Solved Antiviruses stop searching or can't clean

Stefan B · 2009/11/14

[Resolved] Antiviruses stop searching or can't clean

Hi,
I have a virus problem with my pc. Avira stopped scanning at "ezdgjg.sys" file.
Spyware Cleaner 2009, MalwareBytes and RootkitRevealer couldn't finish the scan, too.
F-Secure found "Trojan.Generic.IS" and "Rootkit: W32/TDSS.gen!C ", but couldn't delete them.

Help, please.
Stefan

Admin. · 2009/11/14

Hi,

Read this post as indicated at the top of this forum & follow the instructions.

Stefan B · 2009/11/16

DDS files

DDS (Ver_09-10-26.01) - NTFSx86
Run by Iulia & Stefan at 12:13:01.92 on Mon 11/16/2009
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_15
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.223.54 [GMT 2:00]

AV: PC Tools AntiVirus 2.0.3.35 *On-access scanning enabled* (Updated) {832E7172-E406-4BB2-8B19-6D29F2C93A98}
AV: F-Secure Anti-Virus 2010 10.00 *On-access scanning disabled* (Updated) {E7512ED5-4245-4B4D-AF3A-382D3F313F15}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
C:\WINDOWS\system32\svchost -k rpcss
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Infogate\CZone\Czone.exe
C:\PROGRA~1\Webshots\webshots.scr
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure\Common\FSHDLL32.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
C:\Program Files\F-Secure\ORSP Client\fsorsp.exe
C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\DfrgNtfs.exe
C:\Documents and Settings\i b\Desktop\dds.pif

============== Pseudo HJT Report ===============

uStart Page = about:blank
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
mDefault_Search_URL = hxxp://www.google.com/ie
mSearch Page = hxxp://www.google.com
mStart Page = hxxp://www.google.com
mSearchAssistant = hxxp://www.google.com
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
BHO: {119cd4d7-8024-4ad3-a6b8-178ab65b99be} - c:\windows\system32\ddcAsspQ.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Winamp Toolbar Loader: {25cee8ec-5730-41bc-8b58-22ddc8ab8c20} - c:\program files\winamp toolbar\winamptb.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\rpbrowserrecordplugin.dll
BHO: {a388987f-ee5c-44b2-ad9e-0ea7ee7731a1} - c:\windows\system32\pmnolMGY.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.3.4501.1418\swg.dll
BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_B7C5AC242193BB3E.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
TB: Webshots Toolbar: {c17590d2-ecb4-4b15-8820-f58798dcc118} - c:\program files\webshots\WSToolbar4IE.dll
TB: Winamp Toolbar: {ebf2ba02-9094-4c5a-858b-bb198f3d8de2} - c:\program files\winamp toolbar\winamptb.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
TB: {A057A204-BACC-4D26-9990-79A187E2698E} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe "
uRun: [Messenger (Yahoo!)] "c:\progra~1\yahoo!\messen~1\YAHOOM~1.EXE" -quiet
mRun: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe
mRun: [InCD] c:\program files\ahead\incd\InCD.exe
mRun: [ISUSPM] "c:\program files\common files\installshield\updateservice\ISUSPM.exe" -scheduler
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe "
mRun: [WinampAgent] "c:\program files\winamp\winampa.exe "
mRun: [ISTray] "c:\program files\spyware doctor\pctsTray.exe "
mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe "
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe "
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe "
mRun: [F-Secure Manager] "c:\program files\f-secure\common\FSM32.EXE" /splash
mRun: [F-Secure TNB] "c:\program files\f-secure\fsgui\TNBUtil.exe" /CHECKALL /WAITFORSW
StartupFolder: c:\docume~1\iulia&~1\startm~1\programs\startup\c-zone.lnk - c:\program files\infogate\C-zone.exe
StartupFolder: c:\docume~1\iulia&~1\startm~1\programs\startup\webshots.lnk - c:\program files\webshots\Launcher.exe
StartupFolder: c:\docume~1\alluse~1.win\startm~1\programs\startup\czone.lnk - c:\program files\infogate\czone\Czone.exe
IE: &Webshots Photo Search - c:\program files\webshots\WSToolbar4IE.dll/MENUSEARCH.HTM
IE: &Winamp Search - c:\documents and settings\all users.windows\application data\winamp toolbar\ietoolbar\resources\en-us\local\search.html
IE: &Yahoo! Search - file:///c:\program files\yahoo!\Common/ycsrch.htm
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000
IE: Yahoo! &Dictionary - file:///c:\program files\yahoo!\Common/ycdict.htm
IE: Yahoo! &Maps - file:///c:\program files\yahoo!\Common/ycmap.htm
IE: Yahoo! &SMS - file:///c:\program files\yahoo!\Common/ycsms.htm
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - c:\program files\yahoo!\common\yiesrvc.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
LSP: c:\program files\f-secure\fsps\program\FSLSP.DLL
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/C/0/C/C0CBBA88-A6F2-48D9-9B0E-1719D1177202/LegitCheckControl.cab
DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} - hxxp://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\yinsthelper.dll
DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} - hxxp://www.eset.eu/buxus/docs/OnlineScanner.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1248936321140
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
TCP: {C8B928FF-7423-4F30-9112-5ED4945ADA23} = 81.181.111.2,80.96.198.2
SEH: {DC6BE1D5-9B83-4C75-ACEB-900781D28611} - No File

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\ib0969~1\applic~1\mozilla\firefox\profiles\4x63kuj1.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Wikipedia (en)
FF - prefs.js: network.proxy.type - 4
FF - component: c:\documents and settings\i b\application data\mozilla\firefox\profiles\4x63kuj1.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}\components\WinampTBPlayer.dll
FF - component: c:\program files\real\realplayer\browserrecord\components\nprpbrowserrecordplugin.dll
FF - plugin: c:\progra~1\yahoo!\common\npyaxmpb.dll
FF - plugin: c:\program files\google\google updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\google\update\1.2.183.7\npGoogleOneClick8.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

============= SERVICES / DRIVERS ===============

R0 fsbts;fsbts;c:\windows\system32\drivers\fsbts.sys [2009-11-11 33920]
R0 FSFW;F-Secure Firewall Driver;c:\windows\system32\drivers\fsdfw.sys [2009-11-11 80000]
R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2008-11-13 28544]
R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2009-7-3 130936]
R1 F-Secure HIPS;F-Secure HIPS Driver;c:\program files\f-secure\hips\drivers\fshs.sys [2009-11-11 68064]
R3 F-Secure Gatekeeper;F-Secure Gatekeeper;c:\program files\f-secure\anti-virus\minifilter\fsgk.sys [2009-11-11 101496]
R3 FSORSPClient;F-Secure ORSP Client;c:\program files\f-secure\orsp client\fsorsp.exe [2009-11-11 55928]
S2 avast!UpdateAgent.exe;avast!UpdateAgent.exe;c:\windows\system32\avast!updateagent.exe -k netsvcs --> c:\windows\system32\avast!UpdateAgent.exe -k netsvcs [?]
S2 ezdgjg;ezdgjg;c:\windows\system32\drivers\ezdgjg.sys [2009-10-18 250880]
S2 gupdate1ca0f9d77f7758e;Google Update Service (gupdate1ca0f9d77f7758e);c:\program files\google\update\GoogleUpdate.exe [2009-7-28 133104]
S3 AGXWOM;AGXWOM;c:\docume~1\ib0969~1\locals~1\temp\AGXWOM.exe [2009-10-31 400256]
S3 E;E;c:\docume~1\ib0969~1\locals~1\temp\E.exe [2009-11-2 580480]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\e:\ntglm7x.sys --> e:\NTGLM7X.sys [?]
S4 F-Secure Filter;F-Secure File System Filter;c:\program files\f-secure\anti-virus\win2k\fsfilter.sys [2009-11-11 39776]
S4 F-Secure Recognizer;F-Secure File System Recognizer;c:\program files\f-secure\anti-virus\win2k\fsrec.sys [2009-11-11 25184]

=============== Created Last 30 ================

2009-11-11 12:03:03 33920 ----a-w- c:\windows\system32\drivers\fsbts.sys
2009-11-11 12:02:20 80000 ----a-w- c:\windows\system32\drivers\fsdfw.sys
2009-11-11 12:01:05 0 d-----w- c:\program files\F-Secure
2009-11-11 11:54:40 0 d-----w- c:\docume~1\alluse~1.win\applic~1\fssg
2009-11-11 11:41:06 0 d-----w- c:\docume~1\alluse~1.win\applic~1\f-secure
2009-11-02 10:29:25 0 d-----w- c:\docume~1\ib0969~1\applic~1\Malwarebytes
2009-11-02 10:29:15 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-11-02 10:29:11 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-11-02 10:29:11 0 d-----w- c:\docume~1\alluse~1.win\applic~1\Malwarebytes
2009-11-02 10:29:10 0 d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-11-02 07:25:09 1409 ----a-w- c:\windows\QTFont.for
2009-11-02 07:25:08 54156 ---ha-w- c:\windows\QTFont.qfn
2009-10-30 07:56:40 0 d-----w- C:\Spyware Cleaner 2009 V3.04
2009-10-26 12:08:35 0 d-----w- c:\documents and settings\i b\New Folder
2009-10-18 15:51:23 250880 --s-a-w- c:\windows\system32\drivers\ezdgjg.sys

==================== Find3M ====================

2009-09-30 08:59:36 716 ----a-w- c:\program files\CinemasterVideo.4.3.manifest
2009-09-30 08:59:36 572 ----a-w- c:\program files\CinemasterAudio.4.3.manifest
2009-09-30 08:59:36 222728 ----a-w- c:\program files\realplay.exe
2009-09-30 08:59:36 1166 ----a-w- c:\program files\realplay.exe.manifest
2009-09-30 08:59:35 23558 ----a-w- c:\program files\freeoffers.ico
2009-09-30 08:59:35 221 ----a-w- c:\program files\subscription.rnx
2009-09-30 08:59:35 17846 ----a-w- c:\program files\videotest.rm
2009-09-30 08:59:35 177 ----a-w- c:\program files\freeoffers.rnx
2009-09-30 08:59:34 499712 ----a-w- c:\windows\system32\msvcp71.dll
2009-09-30 08:59:31 685 ----a-w- c:\program files\RecordingManager.exe.manifest
2009-09-30 08:59:31 198208 ----a-w- c:\program files\RecordingManager.exe
2008-10-29 20:42:15 15900 ----a-w- c:\program files\common files\vygakag.vbs
2008-10-29 20:42:15 14331 ----a-w- c:\program files\common files\zubulomu.lib
2008-10-29 20:42:15 14275 ----a-w- c:\program files\common files\sebe.bat
2008-10-29 20:42:14 12364 ----a-w- c:\program files\common files\ytane.pif
2008-10-29 15:17:19 17433 ----a-w- c:\program files\common files\dypocosev.dl
2008-10-29 15:17:18 14646 ----a-w- c:\program files\common files\ufowaqopos.pif
2008-10-29 15:17:18 13911 ----a-w- c:\program files\common files\mazugokyw.bin
2008-10-29 15:17:18 12206 ----a-w- c:\program files\common files\gatyqem._sy
2008-10-29 15:17:18 10188 ----a-w- c:\program files\common files\edukokor.dl
2008-10-28 15:34:43 19069 ----a-w- c:\program files\common files\conemevasi.lib
2008-10-28 15:34:43 18147 ----a-w- c:\program files\common files\iqefok.ban
2008-10-28 15:34:43 13375 ----a-w- c:\program files\common files\nilolevav.bat
2008-06-30 18:06:30 2479604 ----a-w- c:\program files\ac3filter_1_50a.exe
2007-12-31 09:02:50 250880 ----a-w- c:\program files\install.exe

============= FINISH: 12:14:50.06 ===============

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-10-26.01)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 4/5/2006 7:46:17 PM
System Uptime: 11/16/2009 8:59:59 AM (4 hours ago)

Motherboard: | | P4VM800
Processor: Intel(R) Celeron(R) CPU 2.53GHz | CPUSocket | 2533/133mhz

==== Disk Partitions =========================

A: is Removable
C: is FIXED (NTFS) - 20 GiB total, 2.513 GiB free.
D: is FIXED (NTFS) - 55 GiB total, 22.333 GiB free.
E: is CDROM ()
F: is CDROM ()

==== Disabled Device Manager Items =============

Class GUID: {4D36E968-E325-11CE-BFC1-08002BE10318}
Description: Video Controller (VGA Compatible)
Device ID: PCI\VEN_1106&DEV_3344&SUBSYS_33441849&REV_01\4&354AEA31&0&0008
Manufacturer:
Name: Video Controller (VGA Compatible)
PNP Device ID: PCI\VEN_1106&DEV_3344&SUBSYS_33441849&REV_01\4&354AEA31&0&0008
Service:

==== System Restore Points ===================

RP732: 9/23/2009 12:41:08 PM - System Checkpoint
RP733: 9/24/2009 1:51:06 PM - System Checkpoint
RP734: 9/25/2009 8:53:05 AM - Software Distribution Service 3.0
RP735: 9/26/2009 1:34:25 PM - System Checkpoint
RP736: 9/27/2009 2:23:40 PM - System Checkpoint
RP737: 9/28/2009 5:25:00 PM - Installed Java(TM) 6 Update 15
RP738: 9/30/2009 11:19:30 AM - System Checkpoint
RP739: 10/1/2009 7:05:26 PM - System Checkpoint
RP740: 10/2/2009 7:15:41 PM - System Checkpoint
RP741: 10/4/2009 9:43:13 AM - System Checkpoint
RP742: 10/5/2009 11:14:10 AM - System Checkpoint
RP743: 10/6/2009 2:35:06 PM - System Checkpoint
RP744: 10/7/2009 4:30:10 PM - System Checkpoint
RP745: 10/8/2009 6:45:19 PM - System Checkpoint
RP746: 10/9/2009 8:23:42 PM - System Checkpoint
RP747: 10/13/2009 7:03:08 PM - System Checkpoint
RP748: 10/15/2009 11:54:17 AM - System Checkpoint
RP749: 10/18/2009 12:57:54 PM - System Checkpoint
RP750: 10/20/2009 6:59:08 PM - System Checkpoint
RP751: 10/24/2009 11:52:10 AM - System Checkpoint
RP752: 10/26/2009 3:08:22 PM - System Checkpoint
RP753: 10/27/2009 6:11:12 PM - System Checkpoint
RP754: 10/28/2009 7:02:00 PM - System Checkpoint
RP755: 10/30/2009 1:04:01 PM - System Checkpoint
RP756: 11/2/2009 9:14:59 PM - System Checkpoint
RP757: 11/4/2009 6:37:12 PM - System Checkpoint
RP758: 11/6/2009 1:39:12 PM - System Checkpoint
RP759: 11/9/2009 11:09:53 AM - System Checkpoint
RP760: 11/10/2009 3:53:32 PM - System Checkpoint
RP761: 11/11/2009 1:59:05 PM - Avira AntiVir Personal - 11/11/2009 13:58
RP762: 11/11/2009 2:01:02 PM - is 10.00 build 246 Installation
RP763: 11/12/2009 3:34:37 PM - System Checkpoint
RP764: 11/13/2009 8:45:55 PM - System Checkpoint

==== Installed Programs ======================

µTorrent
50 FREE MP3s +1 Free Audiobook!
ABF Outlook Express Backup
AC3Filter (remove only)
Ad-Aware
Adobe Extension Manager CS4
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 9.2
Adobe Setup
Adobe SVG Viewer 3.0
Apple Mobile Device Support
Apple Software Update
AutoUpdate
AVS Audio Recorder version 3.9
AVS Media Player 3.1
AVS Update Manager 1.0
AVS4YOU Software Navigator 1.3
BodeCAD 2.18
C-Media 3D Audio
Camera Support Core Library
Camera Window DS
Camera Window DVC
Camera Window MC
Canon Camera Support Core Library
Canon Camera Window DS for ZoomBrowser EX
Canon Camera Window DVC for ZoomBrowser EX
Canon Camera Window for ZoomBrowser EX
Canon Internet Library for ZoomBrowser EX
Canon MovieEdit Task for ZoomBrowser EX
Canon PhotoRecord
Canon RAW Image Task for ZoomBrowser EX
Canon RemoteCapture Task for ZoomBrowser EX
Canon Utilities PhotoStitch 3.1
Canon ZoomBrowser EX
CCleaner (remove only)
Certification Preparation
DivX Codec
DivX Converter
DivX Player
DivX Web Player
F-Secure Anti-Virus 2010
F-Secure PSC Prerequisites
Google Chrome
Google Earth
Google Toolbar for Internet Explorer
Google Update Helper
Google Updater
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB914440)
Hotfix for Windows XP (KB915865)
Hotfix for Windows XP (KB926239)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB970653-v3)
InCD
Internet Library
iTunes
Java(TM) 6 Update 15
Java(TM) 6 Update 5
LTspice IV
Malwarebytes' Anti-Malware
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office Professional Edition 2003
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
MovieEdit Task
Mozilla Firefox (3.0.13)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
Nero OEM
NeroVision Express 2
NeroVision Express 2 Content
Neuron GIS
OrCAD 9.0
Panda ActiveScan 2.0
ParetoLogic DriverCure
PhotoStitch
PSpice Student 9.1
QuickTime
RAW Image Task 1.2
RealPlayer
RemoteCapture Task 1.1
ROUTE 66 Route 2000
S3GSetup
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB972260)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 9 (KB917734)
Security Update for Windows Media Player 9 (KB936782)
Security Update for Windows XP (KB883939)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893066)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896422)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899588)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB903235)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921503)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB923694)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928090)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB929969)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931768)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB933566)
Security Update for Windows XP (KB933729)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
Security Update for Windows XP (KB936021)
Security Update for Windows XP (KB937143)
Security Update for Windows XP (KB937894)
Security Update for Windows XP (KB938127)
Security Update for Windows XP (KB938464-v2)
Security Update for Windows XP (KB938829)
Security Update for Windows XP (KB939653)
Security Update for Windows XP (KB941202)
Security Update for Windows XP (KB941568)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB941644)
Security Update for Windows XP (KB941693)
Security Update for Windows XP (KB943055)
Security Update for Windows XP (KB943460)
Security Update for Windows XP (KB943485)
Security Update for Windows XP (KB944653)
Security Update for Windows XP (KB945553)
Security Update for Windows XP (KB946026)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB948590)
Security Update for Windows XP (KB948881)
Security Update for Windows XP (KB950749)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958470)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371-v2)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB971032)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973869)
Spyware Cleaner 2009 V3.04
Spyware Doctor 6.0
The File Splitter 1.31
Update for Windows XP (KB894391)
Update for Windows XP (KB896727)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB904942)
Update for Windows XP (KB908531)
Update for Windows XP (KB910437)
Update for Windows XP (KB911280)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB927891)
Update for Windows XP (KB929338)
Update for Windows XP (KB930916)
Update for Windows XP (KB931836)
Update for Windows XP (KB932823-v3)
Update for Windows XP (KB933360)
Update for Windows XP (KB936357)
Update for Windows XP (KB938828)
Update for Windows XP (KB942763)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB973815)
WebFldrs XP
Webshots Desktop
Webshots Toolbar
Winamp
Winamp Toolbar
Windows Genuine Advantage Validation Tool (KB892130)
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Media Format Runtime
Windows XP Hotfix - KB873333
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB885884
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB887742
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890047
Windows XP Hotfix - KB890175
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB890923
Windows XP Hotfix - KB891781
Windows XP Hotfix - KB893086
WinRAR archiver
Xvid 1.1.3 final uninstall
Yahoo! Browser Services
Yahoo! Install Manager
Yahoo! Internet Mail
Yahoo! Messenger
Yahoo! Toolbar

==== Event Viewer Messages From Past Week ========

11/9/2009 9:29:16 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Application Layer Gateway Service service to connect.
11/9/2009 9:29:16 AM, error: Service Control Manager [7000] - The Application Layer Gateway Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
11/14/2009 2:09:34 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Google Software Updater service to connect.
11/14/2009 2:09:34 PM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service gusvc with arguments " " in order to run the server: {89DAE4CD-9F17-4980-902A-99BA84A8F5C8}
11/12/2009 10:22:47 AM, error: Service Control Manager [7000] - The IMAPI CD-Burning COM Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
11/12/2009 10:22:46 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the IMAPI CD-Burning COM Service service to connect.
11/11/2009 10:47:25 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Beep
11/11/2009 10:46:32 AM, error: Service Control Manager [7000] - The ezdgjg service failed to start due to the following error: A device attached to the system is not functioning.

==== End Of File ===========================

broni · 2009/11/16

Please download ComboFix from [color= "Red"]Here[/color] or [color= "#FF0000"]Here[/color] to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

Please, never rename Combofix unless instructed.

Close any open browsers.

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results ".

Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

NOTE. If Combofix asks you to install Recovery Console, please allow it.

Close any open browsers.

WARNING: Combofix will disconnect your machine from the Internet as soon as it starts

Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.

If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

Double click on combofix.exe & follow the prompts.

When finished, it will produce a report for you.

Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

Make sure, you re-enable your security programs, when you're done with Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

Download HijackThis:
http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download
by clicking on Download HijackThis Installer
Install, and run it.
Post HijackTHis log.
Do NOT attempt to fix anything!

NOTE. If you're using Vista, right click on HijackThis, and click Run as Administrator

Stefan B · 2009/11/17

Didn't obtain ComboFix.txt

Hi,
My guess is I failed to properly run ComboFix.exe.
I installed Recovery Console when I was asked to, antivirus F-Secure was disabled, I ran ComboFix.exe and it showed a window - AutoScan. After more than 1 hour the text in the window was this:

"Scanning for infected files . . .
This typically doesn't take more than 10 minutes
However, scan times for badly infected machines may easily double

Completed Stage_1
Completed Stage_2
Completed Stage_3
Completed Stage_4
Completed Stage_5
Completed Stage_6
Completed Stage_6A
Completed Stage_7
Completed Stage_8
Completed Stage_9
Completed Stage_10
Completed Stage_11
Completed Stage_12
Completed Stage_13
Completed Stage_14
Completed Stage_15
Completed Stage_16
Completed Stage_17 "

I stopped the computer.
Folder "ComboFix" was created on drive C:\ and "Shows the disk drives and hardware connected to this computer ".
What shall I do next?

broni · 2009/11/17

Delete Combofix manually (whatever is present)....
Delete Combofix, Qoobox folders,and Combofix.txt file from C:
Delete Combofix from your desktop.

With serious infection, Combofix run time may be longer.
Download fresh copy from HERE and run it again.
I renamed the file for a reason.

Stefan B · 2009/11/18

I downloaded "5cft34rsd.exe" on my desktop, I ran it and the message that showed up said this executable file "is not a valid Win32 application ".

broni · 2009/11/18

Please download [color= "#CC0000"]The Avenger[/color] by Swandog46 to your Desktop.
- Right click on the Avenger.zip folder and select Extract All...
- Follow the prompts and extract the avenger folder to your desktop

Double click on avenger.exe.
Click OK in pop-up window.

Avenger window will open.

Click on Execute button.
Click OK in two consecutive pop-up windows.

Your computer will re-boot now.

Upon re-boot, Notepad window will open.
Select all text, copy it, and paste it into next reply.

NOTE. If the log doesn't open on reboot, open Avenger again, and go File>Open Log File.

Stefan B · 2009/11/19

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

Completed script processing.

*******************

Finished! Terminate.

broni · 2009/11/19

Download OTL to your Desktop.

* Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
* Under the Custom Scan box paste this in:

netsvcs
%SYSTEMDRIVE%\*.exe
%systemroot%\system32\eventlog.dll
%systemroot%\system32\scecli.dll
%systemroot%\netlogon.dll
%systemroot%\system32\cngaudit.dll
%systemroot%\system32\sceclt.dll
%systemroot%\ntelogon.dll
%systemroot%\system32\logevent.dll

* Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.

Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.
Since those are pretty big files, you can attach them, if you wish.

Stefan B · 2009/11/23

Hi,
I don't have the .txt files. OTL scan stopped and the bottom message was "Looking for newly created files: C:\WINDOWS\System32\drivers\ezdgjg.sys... "
This was the file where my initial Avira program stopped, too.

Stefan B · 2009/11/23

I can't close the window "OTL by OldTimer - Version 3.1.6.1 "

I tried Windows Task Manager > Applications > End Task and ...> Processes > End process.

broni · 2009/11/23

See, if you can run Combofix from Safe mode.

Stefan B · 2009/11/25

How can I send e-mail with attached files?

Stefan B · 2009/11/25

I mean Post Reply with attachments.

broni · 2009/11/25

You can't on this board. Why do you need to attach anything?

Stefan B · 2009/11/26

I don't need to attach, but somewhere you left me the idea that it is possible and I wanted to see it.
I couldn't disable PC Tools Antivirus - I couldn't find it on my computer.

ComboFix.txt

ComboFix 09-11-23.06 - Iulia & Stefan 11/24/2009 19:48.2.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.223.104 [GMT 2:00]
Running from: c:\documents and settings\i b\Desktop\ComboFix.exe
AV: PC Tools AntiVirus 2.0.3.35 *On-access scanning enabled* (Updated) {832E7172-E406-4BB2-8B19-6D29F2C93A98}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users.WINDOWS\Application Data\Software Licensors
c:\documents and settings\i b\Desktop\[TorrentReactor.to] - Uniblue Driver Scanner 2009 v 2 0 0 26 [100% Working].torrent
c:\documents and settings\i b\Desktop\[TorrentReactor.to] - Uniblue Driver Scanner 2009 v 2 0 0 26 [100% Working].torrent
c:\documents and settings\i b\Local Settings\Application Data\ynyzuz.inf
c:\documents and settings\i b\Local Settings\Temporary Internet Files\bififeh.dat
c:\documents and settings\i b\Local Settings\Temporary Internet Files\garime._sy
c:\documents and settings\i b\Local Settings\Temporary Internet Files\lihypi.inf
c:\documents and settings\i b\Local Settings\Temporary Internet Files\pevequra.lib
c:\documents and settings\i b\Local Settings\Temporary Internet Files\qusuz.bin
c:\documents and settings\i b\Local Settings\Temporary Internet Files\wusuwuxa.reg
c:\documents and settings\i b\Local Settings\Temporary Internet Files\yjeqifuny.sys
c:\program files\Common Files\nilolevav.bat
c:\program files\Common Files\sebe.bat
c:\program files\Common Files\vygakag.vbs
c:\recycler\S-1-5-21-789336058-2077806209-725345543-500
c:\windows\enyviquz.scr
c:\windows\eqom.scr
c:\windows\migoqova.reg
c:\windows\omytipobe.exe
c:\windows\opotabyqe.inf
c:\windows\oselodacu.exe
c:\windows\system32\drivers\ezdgjg.sys
c:\windows\system32\ieupdates.exe.tmp
c:\windows\system32\mcrh.tmp
c:\windows\uxiv._sy
c:\windows\vysuce.reg
c:\windows\yqemeduvir.reg

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_E
-------\Legacy_EZDGJG
-------\Service_E
-------\Service_ezdgjg

((((((((((((((((((((((((( Files Created from 2009-10-24 to 2009-11-24 )))))))))))))))))))))))))))))))
.

2009-11-24 13:13 . 2009-11-24 13:13 33558 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Google\Toolbar for Firefox\Firefox_Toolbar_Uninstaller.exe
2009-11-20 14:38 . 2009-11-23 17:38 -------- d-----w- c:\documents and settings\i b\Local Settings\Application Data\AskToolbar
2009-11-20 14:37 . 2009-11-20 14:37 -------- d-----w- c:\program files\Ask.com
2009-11-20 14:36 . 2009-11-23 16:51 -------- d-----w- c:\documents and settings\i b\Local Settings\Application Data\FLVService
2009-11-20 14:36 . 2009-11-20 14:36 -------- d-----w- c:\windows\Ask & Record Toolbar
2009-11-20 14:36 . 2009-11-20 14:36 -------- d-----w- c:\program files\Ask & Record Toolbar
2009-11-20 14:33 . 2009-11-20 14:34 8801704 ----a-w- c:\program files\FLV PlayerATBSetup.exe
2009-11-20 14:33 . 2009-11-20 14:33 -------- d-----w- c:\program files\FLV Player
2009-11-20 14:33 . 2009-11-20 14:33 -------- d-----w- c:\windows\Applian FLV Player
2009-11-20 14:07 . 2009-11-20 14:07 -------- d-----w- C:\My Music
2009-11-19 11:04 . 2009-11-19 11:04 283006 ----a-w- c:\program files\utorrent.exe
2009-11-11 12:03 . 2009-11-11 12:03 -------- d-----w- c:\documents and settings\NetworkService.NT AUTHORITY.000\Local Settings\Application Data\F-Secure
2009-11-11 12:01 . 2009-11-24 17:34 -------- d-----w- c:\program files\F-Secure
2009-11-11 11:54 . 2009-11-11 12:00 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\fssg
2009-11-11 11:41 . 2009-11-24 17:23 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\f-secure
2009-11-05 16:24 . 2009-11-05 16:28 -------- d-----w- c:\documents and settings\Default User.WINDOWS\Local Settings\Application Data\Adobe
2009-11-02 10:29 . 2009-11-02 10:29 -------- d-----w- c:\documents and settings\i b\Application Data\Malwarebytes
2009-11-02 10:29 . 2009-09-10 12:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-11-02 10:29 . 2009-11-02 10:29 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Malwarebytes
2009-11-02 10:29 . 2009-09-10 12:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-11-02 10:29 . 2009-11-02 10:29 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-10-30 07:56 . 2009-10-30 07:56 -------- d-----w- C:\Spyware Cleaner 2009 V3.04
2009-10-26 12:08 . 2009-10-26 12:08 -------- d-----w- c:\documents and settings\i b\New Folder

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-24 14:37 . 2009-08-11 11:29 664 ----a-w- c:\windows\system32\d3d9caps.dat
2009-11-24 13:14 . 2008-06-18 17:44 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Google Updater
2009-11-20 15:45 . 2008-10-25 11:52 -------- d-----w- c:\documents and settings\i b\Application Data\uTorrent
2009-11-20 14:13 . 2009-09-30 09:00 -------- d-----w- c:\program files\library
2009-11-17 12:06 . 2008-11-05 16:40 -------- d---a-w- c:\documents and settings\All Users.WINDOWS\Application Data\TEMP
2009-11-06 14:35 . 2008-02-16 16:02 -------- d-----w- c:\program files\Common Files\Adobe
2009-10-15 09:23 . 2007-12-31 09:19 -------- d-----w- c:\program files\Apple Software Update
2009-10-09 08:50 . 2009-10-09 08:39 -------- d-----w- c:\program files\LTC
2009-10-05 16:36 . 2009-10-05 16:36 -------- d-----w- c:\program files\CCleaner
2009-09-30 08:59 . 2009-09-30 08:59 716 ----a-w- c:\program files\CinemasterVideo.4.3.manifest
2009-09-30 08:59 . 2009-09-30 08:59 572 ----a-w- c:\program files\CinemasterAudio.4.3.manifest
2009-09-30 08:59 . 2009-09-30 08:59 222728 ----a-w- c:\program files\realplay.exe
2009-09-30 08:59 . 2009-09-30 08:59 1166 ----a-w- c:\program files\realplay.exe.manifest
2009-09-30 08:59 . 2009-09-30 08:59 23558 ----a-w- c:\program files\freeoffers.ico
2009-09-30 08:59 . 2009-09-30 08:59 221 ----a-w- c:\program files\subscription.rnx
2009-09-30 08:59 . 2009-09-30 08:59 17846 ----a-w- c:\program files\videotest.rm
2009-09-30 08:59 . 2009-09-30 08:59 177 ----a-w- c:\program files\freeoffers.rnx
2009-09-30 08:59 . 2003-03-18 18:14 499712 ----a-w- c:\windows\system32\msvcp71.dll
2009-09-30 08:59 . 2009-09-30 08:59 685 ----a-w- c:\program files\RecordingManager.exe.manifest
2009-09-30 08:59 . 2009-09-30 08:59 198208 ----a-w- c:\program files\RecordingManager.exe
2009-09-28 14:25 . 2007-09-09 08:34 -------- d-----w- c:\program files\Java
2009-09-28 14:23 . 2009-09-28 14:23 152576 ----a-w- c:\documents and settings\i b\Application Data\Sun\Java\jre1.6.0_15\lzma.dll
2009-09-14 22:38 . 2009-09-14 22:38 79856 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Google\Toolbar for Firefox\{3112ca9c-de6d-4884-a869-9855de68056c}\uninstaller.exe
2008-10-29 20:42 . 2008-10-29 20:42 14331 ----a-w- c:\program files\Common Files\zubulomu.lib
2008-10-29 20:42 . 2008-10-29 20:42 12364 ----a-w- c:\program files\Common Files\ytane.pif
2008-10-29 15:17 . 2008-10-29 15:17 17433 ----a-w- c:\program files\Common Files\dypocosev.dl
2008-10-29 15:17 . 2008-10-29 15:17 14646 ----a-w- c:\program files\Common Files\ufowaqopos.pif
2008-10-29 15:17 . 2008-10-29 15:17 13911 ----a-w- c:\program files\Common Files\mazugokyw.bin
2008-10-29 15:17 . 2008-10-29 15:17 12206 ----a-w- c:\program files\Common Files\gatyqem._sy
2008-10-29 15:17 . 2008-10-29 15:17 10188 ----a-w- c:\program files\Common Files\edukokor.dl
2008-10-28 15:34 . 2008-10-28 15:34 19069 ----a-w- c:\program files\Common Files\conemevasi.lib
2008-10-28 15:34 . 2008-10-28 15:34 18147 ----a-w- c:\program files\Common Files\iqefok.ban
2008-06-30 18:06 . 2008-07-02 16:39 2479604 ----a-w- c:\program files\ac3filter_1_50a.exe
2007-12-31 09:02 . 2007-12-31 09:02 250880 ----a-w- c:\program files\install.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2009-06-04 16:04 1144712 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440} "= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-06-04 1144712]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440} "= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-06-04 1144712]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg "= "c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-06-18 68856]
"ctfmon.exe "= "c:\windows\system32\ctfmon.exe" [2004-08-03 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck "= "c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"InCD "= "c:\program files\Ahead\InCD\InCD.exe" [2004-07-16 1409136]
"QuickTime Task "= "c:\program files\QuickTime\qttask.exe" [2007-12-11 286720]
"iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2007-12-11 267048]
"WinampAgent "= "c:\program files\Winamp\winampa.exe" [2009-07-01 37888]
"SunJavaUpdateSched "= "c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"TkBellExe "= "c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-09-30 198160]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM "= "c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"Ask and Record FLV Service "= "c:\program files\Ask & Record Toolbar\FLVSrvc.exe" [2009-03-10 156672]

c:\documents and settings\All Users.WINDOWS\Start Menu\Programs\Startup\
Czone.lnk - c:\program files\Infogate\CZone\Czone.exe [2009-6-11 1380864]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ 'autocheck autochk *'\0lsdelete

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@= "Service "

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"SharedAccess "=2 (0x2)
"FSORSPClient "=3 (0x3)
"FSMA "=2 (0x2)
"FSDFWD "=3 (0x3)
"Browser "=2 (0x2)
"avast!UpdateAgent.exe "=2 (0x2)
"aawservice "=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall "= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe "=
"c:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe "=
"c:\\Program Files\\NetMeeting\\conf.exe "=
"c:\\WINDOWS\\system32\\mmc.exe "=
"c:\\Program Files\\uTorrent\\uTorrent.exe "=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest "= 1 (0x1)

R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [11/13/2008 5:10 PM 28544]
S2 gupdate1ca0f9d77f7758e;Google Update Service (gupdate1ca0f9d77f7758e);c:\program files\Google\Update\GoogleUpdate.exe [7/28/2009 6:07 PM 133104]
S3 AGXWOM;AGXWOM;c:\docume~1\IB0969~1\LOCALS~1\Temp\AGXWOM.exe --> c:\docume~1\IB0969~1\LOCALS~1\Temp\AGXWOM.exe [?]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\e:\ntglm7x.sys --> e:\NTGLM7X.sys [?]
S4 avast!UpdateAgent.exe;avast!UpdateAgent.exe;c:\windows\System32\avast!UpdateAgent.exe -k netsvcs --> c:\windows\System32\avast!UpdateAgent.exe -k netsvcs [?]
.
Contents of the 'Scheduled Tasks' folder

2009-11-19 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 09:34]

2009-07-26 c:\windows\Tasks\DriverCure.job
- c:\program files\ParetoLogic\DriverCure\DriverCure.exe [2009-07-18 00:16]

2009-11-24 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-06-18 13:57]

2009-11-24 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-28 16:06]

2009-11-24 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-28 16:06]

2009-11-24 c:\windows\Tasks\ParetoLogic Registration.job
- c:\program files\Common Files\ParetoLogic\UUS2\UUS.dll [2009-01-13 14:59]

2009-07-28 c:\windows\Tasks\ParetoLogic Update Version2.job
- c:\program files\Common Files\ParetoLogic\UUS2\Pareto_Update.exe [2009-01-13 14:59]

2009-11-24 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
- c:\program files\Ask.com\UpdateTask.exe [2009-06-04 16:04]
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
mStart Page = hxxp://www.google.com
IE: &Webshots Photo Search - c:\program files\Webshots\WSToolbar4IE.dll/MENUSEARCH.HTM
IE: &Winamp Search - c:\documents and settings\All Users.WINDOWS\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
IE: &Yahoo! Search - file:///c:\program files\Yahoo!\Common/ycsrch.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Yahoo! &Dictionary - file:///c:\program files\Yahoo!\Common/ycdict.htm
IE: Yahoo! &Maps - file:///c:\program files\Yahoo!\Common/ycmap.htm
IE: Yahoo! &SMS - file:///c:\program files\Yahoo!\Common/ycsms.htm
TCP: {C8B928FF-7423-4F30-9112-5ED4945ADA23} = 81.181.111.2,80.96.198.2
FF - ProfilePath - c:\documents and settings\i b\Application Data\Mozilla\Firefox\Profiles\4x63kuj1.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Wikipedia (en)
FF - prefs.js: network.proxy.type - 4
FF - component: c:\documents and settings\i b\Application Data\Mozilla\Firefox\Profiles\4x63kuj1.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}\components\WinampTBPlayer.dll
FF - plugin: c:\progra~1\Yahoo!\Common\npyaxmpb.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
.
- - - - ORPHANS REMOVED - - - -

BHO-{119CD4D7-8024-4AD3-A6B8-178AB65B99BE} - c:\windows\system32\ddcAsspQ.dll
BHO-{A388987F-EE5C-44B2-AD9E-0EA7EE7731A1} - c:\windows\system32\pmnolMGY.dll
HKLM-Run-ISUSPM - c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe
HKLM-Run-Cmaudio - cmicnfg.cpl
Notify-WgaLogon - (no file)
AddRemove-Neuron GIS - c:\documents and settings\i b\my documents\DeIsL1.isu
AddRemove-RealPlayer 12.0 - c:\program files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|12.0
AddRemove-{F37167DD-4436-4641-90B6-329D60632DDA} - c:\program files\InstallShield Installation Information\{F37167DD-4436-4641-90B6-329D60632DDA}\Setup.exe REMOVEALL --u:{F37167DD-4436-4641-90B6-329D60632DDA}

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-24 20:07
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1078081533-1085031214-682003330-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_USERS\S-1-5-21-1078081533-1085031214-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{4EE0D014-61F0-435A-5415-C836379D00C7}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"abgkmecblkghfidmmciigndempfbfchkmo "=hex:61,61,00,00
"bbgkmecblkghfidmmcnhojcnaahmfcbiceca "=hex:61,61,00,00
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3824)
c:\windows\system32\WININET.dll
c:\documents and settings\i b\Local Settings\Application Data\FLVService\lib\FLVSrvLib.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\mshtml.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Ahead\InCD\InCDsrv.exe
c:\progra~1\Webshots\webshots.scr
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\wdfmgr.exe
c:\program files\iPod\bin\iPodService.exe
c:\progra~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
c:\windows\system32\wscntfy.exe
c:\program files\Java\jre6\bin\jucheck.exe
.
**************************************************************************
.
Completion time: 2009-11-24 20:13 - machine was rebooted
ComboFix-quarantined-files.txt 2009-11-24 18:13

Pre-Run: 3,570,774,016 bytes free
Post-Run: 4,407,283,712 bytes free

- - End Of File - - E5BAC766744B6DACCAC240B78C458415

highjackthis.log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:04:27 AM, on 11/25/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16876)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Ask & Record Toolbar\FLVSrvc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Infogate\CZone\Czone.exe
C:\PROGRA~1\Webshots\webshots.scr
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Common\FSHDLL32.EXE
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\rpbrowserrecordplugin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Webshots Toolbar - {C17590D2-ECB4-4b15-8820-F58798DCC118} - C:\Program Files\Webshots\WSToolbar4IE.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: Ask && Record Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe "
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe "
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe "
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe "
O4 - HKLM\..\Run: [Ask and Record FLV Service] "C:\Program Files\Ask & Record Toolbar\FLVSrvc.exe" /run
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe "
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: C-zone.lnk = C:\Program Files\Infogate\C-zone.exe
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O4 - Global Startup: Czone.lnk = C:\Program Files\Infogate\CZone\Czone.exe
O8 - Extra context menu item: &Webshots Photo Search - res://C:\Program Files\Webshots\WSToolbar4IE.dll/MENUSEARCH.HTM
O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users.WINDOWS\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1248936321140
O17 - HKLM\System\CCS\Services\Tcpip\..\{C8B928FF-7423-4F30-9112-5ED4945ADA23}: NameServer = 81.181.111.2,80.96.198.2
O23 - Service: AGXWOM - Unknown owner - C:\DOCUME~1\IB0969~1\LOCALS~1\Temp\AGXWOM.exe (file missing)
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: F-Secure ORSP Client (FSORSPClient) - F-Secure Corporation - C:\Program Files\F-Secure\ORSP Client\fsorsp.exe
O23 - Service: Google Update Service (gupdate1ca0f9d77f7758e) (gupdate1ca0f9d77f7758e) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

--
End of file - 9208 bytes

broni · 2009/11/26

1. Please open Notepad

Click Start , then Run

Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:
Code:
File::
c:\program files\Common Files\zubulomu.lib
c:\program files\Common Files\ytane.pif
c:\program files\Common Files\dypocosev.dl
c:\program files\Common Files\ufowaqopos.pif
c:\program files\Common Files\mazugokyw.bin
c:\program files\Common Files\gatyqem._sy
c:\program files\Common Files\edukokor.dl
c:\program files\Common Files\conemevasi.lib
c:\program files\Common Files\iqefok.ban
c:\program files\install.exe
c:\docume~1\IB0969~1\LOCALS~1\Temp\AGXWOM.exe


Folder::

Driver::
AGXWOM

Registry::

RegLockDel::
3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

Combofix.txt

A new HijackThis log.

Stefan B · 2009/11/27

Hi,
These are the .txt and .log files:

ComboFix 09-11-26.02 - Iulia & Stefan 11/27/2009 10:11.3.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.223.111 [GMT 2:00]
Running from: c:\documents and settings\i b\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\i b\Desktop\CFScript.txt
AV: PC Tools AntiVirus 2.0.3.35 *On-access scanning enabled* (Updated) {832E7172-E406-4BB2-8B19-6D29F2C93A98}

FILE ::
"c:\docume~1\IB0969~1\LOCALS~1\Temp\AGXWOM.exe "
"c:\program files\Common Files\conemevasi.lib "
"c:\program files\Common Files\dypocosev.dl "
"c:\program files\Common Files\edukokor.dl "
"c:\program files\Common Files\gatyqem._sy "
"c:\program files\Common Files\iqefok.ban "
"c:\program files\Common Files\mazugokyw.bin "
"c:\program files\Common Files\ufowaqopos.pif "
"c:\program files\Common Files\ytane.pif "
"c:\program files\Common Files\zubulomu.lib "
"c:\program files\install.exe "
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Common Files\conemevasi.lib
c:\program files\Common Files\dypocosev.dl
c:\program files\Common Files\edukokor.dl
c:\program files\Common Files\gatyqem._sy
c:\program files\Common Files\iqefok.ban
c:\program files\Common Files\mazugokyw.bin
c:\program files\Common Files\ufowaqopos.pif
c:\program files\Common Files\ytane.pif
c:\program files\Common Files\zubulomu.lib
c:\program files\install.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_AGXWOM
-------\Service_AGXWOM

((((((((((((((((((((((((( Files Created from 2009-10-27 to 2009-11-27 )))))))))))))))))))))))))))))))
.

2009-11-26 15:17 . 2009-11-26 15:18 -------- d-----w- c:\program files\Common Files\DivX Shared
2009-11-25 09:02 . 2009-11-25 09:02 -------- d-----w- c:\program files\Trend Micro
2009-11-24 13:13 . 2009-11-24 13:13 33558 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Google\Toolbar for Firefox\Firefox_Toolbar_Uninstaller.exe
2009-11-20 14:38 . 2009-11-23 17:38 -------- d-----w- c:\documents and settings\i b\Local Settings\Application Data\AskToolbar
2009-11-20 14:37 . 2009-11-20 14:37 -------- d-----w- c:\program files\Ask.com
2009-11-20 14:36 . 2009-11-27 07:30 -------- d-----w- c:\documents and settings\i b\Local Settings\Application Data\FLVService
2009-11-20 14:36 . 2009-11-20 14:36 -------- d-----w- c:\windows\Ask & Record Toolbar
2009-11-20 14:36 . 2009-11-20 14:36 -------- d-----w- c:\program files\Ask & Record Toolbar
2009-11-20 14:33 . 2009-11-20 14:34 8801704 ----a-w- c:\program files\FLV PlayerATBSetup.exe
2009-11-20 14:33 . 2009-11-20 14:33 -------- d-----w- c:\program files\FLV Player
2009-11-20 14:33 . 2009-11-20 14:33 -------- d-----w- c:\windows\Applian FLV Player
2009-11-20 14:07 . 2009-11-20 14:07 -------- d-----w- C:\My Music
2009-11-19 11:04 . 2009-11-19 11:04 283006 ----a-w- c:\program files\utorrent.exe
2009-11-14 00:47 . 2009-11-14 00:47 90112 ----a-w- c:\windows\system32\dpl100.dll
2009-11-14 00:47 . 2009-11-14 00:47 856064 ----a-w- c:\windows\system32\divx_xx0c.dll
2009-11-14 00:47 . 2009-11-14 00:47 856064 ----a-w- c:\windows\system32\divx_xx07.dll
2009-11-14 00:47 . 2009-11-14 00:47 847872 ----a-w- c:\windows\system32\divx_xx0a.dll
2009-11-14 00:47 . 2009-11-14 00:47 843776 ----a-w- c:\windows\system32\divx_xx16.dll
2009-11-14 00:47 . 2009-11-14 00:47 839680 ----a-w- c:\windows\system32\divx_xx11.dll
2009-11-14 00:47 . 2009-11-14 00:47 696320 ----a-w- c:\windows\system32\DivX.dll
2009-11-11 12:03 . 2009-11-11 12:03 -------- d-----w- c:\documents and settings\NetworkService.NT AUTHORITY.000\Local Settings\Application Data\F-Secure
2009-11-11 12:01 . 2009-11-27 08:01 -------- d-----w- c:\program files\F-Secure
2009-11-11 11:54 . 2009-11-25 08:30 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\fssg
2009-11-11 11:41 . 2009-11-27 07:56 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\f-secure
2009-11-05 16:24 . 2009-11-05 16:28 -------- d-----w- c:\documents and settings\Default User.WINDOWS\Local Settings\Application Data\Adobe
2009-11-02 10:29 . 2009-11-02 10:29 -------- d-----w- c:\documents and settings\i b\Application Data\Malwarebytes
2009-11-02 10:29 . 2009-09-10 12:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-11-02 10:29 . 2009-11-02 10:29 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Malwarebytes
2009-11-02 10:29 . 2009-09-10 12:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-11-02 10:29 . 2009-11-02 10:29 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-10-30 07:56 . 2009-10-30 07:56 -------- d-----w- C:\Spyware Cleaner 2009 V3.04

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-27 07:53 . 2008-10-25 11:52 -------- d-----w- c:\documents and settings\i b\Application Data\uTorrent
2009-11-26 18:00 . 2009-08-11 11:29 664 ----a-w- c:\windows\system32\d3d9caps.dat
2009-11-26 15:19 . 2008-07-16 19:29 -------- d-----w- c:\program files\DivX
2009-11-26 15:16 . 2008-06-18 17:44 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Google Updater
2009-11-26 09:20 . 2007-09-24 18:18 -------- d-----w- c:\program files\Windows Media Connect 2
2009-11-20 14:13 . 2009-09-30 09:00 -------- d-----w- c:\program files\library
2009-11-17 12:06 . 2008-11-05 16:40 -------- d---a-w- c:\documents and settings\All Users.WINDOWS\Application Data\TEMP
2009-11-06 14:35 . 2008-02-16 16:02 -------- d-----w- c:\program files\Common Files\Adobe
2009-10-15 09:23 . 2007-12-31 09:19 -------- d-----w- c:\program files\Apple Software Update
2009-10-09 08:50 . 2009-10-09 08:39 -------- d-----w- c:\program files\LTC
2009-10-05 16:36 . 2009-10-05 16:36 -------- d-----w- c:\program files\CCleaner
2009-09-30 08:59 . 2009-09-30 08:59 716 ----a-w- c:\program files\CinemasterVideo.4.3.manifest
2009-09-30 08:59 . 2009-09-30 08:59 572 ----a-w- c:\program files\CinemasterAudio.4.3.manifest
2009-09-30 08:59 . 2009-09-30 08:59 222728 ----a-w- c:\program files\realplay.exe
2009-09-30 08:59 . 2009-09-30 08:59 1166 ----a-w- c:\program files\realplay.exe.manifest
2009-09-30 08:59 . 2009-09-30 08:59 23558 ----a-w- c:\program files\freeoffers.ico
2009-09-30 08:59 . 2009-09-30 08:59 221 ----a-w- c:\program files\subscription.rnx
2009-09-30 08:59 . 2009-09-30 08:59 17846 ----a-w- c:\program files\videotest.rm
2009-09-30 08:59 . 2009-09-30 08:59 177 ----a-w- c:\program files\freeoffers.rnx
2009-09-30 08:59 . 2003-03-18 18:14 499712 ----a-w- c:\windows\system32\msvcp71.dll
2009-09-30 08:59 . 2009-09-30 08:59 685 ----a-w- c:\program files\RecordingManager.exe.manifest
2009-09-30 08:59 . 2009-09-30 08:59 198208 ----a-w- c:\program files\RecordingManager.exe
2009-09-28 14:25 . 2007-09-09 08:34 -------- d-----w- c:\program files\Java
2009-09-28 14:23 . 2009-09-28 14:23 152576 ----a-w- c:\documents and settings\i b\Application Data\Sun\Java\jre1.6.0_15\lzma.dll
2009-09-14 22:38 . 2009-09-14 22:38 79856 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Google\Toolbar for Firefox\{3112ca9c-de6d-4884-a869-9855de68056c}\uninstaller.exe
2008-06-30 18:06 . 2008-07-02 16:39 2479604 ----a-w- c:\program files\ac3filter_1_50a.exe
.

((((((((((((((((((((((((((((( SnapShot@2009-11-24_18.06.16 )))))))))))))))))))))))))))))))))))))))))
.
+ 1601-01-01 00:00 . 1601-01-01 00:00 0 c:\windows\Temp\Perflib_Perfdata_b64.dat
+ 2009-11-27 08:25 . 2009-11-27 08:25 16384 c:\windows\Temp\Perflib_Perfdata_47c.dat
+ 2006-10-18 19:47 . 2006-10-18 19:47 38400 c:\windows\system32\wpdshextres.dll
+ 2006-10-18 18:00 . 2006-10-18 18:00 17408 c:\windows\system32\wpdshextautoplay.exe
+ 2005-01-28 11:44 . 2006-10-18 19:47 63488 c:\windows\system32\wpdmtpus.dll
+ 2005-01-28 11:44 . 2006-10-18 19:47 35840 c:\windows\system32\wpdconns.dll
+ 2004-08-03 22:56 . 2006-10-18 19:47 99840 c:\windows\system32\wmpshell.dll
+ 2004-08-03 22:56 . 2006-10-18 19:47 37376 c:\windows\system32\wmdmps.dll
+ 2004-08-03 22:56 . 2006-10-18 19:47 33792 c:\windows\system32\wmdmlog.dll
+ 2009-11-26 09:21 . 2006-09-25 15:58 14640 c:\windows\system32\spmsg.dll
+ 2001-08-23 12:00 . 2009-11-27 07:56 42584 c:\windows\system32\perfc009.dat
+ 2004-08-03 22:56 . 2006-10-18 19:47 27136 c:\windows\system32\mspmsnsv.dll
+ 2004-08-03 22:56 . 2006-10-18 19:47 11264 c:\windows\system32\LAPRXY.dll
+ 2005-01-28 11:44 . 2006-10-18 18:00 38528 c:\windows\system32\drivers\wpdusb.sys
+ 2004-08-03 22:56 . 2006-10-18 19:47 99840 c:\windows\system32\dllcache\wmpshell.dll
+ 2006-02-28 18:57 . 2006-10-18 19:46 64000 c:\windows\system32\dllcache\wmplayer.exe
+ 2006-02-28 18:57 . 2006-10-18 19:47 96256 c:\windows\system32\dllcache\wmpband.dll
+ 2004-08-03 22:56 . 2006-10-18 19:47 37376 c:\windows\system32\dllcache\wmdmps.dll
+ 2004-08-03 22:56 . 2006-10-18 19:47 33792 c:\windows\system32\dllcache\wmdmlog.dll
+ 2004-08-03 22:56 . 2006-10-18 19:47 27136 c:\windows\system32\dllcache\mspmsnsv.dll
+ 2004-08-03 22:56 . 2006-10-18 19:47 11264 c:\windows\system32\dllcache\LAPRXY.dll
+ 2004-08-03 22:56 . 2006-10-18 19:47 4096 c:\windows\system32\wmvdmoe2.dll
+ 2004-08-03 22:56 . 2006-10-18 19:47 4096 c:\windows\system32\wmvdmod.dll
+ 2005-01-28 11:44 . 2006-10-18 19:47 4096 c:\windows\system32\WMVADVE.DLL
+ 2005-01-28 11:44 . 2006-10-18 19:47 4096 c:\windows\system32\WMVADVD.dll
+ 2004-08-03 22:56 . 2006-10-18 19:47 4096 c:\windows\system32\wmsdmoe2.dll
+ 2004-08-03 22:56 . 2006-10-18 19:47 4096 c:\windows\system32\wmsdmod.dll
+ 2005-01-28 11:44 . 2006-10-18 19:58 8704 c:\windows\system32\wdfmgr.exe
+ 2005-01-28 11:44 . 2006-10-18 19:47 4096 c:\windows\system32\wdfapi.dll
+ 2005-01-28 11:44 . 2006-10-18 19:58 8704 c:\windows\system32\uwdf.exe
+ 2004-08-03 22:56 . 2006-10-18 19:47 4096 c:\windows\system32\MPG4DMOD.dll
+ 2004-08-03 22:56 . 2006-10-18 19:47 4096 c:\windows\system32\MP4SDMOD.dll
+ 2004-08-03 22:56 . 2006-10-18 19:47 4096 c:\windows\system32\MP43DMOD.dll
+ 2004-08-03 22:56 . 2006-10-18 19:47 4096 c:\windows\system32\dllcache\wmvdmoe2.dll
+ 2004-08-03 22:56 . 2006-10-18 19:47 4096 c:\windows\system32\dllcache\wmvdmod.dll
+ 2004-08-03 22:56 . 2006-10-18 19:47 4096 c:\windows\system32\dllcache\wmsdmoe2.dll
+ 2004-08-03 22:56 . 2006-10-18 19:47 4096 c:\windows\system32\dllcache\wmsdmod.dll
+ 2004-08-03 22:56 . 2006-10-18 19:47 4096 c:\windows\system32\dllcache\MPG4DMOD.dll
+ 2004-08-03 22:56 . 2006-10-18 19:47 4096 c:\windows\system32\dllcache\MP4SDMOD.dll
+ 2004-08-03 22:56 . 2006-10-18 19:47 4096 c:\windows\system32\dllcache\MP43DMOD.dll
+ 2004-08-03 22:56 . 2006-10-18 19:47 7168 c:\windows\system32\dllcache\asferror.dll
+ 2004-08-03 22:56 . 2006-10-18 19:47 7168 c:\windows\system32\asferror.dll
+ 2009-07-11 23:12 . 2009-07-11 23:12 632656 c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll
+ 2009-07-11 23:09 . 2009-07-11 23:09 554832 c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcp80.dll
+ 2009-07-11 23:08 . 2009-07-11 23:08 479232 c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcm80.dll
+ 2005-01-28 11:44 . 2006-10-18 19:47 356352 c:\windows\system32\wpdsp.dll
+ 2006-10-18 19:47 . 2006-10-18 19:47 133632 c:\windows\system32\WPDShServiceObj.dll
+ 2005-01-28 11:44 . 2006-10-18 19:47 154624 c:\windows\system32\wpdmtp.dll
+ 2005-01-28 11:44 . 2006-10-18 19:47 629760 c:\windows\system32\wpd_ci.dll
+ 2006-10-18 19:47 . 2006-10-18 19:47 656896 c:\windows\system32\WMVXENCD.dll
+ 2006-10-18 19:47 . 2006-10-18 19:47 767488 c:\windows\system32\WMVSENCD.dll
+ 2004-08-03 22:56 . 2006-10-18 19:47 603648 c:\windows\system32\WMSPDMOD.dll
+ 2006-10-18 19:47 . 2006-10-18 19:47 204288 c:\windows\system32\wmpsrcwp.dll
+ 2006-10-18 19:47 . 2006-10-18 19:47 130048 c:\windows\system32\wmpps.dll
+ 2006-10-18 19:47 . 2006-10-18 19:47 613376 c:\windows\system32\wmpmde.dll
+ 2006-10-18 19:47 . 2006-10-18 19:47 295936 c:\windows\system32\wmpeffects.dll
+ 2004-08-03 22:56 . 2006-10-18 19:47 314880 c:\windows\system32\wmpdxm.dll
+ 2004-08-03 22:56 . 2006-10-18 19:47 242688 c:\windows\system32\wmpasf.dll
+ 2004-08-03 22:56 . 2006-10-18 19:47 937984 c:\windows\system32\WMNetMgr.dll
+ 2004-08-03 22:56 . 2006-10-18 19:47 157184 c:\windows\system32\wmidx.dll
+ 2004-08-03 22:56 . 2006-10-18 19:47 227328 c:\windows\system32\wmerror.dll
+ 2006-10-18 19:47 . 2006-10-18 19:47 535040 c:\windows\system32\wmdrmsdk.dll
+ 2005-01-28 11:44 . 2006-10-18 19:47 348672 c:\windows\system32\wmdrmnet.dll
+ 2005-01-28 11:44 . 2006-10-18 19:47 429056 c:\windows\system32\wmdrmdev.dll
+ 2004-08-03 22:56 . 2006-10-18 19:47 222208 c:\windows\system32\wmasf.dll
+ 2004-08-03 22:56 . 2006-10-18 19:47 757248 c:\windows\system32\WMADMOD.dll
+ 2004-08-03 22:56 . 2006-10-18 19:47 211456 c:\windows\system32\qasf.dll
+ 2006-10-18 19:47 . 2006-10-18 19:47 199168 c:\windows\system32\PortableDeviceWMDRM.dll
+ 2006-10-18 19:47 . 2006-10-18 19:47 132096 c:\windows\system32\PortableDeviceWiaCompat.dll
+ 2006-10-18 19:47 . 2006-10-18 19:47 166912 c:\windows\system32\PortableDeviceTypes.dll
+ 2006-10-18 19:47 . 2006-10-18 19:47 101888 c:\windows\system32\PortableDeviceClassExtension.dll
+ 2006-10-18 19:47 . 2006-10-18 19:47 284160 c:\windows\system32\PortableDeviceApi.dll
+ 2001-08-23 12:00 . 2009-11-27 07:56 317776 c:\windows\system32\perfh009.dat
+ 2004-08-03 22:56 . 2006-10-18 19:47 321536 c:\windows\system32\mswmdm.dll
+ 2004-08-03 22:57 . 2006-10-18 19:47 414208 c:\windows\system32\msscp.dll
+ 2004-08-03 22:56 . 2006-10-18 19:47 175616 c:\windows\system32\mspmsp.dll
+ 2004-08-03 22:57 . 2006-10-18 19:47 179712 c:\windows\system32\msnetobj.dll
+ 2006-10-18 19:47 . 2006-10-18 19:47 259072 c:\windows\system32\MPG4DECD.dll
+ 2006-10-18 19:47 . 2006-10-18 19:47 317440 c:\windows\system32\MP4SDECD.dll
+ 2006-10-18 19:47 . 2006-10-18 19:47 259072 c:\windows\system32\MP43DECD.dll
+ 2006-10-18 19:47 . 2006-10-18 19:47 212992 c:\windows\system32\MFPLAT.dll
+ 2004-08-03 22:56 . 2006-10-18 18:03 100864 c:\windows\system32\logagent.exe
+ 2004-08-03 22:57 . 2006-10-18 19:47 991744 c:\windows\system32\drmv2clt.dll
+ 2006-10-18 18:00 . 2006-10-18 18:00 249856 c:\windows\system32\drmupgds.exe
+ 2006-10-18 19:47 . 2006-10-18 19:47 671232 c:\windows\system32\drivers\UMDF\wpdmtpdr.dll
+ 2004-08-03 22:56 . 2006-10-18 19:47 603648 c:\windows\system32\dllcache\WMSPDMOD.dll
+ 2004-08-03 22:56 . 2006-10-18 19:47 314880 c:\windows\system32\dllcache\wmpdxm.dll
+ 2004-08-03 22:56 . 2006-10-18 19:47 242688 c:\windows\system32\dllcache\wmpasf.dll
+ 2004-08-03 22:56 . 2006-10-18 19:47 937984 c:\windows\system32\dllcache\WMNetMgr.dll
+ 2004-08-03 22:56 . 2006-10-18 19:47 157184 c:\windows\system32\dllcache\wmidx.dll
+ 2004-08-03 22:56 . 2006-10-18 19:47 227328 c:\windows\system32\dllcache\wmerror.dll
+ 2004-08-03 22:56 . 2006-10-18 19:47 222208 c:\windows\system32\dllcache\WMASF.dll
+ 2004-08-03 22:56 . 2006-10-18 19:47 757248 c:\windows\system32\dllcache\WMADMOD.dll
+ 2004-08-03 22:56 . 2006-11-01 16:31 315904 c:\windows\system32\dllcache\unregmp2.exe
+ 2004-08-03 22:56 . 2006-10-18 19:47 211456 c:\windows\system32\dllcache\qasf.dll
+ 2004-08-03 22:56 . 2006-10-18 19:47 321536 c:\windows\system32\dllcache\mswmdm.dll
+ 2004-08-03 22:57 . 2006-10-18 19:47 414208 c:\windows\system32\dllcache\msscp.dll
+ 2004-08-03 22:56 . 2006-10-18 19:47 175616 c:\windows\system32\dllcache\mspmsp.dll
+ 2004-08-03 22:57 . 2006-10-18 19:47 179712 c:\windows\system32\dllcache\msnetobj.dll
+ 2006-02-28 18:57 . 2006-10-18 19:47 243712 c:\windows\system32\dllcache\mpvis.dll
+ 2004-08-03 22:56 . 2006-10-18 18:03 100864 c:\windows\system32\dllcache\logagent.exe
+ 2004-08-03 22:57 . 2006-10-18 19:47 991744 c:\windows\system32\dllcache\drmv2clt.dll
+ 2004-08-03 22:56 . 2006-10-18 19:47 229376 c:\windows\system32\dllcache\cewmdm.dll
+ 2004-08-03 22:56 . 2006-10-18 19:47 542720 c:\windows\system32\dllcache\blackbox.dll
+ 2004-08-03 22:56 . 2006-10-18 19:47 229376 c:\windows\system32\cewmdm.dll
+ 2004-08-03 22:56 . 2006-10-18 19:47 542720 c:\windows\system32\blackbox.dll
+ 2006-10-18 19:47 . 2006-10-18 19:47 276992 c:\windows\system32\audiodev.dll
+ 2009-11-26 15:18 . 2009-11-26 15:18 169472 c:\windows\Installer\25a549.msi
+ 2004-08-03 22:56 . 2006-11-01 16:31 315904 c:\windows\inf\unregmp2.exe
+ 2006-10-18 19:47 . 2006-10-18 19:47 2603008 c:\windows\system32\WpdShext.dll
+ 2006-10-18 19:47 . 2006-10-18 19:47 1382912 c:\windows\system32\WMVSDECD.dll
+ 2006-10-18 19:47 . 2006-10-18 19:47 1574912 c:\windows\system32\WMVENCOD.dll
+ 2006-10-18 19:47 . 2006-10-18 19:47 1543680 c:\windows\system32\WMVDECOD.dll
+ 2004-08-03 22:57 . 2006-10-18 19:47 2450944 c:\windows\system32\wmvcore.dll
+ 2004-08-03 22:56 . 2006-10-18 19:47 1329152 c:\windows\system32\WMSPDMOE.dll
+ 2004-08-03 22:56 . 2006-10-18 19:47 8231936 c:\windows\system32\wmploc.dll
+ 2006-10-18 19:47 . 2006-10-18 19:47 1661440 c:\windows\system32\wmpencen.dll
+ 2004-08-03 22:56 . 2006-10-18 19:47 1117696 c:\windows\system32\WMADMOE.dll
+ 2004-08-03 22:57 . 2006-10-18 19:47 2450944 c:\windows\system32\dllcache\wmvcore.dll
+ 2004-08-03 22:56 . 2006-10-18 19:47 1329152 c:\windows\system32\dllcache\WMSPDMOE.dll
+ 2004-08-03 22:56 . 2006-10-18 19:47 8231936 c:\windows\system32\dllcache\wmploc.dll
+ 2004-08-03 22:56 . 2006-10-18 19:47 1117696 c:\windows\system32\dllcache\WMADMOE.dll
+ 2006-02-28 18:57 . 2006-11-01 16:31 1669120 c:\windows\system32\dllcache\setup_wm.exe
+ 2004-08-03 22:56 . 2006-10-18 19:47 10834432 c:\windows\system32\wmp.dll
+ 2004-08-03 22:56 . 2006-10-18 19:47 10834432 c:\windows\system32\dllcache\wmp.dll
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2009-06-04 16:04 1144712 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440} "= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-06-04 1144712]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440} "= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-06-04 1144712]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg "= "c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-06-18 68856]
"ctfmon.exe "= "c:\windows\system32\ctfmon.exe" [2004-08-03 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck "= "c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"InCD "= "c:\program files\Ahead\InCD\InCD.exe" [2004-07-16 1409136]
"QuickTime Task "= "c:\program files\QuickTime\qttask.exe" [2007-12-11 286720]
"iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2007-12-11 267048]
"WinampAgent "= "c:\program files\Winamp\winampa.exe" [2009-07-01 37888]
"SunJavaUpdateSched "= "c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"TkBellExe "= "c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-09-30 198160]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM "= "c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"Ask and Record FLV Service "= "c:\program files\Ask & Record Toolbar\FLVSrvc.exe" [2009-03-10 156672]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"NSSInstallation "= "c:\program files\DivX\Symantec\scstubinstaller.exe" [2009-11-14 497016]

c:\documents and settings\All Users.WINDOWS\Start Menu\Programs\Startup\
Czone.lnk - c:\program files\Infogate\CZone\Czone.exe [2009-6-11 1380864]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ 'autocheck autochk *'\0lsdelete

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@= "Service "

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"SharedAccess "=2 (0x2)
"FSORSPClient "=3 (0x3)
"FSMA "=2 (0x2)
"FSDFWD "=3 (0x3)
"Browser "=2 (0x2)
"avast!UpdateAgent.exe "=2 (0x2)
"aawservice "=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe "=
"c:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe "=
"c:\\Program Files\\NetMeeting\\conf.exe "=
"c:\\WINDOWS\\system32\\mmc.exe "=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest "= 1 (0x1)

R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [11/13/2008 5:10 PM 28544]
S2 gupdate1ca0f9d77f7758e;Google Update Service (gupdate1ca0f9d77f7758e);c:\program files\Google\Update\GoogleUpdate.exe [7/28/2009 6:07 PM 133104]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\e:\ntglm7x.sys --> e:\NTGLM7X.sys [?]
S4 avast!UpdateAgent.exe;avast!UpdateAgent.exe;c:\windows\System32\avast!UpdateAgent.exe -k netsvcs --> c:\windows\System32\avast!UpdateAgent.exe -k netsvcs [?]
.
Contents of the 'Scheduled Tasks' folder

2009-11-26 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 09:34]

2009-07-26 c:\windows\Tasks\DriverCure.job
- c:\program files\ParetoLogic\DriverCure\DriverCure.exe [2009-07-18 00:16]

2009-11-27 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-06-18 13:57]

2009-11-27 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-28 16:06]

2009-11-27 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-28 16:06]

2009-11-27 c:\windows\Tasks\Install_NSS.job
- c:\program files\DivX\Symantec\scstubinstaller.exe [2009-11-14 00:49]

2009-11-26 c:\windows\Tasks\ParetoLogic Registration.job
- c:\program files\Common Files\ParetoLogic\UUS2\UUS.dll [2009-01-13 14:59]

2009-11-25 c:\windows\Tasks\ParetoLogic Update Version2.job
- c:\program files\Common Files\ParetoLogic\UUS2\Pareto_Update.exe [2009-01-13 14:59]

2009-11-26 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
- c:\program files\Ask.com\UpdateTask.exe [2009-06-04 16:04]
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
mStart Page = hxxp://www.google.com
IE: &Webshots Photo Search - c:\program files\Webshots\WSToolbar4IE.dll/MENUSEARCH.HTM
IE: &Winamp Search - c:\documents and settings\All Users.WINDOWS\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
IE: &Yahoo! Search - file:///c:\program files\Yahoo!\Common/ycsrch.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Yahoo! &Dictionary - file:///c:\program files\Yahoo!\Common/ycdict.htm
IE: Yahoo! &Maps - file:///c:\program files\Yahoo!\Common/ycmap.htm
IE: Yahoo! &SMS - file:///c:\program files\Yahoo!\Common/ycsms.htm
TCP: {C8B928FF-7423-4F30-9112-5ED4945ADA23} = 81.181.111.2,80.96.198.2
FF - ProfilePath - c:\documents and settings\i b\Application Data\Mozilla\Firefox\Profiles\4x63kuj1.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Wikipedia (en)
FF - prefs.js: network.proxy.type - 4
.
- - - - ORPHANS REMOVED - - - -

AddRemove-uTorrent - c:\program files\uTorrent\uTorrent.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-27 10:25
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1078081533-1085031214-682003330-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_USERS\S-1-5-21-1078081533-1085031214-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{4EE0D014-61F0-435A-5415-C836379D00C7}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"abgkmecblkghfidmmciigndempfbfchkmo "=hex:61,61,00,00
"bbgkmecblkghfidmmcnhojcnaahmfcbiceca "=hex:61,61,00,00
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(2076)
c:\windows\system32\WININET.dll
c:\documents and settings\i b\Local Settings\Application Data\FLVService\lib\FLVSrvLib.dll
c:\windows\system32\IEFRAME.dll
c:\progra~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL
c:\progra~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL
c:\windows\system32\mshtml.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Ahead\InCD\InCDsrv.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\progra~1\Webshots\webshots.scr
c:\progra~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2009-11-27 10:32 - machine was rebooted
ComboFix-quarantined-files.txt 2009-11-27 08:32
ComboFix2.txt 2009-11-24 18:13

Pre-Run: 4,081,573,888 bytes free
Post-Run: 4,138,758,144 bytes free

- - End Of File - - 6C0AE360B7A328439C1AE856321AE5E4

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:04:27 AM, on 11/25/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16876)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Ask & Record Toolbar\FLVSrvc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Infogate\CZone\Czone.exe
C:\PROGRA~1\Webshots\webshots.scr
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Common\FSHDLL32.EXE
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\rpbrowserrecordplugin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Webshots Toolbar - {C17590D2-ECB4-4b15-8820-F58798DCC118} - C:\Program Files\Webshots\WSToolbar4IE.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: Ask && Record Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe "
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe "
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe "
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe "
O4 - HKLM\..\Run: [Ask and Record FLV Service] "C:\Program Files\Ask & Record Toolbar\FLVSrvc.exe" /run
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe "
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: C-zone.lnk = C:\Program Files\Infogate\C-zone.exe
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O4 - Global Startup: Czone.lnk = C:\Program Files\Infogate\CZone\Czone.exe
O8 - Extra context menu item: &Webshots Photo Search - res://C:\Program Files\Webshots\WSToolbar4IE.dll/MENUSEARCH.HTM
O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users.WINDOWS\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1248936321140
O17 - HKLM\System\CCS\Services\Tcpip\..\{C8B928FF-7423-4F30-9112-5ED4945ADA23}: NameServer = 81.181.111.2,80.96.198.2
O23 - Service: AGXWOM - Unknown owner - C:\DOCUME~1\IB0969~1\LOCALS~1\Temp\AGXWOM.exe (file missing)
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: F-Secure ORSP Client (FSORSPClient) - F-Secure Corporation - C:\Program Files\F-Secure\ORSP Client\fsorsp.exe
O23 - Service: Google Update Service (gupdate1ca0f9d77f7758e) (gupdate1ca0f9d77f7758e) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

--
End of file - 9208 bytes

broni · 2009/11/27

Uninstall Combofix:
Go Start > Run [Vista users, go Start> "Start search"]
Type in:
Combofix /Uninstall
Note the space between the "Combofix" and the "/Uninstall "
Restart computer.

==============================================================

Print these instructions out.

NOTE. If any of the programs listed below refuse to run, try renaming executive file to something else; for instance, rename hijackthis.exe to scanner.exe

***VERY IMPORTANT! Make sure, you update Superantispyware, and Malwarebytes before running the scans.***

STEP 1. Download SUPERAntiSpyware Free for Home Users:
http://www.superantispyware.com/

* Double-click SUPERAntiSpyware.exe and use the default settings for installation.
* An icon will be created on your desktop. Double-click that icon to launch the program.
* If asked to update the program definitions, click "Yes ". If not, update the definitions before scanning by selecting "Check for Updates ". (If you encounter any problems while downloading the updates, manually download and unzip them from here: http://www.superantispyware.com/definitions.html.)
* Close SUPERAntiSpyware.

PHYSICALLY DISCONNECT FROM THE INTERNET

Restart computer in Safe Mode.
To enter Safe Mode, restart computer, and keep tapping F8 key, until menu appears; select Safe Mode; you'll see "Safe Mode" in all four corners of your screen

* Open SUPERAntiSpyware.
* Click Scan your Computer... button.
* Click Scanning Preferences/Control Center... button.
* Under General and Startup tab, make sure, Start SUPERAntiSpyware when Windows starts option is UN-checked.
* Click the Scanning Control tab.
* Under Scanner Options make sure the following are checked (leave all others unchecked):
- Close browsers before scanning.
- Terminate memory threats before quarantining.
* Click the Close button to leave the control center screen.
* On the left, make sure you check C:\Fixed Drive.
* On the right, choose Perform Complete Scan.
* Click Next to start the scan. Please be patient while it scans your computer.
* After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click OK.
* Make sure everything has a checkmark next to it and click Next.
* A notification will appear that Quarantine and Removal is Complete. Click OK and then click the Finish button to return to the main menu.
* If asked if you want to reboot, click Yes.
* To retrieve the removal information after reboot, launch SUPERAntispyware again.
- Click Preferences, then click the Statistics/Logs tab.
- Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
- If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
- Please copy and paste the Scan Log results in your next reply.
* Click Close to exit the program.
Post SUPERAntiSpyware log.

RECONNECT TO THE INTERNET

RESTART COMPUTER!

STEP 2. Download Malwarebytes' Anti-Malware: http://www.malwarebytes.org/mbam.php to your desktop.
(Malwarebytes is free to use as a manual scanner. Payment is only required if you wish to have it run and update automatically which is not necessary for our purposes)

******************************************************************************************
Due to a bug in Malwarebytes, you may see in MBAM's log following entries:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\atapi (Rootkit)
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\atapi (Rootkit)
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\atapi (Rootkit)
DO NOT remove those entries!
If you do, your computer will become UN-bootable.
The issue has been fixed in the latest MBAM update, so, it's EXTREMELY important, you update MBAM before you run it.
****************************************************************************************

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.

The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

RESTART COMPUTER!

STEP 3.
Post fresh HijackThis log.
NOTE. If you're using Vista, right click on HijackThis, and click Run as Administrator
Do NOT attempt to "fix" anything!

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

Log in or Sign up

Solved Antiviruses stop searching or can't clean

Stefan B Inactive Thread Starter

Admin. Administrator Administrator Staff

Stefan B Inactive Thread Starter

broni Moderator Malware Analyst

Stefan B Inactive Thread Starter

broni Moderator Malware Analyst

Stefan B Inactive Thread Starter

broni Moderator Malware Analyst

Stefan B Inactive Thread Starter

broni Moderator Malware Analyst

Stefan B Inactive Thread Starter

Stefan B Inactive Thread Starter

broni Moderator Malware Analyst

Stefan B Inactive Thread Starter

Stefan B Inactive Thread Starter

broni Moderator Malware Analyst

Stefan B Inactive Thread Starter

broni Moderator Malware Analyst

Stefan B Inactive Thread Starter

broni Moderator Malware Analyst

Share This Page

Log in or Sign up

Solved Antiviruses stop searching or can't clean

Stefan B Inactive Thread Starter

Admin. Administrator Administrator Staff

Stefan B Inactive Thread Starter

broni Moderator Malware Analyst

Stefan B Inactive Thread Starter

broni Moderator Malware Analyst

Stefan B Inactive Thread Starter

broni Moderator Malware Analyst

Stefan B Inactive Thread Starter

broni Moderator Malware Analyst

Stefan B Inactive Thread Starter

Stefan B Inactive Thread Starter

broni Moderator Malware Analyst

Stefan B Inactive Thread Starter

Stefan B Inactive Thread Starter

broni Moderator Malware Analyst

Stefan B Inactive Thread Starter

broni Moderator Malware Analyst

Stefan B Inactive Thread Starter

broni Moderator Malware Analyst

Share This Page

Useful Searches