service: CachemanXP (CachemanXPService) - OuterTechnologies - C:\PROGRA~1\CACHEM~1\CachemanXP.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Portrait Displays Display Tune Service (DTSRVC) - Unknown owner - C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: Portrait Displays SDK Service (PdiService) - Portrait Displays, Inc. - C:\Program Files\Common Files\Portrait Displays\Drivers\pdisrvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

–
End of file - 10819 bytes

I'm pretty sure I have an infection of some sort. Thanks again.

jpshortstuff

Post #2December 5, 2008, 12:16 PM UTC

Hi, and Welcome to WhatTheTech

My name is jpshortstuff. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for the issues on this machine.
Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time or two.

Download ComboFix by sUBs from here or here

Note: If you already have a copy of ComboFix on your system it is essential that you delete it before downloading this copy.

**Save it to your desktop**

We need to disable one or more of your security programs so that they do not interfere with ComboFix.

Please navigate to the system tray on the bottom right hand corner and look for a [external image: Posted Image] sign.

click it -> click on the [external image: Posted Image] button.
a popup will warn that protection will now be disabled. Click on "Yes" to disable the Antivirus guard.

Double click on ComboFix.exe & follow the prompts. If you are prompted to install the Recovery Console I recommend you go ahead and hit yes.
When finished, it shall produce a log for you. Please save that log to post in your next reply along with a fresh HJT log

Notes:

Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you - please let me know.
ComboFix disconnects your machine from the internet when it runs. This connection should be automatically restored when ComboFix completes its run. If ComboFix runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

I need to see another log from HijackThis.

Run Hijackthis.
Click on Open the Misc Tools section.
Next click on Open uninstall manager.
Press the Save list button.
Save the file to your desktop, with the default name of uninstall_list
Copy & Paste the entire contents of that file in your in your next post.

Thanks.

Gorga53

Post #3December 6, 2008, 3:00 AM UTC

Sorry about the delay in getting you your logs. Here's the uninstall list from HJT:

ACDSee for PENTAX 2.0
Acer eDisplay Management
Adobe AIR
Adobe AIR
Adobe Flash Player 10 Plugin
Adobe Reader 8.1.3
Adobe Shockwave Player
Aimersoft DVD Ripper(Build 1.0.16)
Alien Shooter 1.2
AOL Instant Messenger
A-one Video Joiner 4.77
Apple Software Update
ArchMage 1.03
ASUS Probe V2.24.10
ATC for Splinter Cell Chaos Theory 1.0
Atomic Alarm Clock 5.81
Audiosurf
AVS DVD to GO 2 (Beta)
Azangara version 1.31
Banshee Screamer Alarm 2.54
Battle Rush
Battlefield 2142
Battleships Forever v0.85j
Bejeweled 2 Deluxe 1.0
Bionic Commando Rearmed
BitLord 1.1
BitPim 1.0.6
BitTorrent 4.20.9
Breakout Shooting 1.1
BusinessCardsMX 3.92
CachemanXP 1.1
Call of Duty® 4 - Modern Warfare™
Call of Duty® 4 - Modern Warfare™ 1.4 Patch
Call of Duty® 4 - Modern Warfare™ 1.5 Multiplayer Patch
Call of Duty® 4 - Modern Warfare™ 1.6 Patch
Call of Duty® 4 - Modern Warfare™ 1.7 Patch
CCleaner (remove only)
Chinese Traditional Fonts Support For Adobe Reader 8
Clone Terminator 1.0
Combined Community Codec Pack 2006-07-28 (Remove Only)
Command & Conquer 3
Command & Conquer The First Decade
ConceptDraw WebWave
Creative Audio Console
Creative MediaSource
Creative System Information
DaemonVector0817_ENG
Darwinia
Dawn of War - Soulstorm
Day of Defeat
DC++ 0.699
Dead Space™
DeadAIM
DH Driver Cleaner Professional Edition
Diablo II
Direct Show Ogg Vorbis Filter (remove only)
DivX Player
DivX Pro
DivX Web Player
Dragonball Source
Driver Detective
Driver Magician 3.26
Duplicate File Hunter 2.01
DVD Decrypter (Remove Only)
DVDXCopy Platinum 4.0.3
EAX4 Unified Redist
EC Software TNT Screen Capture 2.1
Elprime Media Recovery 1.0
Enemy Territory - QUAKE Wars™ Beta 1.1 Patch
Enemy Territory - QUAKE Wars™ Beta 2 1.1 Patch
Equation Wizard
ESForces
EVEREST Ultimate Edition v3.01
Extreme Thumbnail Generator 1.9.4
Fallout 3
FEARCombat
ffdshow [rev 1324] [2007-07-01]
GameSpy Arcade
GameTap
GGPO
GPGNet
Guild Wars
Half-Life 2: Episode One
Half-Life 2: Episode Two
Hamachi 1.0.3.0
HDDlife
Hide IP Platinum 3.42
Highlight Viewer (Windows Live Toolbar)
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.0 (KB932471)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Format SDK (KB902344)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB914440)
Hotfix for Windows XP (KB915865)
Hotfix for Windows XP (KB926239)
HyperSnap-DX 5
Hyperspace Invader
IGN Download Manager 2.2.2
Infra Recorder
InterVideo Home Theater
J2SE Runtime Environment 5.0 Update 10
J2SE Runtime Environment 5.0 Update 11
J2SE Runtime Environment 5.0 Update 6
J2SE Runtime Environment 5.0 Update 9
Java 2 Runtime Environment, SE v1.4.2_12
Java™ 6 Update 2
Java™ 6 Update 3
Java™ SE Runtime Environment 6 Update 1
KRyLack Password Recovery
Left 4 Dead
LG GSM PC Components
LG USB Modem driver
LimeWire
LimeWire PRO 4.12.3
Little Fighter 2 1.9c
MachineHell version 1.3
MadMagic
Mail Bomber
Map Button (Windows Live Toolbar)
Marvel™ - Ultimate Alliance
Matroska Pack - Lazy Man's MKV 0.9.9
Media Resizer
Media Resizer PRO
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0 Service Pack 1
Microsoft .NET Framework 3.0 Service Pack 1
Microsoft Bootvis
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Games for Windows - LIVE Redistributable
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office Live Meeting 2005
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Moyea DVD Ripper version 1.1.2.14
Mozilla Firefox (3.0.4)
MSN Music Assistant
MSXML 4.0 SP2 (KB925672)
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 Parser and SDK
MSXML 6.0 Parser (KB933579)
Mumble and Murmur
Natural Selection 3.2
Nero 6 Ultra Edition
NOD32 Antivirus System
NOD32 FiX v2.1
Nox
Nuclear Coffee - VideoGet [removed]
NVIDIA Drivers
NVIDIA PhysX v8.10.13
NVIDIA PureVideo Decoder
O&O Defrag Professional Edition
oggcodecs 0.71.0946
OpenAL
Opera 9.50
Opposing Force
Orb
Pcsx2 0.9.2 Watermoose
Peggle Extreme
Perfect Dark: Source Beta 1.0
Pivot Software
Plato DVD Ripper Pro 6.66.2
Plato Video Converter 5.68
Portal
PowerISO
Prey
ProgramChecker
Project64 1.6
PunkBuster Services
QuickTime
RealPlayer
Replay Media Catcher 3.01
Rhapsody Player Engine
RIP Strike Back v1.0.6
RIP v1.1.0
RIP3: The Last Hero
Robbox
ROM CHECK FAIL 1.0
S.T.A.L.K.E.R. - Shadow of Chernobyl [v1.0004]
SDK
Security Update for Windows Internet Explorer 7 (KB928090)
Security Update for Windows Internet Explorer 7 (KB929969)
Security Update for Windows Internet Explorer 7 (KB931768)
Security Update for Windows Internet Explorer 7 (KB933566)
Security Update for Windows Internet Explorer 7 (KB937143)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB917159)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB918899)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920214)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB921503)
Security Update for Windows XP (KB921883)
Security Update for Windows XP (KB922616)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923694)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925486)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB933729)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
Security Update for Windows XP (KB936021)
Security Update for Windows XP (KB937894)
Security Update for Windows XP (KB938829)
Security Update for Windows XP (KB941202)
Security Update for Windows XP (KB941568)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB941644)
Security Update for Windows XP (KB943460)
Security Update for Windows XP (KB943485)
Security Update for Windows XP (KB944653)
Smart Menus (Windows Live Toolbar)
Soldat 1.3.1
Sound Blaster X-Fi
SpeechRedist
Spybot - Search & Destroy
Spybot - Search & Destroy 1.5.2.20
SpywareBlaster 4.1
Starcraft
Station LaunchPad
Steam
Super DVD Ripper v1.90
Super Mario War 1.7
Supreme Commander
Synaesthete (v1.0)
System Requirements Lab
TBS WMP Plug-in
Team Fortress 2
TeamViewer 3
Tom Clancy's Ghost Recon Advanced Warfighter® 2
Tom Clancy's Rainbow Six Vegas 2
TubeHunter Ultra
TVersity Codec Pack 1.1
Ultimate Spider-Man ™
Unreal Anthology
Unreal Tournament 3
Update for Windows XP (KB911280)
Update for Windows XP (KB916595)
Update for Windows XP (KB920342)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB925720)
Update for Windows XP (KB925876)
Update for Windows XP (KB927891)
Update for Windows XP (KB929338)
Update for Windows XP (KB930916)
Update for Windows XP (KB931836)
Update for Windows XP (KB933360)
Update for Windows XP (KB938828)
Update for Windows XP (KB942763)
Ventrilo Client
Ventrilo Server
VentriloMIX
Veo Advanced Connect
Viewpoint Manager (Remove Only)
Viewpoint Media Player
VLC media player 0.9.3
VobSub v2.23 (Remove Only)
WebcamMax
webcamXP (remove only)
Westwood Shared Internet Components
Winamp (remove only)
Windows Defender
Windows Desktop Search
Windows Driver Package - Advanced Micro Devices (AmdK8) Processor (05/27/2006 1.3.2.0)
Windows Imaging Component
Windows Internet Explorer 7
Windows Live Favorites for Windows Live Toolbar
Windows Live installer
Windows Live Mail
Windows Live Messenger
Windows Live Sign-in Assistant
Windows Live Toolbar
Windows Live Toolbar
Windows Live Toolbar Extension (Windows Live Toolbar)
Windows Live Writer
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Format SDK Hotfix - KB891122
Windows Media Player 11
Windows Media Player 11
Windows Presentation Foundation
WinPatrol 2007
WinRAR archiver
WordRacer Buddy 2.8
xp-AntiSpy 3.96-4
XviD MPEG-4 Codec
Yahoo! Install Manager
Yahoo! Messenger
Zoner GIF Animator 5

Here's the log from combo fix:

ComboFix 08-12-05.01 - Gorga! 2008-12-05 14:00:09.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1322 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
* Resident AV is active

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\documents and settings\Gorga!\Application Data\addon.dat
c:\documents and settings\Gorga!\Application Data\NI.GSCNS
c:\documents and settings\Gorga!\Application Data\NI.GSCNS\dl.ini
c:\documents and settings\Gorga!\Application Data\NI.GSCNS\settings.ini
C:\install.exe
c:\windows\9129837.exe
c:\windows\msvrc20.dll
c:\windows\system32\jsdf8j3dgf.dll
c:\windows\system32\winsecurityxp
c:\windows\system32\winsecurityxp\mswinup.exe
c:\windows\system32\winsecurityxp\rk.exe

—– BITS: Possible infected sites —–

hxxp://zinbob.110mb.com
.
((((((((((((((((((((((((( Files Created from 2008-11-05 to 2008-12-05 )))))))))))))))))))))))))))))))
.

2008-12-04 21:36 . 2008-12-04 21:36 237,568 –a—— c:\windows\system32\rmc_rtspdl.dll
2008-12-04 21:36 . 2008-12-04 21:36 156,672 –a—— c:\windows\system32\rmc_fixasf.exe
2008-12-04 21:04 . 2008-12-04 21:33 323,584 –a—— c:\windows\system32\AUDIOGENIE2.DLL
2008-12-04 21:00 . 2008-12-04 21:00 d——– c:\windows\Replay Media Catcher
2008-12-04 21:00 . 2008-12-04 21:45 d——– c:\program files\Replay Media Catcher
2008-12-04 21:00 . 2008-12-04 21:01 133,120 –a—— c:\windows\ovewijehulalihoc.dll
2008-12-04 20:51 . 2008-12-04 20:51 d——– c:\program files\uTorrent
2008-12-04 20:51 . 2008-12-04 21:18 d——– c:\documents and settings\Gorga!\Application Data\uTorrent
2008-12-04 20:49 . 2008-12-04 20:49 59,904 –a—— C:\gxridiq.exe
2008-12-04 20:48 . 2008-12-04 20:48 40,448 –a—— c:\windows\Rlunejiqaluhe.dll
2008-12-04 20:48 . 2008-12-04 20:49 40,448 –a—— C:\muwgfsc.exe
2008-12-04 20:28 . 2008-12-04 20:28 5,849 –a—— c:\windows\system32\nokye.exe
2008-12-04 11:02 . 2008-12-04 11:02 61,440 –a—— c:\windows\incatio.exe
2008-12-02 20:29 . 2008-12-02 20:29 d——– c:\documents and settings\Gorga!\Application Data\DisplayTune
2008-12-02 20:27 . 2008-12-02 20:27 d——– c:\program files\Portrait Displays
2008-12-02 20:27 . 2007-02-09 12:17 62,009 –a—— c:\windows\system32\WPFB.DLL
2008-12-02 20:27 . 2007-02-09 12:17 17,465 –a—— c:\windows\system32\drivers\pivot.sys
2008-12-02 20:27 . 2008-06-04 17:59 17,064 –a—— c:\windows\system32\drivers\PdiPorts.sys
2008-12-02 20:27 . 2007-02-09 12:17 11,323 –a—— c:\windows\system32\drivers\pivotmou.sys
2008-12-02 20:27 . 2004-11-22 12:07 2,304 –a—— c:\windows\system32\Machnm32.sys
2008-12-02 20:26 . 2008-12-02 20:27 d——– c:\program files\Common Files\Portrait Displays
2008-12-02 20:26 . 2008-12-02 20:26 d——– c:\program files\Acer Display
2008-11-20 21:59 . 2008-11-20 21:59 d——– c:\documents and settings\All Users\Application Data\Fallout3
2008-11-20 21:58 . 2008-11-20 21:58 d——– c:\program files\Bethesda Softworks
2008-11-20 21:57 . 2008-11-20 21:57 d——– c:\windows\system32\xlive
2008-11-18 18:08 . 2008-11-19 03:13 d——– c:\documents and settings\Gorga!\.housecall6.6
2008-11-18 01:48 . 2008-11-18 01:48 d——– c:\program files\Common Files\Adobe AIR
2008-11-17 16:12 . 2008-10-10 04:52 4,379,984 –a—— c:\windows\system32\D3DX9_40.dll
2008-11-17 16:12 . 2008-10-10 04:52 2,036,576 –a—— c:\windows\system32\D3DCompiler_40.dll
2008-11-17 16:12 . 2008-10-27 10:04 514,384 –a—— c:\windows\system32\XAudio2_3.dll
2008-11-17 16:12 . 2008-10-10 04:52 452,440 –a—— c:\windows\system32\d3dx10_40.dll
2008-11-17 16:12 . 2008-10-27 10:04 235,856 –a—— c:\windows\system32\xactengine3_3.dll
2008-11-17 16:12 . 2008-10-27 10:04 70,992 –a—— c:\windows\system32\XAPOFX1_2.dll
2008-11-17 16:12 . 2008-10-27 10:04 23,376 –a—— c:\windows\system32\X3DAudio1_5.dll
2008-11-14 01:07 . 2008-11-14 01:07 d——– c:\windows\Logs
2008-11-11 19:40 . 2008-11-11 19:40 d——– c:\documents and settings\Gorga!\Application Data\InstallShield

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-05 04:40 ——— d—–w c:\program files\Mozilla Firefox 3 Beta 5
2008-12-05 01:27 ——— d—–w c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-12-03 01:27 ——— d–h–w c:\program files\InstallShield Installation Information
2008-12-03 01:17 ——— d—–w c:\program files\Common Files\Wise Installation Wizard
2008-12-03 01:16 ——— d—–w c:\program files\AGEIA Technologies
2008-11-30 23:24 ——— d—–w c:\documents and settings\Gorga!\Application Data\IGN_DLM
2008-11-24 17:52 ——— d—–w c:\program files\Electronic Arts
2008-11-21 21:45 ——— d—–w c:\program files\Spybot - Search & Destroy
2008-11-18 23:24 ——— d—–w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2008-11-14 06:07 413,696 —-a-w c:\windows\system32\wrap_oal.dll
2008-11-14 06:07 110,592 —-a-w c:\windows\system32\OpenAL32.dll
2008-11-12 18:45 453,152 —-a-w c:\windows\system32\NVUNINST.EXE
2008-11-12 00:50 ——— d—–w c:\program files\Doom 3
2008-11-11 00:03 202,320 —-a-w c:\windows\system32\PnkBstrB.exe
2008-11-11 00:03 138,408 —-a-w c:\windows\system32\drivers\PnkBstrK.sys
2008-11-08 14:26 ——— d—–w c:\program files\Common Files\Adobe
2008-11-07 07:36 ——— d—–w c:\program files\Diablo II
2008-11-05 07:50 ——— d—a-w c:\documents and settings\All Users\Application Data\TEMP
2008-11-05 07:50 ——— d—–w c:\program files\SpywareBlaster
2008-10-13 14:56 70,936 —-a-w c:\windows\system32\PhysXLoader.dll
2008-10-07 18:33 286,720 —-a-w c:\windows\system32\nvnt4cpl.dll
2008-10-07 14:13 58,648 —-a-w c:\windows\system32\AgCPanelTraditionalChinese.dll
2008-10-07 14:13 58,648 —-a-w c:\windows\system32\AgCPanelSwedish.dll
2008-10-07 14:13 58,648 —-a-w c:\windows\system32\AgCPanelSpanish.dll
2008-10-07 14:13 58,648 —-a-w c:\windows\system32\AgCPanelSimplifiedChinese.dll
2008-10-07 14:13 58,648 —-a-w c:\windows\system32\AgCPanelPortugese.dll
2008-10-07 14:13 58,648 —-a-w c:\windows\system32\AgCPanelKorean.dll
2008-10-07 14:13 58,648 —-a-w c:\windows\system32\AgCPanelJapanese.dll
2008-10-07 14:13 58,648 —-a-w c:\windows\system32\AgCPanelGerman.dll
2008-10-07 14:13 58,648 —-a-w c:\windows\system32\AgCPanelFrench.dll
2008-10-07 14:13 288,024 —-a-w c:\windows\system32\PhysXCplUI.exe
2008-10-07 14:13 288,024 —-a-w c:\windows\system32\PhysXCompatCplUI.exe
2008-10-07 14:13 23,320 —-a-w c:\windows\system32\PhysXDevice.dll
2008-09-17 13:55 86,016 —-a-w c:\windows\system32\SET281.tmp
2008-09-17 13:55 6,057,472 —-a-w c:\windows\system32\SET275.tmp
2008-09-17 13:55 475,136 —-a-w c:\windows\system32\SET279.tmp
2008-09-17 13:55 122,880 —-a-w c:\windows\system32\SET299.tmp
2008-08-16 15:16 22,328 —-a-w c:\documents and settings\Gorga!\Application Data\PnkBstrK.sys
2006-10-09 18:37 37,655 —-a-w c:\documents and settings\Gorga!\sig279.dat
2006-09-11 20:38 1 —-a-w c:\documents and settings\Gorga!\SI.bin
2006-05-06 16:42 7,260,160 —-a-w c:\program files\mozilla firefox\plugins\libvlc.dll
2006-09-02 02:22 56 –sh–r c:\windows\system32\BFD094A143.sys
2007-12-03 11:15 12,570 –sha-w c:\windows\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AIM"="c:\program files\AIM\aim.exe" [2006-08-01 67112]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
"igndlm.exe"="c:\program files\IGN\Download Manager\dlm.exe" [2008-08-01 1103216]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-08-04 1694208]
"Google Update"="c:\documents and settings\Gorga!\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-09-04 133104]
"SkinClock"="c:\program files\Atomic Alarm Clock\AtomicAlarmClock.exe" [2008-09-11 1739264]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-11-12 13672448]
"nod32kui"="c:\program files\Eset\nod32kui.exe" [2007-03-11 949376]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2007-02-05 849280]
"DeadAIM"="c:\program files\AIM\\DeadAIM.ocm" [2004-02-28 144896]
"OODefragTray"="c:\windows\system32\oodtray.exe" [2007-05-11 2512392]
"ASUS Probe"="c:\program files\ASUS\Asus Probe\AsusProb.exe" [2002-12-06 617984]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-09-06 413696]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-11-12 86016]
"PivotSoftware"="c:\program files\Portrait Displays\Pivot Software\wpctrl.exe" [2007-02-09 694008]
"DT ACR"="c:\program files\Common Files\Portrait Displays\Shared\DT_startup.exe" [2008-06-06 81920]
"Ipehidac"="c:\windows\ovewijehulalihoc.dll" [2008-12-04 133120]
"Mwakuq"="c:\windows\Rlunejiqaluhe.dll" [2008-12-04 40448]
"CTHelper"="CTHELPER.EXE" [2006-12-12 c:\windows\system32\CtHelper.exe]
"nwiz"="nwiz.exe" [2008-11-12 c:\windows\system32\nwiz.exe]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2006-04-24 282624]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"MSVideo"= ucdvfw.dll
"vidc.xvid"= xvid.dll
"vidc.wmv3"= c:\progra~1\COMBIN~1\Filters\wmv9vcm.dll
"VIDC.ACDV"= ACDV.dll
"VIDC.D263"= xl_x263dec.dll
"VIDC.YV12"= xl_yv12.dll
"VIDC.XJPG"= camfc.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ASUS Probe]
–a—— 2002-12-06 15:07 617984 c:\program files\ASUS\Asus Probe\AsusProb.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Creative Detector]
–a—— 2004-12-02 18:23 102400 c:\program files\Creative\MediaSource\Detector\CTDetect.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
–a—— 2004-08-03 23:56 15360 c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Home Theater SchSvr]
–a—— 2005-09-27 04:00 106496 c:\program files\Common Files\InterVideo\SchSvr\SchSvr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igndlm.exe]
–a—— 2008-08-01 12:36 1103216 c:\program files\IGN\Download Manager\DLM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ipehidac]
–a—— 2008-12-04 21:01 133120 c:\windows\ovewijehulalihoc.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
–a—— 2005-08-11 15:30 81920 c:\program files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper.exe]
c:\program files\iTunes\iTunesHelper.exe [BU]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
——— 2004-08-04 00:06 1694208 c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
–a—— 2007-10-18 11:34 5724184 c:\program files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Mwakuq]
–a—— 2008-12-04 20:48 40448 c:\windows\Rlunejiqaluhe.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
–a—— 2001-07-09 10:50 155648 c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ProgramChecker]
–a—— 2006-02-15 15:17 503808 c:\program files\Zenturi\ProgramChecker\pcheckp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
–a—— 2008-09-06 14:09 413696 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealPlayer]
–a—— 2007-07-02 12:40 208941 c:\program files\Real\RealPlayer\realplay.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
–a—— 2007-09-25 00:11 132496 c:\program files\Java\jre1.6.0_03\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ViewMgr]
–a—— 2004-11-10 23:15 111816 c:\program files\Viewpoint\Viewpoint Manager\ViewMgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
–a—— 2007-05-14 17:22 35328 c:\program files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WINCINEMAMGR]
–a—— 2005-09-27 02:47 266240 c:\program files\InterVideo\Common\Bin\WinCinemaMgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
–a—— 2006-11-30 21:49 4662776 c:\program files\Yahoo!\Messenger\YahooMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTxfiHlp]
–a—— 2006-12-12 09:46 20480 c:\windows\system32\Ctxfihlp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
–a—— 2008-11-12 14:54 1630208 c:\windows\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WLSetupSvc"=3 (0x3)
"WinDefend"=2 (0x2)
"usnjsvc"=3 (0x3)
"sassvc"=3 (0x3)
"iPod Service"=3 (0x3)
"idsvc"=3 (0x3)
"WMPNetworkSvc"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Program Files\\AIM\\aim.exe"=
"c:\\Program Files\\BitLord\\BitLord.exe"=
"c:\\Program Files\\Valve\\Steam\\steamapps\\[removed]\\team fortress classic\\hl.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Hamachi\\hamachi.exe"=
"c:\\Program Files\\Electronic Arts\\Battlefield 2142\\BF2142.exe"=
"c:\\Program Files\\Sierra\\FEARCombat\\FEARMP.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Orb Networks\\Orb\\bin\\Orb.exe"=
"c:\\Program Files\\Orb Networks\\Orb\\bin\\OrbTray.exe"=
"c:\\Program Files\\Orb Networks\\Orb\\bin\\OrbStreamerClient.exe"=
"c:\\Program Files\\LimeWire\\LimeWire 4.0.7 Pro\\LimeWire.exe"=
"c:\\Program Files\\THQ\\Gas Powered Games\\Supreme Commander\\bin\\SupremeCommander.exe"=
"c:\\Program Files\\THQ\\Gas Powered Games\\GPGNet\\GPG.Multiplayer.Client.exe"=
"c:\\Program Files\\THQ\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\XR_3DA.exe"=
"c:\\Program Files\\THQ\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\dedicated\\XR_3DA.exe"=
"%SystemDir%\\winsecurityxp\\mswinup.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Unreal Tournament 3\\Binaries\\UT3.exe"=
"c:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
"c:\\Program Files\\Ubisoft\\Tom Clancy's Rainbow Six Vegas 2\\Binaries\\R6Vegas2_Game.exe"=
"c:\\Program Files\\Ubisoft\\Tom Clancy's Rainbow Six Vegas 2\\Binaries\\R6Vegas2_Launcher.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"c:\\Program Files\\Capcom\\Bionic Commando Rearmed\\bcr.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R1 nod32drv;nod32drv;c:\windows\system32\drivers\nod32drv.sys [2007-03-11 15424]
R2 CAMTHWDM;WebcamMax, WDM Video Capture;c:\windows\system32\DRIVERS\CAMTHWDM.sys [2007-01-11 941784]
R2 PdiService;Portrait Displays SDK Service;c:\program files\Common Files\Portrait Displays\Drivers\pdisrvc.exe [2008-12-02 90112]
S3 CachemanXPService;CachemanXP;c:\progra~1\CACHEM~1\CachemanXP.exe [2006-09-03 201728]
S3 cpuz126;cpuz126;\??\c:\program files\PC Wizard 2007\pcwiz32.sys []
S3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.12.1;c:\windows\system32\drivers\libusb0.sys [2008-01-22 28672]
S3 pfsvgae;pfsvgae;\??\c:\docume~1\Gorga!\LOCALS~1\Temp\pfsvgae.sys []
S3 XIRLINK;Veo PC Camera;c:\windows\system32\DRIVERS\ucdnt.sys [2004-01-26 899980]
S4 sassvc;ProgramCheckerPro;c:\program files\Zenturi\ProgramChecker\sassvc.exe [2006-02-15 122880]
S4 WinDefend;Windows Defender;"c:\program files\Windows Defender\MsMpEng.exe" [2006-11-03 13592]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{97d67f4f-39df-11db-9759-806d6172696f}]
\Shell\AutoRun\command - D:\ASUSACPI.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{64D90875-9DD7-75F3-EB56-8A3F55DA75B6}]
c:\windows\system32\win32GI\Isass.exe s
.
Contents of the 'Scheduled Tasks' folder

2008-11-29 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2008-12-05 c:\windows\Tasks\GoogleUpdateTaskUser.job
- c:\documents and settings\Gorga!\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-04 01:19]

2007-11-15 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 18:20]
.
- - - - ORPHANS REMOVED - - - -

HKLM-RunServices-iesetup.exe - iesetup.exe
HKLM-Explorer_Run-Lsass Service - c:\documents and settings\Gorga!\Application Data\Microsoft\Windows\lsass.exe
MSConfigStartUp-CAMTHINS - c:\program files\WebcamMax\CAMTHINS.exe
MSConfigStartUp-iTunesHelper - c:\program files\iTunes\iTunesHelper.exe
MSConfigStartUp-SDTray - c:\program files\Spyware Doctor\SDTrayApp.exe
MSConfigStartUp-SmartToDo - c:\program files\Smart To-Do\SmartToDo.exe
MSConfigStartUp-swg - c:\program files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
MSConfigStartUp-ttool - c:\windows\9129837.exe
MSConfigStartUp-iesetup - iesetup.exe

.
——- Supplementary Scan ——-
.
uStart Page = about:blank
uInternet Connection Wizard,ShellNext = iexplore
IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
IE: E&xport to Microsoft Excel - c:\progra~1\Microsoft Office\Office12\EXCEL.EXE/3000
LSP: c:\windows\system32\imon.dll
Trusted Zone: *.amaena.com
Trusted Zone: *.avsystemcare.com
Trusted Zone: *.onerateld.com
Trusted Zone: *.safetydownload.com
Trusted Zone: *.trustedantivirus.com
Trusted Zone: *.virusremover2008.com
Trusted Zone: *.virusschlacht.com
Trusted Zone: *.amaena.com
Trusted Zone: *.avsystemcare.com
Trusted Zone: *.onerateld.com
Trusted Zone: *.safetydownload.com
Trusted Zone: *.trustedantivirus.com
Trusted Zone: *.virusremover2008.com
Trusted Zone: *.virusschlacht.com

c:\windows\Downloaded Program Files\QOLCheck.ocx - O16 -: {483EB14D-AF1C-4951-81B0-4E2B41829FF6}
hxxps://www.select2perform.com/cabs/QOLCheck.ocx
FireFox -: Profile - c:\documents and settings\Gorga!\Application Data\Mozilla\Firefox\Profiles\n7230eyv.default\
FF -: plugin - c:\documents and settings\Gorga!\Local Settings\Application Data\Google\Update\1.2.131.27\npGoogleOneClick6.dll
FF -: plugin - c:\progra~1\Yahoo!\Common\npyaxmpb.dll
FF -: plugin - c:\program files\GameTap\bin\Release\npgametaptool.dll
FF -: plugin - c:\program files\IGN\Download Manager\npfpdlm.dll
FF -: plugin - c:\program files\Mozilla Firefox\plugins\NPAdbESD.dll
FF -: plugin - c:\program files\Mozilla Firefox\plugins\nptnt.dll
FF -: plugin - c:\program files\Mozilla Firefox\plugins\NPTURNMED.dll
FF -: plugin - c:\program files\Opera 9.5 alpha\program\plugins\npdivx32.dll
FF -: plugin - c:\program files\Opera 9.5 alpha\program\plugins\npdsplay.dll
FF -: plugin - c:\program files\Opera 9.5 alpha\program\plugins\NPOFF12.DLL
FF -: plugin - c:\program files\Opera 9.5 alpha\program\plugins\npqtplugin.dll
FF -: plugin - c:\program files\Opera 9.5 alpha\program\plugins\npqtplugin2.dll
FF -: plugin - c:\program files\Opera 9.5 alpha\program\plugins\npqtplugin3.dll
FF -: plugin - c:\program files\Opera 9.5 alpha\program\plugins\npqtplugin4.dll
FF -: plugin - c:\program files\Opera 9.5 alpha\program\plugins\npqtplugin5.dll
FF -: plugin - c:\program files\Opera 9.5 alpha\program\plugins\npqtplugin6.dll
FF -: plugin - c:\program files\Opera 9.5 alpha\program\plugins\npqtplugin7.dll
FF -: plugin - c:\program files\Opera 9.5 alpha\program\plugins\NPSWF32.dll
FF -: plugin - c:\program files\Opera 9.5 alpha\program\plugins\NPTURNMED.dll
FF -: plugin - c:\program files\Opera 9.5 alpha\program\plugins\npwmsdrm.dll
FF -: plugin - c:\program files\Real\RhapsodyPlayerEngine\nprhapengine.dll
FF -: plugin - c:\program files\Yahoo!\Shared\npYState.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-05 14:04:55
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
Lsass Service = c:\documents and settings\Gorga!\Application Data\Microsoft\Windows\lsass.exe??????????????????????????????????????????????????

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
c:\windows\system32\CTSVCCDA.EXE
c:\program files\Common Files\Portrait Displays\Shared\DTSRVC.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
c:\program files\ESET\nod32krn.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\oodag.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\MsPMSPSv.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\rundll32.exe
c:\program files\Acer Display\eDisplay Management\dthtml.exe
c:\program files\Portrait Displays\Pivot Software\Floater.exe
c:\program files\Common Files\Portrait Displays\Shared\HookManager.exe
.
**************************************************************************
.
Completion time: 2008-12-05 14:10:00 - machine was rebooted [Gorga!]
ComboFix-quarantined-files.txt 2008-12-05 19:09:58

Pre-Run: 13,324,316,672 bytes free
Post-Run: 13,622,915,072 bytes free

361

Thanks once again.

jpshortstuff

Post #4December 6, 2008, 6:27 PM UTC

LimeWire
You have LimeWire, a P2P/file sharing programs installed on your computer. P2P applications like it are the largest source of malware we see. You'll be doing yourself a favor by removing it.

References for the risk of these programs can be found in these links:
http://www.microsoft.com/windows/ie/commun…protection.mspx
http://www.techweb.com/wire/160500554
http://www.internetworldstats.com/articles/art053.htm
See Clean/Infected P2P Programs here

I would recommend that you uninstall LimeWire, however that choice is up to you. If you choose to remove these programs, you can do so via Control Panel >> Add or Remove Programs.

If you wish to keep it, please do not use it until your computer is cleaned.

Viewpoint Manager is often installed without the users permission. If you didn't install it, or if you did but you no longer use it, I recommend you get rid of it.

Please click Start >> Control Panel >> Add or Remove Programs.
Find the item below on the list and click Remove.
Viewpoint Manager
Viewpoint Media Player
Let me know how it goes.

Please disable NOD32 as before.

1. Please open Notepad

Click Start , then Run
Type notepad.exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

http://forums.whatthetech.com/Flipping_out_computer_t97573.html

Collect::
c:\documents and settings\Gorga!\Application Data\Microsoft\Windows\lsass.exe
c:\windows\system32\win32GI\Isass.exe
C:\gxridiq.exe
c:\windows\Rlunejiqaluhe.dll
C:\muwgfsc.exe
C:\windows\system32\nokye.exe
c:\windows\incatio.exe
c:\windows\ovewijehulalihoc.dll

File::
c:\windows\system32\SET281.tmp
c:\windows\system32\SET275.tmp
c:\windows\system32\SET279.tmp
c:\windows\system32\SET299.tmp
c:\documents and settings\Gorga!\sig279.dat

DirLook::
c:\documents and settings\Gorga!\Application Data\Microsoft\Windows

Driver::
pfsvgae

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Ipehidac"=-
"Mwakuq"=-
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
"Lsass Service"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ipehidac]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Mwakuq]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{97d67f4f-39df-11db-9759-806d6172696f}]
[-HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{64D90875-9DD7-75F3-EB56-8A3F55DA75B6}]
Trusted Zone: *.amaena.com
Trusted Zone: *.avsystemcare.com
Trusted Zone: *.onerateld.com
Trusted Zone: *.safetydownload.com
Trusted Zone: *.trustedantivirus.com
Trusted Zone: *.virusremover2008.com
Trusted Zone: *.virusschlacht.com
Trusted Zone: *.amaena.com
Trusted Zone: *.avsystemcare.com
Trusted Zone: *.onerateld.com
Trusted Zone: *.safetydownload.com
Trusted Zone: *.trustedantivirus.com
Trusted Zone: *.virusremover2008.com
Trusted Zone: *.virusschlacht.com

3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

[external image: Posted Image]

5. Additonally, ComboFix will generate the following files on your desktop

A zipped file on your desktop called Submit [Date Time].zip
And another file named - CF-Submit.htm

6. ComboFix may need to reboot to finish its work. Let it.

7. When CF has finished its run, it will generate ComboFix.log which will appear on your screen.

8. Next, a window will popup prompting you to "Submit Files for further analysis". Click "OK"

9. Your system's browser will automatically respond by loading the CF-Submit.htm file and open a window :

Click the "Browse" button and locate the Submit [Date Time].zip file on your desktop.
Click on the file to Select it.
Submit the file by clicking "OK"

10. Once the file has been submitted, you may DELETE both files on your desktop.

11. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

Combofix.txt
A new HijackThis log.

Your Java Runtime Environment is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.

Updating Java:

Download the latest version of Java Runtime Environment (JRE) 6 Update 11.
Scroll down to where it says "Java Runtime Environment (JRE) 6 Update 11, The Java SE Runtime Environment (JRE) allows end-users to run Java applications".
Click the "Download" button to the right.
Check the box that says: "Accept License Agreement".
The page will refresh.
Click on the link to download Windows Offline Installation, Multi-language and save it to your desktop.
Close any programs you may have running - especially any web browsers.
Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
Check any item with Java Runtime Environment (JRE or J2SE) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6u11-windowsi586.exe to install the newest version.

Please go to Kaspersky website and perform an online antivirus scan.

Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
- Spyware, Adware, Dialers, and other potentially dangerous programs
  Archives
  Mail databases
Click on My Computer under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As….
Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
Please post this log in your next reply.

Also, please give a detailed description of how your computer is running and behaving at the moment, listing any remaining problems.

Thanks.

Gorga53

Post #5December 8, 2008, 11:32 PM UTC

Viewpoint uninstall, successful. When I drag and dropped the CFScript.txt file as per your instructions, the program loaded, then asked me to update. I chose yes, the update appeared to fail and then the program told me it would run as normal . From there it pretty much did a normal scan like the first time, and created no new files on my desktop for submission. Java install was a success. Here's my log for the Kasperspy scan, which froze up at 98% , so I had to stop it manually.

SPERSKY ONLINE SCANNER 7 REPORT
Sunday, December 7, 2008
Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Saturday, December 06, 2008 19:53:45
Records in database: 1440831
——————————————————————————–

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\
F:\
G:\

Scan statistics:
Files scanned: 369352
Threat name: 35
Infected objects: 49
Suspicious objects: 0
Duration of the scan: 05:13:38

File name / Threat name / Threats count
C:\Documents and Settings\Gorga!\Desktop\New Folder\mongler.zip Infected: Trojan.Win32.Delf.cvl 1
C:\Program Files\BitLord\Downloads\ Infected: Backdoor.Win32.Bifrose.agas 1
C:\Program Files\BitLord\Downloads\PCSX and Plugins !!!#\Pcsx2_0.9.1_Setup.exe Infected: Trojan.Win32.Delf.ari 1
C:\Program Files\ESET\cache\FND0.NFI Infected: Backdoor.Win32.Rbot.aeu 1
C:\Program Files\ESET\cache\FND1.NFI Infected: Backdoor.Win32.Rbot.aeu 1
C:\Program Files\ESET\cache\FND3.NFI Infected: Backdoor.Win32.Rbot.euv 1
C:\Program Files\ESET\cache\FND5.NFI Infected: Trojan-Banker.Win32.Banker.hgk 1
C:\Program Files\ESET\cache\FND6.NFI Infected: Trojan.Win32.VB.gop 1
C:\Program Files\ESET\cache\FND7.NFI Infected: Trojan-Downloader.Win32.VB.irr 1
C:\Program Files\ESET\cache\FND8.NFI Infected: Trojan-PSW.Win32.QQPass.eab 1
C:\Program Files\ESET\cache\FND9.NFI Infected: Trojan-Downloader.Win32.Agent.aoeq 1
C:\Program Files\ESET\cache\FNDA.NFI Infected: Trojan.Win32.VB.gmp 1
C:\Program Files\ESET\cache\FNDB.NFI Infected: Trojan-Downloader.Win32.VB.hpv 1
C:\Program Files\ESET\cache\FNDC.NFI Infected: Trojan.Win32.Agent.amfx 1
C:\Program Files\ESET\infected\0TZ4YUBA.NQF Infected: Backdoor.Win32.Rbot.aeu 1
C:\Program Files\ESET\infected\1MGWBWDA.NQF Infected: Trojan-Downloader.Win32.Agent.akwa 1
C:\Program Files\ESET\infected\5QQEQKAA.NQF Infected: Trojan.Win32.Agent.amfx 1
C:\Program Files\ESET\infected\BOT1RKDA.NQF Infected: not-a-virus:AdWare.Win32.Virtumonde.ks 1
C:\Program Files\ESET\infected\BQCW5EBA.NQF Infected: not-a-virus:AdWare.Win32.180Solutions.as 1
C:\Program Files\ESET\infected\DH1PIKDA.NQF Infected: Backdoor.Win32.Rbot.aeu 1
C:\Program Files\ESET\infected\EDYRJSDA.NQF Infected: Backdoor.Win32.Bandok.av 1
C:\Program Files\ESET\infected\EEUTXTCA.NQF Infected: Trojan-Downloader.Win32.Agent.aoeq 1
C:\Program Files\ESET\infected\EGRTLGDA.NQF Infected: not-a-virus:AdWare.Win32.180Solutions.ax 1
C:\Program Files\ESET\infected\IA3PBMDA.NQF Infected: Trojan-Downloader.Win32.Agent.akwa 1
C:\Program Files\ESET\infected\KFQYALDA.NQF Infected: Trojan-Downloader.Win32.Zlob.tjx 1
C:\Program Files\ESET\infected\KUV1ESCA.NQF Infected: Trojan.Win32.VB.gmp 1
C:\Program Files\ESET\infected\KZVRLTBA.NQF Infected: Trojan-GameThief.Win32.Magania.ajto 1
C:\Program Files\ESET\infected\M4PMFJDA.NQF Infected: Trojan-Downloader.Win32.VB.hpv 1
C:\Program Files\ESET\infected\NEKQZTDA.NQF Infected: Trojan.Win32.Monderd.gen 1
C:\Program Files\ESET\infected\PDPOLGBA.NQF Infected: Trojan-Downloader.Win32.VB.irr 1
C:\Program Files\ESET\infected\PY40KUAA.NQF Infected: Trojan.Win32.VB.bla 1
C:\Program Files\ESET\infected\RABFHJAA.NQF Infected: Trojan-Downloader.Win32.FraudLoad.vdjv 1
C:\Program Files\ESET\infected\SQVOK1DA.NQF Infected: Rootkit.Win32.Agent.ex 1
C:\Program Files\ESET\infected\T0XG5FBA.NQF Infected: Trojan.Win32.VB.gop 1
C:\Program Files\ESET\infected\U5DJ3TCA.NQF Infected: Trojan-Banker.Win32.Banker.hgk 1
C:\Program Files\ESET\infected\UW50PZAA.NQF Infected: Backdoor.Win32.Rbot.fer 1
C:\Program Files\ESET\infected\V1ZPJIAA.NQF Infected: Backdoor.Win32.Rbot.gen 1
C:\Program Files\ESET\infected\XMFTXNCA.NQF Infected: Trojan-PSW.Win32.QQPass.eab 1
C:\Qoobox\Quarantine\[4]-[removed] Infected: Trojan-Dropper.Win32.VB.hde 1
C:\Qoobox\Quarantine\[4]-[removed] Infected: Trojan.Win32.Midgare.qyd 1

The scan was stopped by the user.

Here's a fresh HJT log as of this writing

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:14:00 PM, on 12/8/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\WINDOWS\system32\oodtray.exe
C:\Program Files\ASUS\Asus Probe\AsusProb.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\AIM\aim.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Gorga!\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\Atomic Alarm Clock\AtomicAlarmClock.exe
C:\Program Files\Acer Display\eDisplay Management\DTHtml.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\oodag.exe
C:\Program Files\Common Files\Portrait Displays\Shared\HookManager.exe
C:\Program Files\Portrait Displays\Pivot Software\floater.exe
C:\Program Files\Common Files\Portrait Displays\Drivers\pdisrvc.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Gorga!\Desktop\HiJackThis.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Windows Live Toolbar\msn_sl.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [DeadAIM] rundll32.exe "C:\Program Files\AIM\\DeadAIM.ocm",ExportedCheckODLs
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [OODefragTray] C:\WINDOWS\system32\oodtray.exe
O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Asus Probe\AsusProb.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [PivotSoftware] "C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe"
O4 - HKLM\..\Run: [DT ACR] C:\Program Files\Common Files\Portrait Displays\Shared\DT_startup.exe -ACR
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [igndlm.exe] C:\Program Files\IGN\Download Manager\dlm.exe /windowsstart /startifwork
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Gorga!\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [SkinClock] C:\Program Files\Atomic Alarm Clock\AtomicAlarmClock.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\Microsoft Office\Office12\EXCEL.EXE/3000
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\Microsoft Office\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\Microsoft Office\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\Microsoft Office\Office12\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.amaena.com
O15 - Trusted Zone: *.avsystemcare.com
O15 - Trusted Zone: *.onerateld.com
O15 - Trusted Zone: *.safetydownload.com
O15 - Trusted Zone: *.trustedantivirus.com
O15 - Trusted Zone: *.virusremover2008.com
O15 - Trusted Zone: *.virusschlacht.com
O15 - Trusted Zone: *.amaena.com (HKLM)
O15 - Trusted Zone: *.avsystemcare.com (HKLM)
O15 - Trusted Zone: *.onerateld.com (HKLM)
O15 - Trusted Zone: *.safetydownload.com (HKLM)
O15 - Trusted Zone: *.trustedantivirus.com (HKLM)
O15 - Trusted Zone: *.virusremover2008.com (HKLM)
O15 - Trusted Zone: *.virusschlacht.com (HKLM)
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15030/CTSUEng.cab
O16 - DPF: {483EB14D-AF1C-4951-81B0-4E2B41829FF6} (QOLCheck Control) - https://www.select2perform.com/cabs/QOLCheck.ocx
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1188267067278
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1188267051153
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {DA758BB1-5F89-4465-975F-8D7179A4BCF3} (WheelofFortune Object) - http://messenger.zone.msn.com/binary/WoF.cab57176.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15033/CTPID.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: CachemanXP (CachemanXPService) - OuterTechnologies - C:\PROGRA~1\CACHEM~1\CachemanXP.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Portrait Displays Display Tune Service (DTSRVC) - Unknown owner - C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: Portrait Displays SDK Service (PdiService) - Portrait Displays, Inc. - C:\Program Files\Common Files\Portrait Displays\Drivers\pdisrvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe

As for how the computer is running, a bit odd I think. There were around 50 something processes running upon boot, which is definitely high. Internet explorer and yahoo messanger are acting weird, they don't display images correctly, thumbnails to be exact. I'll include a screen shot. Registry editing seems to work again. Also, while I was making this post, Data Execution Prevention popped up and told me to close explorer, which has never happened.

Here's the screen:

[external image: Posted Image]

jpshortstuff

Post #6December 9, 2008, 11:56 AM UTC

Please submit this file:
C:\Qoobox\Quarantine\[4]-[removed]
Here:
http://www.bleepingcomputer.com/submit-malware.php?channel=4

Post a link to this topic and type "Requested by jpshortstuff" in the comments box.

Next, please post the contents of C:\ComboFix.txt

Thanks.

Gorga53

Post #7December 9, 2008, 6:35 PM UTC

The file you requested has been successfully submitted. Here is the log you requested.

ComboFix 08-12-06.03 - Gorga! 2008-12-06 17:13:12.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1582 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Gorga!\Desktop\CFScript.txt
* Created a new restore point
* Resident AV is active

FILE ::
c:\documents and settings\Gorga!\sig279.dat
c:\windows\system32\SET275.tmp
c:\windows\system32\SET279.tmp
c:\windows\system32\SET281.tmp
c:\windows\system32\SET299.tmp
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Gorga!\sig279.dat
C:\gxridiq.exe
C:\muwgfsc.exe
c:\windows\incatio.exe
c:\windows\ovewijehulalihoc.dll
c:\windows\Rlunejiqaluhe.dll
c:\windows\system32\nokye.exe
c:\windows\system32\SET275.tmp
c:\windows\system32\SET279.tmp
c:\windows\system32\SET281.tmp
c:\windows\system32\SET299.tmp
c:\windows\system32\win32GI\Isass.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_PFSVGAE
——-\Service_pfsvgae

((((((((((((((((((((((((( Files Created from 2008-11-06 to 2008-12-06 )))))))))))))))))))))))))))))))
.

2008-12-04 21:36 . 2008-12-04 21:36 237,568 –a—— c:\windows\system32\rmc_rtspdl.dll
2008-12-04 21:36 . 2008-12-04 21:36 156,672 –a—— c:\windows\system32\rmc_fixasf.exe
2008-12-04 21:04 . 2008-12-04 21:33 323,584 –a—— c:\windows\system32\AUDIOGENIE2.DLL
2008-12-04 21:00 . 2008-12-04 21:00 d——– c:\windows\Replay Media Catcher
2008-12-04 21:00 . 2008-12-04 21:45 d——– c:\program files\Replay Media Catcher
2008-12-04 20:51 . 2008-12-04 20:51 d——– c:\program files\uTorrent
2008-12-04 20:51 . 2008-12-04 21:18 d——– c:\documents and settings\Gorga!\Application Data\uTorrent
2008-12-02 20:29 . 2008-12-02 20:29 d——– c:\documents and settings\Gorga!\Application Data\DisplayTune
2008-12-02 20:27 . 2008-12-02 20:27 d——– c:\program files\Portrait Displays
2008-12-02 20:27 . 2007-02-09 12:17 62,009 –a—— c:\windows\system32\WPFB.DLL
2008-12-02 20:27 . 2007-02-09 12:17 17,465 –a—— c:\windows\system32\drivers\pivot.sys
2008-12-02 20:27 . 2008-06-04 17:59 17,064 –a—— c:\windows\system32\drivers\PdiPorts.sys
2008-12-02 20:27 . 2007-02-09 12:17 11,323 –a—— c:\windows\system32\drivers\pivotmou.sys
2008-12-02 20:27 . 2004-11-22 12:07 2,304 –a—— c:\windows\system32\Machnm32.sys
2008-12-02 20:26 . 2008-12-02 20:27 d——– c:\program files\Common Files\Portrait Displays
2008-12-02 20:26 . 2008-12-02 20:26 d——– c:\program files\Acer Display
2008-11-20 21:59 . 2008-11-20 21:59 d——– c:\documents and settings\All Users\Application Data\Fallout3
2008-11-20 21:58 . 2008-11-20 21:58 d——– c:\program files\Bethesda Softworks
2008-11-20 21:57 . 2008-11-20 21:57 d——– c:\windows\system32\xlive
2008-11-18 18:08 . 2008-11-19 03:13 d——– c:\documents and settings\Gorga!\.housecall6.6
2008-11-18 01:48 . 2008-11-18 01:48 d——– c:\program files\Common Files\Adobe AIR
2008-11-17 16:12 . 2008-10-10 04:52 4,379,984 –a—— c:\windows\system32\D3DX9_40.dll
2008-11-17 16:12 . 2008-10-10 04:52 2,036,576 –a—— c:\windows\system32\D3DCompiler_40.dll
2008-11-17 16:12 . 2008-10-27 10:04 514,384 –a—— c:\windows\system32\XAudio2_3.dll
2008-11-17 16:12 . 2008-10-10 04:52 452,440 –a—— c:\windows\system32\d3dx10_40.dll
2008-11-17 16:12 . 2008-10-27 10:04 235,856 –a—— c:\windows\system32\xactengine3_3.dll
2008-11-17 16:12 . 2008-10-27 10:04 70,992 –a—— c:\windows\system32\XAPOFX1_2.dll
2008-11-17 16:12 . 2008-10-27 10:04 23,376 –a—— c:\windows\system32\X3DAudio1_5.dll
2008-11-14 01:07 . 2008-11-14 01:07 d——– c:\windows\Logs
2008-11-11 19:40 . 2008-11-11 19:40 d——– c:\documents and settings\Gorga!\Application Data\InstallShield

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-06 22:10 ——— d—–w c:\program files\Mozilla Firefox 3 Beta 5
2008-12-06 22:02 ——— d—–w c:\program files\Viewpoint
2008-12-05 01:27 ——— d—–w c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-12-03 01:27 ——— d–h–w c:\program files\InstallShield Installation Information
2008-12-03 01:17 ——— d—–w c:\program files\Common Files\Wise Installation Wizard
2008-12-03 01:16 ——— d—–w c:\program files\AGEIA Technologies
2008-11-30 23:24 ——— d—–w c:\documents and settings\Gorga!\Application Data\IGN_DLM
2008-11-24 17:52 ——— d—–w c:\program files\Electronic Arts
2008-11-21 21:45 ——— d—–w c:\program files\Spybot - Search & Destroy
2008-11-18 23:24 ——— d—–w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2008-11-12 19:54 6,188,320 —-a-w c:\windows\system32\drivers\nv4_mini.sys
2008-11-12 00:50 ——— d—–w c:\program files\Doom 3
2008-11-11 00:03 138,408 —-a-w c:\windows\system32\drivers\PnkBstrK.sys
2008-11-08 14:26 ——— d—–w c:\program files\Common Files\Adobe
2008-11-07 07:36 ——— d—–w c:\program files\Diablo II
2008-11-05 07:50 ——— d—a-w c:\documents and settings\All Users\Application Data\TEMP
2008-11-05 07:50 ——— d—–w c:\program files\SpywareBlaster
2008-08-16 15:16 22,328 —-a-w c:\documents and settings\Gorga!\Application Data\PnkBstrK.sys
2006-09-11 20:38 1 —-a-w c:\documents and settings\Gorga!\SI.bin
2006-05-06 16:42 7,260,160 —-a-w c:\program files\mozilla firefox\plugins\libvlc.dll
2006-09-02 02:22 56 –sh–r c:\windows\system32\BFD094A143.sys
2007-12-03 11:15 12,570 –sha-w c:\windows\system32\KGyGaAvL.sys
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

—- Directory of c:\documents and settings\Gorga!\Application Data\Microsoft\Windows —-

2008-12-04 00:21 5735 –a—— c:\documents and settings\Gorga!\Application Data\Microsoft\Windows\Themes\Custom.theme
2008-11-18 03:12 435 —hs—- c:\documents and settings\Gorga!\Application Data\Microsoft\Windows\cmp.stm

((((((((((((((((((((((((((((( snapshot@2008-12-05_14.09.37.32 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-10-21 01:02:28 163,328 —-a-w c:\windows\ERDNT\subs\ERDNT.EXE
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AIM"="c:\program files\AIM\aim.exe" [2006-08-01 67112]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
"igndlm.exe"="c:\program files\IGN\Download Manager\dlm.exe" [2008-08-01 1103216]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-08-04 1694208]
"Google Update"="c:\documents and settings\Gorga!\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-09-04 133104]
"SkinClock"="c:\program files\Atomic Alarm Clock\AtomicAlarmClock.exe" [2008-09-11 1739264]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-11-12 13672448]
"nod32kui"="c:\program files\Eset\nod32kui.exe" [2007-03-11 949376]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2007-02-05 849280]
"DeadAIM"="c:\program files\AIM\\DeadAIM.ocm" [2004-02-28 144896]
"OODefragTray"="c:\windows\system32\oodtray.exe" [2007-05-11 2512392]
"ASUS Probe"="c:\program files\ASUS\Asus Probe\AsusProb.exe" [2002-12-06 617984]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-09-06 413696]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-11-12 86016]
"PivotSoftware"="c:\program files\Portrait Displays\Pivot Software\wpctrl.exe" [2007-02-09 694008]
"DT ACR"="c:\program files\Common Files\Portrait Displays\Shared\DT_startup.exe" [2008-06-06 81920]
"CTHelper"="CTHELPER.EXE" [2006-12-12 c:\windows\system32\CtHelper.exe]
"nwiz"="nwiz.exe" [2008-11-12 c:\windows\system32\nwiz.exe]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2006-04-24 282624]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"MSVideo"= ucdvfw.dll
"vidc.xvid"= xvid.dll
"vidc.wmv3"= c:\progra~1\COMBIN~1\Filters\wmv9vcm.dll
"VIDC.ACDV"= ACDV.dll
"VIDC.D263"= xl_x263dec.dll
"VIDC.YV12"= xl_yv12.dll
"VIDC.XJPG"= camfc.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ASUS Probe]
–a—— 2002-12-06 15:07 617984 c:\program files\ASUS\Asus Probe\AsusProb.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Creative Detector]
–a—— 2004-12-02 18:23 102400 c:\program files\Creative\MediaSource\Detector\CTDetect.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
–a—— 2004-08-03 23:56 15360 c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Home Theater SchSvr]
–a—— 2005-09-27 04:00 106496 c:\program files\Common Files\InterVideo\SchSvr\SchSvr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igndlm.exe]
–a—— 2008-08-01 12:36 1103216 c:\program files\IGN\Download Manager\DLM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
–a—— 2005-08-11 15:30 81920 c:\program files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper.exe]
c:\program files\iTunes\iTunesHelper.exe [BU]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
——— 2004-08-04 00:06 1694208 c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
–a—— 2007-10-18 11:34 5724184 c:\program files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
–a—— 2001-07-09 10:50 155648 c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ProgramChecker]
–a—— 2006-02-15 15:17 503808 c:\program files\Zenturi\ProgramChecker\pcheckp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
–a—— 2008-09-06 14:09 413696 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealPlayer]
–a—— 2007-07-02 12:40 208941 c:\program files\Real\RealPlayer\realplay.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
–a—— 2007-09-25 00:11 132496 c:\program files\Java\jre1.6.0_03\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
–a—— 2007-05-14 17:22 35328 c:\program files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WINCINEMAMGR]
–a—— 2005-09-27 02:47 266240 c:\program files\InterVideo\Common\Bin\WinCinemaMgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
–a—— 2006-11-30 21:49 4662776 c:\program files\Yahoo!\Messenger\YahooMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTxfiHlp]
–a—— 2006-12-12 09:46 20480 c:\windows\system32\Ctxfihlp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
–a—— 2008-11-12 14:54 1630208 c:\windows\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WLSetupSvc"=3 (0x3)
"WinDefend"=2 (0x2)
"usnjsvc"=3 (0x3)
"sassvc"=3 (0x3)
"iPod Service"=3 (0x3)
"idsvc"=3 (0x3)
"WMPNetworkSvc"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Program Files\\AIM\\aim.exe"=
"c:\\Program Files\\BitLord\\BitLord.exe"=
"c:\\Program Files\\Valve\\Steam\\steamapps\\[removed]\\team fortress classic\\hl.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Hamachi\\hamachi.exe"=
"c:\\Program Files\\Electronic Arts\\Battlefield 2142\\BF2142.exe"=
"c:\\Program Files\\Sierra\\FEARCombat\\FEARMP.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Orb Networks\\Orb\\bin\\Orb.exe"=
"c:\\Program Files\\Orb Networks\\Orb\\bin\\OrbTray.exe"=
"c:\\Program Files\\Orb Networks\\Orb\\bin\\OrbStreamerClient.exe"=
"c:\\Program Files\\LimeWire\\LimeWire 4.0.7 Pro\\LimeWire.exe"=
"c:\\Program Files\\THQ\\Gas Powered Games\\Supreme Commander\\bin\\SupremeCommander.exe"=
"c:\\Program Files\\THQ\\Gas Powered Games\\GPGNet\\GPG.Multiplayer.Client.exe"=
"c:\\Program Files\\THQ\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\XR_3DA.exe"=
"c:\\Program Files\\THQ\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\dedicated\\XR_3DA.exe"=
"%SystemDir%\\winsecurityxp\\mswinup.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Unreal Tournament 3\\Binaries\\UT3.exe"=
"c:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
"c:\\Program Files\\Ubisoft\\Tom Clancy's Rainbow Six Vegas 2\\Binaries\\R6Vegas2_Game.exe"=
"c:\\Program Files\\Ubisoft\\Tom Clancy's Rainbow Six Vegas 2\\Binaries\\R6Vegas2_Launcher.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"c:\\Program Files\\Capcom\\Bionic Commando Rearmed\\bcr.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R1 nod32drv;nod32drv;c:\windows\system32\drivers\nod32drv.sys [2007-03-11 15424]
R2 CAMTHWDM;WebcamMax, WDM Video Capture;c:\windows\system32\DRIVERS\CAMTHWDM.sys [2007-01-11 941784]
R2 PdiService;Portrait Displays SDK Service;c:\program files\Common Files\Portrait Displays\Drivers\pdisrvc.exe [2008-12-02 90112]
S3 CachemanXPService;CachemanXP;c:\progra~1\CACHEM~1\CachemanXP.exe [2006-09-03 201728]
S3 cpuz126;cpuz126;\??\c:\program files\PC Wizard 2007\pcwiz32.sys []
S3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.12.1;c:\windows\system32\drivers\libusb0.sys [2008-01-22 28672]
S3 XIRLINK;Veo PC Camera;c:\windows\system32\DRIVERS\ucdnt.sys [2004-01-26 899980]
S4 sassvc;ProgramCheckerPro;c:\program files\Zenturi\ProgramChecker\sassvc.exe [2006-02-15 122880]
S4 WinDefend;Windows Defender;"c:\program files\Windows Defender\MsMpEng.exe" [2006-11-03 13592]
.
Contents of the 'Scheduled Tasks' folder

2008-12-06 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2008-12-06 c:\windows\Tasks\GoogleUpdateTaskUser.job
- c:\documents and settings\Gorga!\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-04 01:19]

2007-11-15 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 18:20]
.
- - - - ORPHANS REMOVED - - - -

MSConfigStartUp-ViewMgr - c:\program files\Viewpoint\Viewpoint Manager\ViewMgr.exe

.
——- Supplementary Scan ——-
.
uStart Page = about:blank
uInternet Connection Wizard,ShellNext = iexplore
IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
IE: E&xport to Microsoft Excel - c:\progra~1\Microsoft Office\Office12\EXCEL.EXE/3000
LSP: c:\windows\system32\imon.dll
Trusted Zone: *.amaena.com
Trusted Zone: *.avsystemcare.com
Trusted Zone: *.onerateld.com
Trusted Zone: *.safetydownload.com
Trusted Zone: *.trustedantivirus.com
Trusted Zone: *.virusremover2008.com
Trusted Zone: *.virusschlacht.com
Trusted Zone: *.amaena.com
Trusted Zone: *.avsystemcare.com
Trusted Zone: *.onerateld.com
Trusted Zone: *.safetydownload.com
Trusted Zone: *.trustedantivirus.com
Trusted Zone: *.virusremover2008.com
Trusted Zone: *.virusschlacht.com

c:\windows\Downloaded Program Files\QOLCheck.ocx - O16 -: {483EB14D-AF1C-4951-81B0-4E2B41829FF6}
hxxps://www.select2perform.com/cabs/QOLCheck.ocx
FireFox -: Profile - c:\documents and settings\Gorga!\Application Data\Mozilla\Firefox\Profiles\n7230eyv.default\
FF -: plugin - c:\documents and settings\Gorga!\Local Settings\Application Data\Google\Update\1.2.131.27\npGoogleOneClick6.dll
FF -: plugin - c:\progra~1\Yahoo!\Common\npyaxmpb.dll
FF -: plugin - c:\program files\GameTap\bin\Release\npgametaptool.dll
FF -: plugin - c:\program files\IGN\Download Manager\npfpdlm.dll
FF -: plugin - c:\program files\Mozilla Firefox 3 Beta 5\plugins\npnul32.dll
FF -: plugin - c:\program files\Mozilla Firefox 3 Beta 5\plugins\NPOFF12.DLL
FF -: plugin - c:\program files\Mozilla Firefox 3 Beta 5\plugins\nppdf32.dll
FF -: plugin - c:\program files\Mozilla Firefox 3 Beta 5\plugins\npqtplugin.dll
FF -: plugin - c:\program files\Mozilla Firefox 3 Beta 5\plugins\npqtplugin2.dll
FF -: plugin - c:\program files\Mozilla Firefox 3 Beta 5\plugins\npqtplugin3.dll
FF -: plugin - c:\program files\Mozilla Firefox 3 Beta 5\plugins\npqtplugin4.dll
FF -: plugin - c:\program files\Mozilla Firefox 3 Beta 5\plugins\npqtplugin5.dll
FF -: plugin - c:\program files\Mozilla Firefox 3 Beta 5\plugins\npqtplugin6.dll
FF -: plugin - c:\program files\Mozilla Firefox 3 Beta 5\plugins\npqtplugin7.dll
FF -: plugin - c:\program files\Opera 9.5 alpha\program\plugins\npdivx32.dll
FF -: plugin - c:\program files\Opera 9.5 alpha\program\plugins\npdsplay.dll
FF -: plugin - c:\program files\Opera 9.5 alpha\program\plugins\NPOFF12.DLL
FF -: plugin - c:\program files\Opera 9.5 alpha\program\plugins\npqtplugin.dll
FF -: plugin - c:\program files\Opera 9.5 alpha\program\plugins\npqtplugin2.dll
FF -: plugin - c:\program files\Opera 9.5 alpha\program\plugins\npqtplugin3.dll
FF -: plugin - c:\program files\Opera 9.5 alpha\program\plugins\npqtplugin4.dll
FF -: plugin - c:\program files\Opera 9.5 alpha\program\plugins\npqtplugin5.dll
FF -: plugin - c:\program files\Opera 9.5 alpha\program\plugins\npqtplugin6.dll
FF -: plugin - c:\program files\Opera 9.5 alpha\program\plugins\npqtplugin7.dll
FF -: plugin - c:\program files\Opera 9.5 alpha\program\plugins\NPSWF32.dll
FF -: plugin - c:\program files\Opera 9.5 alpha\program\plugins\NPTURNMED.dll
FF -: plugin - c:\program files\Opera 9.5 alpha\program\plugins\npwmsdrm.dll
FF -: plugin - c:\program files\Real\RhapsodyPlayerEngine\nprhapengine.dll
FF -: plugin - c:\program files\Yahoo!\Shared\npYState.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-06 17:22:01
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
c:\windows\system32\CTSVCCDA.EXE
c:\program files\Common Files\Portrait Displays\Shared\DTSRVC.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
c:\program files\ESET\nod32krn.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\oodag.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\MsPMSPSv.exe
c:\windows\system32\rundll32.exe
c:\program files\Acer Display\eDisplay Management\dthtml.exe
c:\program files\Portrait Displays\Pivot Software\Floater.exe
c:\program files\Common Files\Portrait Displays\Shared\HookManager.exe
.
**************************************************************************
.
Completion time: 2008-12-06 17:29:54 - machine was rebooted [Gorga!]
ComboFix-quarantined-files.txt 2008-12-06 22:29:51
ComboFix2.txt 2008-12-05 19:10:02

Pre-Run: 11,139,858,432 bytes free
Post-Run: 11,005,624,320 bytes free

336

jpshortstuff

Post #8December 10, 2008, 11:21 AM UTC

Right Click the ESET icon running in Taskbar near the system clock.
From the context menu that will appear, choose "Open Window".
The program's interface will appear. Choose Tools >> Quarantine.
Right click on the Quarantined item(s) and choose Remove from the drop down Menu that will appear.

Open HijackThis. Hit Do A System Scan Only. Place a check next to the following items (if present):
O15 - Trusted Zone: *.amaena.com
O15 - Trusted Zone: *.avsystemcare.com
O15 - Trusted Zone: *.onerateld.com
O15 - Trusted Zone: *.safetydownload.com
O15 - Trusted Zone: *.trustedantivirus.com
O15 - Trusted Zone: *.virusremover2008.com
O15 - Trusted Zone: *.virusschlacht.com
O15 - Trusted Zone: *.amaena.com (HKLM)
O15 - Trusted Zone: *.avsystemcare.com (HKLM)
O15 - Trusted Zone: *.onerateld.com (HKLM)
O15 - Trusted Zone: *.safetydownload.com (HKLM)
O15 - Trusted Zone: *.trustedantivirus.com (HKLM)
O15 - Trusted Zone: *.virusremover2008.com (HKLM)
O15 - Trusted Zone: *.virusschlacht.com (HKLM)

Close all browsers and windows except for HijackThis and click Fix Checked.

Delete this file:
C:\Documents and Settings\Gorga!\Desktop\New Folder\mongler.zip

Please post a new HijackThis log as well.

Thanks.

Gorga53

Post #9December 11, 2008, 5:36 AM UTC

Everything completed as per your specifications. Here's a fresh HJT log.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:34:48 AM, on 12/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\oodag.exe
C:\Program Files\Common Files\Portrait Displays\Drivers\pdisrvc.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\AIM\aim.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Gorga!\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\Acer Display\eDisplay Management\DTHtml.exe
C:\Program Files\Common Files\Portrait Displays\Shared\HookManager.exe
C:\Program Files\Portrait Displays\Pivot Software\floater.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\Program Files\ESET\nod32kui.exe
C:\Documents and Settings\Gorga!\Desktop\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [DeadAIM] rundll32.exe "C:\Program Files\AIM\\DeadAIM.ocm",ExportedCheckODLs
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [OODefragTray] C:\WINDOWS\system32\oodtray.exe
O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Asus Probe\AsusProb.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [PivotSoftware] "C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe"
O4 - HKLM\..\Run: [DT ACR] C:\Program Files\Common Files\Portrait Displays\Shared\DT_startup.exe -ACR
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [igndlm.exe] C:\Program Files\IGN\Download Manager\dlm.exe /windowsstart /startifwork
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Gorga!\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [SkinClock] C:\Program Files\Atomic Alarm Clock\AtomicAlarmClock.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\Microsoft Office\Office12\EXCEL.EXE/3000
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\Microsoft Office\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\Microsoft Office\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\Microsoft Office\Office12\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15030/CTSUEng.cab
O16 - DPF: {483EB14D-AF1C-4951-81B0-4E2B41829FF6} (QOLCheck Control) - https://www.select2perform.com/cabs/QOLCheck.ocx
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1188267067278
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1188267051153
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {DA758BB1-5F89-4465-975F-8D7179A4BCF3} (WheelofFortune Object) - http://messenger.zone.msn.com/binary/WoF.cab57176.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15033/CTPID.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: CachemanXP (CachemanXPService) - OuterTechnologies - C:\PROGRA~1\CACHEM~1\CachemanXP.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Portrait Displays Display Tune Service (DTSRVC) - Unknown owner - C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: Portrait Displays SDK Service (PdiService) - Portrait Displays, Inc. - C:\Program Files\Common Files\Portrait Displays\Drivers\pdisrvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe

–
End of file - 9745 bytes

jpshortstuff

Post #10December 11, 2008, 9:44 AM UTC

Hi. I am looking into this issue with the images. Can you tell me at what point you first noticed this problem? Are you having any other problems apart from this? Thanks.

Gorga53

Post #11December 11, 2008, 10:51 PM UTC

No apparent problems that I can think of. I'm almost positive it appeared after the first time I ran combo fix.

jpshortstuff

Post #12December 12, 2008, 7:18 AM UTC

Hi,

I've had this suggestion from a colleague.

Open Internet Ecplorer, click Tools >> Internet Options >> Advanced. Go to the "Multimedia" category, remove tick in front of "Show image download placeholders", and add a tick in "Show pictures" and "Smart image dithering".

Let me know if that helps, still searching for other solutions. Apologies about this, but never seen if before.

Thanks.

Gorga53

Post #13December 12, 2008, 2:53 PM UTC

Actually, the "Show image download placeholders" check box wasn't checked to begin with. Neither was "Show Pictures'. Only "Smart image dithering" was checked. The most obvious step from here was to click show pictures. That fixed it! I'm still having the Windows Data Execution Prevention popping up at random. I've ctrl+alt+deleted a few running processes before and it seems to happen then, but it's happened on boot before once. Not sure what to do about that one, not even sure if I should be concerned as it seems to be so random.

jpshortstuff

Post #14December 12, 2008, 3:16 PM UTC

Hi Gorga53

Glad that worked for you.

Log looks good

Click Start >> Run, and then type ComboFix /u and hit enter.
You can now delete any other tools I had you download and use, unless you wish to keep them.

If you want to get a Techie to take a look at that data execution problem, then feel free to post in out Microsoft Windows forum. I don't think its Malware related.

Now that your system appears to be clean, theres just a few steps I'd like you to take to prevent any future infections.

Keeping your Windows up-to-date is crucial to your computer's security. Please go to the Windows Update Site (using Internet Explorer) and download and install all critical updates on a regular basis.
You don't appear to be running any third party Firewall software.

Install a firewall! Without a firewall you are very susceptible to being hacked, and people could gain access to your computer. If you don't have a firewall I strongly recommend you download ONE of the following:
1) Comodo
2) Agnitum
3) Sunbelt/Kerio
Make sure you update your Anti-Virus software regularly, new viruses are being developed all the time.
Some more programs that it would be useful to have [OPTIONAL but RECOMMENDED]:

Download Spybot Search and Destroy 1.5 from here
Check for Updates/ Immunize and run a Full System Scan on a regular basis.

SpywareBlaster is another real-time scanner that prevents most spyware from even being installed.
Freely available: Download SpywareBlaster

Download and install the free version of WinPatrol. This program protects your computer in a variety of ways and will work well with your existing security software. Have a look at this tutorial to help you get started with the program.

Also, please read this great article by Tony Klein: So How Did I Get Infected In First Place

Glad we could be of assistance.

Please reply to this thread once more if you are satisfied so that we can mark the problem as resolved.

Stay Clean!

jpshortstuff

Gorga53

Post #15December 14, 2008, 5:36 AM UTC

I actually had most of those steps done! spybot/spyware blaster/anti-virus completely updated. Anyway, Thanks for all the help jp! Did a great job!

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] Flipping out computer.

✨ Ask AI

Ask AI