What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Baseline

8 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
Amongst other symptoms, the infection is disabling window's firewall and AVG. As such, I'm keeping that laptop offline. ATF Cleaner was run with Main: Select All Malwarebyte's Anti-Malware will not install. Upon double-clicking it, mbam-setup.exe will display in Taskmanager's process list. However, the install dialog will never display. Attempted to install in normal and safemode. The HijackThis log is attached edit: some additional symptoms: regedit is "disabled by admin" , even to Administrator account menu options in Explorer are limited, cannot access Tools > Folder Options random IE browser pop-ups.

Attachments:

Post #2
[external image: Posted Image]

Sorry about the delay in responding :(

If you still need help, Scan again with HijackThis, and "copy/paste" a new log file into this thread, do not attach it.

Also please describe how your computer behaves at the moment.
Post #3 last edited
Windows XP will usually freeze:
Sometimes before fully loading the Welcome-login screen,
sometime shortly after entering the username's password,
or sometime after the desktop begins to load.

On the odd chance, that booting is successful:
Window's Firewall + AVG (free) will be automatically disabled – no matter what the previous setting was.
Registry editing is restricted, even to Administrator accounts.
In Explorer, Tools–>Folder Options is not visible.
Random browser pop-ups.
Last I checked, browsing to www.avg.com was somehow restricted.
Forcing AVG to update it's definition files, also fails.

I'd prefer to keep that laptop disconnected from the network at this point.
Aside from booting the laptop to regenerate the HijackThis log, it's been powered down.

edit: this is not my machine. it's possible that i'm missing other symptoms, due to the limited usage i've had on it. :tide
edit2: and thanks for the help :) :2tide
———————
HiJackThis Log
———————
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:06:06 AM, on 12/18/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
D:\Program Files\Java\jre6\bin\jqs.exe
D:\WINDOWS\system32\svchost.exe
D:\PROGRA~1\AVG\AVG8\avgrsx.exe
D:\PROGRA~1\AVG\AVG8\avgemc.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\system32\wscntfy.exe
D:\Documents and Settings\Owner\lsass.exe
D:\PROGRA~1\AVG\AVG8\avgtray.exe
D:\Program Files\Lexmark 7100 Series\lxbxmon.exe
D:\Program Files\Lexmark 7100 Series\ezprint.exe
D:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
D:\Program Files\Java\jre6\bin\jusched.exe
D:\WINDOWS\System32\rs32net.exe
D:\DOCUME~1\Owner\LOCALS~1\Temp\winlogin.exe
D:\WINDOWS\system32\rundll32.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Program Files\Messenger\msmsgs.exe
D:\WINDOWS\System32\rs32net.exe
D:\DOCUME~1\Owner\LOCALS~1\Temp\csrssc.exe
D:\WINDOWS\system32\lxbxcoms.exe
D:\HJT\HiJackThis(2).exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: (no name) - {2f59967a-615c-4777-9703-c738b41ca7a3} - D:\WINDOWS\system32\fcccdaxu.dll
O2 - BHO: (no name) - {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - D:\WINDOWS\system32\fcccCrrq.dll
O2 - BHO: D:\WINDOWS\system32\jkse73hedfdgf.dll - {c5bf49a2-94f3-42bd-f434-3604812c897d} - D:\WINDOWS\system32\jkse73hedfdgf.dll
O4 - HKLM\..\Run: [LSA Shellu] D:\Documents and Settings\Owner\lsass.exe
O4 - HKLM\..\Run: [AVG8_TRAY] D:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [LXBXCATS] rundll32 D:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBXtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [lxbxmon.exe] "D:\Program Files\Lexmark 7100 Series\lxbxmon.exe"
O4 - HKLM\..\Run: [FaxCenterServer4_in_1] "D:\Program Files\Lexmark 7100 Series\fm3032.exe" /s
O4 - HKLM\..\Run: [EzPrint] "D:\Program Files\Lexmark 7100 Series\ezprint.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [rs32net] D:\WINDOWS\System32\rs32net.exe
O4 - HKLM\..\Run: [xsjfn83jkemfofght] D:\DOCUME~1\Owner\LOCALS~1\Temp\winlogin.exe
O4 - HKLM\..\Run: [887407b3] rundll32.exe "D:\WINDOWS\system32\arilnsga.dll",b
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [69496049621476209285245795890075] D:\Program Files\Antivirus 2009\av2009.exe
O4 - HKCU\..\Run: [Windows Service] D:\Documents and Settings\Owner\service.exe
O4 - HKCU\..\Run: [rs32net] D:\WINDOWS\System32\rs32net.exe
O4 - HKCU\..\Run: [xsjfn83jkemfofght] D:\DOCUME~1\Owner\LOCALS~1\Temp\winlogin.exe
O4 - HKCU\..\Run: [Jnskdfmf9eldfd] D:\DOCUME~1\Owner\LOCALS~1\Temp\csrssc.exe
O4 - HKUS\.DEFAULT\..\Run: [Jnskdfmf9eldfd] D:\WINDOWS\TEMP\csrssc.exe (User 'Default user')
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth Device… - D:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - D:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - D:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - D:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll ncbbpj.dll gmfghy.dll
O20 - Winlogon Notify: awtutqPH - awtutqPH.dll (file missing)
O20 - Winlogon Notify: fcccCrrq - D:\WINDOWS\SYSTEM32\fcccCrrq.dll
O20 - Winlogon Notify: iifcDTjH - iifcDTjH.dll (file missing)
O20 - Winlogon Notify: iifdcDus - iifdcDus.dll (file missing)
O20 - Winlogon Notify: jkkLDWom - jkkLDWom.dll (file missing)
O20 - Winlogon Notify: yayvWqnl - yayvWqnl.dll (file missing)
O22 - SharedTaskScheduler: mcb7uehuj3n8weuhejsw - {C5BF49A2-94F3-42BD-F434-3604812C897D} - D:\WINDOWS\system32\jkse73hedfdgf.dll
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - D:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - D:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Command Service (cmdservice) - Unknown owner - D:\WINDOWS\T3duZXI\command.exe (file missing)
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - D:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: lxbx_device - Lexmark International, Inc. - D:\WINDOWS\system32\lxbxcoms.exe
O23 - Service: Network Monitor (network monitor) - Unknown owner - D:\Program Files\Network Monitor\netmon.exe (file missing)

–
End of file - 6116 bytes
Post #4
DO NOT use any TOOLS such as Combofix, Vundofix, or HijackThis fixes without supervision.

Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.

Note: You could download these to a flash drive / thumb drive and install them on the infected pc.
Don't worry about the MBAM update if you go that route.

Stay with this topic until I give you the all clean post.

You might want to print these instructions out.

I suggest you do this:

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Clear "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Clear "Hide protected operating system files."
Click Apply, and then click OK.


Please do not delete anything unless instructed to.


Next:

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time or two.


Next:

Please download Malwarebytes' Anti-Malware to your desktop.

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected.
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results in the Malware Forum.


Also "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.
Post #5
Windows XP will usually freeze:
Sometimes before fully loading the Welcome-login screen,
sometime shortly after entering the username's password,
or sometime after the desktop begins to load.

On the odd chance, that booting is successful:
The error dialog is displayed:
——–
Error loading D:\Windows\system32\arilnsga.dll
access is denied
[OK]
——–

The systray icon for AVG displays properly – fully colored, indicating an up-to-date virus definitions.
As the windows continues to load the desktop, AVG will become disabled and Windows Security alert icon will activate as an X-red-shield in the systray.
At this point, AVG and Windows built-in firewall are disabled.
Registry editing is restricted, even to Administrator accounts.
Random browser pop-ups, will attempt to open. however, clicking [Work Offline], keeps the from displaying.

Last I checked, browsing to www.avg.com was somehow restricted.
Forcing AVG to update it's definition files, also fails.



As stated above, Tools–>Folder Options does not display at all.

ATF Cleaner freeded 1,496,000 KBs

Upon running mbam-setup.exe, it'll display itself it in TaskManager's Processes list with 0%. System Idle Process is at constant 99%.

Heres' the HiJackThis log :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:15:17 PM, on 12/18/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
D:\Program Files\Java\jre6\bin\jqs.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\Explorer.EXE
D:\PROGRA~1\AVG\AVG8\avgrsx.exe
D:\PROGRA~1\AVG\AVG8\avgtray.exe
D:\Program Files\Lexmark 7100 Series\lxbxmon.exe
D:\Program Files\Lexmark 7100 Series\ezprint.exe
D:\Program Files\Java\jre6\bin\jusched.exe
D:\WINDOWS\System32\rs32net.exe
D:\WINDOWS\System32\rs32net.exe
D:\WINDOWS\system32\ctfmon.exe
D:\PROGRA~1\AVG\AVG8\avgemc.exe
D:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\csrssc.exe
D:\WINDOWS\system32\wscntfy.exe
D:\WINDOWS\system32\lxbxcoms.exe
D:\WINDOWS\system32\taskmgr.exe
D:\HJT\HiJackThis(2).exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://bontrafic.org/s/in.cgi?3&key=door
O2 - BHO: (no name) - {6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} - D:\WINDOWS\system32\fcccCrrq.dll
O2 - BHO: (no name) - {7c94bf77-05ed-4d76-93fe-e537c78eceb8} - D:\WINDOWS\system32\fcccdaxu.dll
O2 - BHO: D:\WINDOWS\system32\jkse73hedfdgf.dll - {c5bf49a2-94f3-42bd-f434-3604812c897d} - D:\WINDOWS\system32\jkse73hedfdgf.dll
O4 - HKLM\..\Run: [LSA Shellu] D:\Documents and Settings\Owner\lsass.exe
O4 - HKLM\..\Run: [AVG8_TRAY] D:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [LXBXCATS] rundll32 D:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBXtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [lxbxmon.exe] "D:\Program Files\Lexmark 7100 Series\lxbxmon.exe"
O4 - HKLM\..\Run: [FaxCenterServer4_in_1] "D:\Program Files\Lexmark 7100 Series\fm3032.exe" /s
O4 - HKLM\..\Run: [EzPrint] "D:\Program Files\Lexmark 7100 Series\ezprint.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [rs32net] D:\WINDOWS\System32\rs32net.exe
O4 - HKLM\..\Run: [xsjfn83jkemfofght] D:\DOCUME~1\Owner\LOCALS~1\Temp\winlogin.exe
O4 - HKLM\..\Run: [887407b3] rundll32.exe "D:\WINDOWS\system32\arilnsga.dll",b
O4 - HKCU\..\Run: [rs32net] D:\WINDOWS\System32\rs32net.exe
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Jnskdfmf9eldfd] D:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\csrssc.exe
O4 - HKUS\.DEFAULT\..\Run: [Jnskdfmf9eldfd] D:\WINDOWS\TEMP\csrssc.exe (User 'Default user')
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - D:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - D:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - D:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll ncbbpj.dll gmfghy.dll
O20 - Winlogon Notify: awtutqPH - awtutqPH.dll (file missing)
O20 - Winlogon Notify: fcccCrrq - D:\WINDOWS\SYSTEM32\fcccCrrq.dll
O20 - Winlogon Notify: iifcDTjH - iifcDTjH.dll (file missing)
O20 - Winlogon Notify: iifdcDus - iifdcDus.dll (file missing)
O20 - Winlogon Notify: jkkLDWom - jkkLDWom.dll (file missing)
O20 - Winlogon Notify: yayvWqnl - yayvWqnl.dll (file missing)
O22 - SharedTaskScheduler: mcb7uehuj3n8weuhejsw - {C5BF49A2-94F3-42BD-F434-3604812C897D} - D:\WINDOWS\system32\jkse73hedfdgf.dll
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - D:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - D:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Command Service (cmdservice) - Unknown owner - D:\WINDOWS\T3duZXI\command.exe (file missing)
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - D:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: lxbx_device - Lexmark International, Inc. - D:\WINDOWS\system32\lxbxcoms.exe
O23 - Service: Network Monitor (network monitor) - Unknown owner - D:\Program Files\Network Monitor\netmon.exe (file missing)

–
End of file - 5691 bytes



Thanks again!
Post #7 last edited
re-named mbam-setup.exe to mbam-setup.com
installed.

Re-ran your originally suggested steps:

Ran ATF Cleaner
– Main:Select All
– Freed 1,128,000 KBs
[small edit here]

Running mbam.exe via the Malwarebyte's Anti-Malware icon does not fully load.
It has the same symptoms as mbam-setup.exe did.
–listing in TaskManager as mbam.exe with 0% CPU usage.
–renaming mbam.exe does not help. Have tried mbam.com, mbam2.exe, and foobar.exe

Rebooted into SafeMode.
Mbam-successfully ran as "mbam.exe"
[did your steps]
log saved as "*–SafeModePass1"
Mbam requested to reboot to finish removing Registry threats.

Upon reboot, error dialog to the effect of "Cannot find [path-to]\mbam.exe"

I manually re-ran mbam.exe,
re-did steps,
log saved as "*–NormalModePass2"
rebooted upon program request,
and created a new HJT log:


————————————–
Mbam – SafeModePass1
————————————–
Malwarebytes' Anti-Malware 1.31
Database version: 1456
Windows 5.1.2600 Service Pack 2

12/19/2008 9:24:19 AM
mbam-log-2008-12-19 (09-24-19).txt

Scan type: Quick Scan
Objects scanned: 48550
Time elapsed: 7 minute(s), 10 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 4
Registry Keys Infected: 33
Registry Values Infected: 14
Registry Data Items Infected: 5
Folders Infected: 5
Files Infected: 43

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
D:\WINDOWS\system32\fcccCrrq.dll (Trojan.Vundo.H) -> Delete on reboot.
D:\WINDOWS\system32\fcccdaxu.dll (Trojan.Vundo.H) -> Delete on reboot.
D:\WINDOWS\system32\ncbbpj.dll (Trojan.Vundo) -> Delete on reboot.
D:\WINDOWS\system32\jkse73hedfdgf.dll (Trojan.BHO) -> Delete on reboot.

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\{5222008a-dd62-49c7-a735-7bd18ecc7350} (Rogue.VirusRemover) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{46d7049a-9db9-4aec-82b1-f101b9367cb1} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDSERVICE (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{0574d50f-c261-490d-bf39-4e91183c4efb} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c5bf49a2-94f3-42bd-f434-3604812c897d} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\fccccrrq (Trojan.Vundo.H) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\{5222008a-dd62-49c7-a735-7bd18ecc7350} (Rogue.VirusRemover) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{e27bbb9b-5db4-44da-8d1a-66b394669a90} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\virusremover2008 (Rogue.VirusRemove) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\virusremover2008 (Rogue.VirusRemove) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{94235fd8-84c8-403b-b08f-3ac0f68f2c54} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3877c2cd-f137-4144-bdb2-0a811492f920} (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e27bbb9b-5db4-44da-8d1a-66b394669a90} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\tdss (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\restore (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{a394e835-c8d6-4b4b-884b-d2709059f3be} (Trojan.Network.Monitor) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{94235fd8-84c8-403b-b08f-3ac0f68f2c54} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETWORK_MONITOR (Trojan.DNSChanger) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c5bf49a2-94f3-42bd-f434-3604812c897d} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Network Monitor (Trojan.Service) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\instkey (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cmdService (Adware.CommAd) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c5bf49a2-94f3-42bd-f434-3604812c897d} (Trojan.Zlob.H) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{0574d50f-c261-490d-bf39-4e91183c4efb} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Service (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\887407b3 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{46d7049a-9db9-4aec-82b1-f101b9367cb1} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rs32net (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Jnskdfmf9eldfd (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rs32net (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsjfn83jkemfofght (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\LSA Shellu (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{c5bf49a2-94f3-42bd-f434-3604812c897d} (Trojan.Zlob.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsjfn83jkemfofght (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jnskdfmf9eldfd (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\69496049621476209285245795890075 (Rogue.Antivirus) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo.H) -> Delete on reboot.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo.H) -> Data: d:\windows\system32\fcccdaxu -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions (Hijack.FolderOptions) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: d:\windows\system32\ -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: d:\windows\system32\fcccdaxu -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: system32\ -> Quarantined and deleted successfully.

Folders Infected:
D:\WINDOWS\T3duZXI (Malware.Trace) -> Quarantined and deleted successfully.
D:\Documents and Settings\Owner\Application Data\gadcom (Trojan.Agent) -> Quarantined and deleted successfully.
D:\Documents and Settings\LocalService\Application Data\NetMon (Trojan.NetMon) -> Quarantined and deleted successfully.
D:\Program Files\Network Monitor (Trojan.DNSChanger) -> Quarantined and deleted successfully.
D:\Documents and Settings\Owner\Start Menu\Antivirus 2009 (Rogue.Antivirus2008) -> Quarantined and deleted successfully.

Files Infected:
D:\WINDOWS\system32\fcccCrrq.dll (Trojan.Vundo.H) -> Delete on reboot.
D:\WINDOWS\system32\ddcBSMcD.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\jkklLCvv.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\kmyfokff.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\fcccdaxu.dll (Trojan.Vundo.H) -> Delete on reboot.
D:\WINDOWS\system32\uxadcccf.ini (Trojan.Vundo.H) -> Delete on reboot.
D:\WINDOWS\system32\uxadcccf.ini2 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\sjdahcml.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\vmqdpz.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\arilnsga.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\agsnlira.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\xjpjfp.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\ncbbpj.dll (Trojan.Vundo) -> Delete on reboot.
D:\WINDOWS\system32\rcwuxvgh.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\hgvxuwcr.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\smndrybm.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\mbyrdnms.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
D:\Documents and Settings\Owner\Local Settings\Temp\csrssc.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\jkse73hedfdgf.dll (Trojan.Zlob.H) -> Delete on reboot.
D:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus 2009.lnk (Rogue.Antivirus2008) -> Quarantined and deleted successfully.
D:\Documents and Settings\Owner\Start Menu\Antivirus 2009\Antivirus 2009.lnk (Rogue.Antivirus2008) -> Quarantined and deleted successfully.
D:\Documents and Settings\Owner\Start Menu\Antivirus 2009\Uninstall Antivirus 2009.lnk (Rogue.Antivirus2008) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\mcrh.tmp (Malware.Trace) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\drivers\core.cache.dsk (Rootkit.Agent) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\pac.txt (Malware.Trace) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\ (Trojan.Agent) -> Quarantined and deleted successfully.
D:\Documents and Settings\LocalService\Application Data\NetMon\log.txt (Trojan.NetMon) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\rs32net.exe (Trojan.Agent) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\pmnkKdbc.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
D:\Documents and Settings\Owner\Local Settings\Temp\winlogin.exe (Trojan.Agent) -> Quarantined and deleted successfully.
D:\WINDOWS\Temp\csrssc.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\knkkeu.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\wdgvylvj.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
D:\Documents and Settings\Owner\lsass.exe (Trojan.Agent) -> Quarantined and deleted successfully.
D:\Documents and Settings\LocalService\Application Data\NetMon\domains.txt (Trojan.NetMon) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\atmtd.dll._ (Trojan.Agent) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\cvagvnup.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
D:\Documents and Settings\Owner\Application Data\gadcom\gadcom.exe (Trojan.Agent) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\pmnnKcbY.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\atmtd.dll (Trojan.Agent) -> Quarantined and deleted successfully.
D:\WINDOWS\uninstall_nmon.vbs (Malware.Trace) -> Quarantined and deleted successfully.
D:\WINDOWS\T3duZXI\naxRtrK.vbs (Malware.Trace) -> Quarantined and deleted successfully.
D:\Documents and Settings\Administrator\Local Settings\Temp\csrssc.exe (Trojan.Downloader) -> Quarantined and deleted successfully.






————————————–
Mbam – NormalModePass2
————————————–
Malwarebytes' Anti-Malware 1.31
Database version: 1456
Windows 5.1.2600 Service Pack 2

12/19/2008 9:35:13 AM
mbam-log-2008-12-19 (09-35-13).txt

Scan type: Quick Scan
Objects scanned: 49279
Time elapsed: 3 minute(s), 17 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 15
Registry Values Infected: 2
Registry Data Items Infected: 2
Folders Infected: 0
Files Infected: 11

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\fccccrrq (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e27bbb9b-5db4-44da-8d1a-66b394669a90} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{e27bbb9b-5db4-44da-8d1a-66b394669a90} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c5bf49a2-94f3-42bd-f434-3604812c897d} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c5bf49a2-94f3-42bd-f434-3604812c897d} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ati8onxx (Rootkit.Agent) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\ati8onxx (Rootkit.Agent) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\ati8onxx (Rootkit.Agent) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\ati8onxx (Rootkit.Agent) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ati8onxx (Rootkit.Agent) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\tdss (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{c5bf49a2-94f3-42bd-f434-3604812c897d} (Trojan.BHO) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: d:\windows\system32\ -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: system32\ -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
D:\WINDOWS\system32\fcccCrrq.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\TDSShrxr.dll (Trojan.TDSS) -> Delete on reboot.
D:\WINDOWS\system32\TDSSofxh.dll (Trojan.TDSS) -> Delete on reboot.
D:\WINDOWS\system32\TDSSrtqp.dll (Trojan.TDSS) -> Delete on reboot.
D:\WINDOWS\system32\TDSSxfum.dll (Trojan.TDSS) -> Delete on reboot.
D:\WINDOWS\system32\drivers\TDSSpaxt.sys (Trojan.TDSS) -> Delete on reboot.
D:\WINDOWS\system32\drivers\ati8onxx.sys (Rootkit.Agent) -> Delete on reboot.
D:\Documents and Settings\Owner\Local Settings\Temp\TDSS3cfa.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\ (Trojan.Agent) -> Delete on reboot.
D:\WINDOWS\system32\TDSSkkbi.log (Trojan.TDSS) -> Delete on reboot.
D:\WINDOWS\system32\TDSSlxwp.dll (Rootkit.Agent) -> Delete on reboot.







————————————–
HJT
————————————–
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:42:25 AM, on 12/19/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
D:\Program Files\Java\jre6\bin\jqs.exe
D:\WINDOWS\system32\svchost.exe
D:\PROGRA~1\AVG\AVG8\avgrsx.exe
D:\PROGRA~1\AVG\AVG8\avgemc.exe
D:\WINDOWS\system32\wscntfy.exe
D:\WINDOWS\Explorer.EXE
D:\PROGRA~1\AVG\AVG8\avgtray.exe
D:\Program Files\Lexmark 7100 Series\lxbxmon.exe
D:\Program Files\Lexmark 7100 Series\ezprint.exe
D:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
D:\Program Files\Java\jre6\bin\jusched.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Program Files\Messenger\msmsgs.exe
D:\WINDOWS\system32\lxbxcoms.exe
D:\HJT\HiJackThis(2).exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O4 - HKLM\..\Run: [AVG8_TRAY] D:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [LXBXCATS] rundll32 D:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBXtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [lxbxmon.exe] "D:\Program Files\Lexmark 7100 Series\lxbxmon.exe"
O4 - HKLM\..\Run: [FaxCenterServer4_in_1] "D:\Program Files\Lexmark 7100 Series\fm3032.exe" /s
O4 - HKLM\..\Run: [EzPrint] "D:\Program Files\Lexmark 7100 Series\ezprint.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\msmsgs.exe" /background
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth Device… - D:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - D:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - D:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - D:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll ncbbpj.dll gmfghy.dll
O20 - Winlogon Notify: awtutqPH - awtutqPH.dll (file missing)
O20 - Winlogon Notify: iifcDTjH - iifcDTjH.dll (file missing)
O20 - Winlogon Notify: iifdcDus - iifdcDus.dll (file missing)
O20 - Winlogon Notify: jkkLDWom - jkkLDWom.dll (file missing)
O20 - Winlogon Notify: yayvWqnl - yayvWqnl.dll (file missing)
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - D:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - D:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - D:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: lxbx_device - Lexmark International, Inc. - D:\WINDOWS\system32\lxbxcoms.exe

–
End of file - 4243 bytes
Post #8
Much better but we still have a ways to go.

Download ComboFix from one of these locations:

Link 1
Link 2
Link 3


* IMPORTANT !!! Save ComboFix.exe to your Desktop


  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : Protective Programs

  • Double click on ComboFix.exe & follow the prompts.

  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


[external image: Posted Image]



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
"copy/paste" a new HijackThis log file into this thread as well.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Give it atleast 20-30 minutes to finish if needed.


Also please describe how your computer behaves at the moment.
Post #9
————–
Behavoir Log
————–
Have not yet experience a lockup during the boot process.
Tools==>Folder Options is now visible and accessible
Regedit is now accessible.
So far, I have not yet seen any browser popups.
Windows Firewall has not yet been disabled.

AVG began to update itself, however the internet connection was lost.
This seems to be an ISP issue and is not isolated to this machine.



—————-
ComboFix Log
—————-
ComboFix 08-12-18.03 - Owner 2008-12-19 14:08:57.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.3007.2597 [GMT -5:00]
Running from: d:\documents and settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

d:\documents and settings\Owner\Local Settings\Temporary Internet Files\fbk.sts
d:\program files\Microsoft Common
d:\program files\Microsoft Common\svchost.exe
d:\windows\system32\auvjvoow.ini
d:\windows\system32\byXPFVLF.dll
d:\windows\system32\cbXQiIAT.dll
d:\windows\system32\dPI02
d:\windows\system32\drivers\ati8onxx.sys
d:\windows\system32\eknhnvoi.ini
d:\windows\system32\EV02
d:\windows\system32\fyrjqnwq.ini
d:\windows\system32\gmfghy.dll
d:\windows\system32\hmddgrwr.ini
d:\windows\system32\hsd63geff.dll
d:\windows\system32\ifwociux.ini
d:\windows\system32\iifdddCt.dll
d:\windows\system32\khfDvurs.dll
d:\windows\system32\KUEKknmp.ini
d:\windows\system32\KUEKknmp.ini2
d:\windows\system32\ljjHabCS.dll
d:\windows\system32\nnnmkLCS.dll
d:\windows\system32\ntos.exe
d:\windows\system32\onxuqsos.ini
d:\windows\system32\opnLfCvw.dll
d:\windows\system32\opnLFvst.dll
d:\windows\system32\oVEMonnn.ini
d:\windows\system32\oVEMonnn.ini2
d:\windows\system32\pmnkkJaB.dll
d:\windows\system32\pqsYGfhk.ini
d:\windows\system32\pqsYGfhk.ini2
d:\windows\system32\qoMeEVol.dll
d:\windows\system32\srvuhouf.ini
d:\windows\system32\ssqRLBuU.dll
d:\windows\system32\TDSSlrvd.dat
d:\windows\system32\tuvstRll.dll
d:\windows\system32\uXPi02
d:\windows\system32\uXPi02\uXPi022328.exe
d:\windows\system32\vkibiarr.ini
d:\windows\system32\vtqytpuu.ini
d:\windows\system32\wGjllnmp.ini
d:\windows\system32\wGjllnmp.ini2
d:\windows\system32\wnxnouhw.ini
d:\windows\system32\wsnpoem
d:\windows\system32\wsnpoem\audio.dll
d:\windows\system32\wsnpoem\video.dll
d:\windows\system32\xibipdrg.dll
F:\autorun.inf

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_ati8onxx
——-\Legacy_tdssserv.sys
——-\Service_ati8onxx
——-\Service_restore
——-\Service_tdssserv.sys


((((((((((((((((((((((((( Files Created from 2008-11-19 to 2008-12-19 )))))))))))))))))))))))))))))))
.

2008-12-19 14:21 . 2008-12-19 14:21 d——– d:\windows\LastGood
2008-12-19 09:12 . 2008-12-19 09:12 d——– d:\documents and settings\Owner\Application Data\Malwarebytes
2008-12-19 09:01 . 2008-12-19 09:01 d–h—– d:\windows\PIF
2008-12-19 08:53 . 2008-12-19 09:05 d——– d:\program files\Malwarebytes' Anti-Malware
2008-12-19 08:53 . 2008-12-19 08:53 d——– d:\documents and settings\All Users\Application Data\Malwarebytes
2008-12-19 08:53 . 2008-12-03 19:59 38,496 –a—— d:\windows\system32\drivers\mbamswissarmy.sys
2008-12-19 08:53 . 2008-12-03 19:59 15,504 –a—— d:\windows\system32\drivers\mbam.sys
2008-12-14 12:09 . 2008-12-19 09:47 d——– D:\matt
2008-12-14 12:09 . 2008-12-19 09:42 d——– D:\HJT
2008-12-13 19:30 . 2008-12-13 19:30 d——– d:\documents and settings\Administrator\Application Data\7100Series
2008-12-13 19:29 . 2004-08-04 15:00 221,184 –a—— d:\windows\system32\wmpns.dll
2008-12-13 19:28 . 2008-12-13 19:28 d——– d:\documents and settings\Administrator
2008-12-13 19:14 . 2008-12-19 14:22 93,420 –a—— d:\windows\system32\drivers\14c5ef89.sys
2008-12-13 19:11 . 2008-12-19 14:22 93,420 –a—— d:\windows\system32\drivers\73419e50.sys
2008-12-13 19:02 . 2008-12-13 19:05 93,420 –a—— d:\windows\system32\drivers\ec0bdea8.sys
2008-12-13 18:56 . 2008-12-19 14:22 93,420 –a—— d:\windows\system32\drivers\23bdf536.sys
2008-12-13 18:34 . 2008-12-19 14:22 93,420 –a—— d:\windows\system32\drivers\6b6a152a.sys
2008-12-13 18:33 . 2008-12-14 11:40 d——– d:\windows\system32\DL5
2008-12-13 18:33 . 2008-12-13 18:33 d——– d:\windows\system32\cap2
2008-12-13 18:33 . 2008-12-13 18:33 d——– d:\windows\system32\ain
2008-12-13 18:16 . 2008-12-19 14:22 93,420 –a—— d:\windows\system32\drivers\2e67c164.sys
2008-12-13 18:15 . 2008-12-13 18:15 d——– d:\windows\system32\whSLD02
2008-12-09 18:35 . 2008-12-09 20:47 23,300 –a—— d:\documents and settings\Owner\gif.exe
2008-11-28 06:42 . 2008-11-28 06:42 d——– d:\documents and settings\Owner\WINDOWS
2008-11-19 15:34 . 2008-11-19 15:34 d——– d:\windows\Sun
2008-11-19 15:34 . 2008-11-19 15:34 d——– d:\program files\Citrix
2008-11-19 15:34 . 2008-11-19 15:34 60,744 –a—— d:\documents and settings\Owner\g2mdlhlpx.exe
2008-11-19 15:29 . 2008-11-19 15:29 d——– d:\program files\Java
2008-11-19 15:29 . 2008-11-19 15:29 410,976 –a—— d:\windows\system32\deploytk.dll
2008-11-19 15:29 . 2008-11-19 15:29 73,728 –a—— d:\windows\system32\javacpl.cpl

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-13 23:28 ——— d—–w d:\documents and settings\All Users\Application Data\avg8
2008-12-01 17:12 ——— d—–w d:\program files\Lx_cats
2008-11-11 22:49 2,663 —-a-w d:\documents and settings\Owner\index.exe
2008-10-29 16:51 ——— d—–w d:\program files\Common Files\Adobe AIR
2008-10-29 16:50 ——— d—–w d:\program files\Common Files\Adobe
2008-10-24 11:10 453,632 —-a-w d:\windows\system32\drivers\mrxsmb.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="d:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"MSMSGS"="d:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG8_TRAY"="d:\progra~1\AVG\AVG8\avgtray.exe" [2008-11-27 1261336]
"LXBXCATS"="d:\windows\System32\spool\DRIVERS\W32X86\3\LXBXtime.dll" [2004-11-02 69632]
"lxbxmon.exe"="d:\program files\Lexmark 7100 Series\lxbxmon.exe" [2005-01-18 196608]
"FaxCenterServer4_in_1"="d:\program files\Lexmark 7100 Series\fm3032.exe" [2004-12-06 286720]
"EzPrint"="d:\program files\Lexmark 7100 Series\ezprint.exe" [2004-09-17 61440]
"Adobe Reader Speed Launcher"="d:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"SunJavaUpdateSched"="d:\program files\Java\jre6\bin\jusched.exe" [2008-11-19 136600]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll ncbbpj.dll gmfghy.dll

[HKLM\~\startupfolder\D:^Documents and Settings^All Users^Start Menu^Programs^Startup^Bluetooth.lnk]
path=d:\documents and settings\All Users\Start Menu\Programs\Startup\Bluetooth.lnk
backup=d:\windows\pss\Bluetooth.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
–a—— 2004-08-04 15:00 15360 d:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
——— 2004-10-13 11:24 1694208 d:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
–a—— 2007-08-23 17:15 8478720 d:\windows\system32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
–a—— 2007-08-23 17:15 81920 d:\windows\system32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPStart]
–a—— 2007-09-14 18:29 102400 d:\program files\Synaptics\SynTP\SynTPStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
–a—— 2007-08-23 17:15 1626112 d:\windows\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ose"=3 (0x3)
"NVSvc"=2 (0x2)
"btwdins"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"d:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"d:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;d:\windows\system32\Drivers\avgldx86.sys [2008-10-04 97928]
R2 avg8emc;AVG Free8 E-mail Scanner;d:\progra~1\AVG\AVG8\avgemc.exe [2008-10-04 875288]
R2 avg8wd;AVG Free8 WatchDog;d:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-10-04 231704]
R2 AvgTdiX;AVG Free8 Network Redirector;d:\windows\system32\Drivers\avgtdix.sys [2008-10-04 76040]
S0 hpowczm;hpowczm;d:\windows\system32\drivers\ddqzic.sys []
S1 streamm;streamm;d:\windows\system32\drivers\streamm.sys []
S3 WLAN_400_500_SERVICE;HP WLAN W400/W500 Wireless Network Adapter Service;d:\windows\system32\DRIVERS\ar5211.sys [2008-08-31 468768]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{27fb5c44-7a74-11dd-9e9a-001e68c6e09b}]
\Shell\Auto\command - F:\Start.exe
\Shell\AutoRun\command - d:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Start.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4f773858-a0a1-11dd-9f1b-001e68c6e09b}]
\Shell\Auto\command - F:\Start.exe
\Shell\AutoRun\command - d:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Start.exe
.
- - - - ORPHANS REMOVED - - - -

BHO-{c5af42a3-94f3-42bd-f434-3604832c897d} - d:\windows\system32\hsd63geff.dll
HKCU-Run-jsg8jfgfdfhfhf - d:\windows\TEMP\winlogun.exe
HKCU-Run-Jnskdfmf9eldfd - d:\windows\TEMP\csrssc.exe
SharedTaskScheduler-{C5AF42A3-94F3-42BD-F434-3604832C897D} - d:\windows\system32\hsd63geff.dll
ShellExecuteHooks-{0A43AB64-3AB7-46C5-9FF5-5F718367B9E3} - d:\windows\system32\iifcDTjH.dll
ShellExecuteHooks-{B40B865D-B0D3-4ED1-A8CB-9EF352BC6EA9} - d:\windows\system32\iifdcDus.dll
Notify-awtutqPH - awtutqPH.dll
Notify-fnnwuke - fnnwuke.dll
Notify-iifcDTjH - iifcDTjH.dll
Notify-iifdcDus - iifdcDus.dll
Notify-jkkLDWom - jkkLDWom.dll
Notify-yayvWqnl - yayvWqnl.dll
MSConfigStartUp-LSA Shellu - d:\documents and settings\Owner\lsass.exe


.
——- Supplementary Scan ——-
.
IE: E&xport to Microsoft Excel - d:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Send to &Bluetooth Device… - d:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
FF - ProfilePath - d:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\vuyfwylj.default\
FF - component: d:\program files\AVG\AVG8\Firefox\components\avgssff.dll

ATTENTION: FIREFOX POLICES IS IN FORCE
FF - user.js: yahoo.homepage.dontask - true.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-19 14:22:10
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
LXBXCATS = rundll32 d:\windows\System32\spool\DRIVERS\W32X86\3\LXBXtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\controlset003\Services\14c5ef89]
"ImagePath"="\SystemRoot\System32\drivers\14c5ef89.sys"

[HKEY_LOCAL_MACHINE\System\controlset003\Services\23bdf536]
"ImagePath"="\SystemRoot\System32\drivers\23bdf536.sys"

[HKEY_LOCAL_MACHINE\System\controlset003\Services\2e67c164]
"ImagePath"="\SystemRoot\System32\drivers\2e67c164.sys"

[HKEY_LOCAL_MACHINE\System\controlset003\Services\6b6a152a]
"ImagePath"="\SystemRoot\System32\drivers\6b6a152a.sys"

[HKEY_LOCAL_MACHINE\System\controlset003\Services\73419e50]
"ImagePath"="\SystemRoot\System32\drivers\73419e50.sys"
.
———————— Other Running Processes ————————
.
d:\program files\Java\jre6\bin\jqs.exe
d:\program files\AVG\AVG8\avgrsx.exe
d:\windows\system32\wscntfy.exe
d:\windows\system32\lxbxcoms.exe
.
**************************************************************************
.
Completion time: 2008-12-19 14:23:25 - machine was rebooted
ComboFix-quarantined-files.txt 2008-12-19 19:23:22

Pre-Run: 178,033,016,832 bytes free
Post-Run: 178,441,560,064 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

227 — E O F — 2008-12-01 16:42:45





—————-
HiJackThis Log
—————-
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:27:46 PM, on 12/19/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
D:\Program Files\Java\jre6\bin\jqs.exe
D:\WINDOWS\system32\svchost.exe
D:\PROGRA~1\AVG\AVG8\avgrsx.exe
D:\PROGRA~1\AVG\AVG8\avgemc.exe
D:\WINDOWS\system32\wuauclt.exe
D:\WINDOWS\system32\wscntfy.exe
D:\Program Files\Lexmark 7100 Series\lxbxmon.exe
D:\Program Files\Lexmark 7100 Series\ezprint.exe
D:\Program Files\Java\jre6\bin\jusched.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Program Files\Messenger\msmsgs.exe
D:\WINDOWS\system32\lxbxcoms.exe
D:\WINDOWS\system32\wuauclt.exe
D:\WINDOWS\explorer.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\Program Files\AVG\AVG8\avgui.exe
D:\HJT\HiJackThis(2).exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O4 - HKLM\..\Run: [AVG8_TRAY] D:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [LXBXCATS] rundll32 D:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBXtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [lxbxmon.exe] "D:\Program Files\Lexmark 7100 Series\lxbxmon.exe"
O4 - HKLM\..\Run: [FaxCenterServer4_in_1] "D:\Program Files\Lexmark 7100 Series\fm3032.exe" /s
O4 - HKLM\..\Run: [EzPrint] "D:\Program Files\Lexmark 7100 Series\ezprint.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\msmsgs.exe" /background
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth Device… - D:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - D:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - D:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - D:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll ncbbpj.dll gmfghy.dll
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - D:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - D:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - D:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: lxbx_device - Lexmark International, Inc. - D:\WINDOWS\system32\lxbxcoms.exe

–
End of file - 3987 bytes
Post #10
Copy/paste the text in the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text. 

File::
d:\windows\system32\drivers\14c5ef89.sys
d:\windows\system32\drivers\73419e50.sys
d:\windows\system32\drivers\ec0bdea8.sys
d:\windows\system32\drivers\23bdf536.sys
d:\windows\system32\drivers\6b6a152a.sys
d:\windows\system32\drivers\2e67c164.sys
d:\documents and settings\Owner\gif.exe
d:\windows\system32\drivers\ddqzic.sys

Driver::
14c5ef89
73419e50
ec0bdea8
23bdf536
6b6a152a
2e67c164
hpowczm

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=""
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{27fb5c44-7a74-11dd-9e9a-001e68c6e09b}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4f773858-a0a1-11dd-9f1b-001e68c6e09b}]

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:
1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …


[external image: Posted Image]

Drag CFScript.txt into ComboFix.exe

Then post the results log and a new HijackThis log.


Also please describe how your computer behaves at the moment.
Post #11
The only noted difference in behavior, is that AVG was able to complete it's update.
But, as I mentioned above, this was most likely and ISP issue and not one of this computer.

No negative behavior is noticed.
regedit works,
folder–>tool options is accessible,
(so far) no browser popups.
no Windows Security Alerts –eg Firewall ON, AntiVirus ON, Windows Update ON.
(so far) no issues booting.

and i just realized, that at some point the Error Dialog:
"Error loading D:\Windows\system32\arilnsga.dll" no longer appears.
(I did not notice when it first stopped)

—————————————-
ComboFix with CFScript Log
—————————————-
ComboFix 08-12-18.03 - Owner 2008-12-19 15:47:17.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.3007.2414 [GMT -5:00]
Running from: d:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: d:\documents and settings\Owner\Desktop\CFScript.txt
* Created a new restore point

FILE ::
d:\documents and settings\Owner\gif.exe
d:\windows\system32\drivers\14c5ef89.sys
d:\windows\system32\drivers\23bdf536.sys
d:\windows\system32\drivers\2e67c164.sys
d:\windows\system32\drivers\6b6a152a.sys
d:\windows\system32\drivers\73419e50.sys
d:\windows\system32\drivers\ddqzic.sys
d:\windows\system32\drivers\ec0bdea8.sys
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

d:\documents and settings\Owner\gif.exe
d:\windows\system32\drivers\14c5ef89.sys
d:\windows\system32\drivers\23bdf536.sys
d:\windows\system32\drivers\2e67c164.sys
d:\windows\system32\drivers\6b6a152a.sys
d:\windows\system32\drivers\73419e50.sys
d:\windows\system32\drivers\ec0bdea8.sys

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Service_14c5ef89
——-\Service_23bdf536
——-\Service_2e67c164
——-\Service_6b6a152a
——-\Service_73419e50
——-\Service_hpowczm


((((((((((((((((((((((((( Files Created from 2008-11-19 to 2008-12-19 )))))))))))))))))))))))))))))))
.

2008-12-19 09:01 . 2008-12-19 09:01 d–h—– d:\windows\PIF
2008-12-19 08:53 . 2008-12-19 09:05 d——– d:\program files\Malwarebytes' Anti-Malware
2008-12-19 08:53 . 2008-12-19 08:53 d——– d:\documents and settings\All Users\Application Data\Malwarebytes
2008-12-19 08:53 . 2008-12-03 19:59 38,496 –a—— d:\windows\system32\drivers\mbamswissarmy.sys
2008-12-19 08:53 . 2008-12-03 19:59 15,504 –a—— d:\windows\system32\drivers\mbam.sys
2008-12-14 12:09 . 2008-12-19 15:45 d——– D:\matt
2008-12-14 12:09 . 2008-12-19 14:27 d——– D:\HJT
2008-12-13 19:30 . 2008-12-13 19:30 d——– d:\documents and settings\Administrator\Application Data\7100Series
2008-12-13 19:29 . 2004-08-04 15:00 221,184 –a—— d:\windows\system32\wmpns.dll
2008-12-13 19:28 . 2008-12-13 19:28 d——– d:\documents and settings\Administrator
2008-12-13 18:33 . 2008-12-14 11:40 d——– d:\windows\system32\DL5
2008-12-13 18:33 . 2008-12-13 18:33 d——– d:\windows\system32\cap2
2008-12-13 18:33 . 2008-12-13 18:33 d——– d:\windows\system32\ain
2008-12-13 18:15 . 2008-12-13 18:15 d——– d:\windows\system32\whSLD02
2008-11-19 15:34 . 2008-11-19 15:34 d——– d:\windows\Sun
2008-11-19 15:34 . 2008-11-19 15:34 d——– d:\program files\Citrix
2008-11-19 15:29 . 2008-11-19 15:29 d——– d:\program files\Java
2008-11-19 15:29 . 2008-11-19 15:29 410,976 –a—— d:\windows\system32\deploytk.dll
2008-11-19 15:29 . 2008-11-19 15:29 73,728 –a—— d:\windows\system32\javacpl.cpl

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-13 23:28 ——— d—–w d:\documents and settings\All Users\Application Data\avg8
2008-12-01 17:12 ——— d—–w d:\program files\Lx_cats
2008-10-29 16:51 ——— d—–w d:\program files\Common Files\Adobe AIR
2008-10-29 16:50 ——— d—–w d:\program files\Common Files\Adobe
2008-10-24 11:10 453,632 —-a-w d:\windows\system32\drivers\mrxsmb.sys
.

((((((((((((((((((((((((((((( snapshot@2008-12-19_14.22.59.00 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-12-19 19:03:28 59,638 —-a-w d:\windows\system32\perfc009.dat
+ 2008-12-19 19:23:05 59,638 —-a-w d:\windows\system32\perfc009.dat
- 2008-12-19 19:03:28 395,438 —-a-w d:\windows\system32\perfh009.dat
+ 2008-12-19 19:23:05 395,438 —-a-w d:\windows\system32\perfh009.dat
+ 2008-12-19 20:49:51 16,384 —-atw d:\windows\Temp\Perflib_Perfdata_64c.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="d:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"Jnskdfmf9eldfd"="d:\docume~1\ADMINI~1\LOCALS~1\Temp\csrssc.exe" [BU]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG8_TRAY"="d:\progra~1\AVG\AVG8\avgtray.exe" [2008-11-27 1261336]
"LXBXCATS"="d:\windows\System32\spool\DRIVERS\W32X86\3\LXBXtime.dll" [2004-11-02 69632]
"lxbxmon.exe"="d:\program files\Lexmark 7100 Series\lxbxmon.exe" [2005-01-18 196608]
"FaxCenterServer4_in_1"="d:\program files\Lexmark 7100 Series\fm3032.exe" [2004-12-06 286720]
"EzPrint"="d:\program files\Lexmark 7100 Series\ezprint.exe" [2004-09-17 61440]
"Adobe Reader Speed Launcher"="d:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"SunJavaUpdateSched"="d:\program files\Java\jre6\bin\jusched.exe" [2008-11-19 136600]

[HKLM\~\startupfolder\D:^Documents and Settings^All Users^Start Menu^Programs^Startup^Bluetooth.lnk]
path=d:\documents and settings\All Users\Start Menu\Programs\Startup\Bluetooth.lnk
backup=d:\windows\pss\Bluetooth.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
–a—— 2004-08-04 15:00 15360 d:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
——— 2004-10-13 11:24 1694208 d:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
–a—— 2007-08-23 17:15 8478720 d:\windows\system32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
–a—— 2007-08-23 17:15 81920 d:\windows\system32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPStart]
–a—— 2007-09-14 18:29 102400 d:\program files\Synaptics\SynTP\SynTPStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
–a—— 2007-08-23 17:15 1626112 d:\windows\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ose"=3 (0x3)
"NVSvc"=2 (0x2)
"btwdins"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"d:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"d:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;d:\windows\system32\Drivers\avgldx86.sys [2008-10-04 97928]
R2 avg8emc;AVG Free8 E-mail Scanner;d:\progra~1\AVG\AVG8\avgemc.exe [2008-10-04 875288]
R2 avg8wd;AVG Free8 WatchDog;d:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-10-04 231704]
R2 AvgTdiX;AVG Free8 Network Redirector;d:\windows\system32\Drivers\avgtdix.sys [2008-10-04 76040]
S1 streamm;streamm;d:\windows\system32\drivers\streamm.sys []
S3 WLAN_400_500_SERVICE;HP WLAN W400/W500 Wireless Network Adapter Service;d:\windows\system32\DRIVERS\ar5211.sys [2008-08-31 468768]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9117e2c0-c9fb-11dd-9fb2-ada12a4cb75d}]
\shell\auto\command - F:\Start.exe
\shell\autorun\command - d:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Start.exe
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-rs32net - d:\windows\System32\rs32net.exe


.
——- Supplementary Scan ——-
.
uInternet Connection Wizard,ShellNext = hxxp://bontrafic.org/s/in.cgi?3&key=door
FF - ProfilePath - d:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tj7j1hj1.default\
FF - component: d:\program files\AVG\AVG8\Firefox\components\avgssff.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-19 15:50:29
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
LXBXCATS = rundll32 d:\windows\System32\spool\DRIVERS\W32X86\3\LXBXtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
d:\program files\Java\jre6\bin\jqs.exe
d:\program files\AVG\AVG8\avgrsx.exe
d:\windows\system32\wscntfy.exe
d:\windows\system32\lxbxcoms.exe
.
**************************************************************************
.
Completion time: 2008-12-19 15:52:01 - machine was rebooted [Administrator]
ComboFix-quarantined-files.txt 2008-12-19 20:51:58
ComboFix2.txt 2008-12-19 19:23:27

Pre-Run: 178,396,143,616 bytes free
Post-Run: 178,384,777,216 bytes free

156 — E O F — 2008-12-01 16:42:45


—————————————-
HiJackThis Log, post CFScript
—————————————-
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:59, on 2008-12-19
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
D:\Program Files\Java\jre6\bin\jqs.exe
D:\WINDOWS\system32\svchost.exe
D:\PROGRA~1\AVG\AVG8\avgrsx.exe
D:\PROGRA~1\AVG\AVG8\avgemc.exe
D:\WINDOWS\system32\lxbxcoms.exe
D:\WINDOWS\Explorer.EXE
D:\PROGRA~1\AVG\AVG8\avgtray.exe
D:\Program Files\Lexmark 7100 Series\lxbxmon.exe
D:\Program Files\Lexmark 7100 Series\ezprint.exe
D:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
D:\Program Files\Java\jre6\bin\jusched.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Program Files\Messenger\msmsgs.exe
D:\HJT\HiJackThis(2).exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O4 - HKLM\..\Run: [AVG8_TRAY] D:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [LXBXCATS] rundll32 D:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBXtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [lxbxmon.exe] "D:\Program Files\Lexmark 7100 Series\lxbxmon.exe"
O4 - HKLM\..\Run: [FaxCenterServer4_in_1] "D:\Program Files\Lexmark 7100 Series\fm3032.exe" /s
O4 - HKLM\..\Run: [EzPrint] "D:\Program Files\Lexmark 7100 Series\ezprint.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\msmsgs.exe" /background
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth Device… - D:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - D:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - D:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - D:\Program Files\AVG\AVG8\avgpp.dll
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - D:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - D:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - D:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: lxbx_device - Lexmark International, Inc. - D:\WINDOWS\system32\lxbxcoms.exe

–
End of file - 3834 bytes
Post #12
Copy/paste the text in the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text. 

File::
d:\docume~1\ADMINI~1\LOCALS~1\Temp\csrssc.exe

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Jnskdfmf9eldfd"=-

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:
1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …


[external image: Posted Image]

Drag CFScript.txt into ComboFix.exe

Then post the results log and a new HijackThis log.


Also please describe how your computer behaves at the moment.
Post #13
——————————
Computer Behavior
——————————
No new negative behavior.
No observable negative behavior.


——————————
ComboFix Log
——————————
ComboFix 08-12-18.03 - Owner 2008-12-21 10:35:07.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.3007.2539 [GMT -5:00]
Running from: d:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: d:\matt\CFScript2.txt
* Created a new restore point

FILE ::
d:\docume~1\ADMINI~1\LOCALS~1\Temp\csrssc.exe
.

((((((((((((((((((((((((( Files Created from 2008-11-21 to 2008-12-21 )))))))))))))))))))))))))))))))
.

2008-12-19 09:12 . 2008-12-19 09:12 d——– d:\documents and settings\Owner\Application Data\Malwarebytes
2008-12-19 09:01 . 2008-12-19 09:01 d–h—– d:\windows\PIF
2008-12-19 08:53 . 2008-12-19 09:05 d——– d:\program files\Malwarebytes' Anti-Malware
2008-12-19 08:53 . 2008-12-19 08:53 d——– d:\documents and settings\All Users\Application Data\Malwarebytes
2008-12-19 08:53 . 2008-12-03 19:59 38,496 –a—— d:\windows\system32\drivers\mbamswissarmy.sys
2008-12-19 08:53 . 2008-12-03 19:59 15,504 –a—— d:\windows\system32\drivers\mbam.sys
2008-12-14 12:09 . 2008-12-21 10:35 d——– D:\matt
2008-12-14 12:09 . 2008-12-19 15:58 d——– D:\HJT
2008-12-13 19:30 . 2008-12-13 19:30 d——– d:\documents and settings\Administrator\Application Data\7100Series
2008-12-13 19:29 . 2004-08-04 15:00 221,184 –a—— d:\windows\system32\wmpns.dll
2008-12-13 19:28 . 2008-12-13 19:28 d——– d:\documents and settings\Administrator
2008-12-13 18:33 . 2008-12-14 11:40 d——– d:\windows\system32\DL5
2008-12-13 18:33 . 2008-12-13 18:33 d——– d:\windows\system32\cap2
2008-12-13 18:33 . 2008-12-13 18:33 d——– d:\windows\system32\ain
2008-12-13 18:15 . 2008-12-13 18:15 d——– d:\windows\system32\whSLD02
2008-11-28 06:42 . 2008-11-28 06:42 d——– d:\documents and settings\Owner\WINDOWS

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-13 23:28 ——— d—–w d:\documents and settings\All Users\Application Data\avg8
2008-12-01 17:12 ——— d—–w d:\program files\Lx_cats
2008-11-19 20:34 60,744 —-a-w d:\documents and settings\Owner\g2mdlhlpx.exe
2008-11-19 20:34 ——— d—–w d:\program files\Citrix
2008-11-19 20:29 410,976 —-a-w d:\windows\system32\deploytk.dll
2008-11-19 20:29 ——— d—–w d:\program files\Java
2008-11-11 22:49 2,663 —-a-w d:\documents and settings\Owner\index.exe
2008-10-29 16:51 ——— d—–w d:\program files\Common Files\Adobe AIR
2008-10-29 16:50 ——— d—–w d:\program files\Common Files\Adobe
2008-10-24 11:10 453,632 —-a-w d:\windows\system32\drivers\mrxsmb.sys
2008-10-23 13:01 283,648 —-a-w d:\windows\system32\gdi32.dll
2008-10-16 20:38 826,368 —-a-w d:\windows\system32\wininet.dll
2008-10-16 19:13 202,776 —-a-w d:\windows\system32\wuweb.dll
2008-10-16 19:13 1,809,944 —-a-w d:\windows\system32\wuaueng.dll
2008-10-16 19:12 561,688 —-a-w d:\windows\system32\wuapi.dll
2008-10-16 19:12 323,608 —-a-w d:\windows\system32\wucltui.dll
2008-10-16 19:09 92,696 —-a-w d:\windows\system32\cdm.dll
2008-10-16 19:09 51,224 —-a-w d:\windows\system32\wuauclt.exe
2008-10-16 19:09 43,544 —-a-w d:\windows\system32\wups2.dll
2008-10-16 19:08 34,328 —-a-w d:\windows\system32\wups.dll
2008-10-04 20:21 10,520 —-a-w d:\windows\system32\avgrsstx.dll
2008-10-03 10:15 247,326 —-a-w d:\windows\system32\strmdll.dll
.

((((((((((((((((((((((((((((( snapshot@2008-12-19_14.22.59.00 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-08-26 07:24:28 124,928 -c—-w d:\windows\ie7updates\KB958215-IE7\advpack.dll
+ 2008-08-26 07:24:28 347,136 -c—-w d:\windows\ie7updates\KB958215-IE7\dxtmsft.dll
+ 2008-08-26 07:24:28 214,528 -c—-w d:\windows\ie7updates\KB958215-IE7\dxtrans.dll
+ 2008-08-26 07:24:28 133,120 -c—-w d:\windows\ie7updates\KB958215-IE7\extmgr.dll
+ 2008-08-26 07:24:28 63,488 -c—-w d:\windows\ie7updates\KB958215-IE7\icardie.dll
+ 2008-08-25 08:37:59 70,656 -c—-w d:\windows\ie7updates\KB958215-IE7\ie4uinit.exe
+ 2008-08-26 07:24:28 153,088 -c—-w d:\windows\ie7updates\KB958215-IE7\ieakeng.dll
+ 2008-08-26 07:24:28 230,400 -c—-w d:\windows\ie7updates\KB958215-IE7\ieaksie.dll
+ 2008-08-23 05:54:51 161,792 -c—-w d:\windows\ie7updates\KB958215-IE7\ieakui.dll
+ 2008-08-26 07:24:28 383,488 -c—-w d:\windows\ie7updates\KB958215-IE7\ieapfltr.dll
+ 2008-08-26 07:24:29 384,512 -c—-w d:\windows\ie7updates\KB958215-IE7\iedkcs32.dll
+ 2008-10-03 17:41:15 6,066,176 -c—-w d:\windows\ie7updates\KB958215-IE7\ieframe.dll
+ 2008-08-26 07:24:29 44,544 -c—-w d:\windows\ie7updates\KB958215-IE7\iernonce.dll
+ 2008-08-26 07:24:29 267,776 -c—-w d:\windows\ie7updates\KB958215-IE7\iertutil.dll
+ 2008-08-25 08:38:00 13,824 -c—-w d:\windows\ie7updates\KB958215-IE7\ieudinit.exe
+ 2008-08-23 05:56:15 635,848 -c—-w d:\windows\ie7updates\KB958215-IE7\iexplore.exe
+ 2008-08-26 07:24:30 27,648 -c—-w d:\windows\ie7updates\KB958215-IE7\jsproxy.dll
+ 2008-08-26 07:24:30 459,264 -c—-w d:\windows\ie7updates\KB958215-IE7\msfeeds.dll
+ 2008-08-26 07:24:30 52,224 -c—-w d:\windows\ie7updates\KB958215-IE7\msfeedsbs.dll
+ 2008-08-26 07:24:30 477,696 -c—-w d:\windows\ie7updates\KB958215-IE7\mshtmled.dll
+ 2008-08-26 07:24:30 193,024 -c—-w d:\windows\ie7updates\KB958215-IE7\msrating.dll
+ 2008-08-26 07:24:30 671,232 -c—-w d:\windows\ie7updates\KB958215-IE7\mstime.dll
+ 2008-08-26 07:24:30 102,912 -c—-w d:\windows\ie7updates\KB958215-IE7\occache.dll
+ 2008-08-26 07:24:30 44,544 -c—-w d:\windows\ie7updates\KB958215-IE7\pngfilt.dll
+ 2007-03-06 01:22:39 213,216 -c—-w d:\windows\ie7updates\KB958215-IE7\spuninst\spuninst.exe
+ 2007-03-06 01:23:51 371,424 -c—-w d:\windows\ie7updates\KB958215-IE7\spuninst\updspapi.dll
+ 2008-08-26 07:24:30 105,984 -c—-w d:\windows\ie7updates\KB958215-IE7\url.dll
+ 2008-08-26 07:24:31 1,159,680 -c—-w d:\windows\ie7updates\KB958215-IE7\urlmon.dll
+ 2008-08-26 07:24:31 233,472 -c—-w d:\windows\ie7updates\KB958215-IE7\webcheck.dll
+ 2008-08-26 07:24:31 826,368 -c—-w d:\windows\ie7updates\KB958215-IE7\wininet.dll
+ 2008-08-27 08:24:32 3,593,216 -c—-w d:\windows\ie7updates\KB960714-IE7\mshtml.dll
+ 2007-03-06 01:22:39 213,216 -c—-w d:\windows\ie7updates\KB960714-IE7\spuninst\spuninst.exe
+ 2007-03-06 01:23:47 371,424 -c—-w d:\windows\ie7updates\KB960714-IE7\spuninst\updspapi.dll
- 2008-08-26 07:24:28 124,928 —-a-w d:\windows\system32\advpack.dll
+ 2008-10-16 20:38:34 124,928 —-a-w d:\windows\system32\advpack.dll
- 2008-08-26 07:24:28 124,928 -c–a-w d:\windows\system32\dllcache\advpack.dll
+ 2008-10-16 20:38:34 124,928 -c–a-w d:\windows\system32\dllcache\advpack.dll
- 2008-08-26 07:24:28 347,136 -c–a-w d:\windows\system32\dllcache\dxtmsft.dll
+ 2008-10-16 20:38:34 347,136 -c–a-w d:\windows\system32\dllcache\dxtmsft.dll
- 2008-08-26 07:24:28 214,528 -c–a-w d:\windows\system32\dllcache\dxtrans.dll
+ 2008-10-16 20:38:34 214,528 -c–a-w d:\windows\system32\dllcache\dxtrans.dll
- 2008-08-26 07:24:28 133,120 -c–a-w d:\windows\system32\dllcache\extmgr.dll
+ 2008-10-16 20:38:35 133,120 -c–a-w d:\windows\system32\dllcache\extmgr.dll
- 2008-02-20 06:51:05 282,624 -c–a-w d:\windows\system32\dllcache\gdi32.dll
+ 2008-10-23 13:01:36 283,648 -c–a-w d:\windows\system32\dllcache\gdi32.dll
- 2008-08-26 07:24:28 63,488 -c—-w d:\windows\system32\dllcache\icardie.dll
+ 2008-10-16 20:38:35 63,488 -c—-w d:\windows\system32\dllcache\icardie.dll
- 2008-08-25 08:37:59 70,656 -c–a-w d:\windows\system32\dllcache\ie4uinit.exe
+ 2008-10-16 13:11:09 70,656 -c–a-w d:\windows\system32\dllcache\ie4uinit.exe
- 2008-08-26 07:24:28 153,088 -c–a-w d:\windows\system32\dllcache\ieakeng.dll
+ 2008-10-16 20:38:35 153,088 -c–a-w d:\windows\system32\dllcache\ieakeng.dll
- 2008-08-26 07:24:28 230,400 -c–a-w d:\windows\system32\dllcache\ieaksie.dll
+ 2008-10-16 20:38:35 230,400 -c–a-w d:\windows\system32\dllcache\ieaksie.dll
- 2008-08-23 05:54:51 161,792 -c–a-w d:\windows\system32\dllcache\ieakui.dll
+ 2008-10-15 07:04:53 161,792 -c–a-w d:\windows\system32\dllcache\ieakui.dll
- 2008-08-26 07:24:28 383,488 -c—-w d:\windows\system32\dllcache\ieapfltr.dll
+ 2008-10-16 20:38:35 383,488 -c—-w d:\windows\system32\dllcache\ieapfltr.dll
- 2008-08-26 07:24:29 384,512 -c–a-w d:\windows\system32\dllcache\iedkcs32.dll
+ 2008-10-16 20:38:35 384,512 -c–a-w d:\windows\system32\dllcache\iedkcs32.dll
- 2008-10-03 17:41:15 6,066,176 -c—-w d:\windows\system32\dllcache\ieframe.dll
+ 2008-10-16 20:38:37 6,066,176 -c—-w d:\windows\system32\dllcache\ieframe.dll
- 2008-08-26 07:24:29 44,544 -c–a-w d:\windows\system32\dllcache\iernonce.dll
+ 2008-10-16 20:38:37 44,544 -c–a-w d:\windows\system32\dllcache\iernonce.dll
- 2008-08-26 07:24:29 267,776 -c—-w d:\windows\system32\dllcache\iertutil.dll
+ 2008-10-16 20:38:37 267,776 -c—-w d:\windows\system32\dllcache\iertutil.dll
- 2008-08-25 08:38:00 13,824 -c—-w d:\windows\system32\dllcache\ieudinit.exe
+ 2008-10-16 13:11:09 13,824 -c—-w d:\windows\system32\dllcache\ieudinit.exe
- 2008-08-23 05:56:15 635,848 -c–a-w d:\windows\system32\dllcache\iexplore.exe
+ 2008-10-15 07:06:26 633,632 -c–a-w d:\windows\system32\dllcache\iexplore.exe
- 2008-08-26 07:24:30 27,648 -c–a-w d:\windows\system32\dllcache\jsproxy.dll
+ 2008-10-16 20:38:37 27,648 -c–a-w d:\windows\system32\dllcache\jsproxy.dll
- 2004-08-04 20:00:00 103,936 -c–a-w d:\windows\system32\dllcache\logagent.exe
+ 2008-06-10 06:31:06 103,936 -c–a-w d:\windows\system32\dllcache\logagent.exe
- 2008-08-26 07:24:30 459,264 -c—-w d:\windows\system32\dllcache\msfeeds.dll
+ 2008-10-16 20:38:37 459,264 -c—-w d:\windows\system32\dllcache\msfeeds.dll
- 2008-08-26 07:24:30 52,224 -c—-w d:\windows\system32\dllcache\msfeedsbs.dll
+ 2008-10-16 20:38:37 52,224 -c—-w d:\windows\system32\dllcache\msfeedsbs.dll
- 2008-08-27 08:24:32 3,593,216 -c–a-w d:\windows\system32\dllcache\mshtml.dll
+ 2008-12-13 06:40:02 3,593,216 -c–a-w d:\windows\system32\dllcache\mshtml.dll
- 2008-08-26 07:24:30 477,696 -c–a-w d:\windows\system32\dllcache\mshtmled.dll
+ 2008-10-16 20:38:38 477,696 -c–a-w d:\windows\system32\dllcache\mshtmled.dll
- 2008-08-26 07:24:30 193,024 -c–a-w d:\windows\system32\dllcache\msrating.dll
+ 2008-10-16 20:38:38 193,024 -c–a-w d:\windows\system32\dllcache\msrating.dll
- 2008-08-26 07:24:30 671,232 -c–a-w d:\windows\system32\dllcache\mstime.dll
+ 2008-10-16 20:38:39 671,232 -c–a-w d:\windows\system32\dllcache\mstime.dll
- 2008-08-26 07:24:30 102,912 -c–a-w d:\windows\system32\dllcache\occache.dll
+ 2008-10-16 20:38:39 102,912 -c–a-w d:\windows\system32\dllcache\occache.dll
- 2008-08-26 07:24:30 44,544 -c–a-w d:\windows\system32\dllcache\pngfilt.dll
+ 2008-10-16 20:38:39 44,544 -c–a-w d:\windows\system32\dllcache\pngfilt.dll
- 2006-08-21 13:52:08 246,814 -c–a-w d:\windows\system32\dllcache\strmdll.dll
+ 2008-10-03 10:15:47 247,326 -c–a-w d:\windows\system32\dllcache\strmdll.dll
- 2008-08-26 07:24:30 105,984 -c–a-w d:\windows\system32\dllcache\url.dll
+ 2008-10-16 20:38:39 105,984 -c–a-w d:\windows\system32\dllcache\url.dll
- 2008-08-26 07:24:31 1,159,680 -c–a-w d:\windows\system32\dllcache\urlmon.dll
+ 2008-10-16 20:38:39 1,160,192 -c–a-w d:\windows\system32\dllcache\urlmon.dll
- 2008-08-26 07:24:31 233,472 -c–a-w d:\windows\system32\dllcache\webcheck.dll
+ 2008-10-16 20:38:39 233,472 -c–a-w d:\windows\system32\dllcache\webcheck.dll
- 2008-08-26 07:24:31 826,368 -c–a-w d:\windows\system32\dllcache\wininet.dll
+ 2008-10-16 20:38:40 826,368 -c–a-w d:\windows\system32\dllcache\wininet.dll
- 2004-08-04 20:00:00 1,050,624 -c–a-w d:\windows\system32\dllcache\wmnetmgr.dll
+ 2008-06-10 23:18:18 1,053,696 -c–a-w d:\windows\system32\dllcache\WMNetmgr.dll
- 2007-10-27 21:37:38 2,109,440 -c–a-w d:\windows\system32\dllcache\wmvcore.dll
+ 2008-11-07 23:32:20 2,109,440 -c–a-w d:\windows\system32\dllcache\WMVCore.dll
- 2008-08-26 07:24:28 347,136 —-a-w d:\windows\system32\dxtmsft.dll
+ 2008-10-16 20:38:34 347,136 —-a-w d:\windows\system32\dxtmsft.dll
- 2008-08-26 07:24:28 214,528 —-a-w d:\windows\system32\dxtrans.dll
+ 2008-10-16 20:38:34 214,528 —-a-w d:\windows\system32\dxtrans.dll
- 2008-08-26 07:24:28 133,120 —-a-w d:\windows\system32\extmgr.dll
+ 2008-10-16 20:38:35 133,120 —-a-w d:\windows\system32\extmgr.dll
- 2008-08-26 07:24:28 63,488 —-a-w d:\windows\system32\icardie.dll
+ 2008-10-16 20:38:35 63,488 —-a-w d:\windows\system32\icardie.dll
- 2008-08-25 08:37:59 70,656 —-a-w d:\windows\system32\ie4uinit.exe
+ 2008-10-16 13:11:09 70,656 —-a-w d:\windows\system32\ie4uinit.exe
- 2008-08-26 07:24:28 153,088 —-a-w d:\windows\system32\ieakeng.dll
+ 2008-10-16 20:38:35 153,088 —-a-w d:\windows\system32\ieakeng.dll
- 2008-08-26 07:24:28 230,400 —-a-w d:\windows\system32\ieaksie.dll
+ 2008-10-16 20:38:35 230,400 —-a-w d:\windows\system32\ieaksie.dll
- 2008-08-23 05:54:51 161,792 —-a-w d:\windows\system32\ieakui.dll
+ 2008-10-15 07:04:53 161,792 —-a-w d:\windows\system32\ieakui.dll
- 2008-08-26 07:24:28 383,488 —-a-w d:\windows\system32\ieapfltr.dll
+ 2008-10-16 20:38:35 383,488 —-a-w d:\windows\system32\ieapfltr.dll
- 2008-08-26 07:24:29 384,512 —-a-w d:\windows\system32\iedkcs32.dll
+ 2008-10-16 20:38:35 384,512 —-a-w d:\windows\system32\iedkcs32.dll
- 2008-10-03 17:41:15 6,066,176 —-a-w d:\windows\system32\ieframe.dll
+ 2008-10-16 20:38:37 6,066,176 —-a-w d:\windows\system32\ieframe.dll
- 2008-08-26 07:24:29 44,544 —-a-w d:\windows\system32\iernonce.dll
+ 2008-10-16 20:38:37 44,544 —-a-w d:\windows\system32\iernonce.dll
- 2008-08-26 07:24:29 267,776 —-a-w d:\windows\system32\iertutil.dll
+ 2008-10-16 20:38:37 267,776 —-a-w d:\windows\system32\iertutil.dll
- 2008-08-25 08:38:00 13,824 —-a-w d:\windows\system32\ieudinit.exe
+ 2008-10-16 13:11:09 13,824 —-a-w d:\windows\system32\ieudinit.exe
- 2008-08-26 07:24:30 27,648 —-a-w d:\windows\system32\jsproxy.dll
+ 2008-10-16 20:38:37 27,648 —-a-w d:\windows\system32\jsproxy.dll
- 2004-08-04 20:00:00 103,936 —-a-w d:\windows\system32\logagent.exe
+ 2008-06-10 06:31:06 103,936 —-a-w d:\windows\system32\logagent.exe
- 2008-11-04 00:10:25 17,318,336 —-a-w d:\windows\system32\MRT.exe
+ 2008-12-09 23:24:37 17,593,280 —-a-w d:\windows\system32\MRT.exe
- 2008-08-26 07:24:30 459,264 —-a-w d:\windows\system32\msfeeds.dll
+ 2008-10-16 20:38:37 459,264 —-a-w d:\windows\system32\msfeeds.dll
- 2008-08-26 07:24:30 52,224 —-a-w d:\windows\system32\msfeedsbs.dll
+ 2008-10-16 20:38:37 52,224 —-a-w d:\windows\system32\msfeedsbs.dll
- 2008-08-27 08:24:32 3,593,216 —-a-w d:\windows\system32\mshtml.dll
+ 2008-12-13 06:40:02 3,593,216 —-a-w d:\windows\system32\mshtml.dll
- 2008-08-26 07:24:30 477,696 —-a-w d:\windows\system32\mshtmled.dll
+ 2008-10-16 20:38:38 477,696 —-a-w d:\windows\system32\mshtmled.dll
- 2008-08-26 07:24:30 193,024 —-a-w d:\windows\system32\msrating.dll
+ 2008-10-16 20:38:38 193,024 —-a-w d:\windows\system32\msrating.dll
- 2008-08-26 07:24:30 671,232 —-a-w d:\windows\system32\mstime.dll
+ 2008-10-16 20:38:39 671,232 —-a-w d:\windows\system32\mstime.dll
- 2008-08-26 07:24:30 102,912 —-a-w d:\windows\system32\occache.dll
+ 2008-10-16 20:38:39 102,912 —-a-w d:\windows\system32\occache.dll
- 2008-12-19 19:03:28 59,638 —-a-w d:\windows\system32\perfc009.dat
+ 2008-12-21 15:35:32 59,638 —-a-w d:\windows\system32\perfc009.dat
- 2008-12-19 19:03:28 395,438 —-a-w d:\windows\system32\perfh009.dat
+ 2008-12-21 15:35:32 395,438 —-a-w d:\windows\system32\perfh009.dat
- 2008-08-26 07:24:30 44,544 —-a-w d:\windows\system32\pngfilt.dll
+ 2008-10-16 20:38:39 44,544 —-a-w d:\windows\system32\pngfilt.dll
- 2008-07-08 13:02:01 17,272 ——w d:\windows\system32\spmsg.dll
+ 2007-07-27 14:41:40 16,760 ——w d:\windows\system32\spmsg.dll
- 2008-07-14 11:09:18 62,976 ——w d:\windows\system32\tzchange.exe
+ 2008-10-22 09:47:07 62,976 ——w d:\windows\system32\tzchange.exe
- 2008-08-26 07:24:30 105,984 —-a-w d:\windows\system32\url.dll
+ 2008-10-16 20:38:39 105,984 —-a-w d:\windows\system32\url.dll
- 2008-08-26 07:24:31 1,159,680 —-a-w d:\windows\system32\urlmon.dll
+ 2008-10-16 20:38:39 1,160,192 —-a-w d:\windows\system32\urlmon.dll
- 2008-08-26 07:24:31 233,472 —-a-w d:\windows\system32\webcheck.dll
+ 2008-10-16 20:38:39 233,472 —-a-w d:\windows\system32\webcheck.dll
- 2004-08-04 20:00:00 1,050,624 —-a-w d:\windows\system32\wmnetmgr.dll
+ 2008-06-10 23:18:18 1,053,696 —-a-w d:\windows\system32\WMNetmgr.dll
- 2007-10-27 21:37:38 2,109,440 —-a-w d:\windows\system32\wmvcore.dll
+ 2008-11-07 23:32:20 2,109,440 —-a-w d:\windows\system32\WMVCore.dll
+ 2008-12-21 15:31:20 16,384 —-atw d:\windows\Temp\Perflib_Perfdata_660.dat
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="d:\windows\system32\ctfmon.exe" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG8_TRAY"="d:\progra~1\AVG\AVG8\avgtray.exe" [2008-11-27 1261336]
"LXBXCATS"="d:\windows\System32\spool\DRIVERS\W32X86\3\LXBXtime.dll" [2004-11-02 69632]
"lxbxmon.exe"="d:\program files\Lexmark 7100 Series\lxbxmon.exe" [2005-01-18 196608]
"FaxCenterServer4_in_1"="d:\program files\Lexmark 7100 Series\fm3032.exe" [2004-12-06 286720]
"EzPrint"="d:\program files\Lexmark 7100 Series\ezprint.exe" [2004-09-17 61440]
"Adobe Reader Speed Launcher"="d:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"SunJavaUpdateSched"="d:\program files\Java\jre6\bin\jusched.exe" [2008-11-19 136600]

[HKLM\~\startupfolder\D:^Documents and Settings^All Users^Start Menu^Programs^Startup^Bluetooth.lnk]
path=d:\documents and settings\All Users\Start Menu\Programs\Startup\Bluetooth.lnk
backup=d:\windows\pss\Bluetooth.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
–a—— 2004-08-04 15:00 15360 d:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
——— 2004-10-13 11:24 1694208 d:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
–a—— 2007-08-23 17:15 8478720 d:\windows\system32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
–a—— 2007-08-23 17:15 81920 d:\windows\system32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPStart]
–a—— 2007-09-14 18:29 102400 d:\program files\Synaptics\SynTP\SynTPStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
–a—— 2007-08-23 17:15 1626112 d:\windows\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ose"=3 (0x3)
"NVSvc"=2 (0x2)
"btwdins"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"d:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"d:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;d:\windows\system32\Drivers\avgldx86.sys [2008-10-04 97928]
R2 avg8emc;AVG Free8 E-mail Scanner;d:\progra~1\AVG\AVG8\avgemc.exe [2008-10-04 875288]
R2 avg8wd;AVG Free8 WatchDog;d:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-10-04 231704]
R2 AvgTdiX;AVG Free8 Network Redirector;d:\windows\system32\Drivers\avgtdix.sys [2008-10-04 76040]
S1 streamm;streamm;d:\windows\system32\drivers\streamm.sys []
S3 WLAN_400_500_SERVICE;HP WLAN W400/W500 Wireless Network Adapter Service;d:\windows\system32\DRIVERS\ar5211.sys [2008-08-31 468768]
.
.
——- Supplementary Scan ——-
.
IE: E&xport to Microsoft Excel - d:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Send to &Bluetooth Device… - d:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
FF - ProfilePath - d:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\vuyfwylj.default\
FF - component: d:\program files\AVG\AVG8\Firefox\components\avgssff.dll

ATTENTION: FIREFOX POLICES IS IN FORCE
FF - user.js: yahoo.homepage.dontask - true.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-21 10:36:06
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
LXBXCATS = rundll32 d:\windows\System32\spool\DRIVERS\W32X86\3\LXBXtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-12-21 10:36:38
ComboFix-quarantined-files.txt 2008-12-21 15:36:35
ComboFix2.txt 2008-12-19 20:52:02
ComboFix3.txt 2008-12-19 19:23:27

Pre-Run: 178,222,989,312 bytes free
Post-Run: 178,208,124,928 bytes free

302 — E O F — 2008-12-19 22:35:47


——————————
HiJackThis Log
——————————
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:38:19 AM, on 12/21/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
D:\Program Files\Java\jre6\bin\jqs.exe
D:\WINDOWS\system32\svchost.exe
D:\PROGRA~1\AVG\AVG8\avgrsx.exe
D:\PROGRA~1\AVG\AVG8\avgemc.exe
D:\PROGRA~1\AVG\AVG8\avgtray.exe
D:\Program Files\Lexmark 7100 Series\lxbxmon.exe
D:\Program Files\Java\jre6\bin\jusched.exe
D:\WINDOWS\system32\ctfmon.exe
D:\WINDOWS\system32\lxbxcoms.exe
D:\WINDOWS\system32\notepad.exe
D:\WINDOWS\explorer.exe
D:\HJT\HiJackThis(2).exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O4 - HKLM\..\Run: [AVG8_TRAY] D:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [LXBXCATS] rundll32 D:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBXtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [lxbxmon.exe] "D:\Program Files\Lexmark 7100 Series\lxbxmon.exe"
O4 - HKLM\..\Run: [FaxCenterServer4_in_1] "D:\Program Files\Lexmark 7100 Series\fm3032.exe" /s
O4 - HKLM\..\Run: [EzPrint] "D:\Program Files\Lexmark 7100 Series\ezprint.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth Device… - D:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - D:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - D:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - D:\Program Files\AVG\AVG8\avgpp.dll
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - D:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - D:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - D:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: lxbx_device - Lexmark International, Inc. - D:\WINDOWS\system32\lxbxcoms.exe

–
End of file - 3648 bytes
Post #14
Good job :thumbup:

The following will implement some cleanup procedures as well as reset System Restore points:

  • Click START then RUN
  • Now type Combofix /u in the runbox and click OK. Note the space between the X and the U, it needs to be there.

    • [external image: Posted Image]


    To be on the safe side, I would also change all my passwords.


    Here's my usual all clean post

    Log looks good :D


    • Make your Internet Explorer more secure - This can be done by following these simple instructions:
      • From within Internet Explorer click on the Tools menu and then click on Options.
      • Click once on the Security tab
      • Click once on the Internet icon so it becomes highlighted.
      • Click once on the Custom Level button.
      • Change the Download signed ActiveX controls to Prompt
      • Change the Download unsigned ActiveX controls to Disable
      • Change the Initialize and script ActiveX controls not marked as safe to Disable
      • Change the Installation of desktop items to Prompt
      • Change the Launching programs and files in an IFRAME to Prompt
      • Change the Navigate sub-frames across different domains to Prompt
      • When all these settings have been made, click on the OK button.
      • If it prompts you as to whether or not you want to save the settings, press the Yes button.
    • Next press the Apply button and then the OK to exit the Internet Properties page.
  • Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week
    (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.

  • Use a Firewall - I can not stress how important it is that you use a Firewall on your computer.
    Without a firewall your computer is succeptible to being hacked and taken over.
    I am very serious about this and see it happen almost every day with my clients.
    Simply using a Firewall in its default configuration can lower your risk greatly.

  • Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly.
    This will ensure your computer has always the latest security updates available installed on your computer.
    If there are new updates to install, install them immediately, reboot your computer, and revisit the site
    until there are no more critical updates.

  • MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.
  • Winpatrol

  • Update all these programs regularly - Make sure you update all the programs I have listed regularly.
    Without regular updates you WILL NOT be protected when new malicious programs are released.

Only run one Anti-Virus and Firewall program.

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein

Also: "How to prevent malware"

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI