Solved malware/virus/dialer the works

[Resolved] malware/virus/dialer the works

if you noticed my other thread, this is for an other PC, the specs saved in my profile are not relevant here:

there are several issues i have been trying to deal with (i hope i do not bore you with the details).
my PC kind of crashes (Tower stays on but PC is off i need to "force shut down" in order to really turn it off), when i first noticed it I figured bad ventilation then i noticed it always crashes like that when i try to do a virus scan, the only way i can scan my PC is go in safe mode with networking and use IE (FF crashes) and do an online scan at

Code:

www.pandasecurity.com

. I usually find a few Trojans and Adwares in my temp and my internet temp folder with file names: "temp###.exe ", although AVG usually picks some up with resident shield, sometimes PC doctor (free version) picks up these items as well.

i don't get how come i keep getting new viruses, only sites i go to are:
google
hotmail
gmail
and a couple of webcomics I have been visiting for several month with no problems.

also suddenly my home network doesn't seem to work any more, both PCs have internet access but printer and folder sharing doesn't work:
- Printer says access denied.
- when trying to access folder on other PC it says i don't not have permission.

this just started a few minutes ago now i have a dialer installed (i-connect), i tried deleting it but it comes back after reboot, also those temp.exe files are giving me "this program has caused and error and has to be shutdown" with the option to send the log to MS those two issues seem to have appeared together.

DDS (Ver_09-02-01.01) - NTFSx86
Run by Nick at 23:24:17.68 on Tue 02/10/2009
Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 1.6.0_10
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.588 [GMT 2:00]

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated)

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
C:\WINDOWS\system32\svchost -k rpcss
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\alg.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\system32\PV92Tray.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\DU Meter\DUMeter.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\AVG\AVG8\avgui.exe
C:\Documents and Settings\Nick\Desktop\dds.pif
C:\WINDOWS\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = about:blank
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
mDefault_Search_URL = hxxp://www.google.com/ie
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Skype add-on (mastermind): {22bf413b-c6d2-4d91-82a9-a0f997ba588c} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File
BHO: AVG Security Toolbar: {a057a204-bacc-4d26-9990-79a187e2698e} - c:\progra~1\avg\avg8\AVGTOO~1.DLL
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.0.926.3450\swg.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: AVG Security Toolbar: {a057a204-bacc-4d26-9990-79a187e2698e} - c:\progra~1\avg\avg8\AVGTOO~1.DLL
uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe
uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe
uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\daemon.exe" -autorun
uRun: [Windows Video Drivers] c:\recycler\s-1-5-21-6950409265-2475029583-782515356-8489\winlogon.exe
mRun: [IMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
mRun: [MSPY2002] c:\windows\system32\ime\pintlgnt\ImScInst.exe /SYNC
mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC
mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName
mRun: [PCTVOICE] pctspk.exe
mRun: [PV92TRAY] PV92Tray.exe
mRun: [SoundMan] SOUNDMAN.EXE
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe "
mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe "
mRun: [DU Meter] c:\program files\du meter\DUMeter.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe "
mRun: [ISTray] "c:\program files\spyware doctor\pctsTray.exe "
mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\autoca~1.lnk - c:\program files\common files\autodesk shared\acstart16.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
dPolicies-system: DisableRegistryTools = 1 (0x1)
IE: &Clean Traces - c:\program files\dap\privacy package\dapcleanerie.htm
IE: &Download with &DAP - c:\program files\dap\dapextie.htm
IE: Download &all with DAP - c:\program files\dap\dapextie2.htm
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - c:\program files\pokerstars\PokerStarsUpdate.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0010-ABCDEFFEDCBC} - c:\program files\java\jre6\bin\jp2iexp.dll
IE: {77BF5300-1474-4EC7-9980-D32B190E9B07} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} - hxxp://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll
DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} - hxxps://www-secure.symantec.com/techsupp/asa/ss/sa/sa_cabs/tgctlsr.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1226591049750
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/products/plugin/1.4/jinstall-14_02-windows-i586.cab
DPF: {CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/1.4/jinstall-14_02-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_10-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_10-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: avgrsstarter - avgrsstx.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\nick\applic~1\mozilla\firefox\profiles\kl3je602.default\
FF - prefs.js: browser.startup.homepage - about:blank
FF - component: c:\program files\avg\avg8\firefox\components\avgssff.dll
FF - component: c:\program files\dap\dapfirefox\components\DAPFireFox.dll
FF - plugin: c:\program files\google\google updater\2.4.1441.4352\npCIDetect13.dll
FF - plugin: c:\program files\mozilla firefox\plugins\NPMGWRAP.DLL

============= SERVICES / DRIVERS ===============

R0 IKFileSec;File Security Driver;c:\windows\system32\drivers\ikfilesec.sys [2009-1-17 40840]
R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2009-2-4 28544]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-1-26 325128]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-1-26 27656]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-1-26 107272]
R1 IKSysFlt;System Filter Driver;c:\windows\system32\drivers\iksysflt.sys [2009-1-17 66952]
R1 IKSysSec;System Security Driver;c:\windows\system32\drivers\iksyssec.sys [2009-1-17 81288]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe [2009-1-26 903960]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-1-26 298264]
R2 sdAuxService;PC Tools Auxiliary Service;c:\program files\spyware doctor\pctsAuxs.exe [2009-1-17 356920]
R2 sdCoreService;PC Tools Security Service;c:\program files\spyware doctor\pctsSvc.exe [2009-1-17 1079176]
S2 Microsoft Service Controler;Microsoft Service Controler; "c:\windows\system32\drivers\services.exe" --> c:\windows\system32\drivers\services.exe [?]
S3 autorun;autorun;\??\c:\huadio.tmp --> c:\huadio.tmp [?]
S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\nos\bin\getPlus_HelperSvc.exe [2008-11-6 33752]
S3 RkPavproc1;RkPavproc1;\??\c:\windows\system32\drivers\rkpavproc1.sys --> c:\windows\system32\drivers\RkPavproc1.sys [?]
S3 RkPavproc2;RkPavproc2;\??\c:\windows\system32\drivers\rkpavproc2.sys --> c:\windows\system32\drivers\RkPavproc2.sys [?]
S3 RkPavproc3;RkPavproc3;\??\c:\windows\system32\drivers\rkpavproc3.sys --> c:\windows\system32\drivers\RkPavproc3.sys [?]
S3 Secdsxxamd0.5;Secdsxxamd0.5;c:\windows\system32\drivers\nwlnkspx.sys [2001-8-23 55936]

=============== Created Last 30 ================

2009-02-08 23:47 268 a---h--- C:\sqmdata02.sqm
2009-02-08 23:47 244 a---h--- C:\sqmnoopt02.sqm
2009-02-04 00:26 28,544 a------- c:\windows\system32\drivers\pavboot.sys
2009-02-03 23:24 <DIR> --d----- c:\program files\Panda Security
2009-02-03 10:13 <DIR> --d----- c:\documents and settings\nick\.housecall6.6
2009-02-02 23:38 <DIR> --d-h--- C:\$AVG8.VAULT$
2009-01-27 16:05 225,856 -c------ c:\windows\system32\dllcache\tcpip6.sys
2009-01-27 16:05 245,248 -c------ c:\windows\system32\dllcache\mswsock.dll
2009-01-27 16:05 147,968 -c------ c:\windows\system32\dllcache\dnsapi.dll
2009-01-26 17:57 10,520 a------- c:\windows\system32\avgrsstx.dll
2009-01-26 17:57 107,272 a------- c:\windows\system32\drivers\avgtdix.sys
2009-01-26 17:57 325,128 a------- c:\windows\system32\drivers\avgldx86.sys
2009-01-26 17:57 <DIR> --d----- c:\windows\system32\drivers\Avg
2009-01-26 17:57 <DIR> --d----- c:\docume~1\nick\applic~1\AVGTOOLBAR
2009-01-19 11:26 229,487 a------- c:\windows\system32\jpicpl32.cpl
2009-01-19 11:24 9,572 a------- c:\windows\mozver.dat
2009-01-18 10:38 268 a---h--- C:\sqmdata01.sqm
2009-01-18 10:38 244 a---h--- C:\sqmnoopt01.sqm
2009-01-17 16:13 81,288 a------- c:\windows\system32\drivers\iksyssec.sys
2009-01-17 16:13 66,952 a------- c:\windows\system32\drivers\iksysflt.sys
2009-01-17 16:13 40,840 a------- c:\windows\system32\drivers\ikfilesec.sys
2009-01-17 16:13 29,576 a------- c:\windows\system32\drivers\kcom.sys
2009-01-17 16:13 <DIR> --d----- c:\program files\Spyware Doctor
2009-01-17 16:13 <DIR> --d----- c:\docume~1\nick\applic~1\PC Tools
2009-01-16 00:29 <DIR> --d----- c:\program files\Microsoft ActiveSync
2009-01-16 00:28 <DIR> --d----- c:\windows\SHELLNEW
2009-01-15 23:07 51,355 a------- c:\windows\system32\muzika.xm
2009-01-15 15:41 <DIR> --d----- c:\windows\SxsCaPendDel
2009-01-15 15:32 376 a------- c:\windows\ODBC.INI
2009-01-15 15:32 17,920 a------- c:\windows\system32\mdimon.dll

==================== Find3M ====================

2009-02-10 22:41 1,536 a------- c:\windows\system32\TrueSoft.dat
2009-01-13 03:18 31 a------- c:\documents and settings\nick\jagex_runescape_preferences.dat
2008-12-17 11:49 37,393 a------- c:\windows\DIIUnin.dat
2008-12-17 08:39 43,520 a------- c:\windows\system32\CmdLineExt03.dll
2008-12-17 08:35 21,840 a------t c:\windows\system32\SIntfNT.dll
2008-12-17 08:35 17,212 a------t c:\windows\system32\SIntf32.dll
2008-12-17 08:35 12,067 a------t c:\windows\system32\SIntf16.dll
2008-12-11 20:00 87,608 a------- c:\docume~1\nick\applic~1\inst.exe
2008-12-11 20:00 47,360 a------- c:\docume~1\nick\applic~1\pcouffin.sys
2008-12-08 00:57 249,856 -------- c:\windows\Setup1.exe
2008-12-08 00:57 73,216 a------- c:\windows\ST6UNST.EXE
2008-12-06 18:05 94,208 a------- c:\windows\DIIUnin.exe
2008-12-06 18:05 2,829 a------- c:\windows\DIIUnin.pif
2008-11-25 08:40 5,607 a------- c:\windows\~GLH0000.TMP
2008-11-25 08:40 104,688 a------- c:\windows\~GLC0000.TMP

============= FINISH: 23:25:04.92 ===============


UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-02-01.01)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume2
Install Date: 11/2/2008 6:39:33 PM
System Uptime: 2/10/2009 10:38:24 PM (1 hours ago)

Motherboard: PCCHIPS | | P25G
Processor: Intel(R) Pentium(R) 4 CPU 3.00GHz | CPU 1 | 2999/200mhz

==== Disk Partitions =========================

A: is Removable
C: is FIXED (NTFS) - 153 GiB total, 133.819 GiB free.
E: is FIXED (NTFS) - 466 GiB total, 114.47 GiB free.
F: is CDROM (CDFS)

==== Disabled Device Manager Items =============

Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description: Ethernet Controller
Device ID: PCI\VEN_1106&DEV_3106&SUBSYS_14031186&REV_86\3&267A616A&0&48
Manufacturer:
Name: Ethernet Controller
PNP Device ID: PCI\VEN_1106&DEV_3106&SUBSYS_14031186&REV_86\3&267A616A&0&48
Service:

Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description: Multimedia Controller
Device ID: PCI\VEN_1131&DEV_7133&SUBSYS_00001131&REV_D0\3&267A616A&0&50
Manufacturer:
Name: Multimedia Controller
PNP Device ID: PCI\VEN_1131&DEV_7133&SUBSYS_00001131&REV_D0\3&267A616A&0&50
Service:

==== System Restore Points ===================

RP1: 2/9/2009 2:54:10 AM - System Checkpoint
RP2: 2/10/2009 2:56:17 AM - System Checkpoint

==== Installed Programs ======================

5600
5600_Help
5600Trb
ACDSee Classic
Acrobat.com
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Photoshop CS
Adobe Reader 9
AiO_Scan
AiOSoftware
Apple Mobile Device Support
Apple Software Update
AutoCAD 2005 - English
Autodesk DWF Viewer
AVG Free 8.0
Bonjour
BufferChm
Combined Community Codec Pack 2008-09-21 16:18
CP_Package_Variety1
CP_Package_Variety2
CP_Package_Variety3
Destinations
DeviceManagementQFolder
Diablo II
DocProc
Download Accelerator Plus (DAP)
DU Meter
DVDFab (Platinum/Gold/HD Decrypter) (Option: Mobile) 5.1.2.2
Fax
Google Earth
Google Updater
Hellfire
Hero Editor V0.96
Hotfix for Windows XP (KB952287)
HP Imaging Device Functions 5.3
HP PSC & OfficeJet 5.3.B
HSP56 Modem Drivers
InterVideo MP3 + DVD XPack
iTunes
Java 2 Runtime Environment, SE v1.4.1_02
Java(TM) 6 Update 10
Microsoft .NET Framework 2.0 Service Pack 1
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
Microsoft Office Professional Edition 2003
Microsoft Visual C++ 2005 Redistributable
Monopoly by Parker Brothers
Mozilla Firefox (3.0.6)
MSVC80_x86
Nero 6 Ultra Edition
NewCopy
NVIDIA Drivers
Panda ActiveScan 2.0
Pinup Strip Poker
PokerStars
ProductContext
QuickTime
Readme
Real Alternative 1.9.0
Scan
ScannerCopy
Security Update for CAPICOM (KB931906)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Skypeâ„¢ 3.8
Spyware Doctor 6.0
SpywareBlaster 4.1
Status
TrayApp
Unload
Update for Windows XP (KB898461)
Update for Windows XP (KB951072-v2)
VideoLAN VLC media player 0.8.6d
WebFldrs XP
Windows Live installer
Windows Live Messenger
Windows XP Service Pack 3
WinRAR archiver
Yahoo! Install Manager

==== Event Viewer Messages From Past Week ========

2/4/2009 3:11:11 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments " " in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
2/4/2009 3:11:30 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AvgLdx86 AvgMfx86 Fips intelppm pavboot
2/4/2009 3:26:13 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments " " in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
2/4/2009 11:43:00 PM, error: Service Control Manager [7031] - The Microsoft Service Controler service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 3000 milliseconds: Restart the service.
2/6/2009 9:42:43 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the NVSvc service.
2/10/2009 9:06:41 PM, error: W32Time [17] - Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 15 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751)
2/10/2009 10:27:41 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.
2/10/2009 10:27:41 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
2/10/2009 10:27:41 PM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning.
2/10/2009 10:27:41 PM, error: Service Control Manager [7001] - The IPv6 Helper Service service depends on the Microsoft IPv6 Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
2/10/2009 10:27:41 PM, error: Service Control Manager [7001] - The Apple Mobile Device service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
2/10/2009 10:27:42 PM, error: Service Control Manager [7001] - The Bonjour Service service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
2/10/2009 10:27:42 PM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.
2/10/2009 10:27:59 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD AvgLdx86 AvgMfx86 AvgTdiX Fips intelppm IPSec MRxSmb NetBIOS NetBT pavboot RasAcd Rdbss Tcpip Tcpip6

==== End Of File ===========================

 

Hi braindead,

Please visit the following webpage for instructions for downloading and running ComboFix

How to use ComboFix


Download ComboFix by sUBs from here, saving the file to your desktop.


Disable realtime protection applications as they sometimes interfere with the tool. Check this link for your applicable programs.

• Close all open programs and windows
• Double click ComboFix.exe and follow the prompts.
• It may reboot your computer and resume running when you logon. Wait for it to complete. When finished, it will open a log for you. Post that log in your next reply.

Note: Do not mouseclick combofix's window while its running. That may cause it to stall

**NOTE - I recommend you allow the Recovery Console to be downloaded and installed if or when prompted.

 

1st of all thank you for the fast reply noahdfear, i also would like to pint out my firewall is disabled (its off and there is no way to turn it on)

and here is the requested log:

ComboFix 09-02-10.02 - Nick 2009-02-11 7:15:06.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.607 [GMT 2:00]
Running from: c:\documents and settings\Nick\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated)
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Nick\Application Data\inst.exe

.
((((((((((((((((((((((((( Files Created from 2009-01-11 to 2009-02-11 )))))))))))))))))))))))))))))))
.

2009-02-11 07:01 . 2009-02-11 07:01 <DIR> d-------- c:\documents and settings\Nick\.java
2009-02-11 06:08 . 2009-02-11 06:08 1,005 --a------ C:\BIOSLOCK.INI
2009-02-08 23:47 . 2009-02-08 23:47 268 --ah----- C:\sqmdata02.sqm
2009-02-08 23:47 . 2009-02-08 23:47 244 --ah----- C:\sqmnoopt02.sqm
2009-02-08 23:28 . 2009-02-08 23:28 <DIR> d-------- c:\documents and settings\Roula\Application Data\AVGTOOLBAR
2009-02-04 03:10 . 2009-02-04 03:10 <DIR> d-------- c:\documents and settings\Administrator
2009-02-04 00:26 . 2008-06-19 16:24 28,544 --a------ c:\windows\system32\drivers\pavboot.sys
2009-02-03 23:24 . 2009-02-03 23:24 <DIR> d-------- c:\program files\Panda Security
2009-02-03 10:13 . 2009-02-03 23:19 <DIR> d-------- c:\documents and settings\Nick\.housecall6.6
2009-02-02 23:38 . 2009-02-11 06:46 <DIR> d--h----- C:\$AVG8.VAULT$
2009-01-29 06:47 . 2009-01-29 07:02 <DIR> d-------- c:\documents and settings\Mom\Application Data\AVGTOOLBAR
2009-01-28 15:27 . 2009-01-28 15:29 <DIR> d-------- c:\documents and settings\Dad\Application Data\AVGTOOLBAR
2009-01-27 16:05 . 2008-06-20 19:46 245,248 -----c--- c:\windows\system32\dllcache\mswsock.dll
2009-01-27 16:05 . 2008-06-20 13:08 225,856 -----c--- c:\windows\system32\dllcache\tcpip6.sys
2009-01-27 16:05 . 2008-06-20 19:46 147,968 -----c--- c:\windows\system32\dllcache\dnsapi.dll
2009-01-26 17:57 . 2009-02-10 17:08 <DIR> d-------- c:\windows\system32\drivers\Avg
2009-01-26 17:57 . 2009-01-30 15:17 <DIR> d-------- c:\documents and settings\Nick\Application Data\AVGTOOLBAR
2009-01-26 17:57 . 2009-01-27 14:25 325,128 --a------ c:\windows\system32\drivers\avgldx86.sys
2009-01-26 17:57 . 2009-01-27 14:25 107,272 --a------ c:\windows\system32\drivers\avgtdix.sys
2009-01-26 17:57 . 2009-01-27 14:25 10,520 --a------ c:\windows\system32\avgrsstx.dll
2009-01-22 18:31 . 2009-01-22 19:32 <DIR> d-------- c:\documents and settings\Nick\Application Data\Download Manager
2009-01-19 11:26 . 2003-02-20 16:42 229,487 --a------ c:\windows\system32\jpicpl32.cpl
2009-01-19 11:24 . 2009-01-19 11:26 9,572 --a------ c:\windows\mozver.dat
2009-01-18 10:38 . 2009-01-18 10:38 268 --ah----- C:\sqmdata01.sqm
2009-01-18 10:38 . 2009-01-18 10:38 244 --ah----- C:\sqmnoopt01.sqm
2009-01-17 16:13 . 2009-02-10 14:09 <DIR> d-------- c:\program files\Spyware Doctor
2009-01-17 16:13 . 2009-01-17 16:13 <DIR> d-------- c:\documents and settings\Nick\Application Data\PC Tools
2009-01-17 16:13 . 2009-01-17 16:17 81,288 --a------ c:\windows\system32\drivers\iksyssec.sys
2009-01-17 16:13 . 2009-01-17 16:17 66,952 --a------ c:\windows\system32\drivers\iksysflt.sys
2009-01-17 16:13 . 2009-01-17 16:17 40,840 --a------ c:\windows\system32\drivers\ikfilesec.sys
2009-01-17 16:13 . 2008-06-02 15:19 29,576 --a------ c:\windows\system32\drivers\kcom.sys
2009-01-16 00:29 . 2009-01-16 00:29 <DIR> d-------- c:\program files\Microsoft ActiveSync
2009-01-16 00:28 . 2009-01-16 00:29 <DIR> d-------- c:\windows\SHELLNEW
2009-01-16 00:27 . 2009-01-16 00:27 <DIR> d-------- c:\program files\Microsoft.NET
2009-01-16 00:25 . 2009-01-16 00:25 <DIR> dr-h----- C:\MSOCache
2009-01-15 23:07 . 2009-01-15 23:07 51,355 --a------ c:\windows\system32\muzika.xm
2009-01-15 15:41 . 2009-01-15 18:02 <DIR> d-------- c:\windows\SxsCaPendDel
2009-01-15 15:32 . 2003-06-18 17:31 17,920 --a------ c:\windows\system32\mdimon.dll
2009-01-15 15:32 . 2009-01-21 21:26 376 --a------ c:\windows\ODBC.INI

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-11 05:00 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-02-10 05:39 --------- d-----w c:\documents and settings\All Users\Application Data\Google Updater
2009-02-09 14:07 --------- d-----w c:\documents and settings\Nick\Application Data\uTorrent
2009-02-08 17:02 --------- d-----w c:\program files\SpywareBlaster
2009-01-27 12:25 --------- d-----w c:\documents and settings\All Users\Application Data\avg8
2009-01-26 17:19 --------- d-----w c:\documents and settings\Nick\Application Data\U3
2009-01-19 09:25 --------- d--h--w c:\program files\InstallShield Installation Information
2009-01-19 09:25 --------- d-----w c:\program files\Java
2009-01-17 02:22 --------- d-----w c:\documents and settings\Nick\Application Data\dvdcss
2009-01-15 22:23 --------- d-----w c:\program files\PokerStars
2009-01-13 01:18 31 ----a-w c:\documents and settings\Nick\jagex_runescape_preferences.dat
2009-01-05 02:45 --------- d-----w c:\program files\Hasbro
2008-12-30 00:09 --------- d-----w c:\documents and settings\Roula\Application Data\Autodesk
2008-12-29 06:48 --------- d-----w c:\documents and settings\Mom\Application Data\OpenOffice.org
2008-12-27 00:21 --------- d-----w c:\documents and settings\Roula\Application Data\Skype
2008-12-27 00:02 --------- d-----w c:\documents and settings\Roula\Application Data\skypePM
2008-12-27 00:01 --------- d-----w c:\program files\Skype
2008-12-27 00:01 --------- d-----w c:\program files\Common Files\Skype
2008-12-27 00:01 --------- d-----w c:\documents and settings\All Users\Application Data\Skype
2008-12-19 19:18 --------- d-----w c:\program files\Diablo II
2008-12-17 06:39 43,520 ----a-w c:\windows\system32\CmdLineExt03.dll
2008-12-17 06:35 21,840 ----atw c:\windows\system32\SIntfNT.dll
2008-12-17 06:35 17,212 ----atw c:\windows\system32\SIntf32.dll
2008-12-17 06:35 12,067 ----atw c:\windows\system32\SIntf16.dll
2008-12-11 18:09 --------- d-----w c:\program files\DVDFab 5
2008-12-11 18:01 --------- d-----w c:\documents and settings\Nick\Application Data\Vso
2008-12-11 18:00 47,360 ----a-w c:\windows\system32\drivers\pcouffin.sys
2008-12-11 18:00 47,360 ----a-w c:\documents and settings\Nick\Application Data\pcouffin.sys
2008-12-07 22:57 73,216 ----a-w c:\windows\ST6UNST.EXE
2008-12-07 22:57 249,856 ------w c:\windows\Setup1.exe
2008-12-06 16:05 94,208 ----a-w c:\windows\DIIUnin.exe
2008-12-06 16:05 2,829 ----a-w c:\windows\DIIUnin.pif
2008-11-25 06:40 5,607 ----a-w c:\windows\~GLH0000.TMP
2008-11-25 06:40 104,688 ----a-w c:\windows\~GLC0000.TMP
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE "= "c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"swg "= "c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-11-08 39408]
"DAEMON Tools Lite "= "c:\program files\DAEMON Tools Lite\daemon.exe" [2008-08-08 490952]
"Windows Video Drivers "= "c:\recycler\S-1-5-21-6950409265-2475029583-782515356-8489\winlogon.exe" [2009-02-02 89600]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1 "= "c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"MSPY2002 "= "c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 59392]
"PHIME2002ASync "= "c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"PHIME2002A "= "c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"NvCplDaemon "= "c:\windows\system32\NvCpl.dll" [2006-06-01 7618560]
"NvMediaCenter "= "c:\windows\system32\NvMcTray.dll" [2006-06-01 86016]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"NeroFilterCheck "= "c:\windows\system32\NeroCheck.exe" [2006-01-12 155648]
"QuickTime Task "= "c:\program files\QuickTime\QTTask.exe" [2008-03-28 413696]
"iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2008-03-30 267048]
"DU Meter "= "c:\program files\DU Meter\DUMeter.exe" [2004-08-25 1465856]
"SunJavaUpdateSched "= "c:\program files\Java\jre6\bin\jusched.exe" [2008-11-03 136600]
"AVG8_TRAY "= "c:\progra~1\AVG\AVG8\avgtray.exe" [2009-01-27 1601304]
"PCTVOICE "= "pctspk.exe" [2003-10-30 c:\windows\system32\pctspk.exe]
"PV92TRAY "= "PV92Tray.exe" [2003-10-30 c:\windows\system32\PV92Tray.exe]
"SoundMan "= "SOUNDMAN.EXE" [2005-06-20 c:\windows\SOUNDMAN.EXE]
"nwiz "= "nwiz.exe" [2006-06-01 c:\windows\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE "= "c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-12-03 113664]
AutoCAD Startup Accelerator.lnk - c:\program files\Common Files\Autodesk Shared\acstart16.exe [2004-02-24 10872]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-11 282624]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-01-27 14:25 10520 c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.ivimp3en "= ivimp3en.acm
"vidc.ffds "= c:\progra~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify "=dword:00000001
"UpdatesDisableNotify "=dword:00000001
"AntiVirusOverride "=dword:00000001
"FirewallOverride "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Bonjour\\mDNSResponder.exe "=
"c:\\Program Files\\iTunes\\iTunes.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"c:\\Program Files\\uTorrent\\uTorrent.exe "=
"c:\\WINDOWS\\system32\\sessmgr.exe "=
"e:\\Documents and Settings\\Nick\\My Documents\\00eMule\\emule.exe "=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe "=
"c:\\Program Files\\Windows Live\\Messenger\\Live Messenger.exe "=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe "=
"c:\\Program Files\\Skype\\Phone\\Skype.exe "=
"c:\\Program Files\\DAP\\DAP.exe "=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe "=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe "=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3587:TCP "= 3587:TCP:Windows Peer-to-Peer Grouping
"3540:UDP "= 3540:UDPeer Name Resolution Protocol (PNRP)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest "= 1 (0x1)

R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2009-02-04 28544]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-01-26 325128]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-01-26 107272]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2009-01-26 903960]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-01-26 298264]
S2 Microsoft Service Controler;Microsoft Service Controler; "c:\windows\system32\drivers\services.exe" --> c:\windows\system32\drivers\services.exe [?]
S3 autorun;autorun;\??\c:\huadio.tmp --> c:\huadio.tmp [?]
S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [2008-11-06 33752]
S3 RkPavproc1;RkPavproc1;\??\c:\windows\system32\drivers\RkPavproc1.sys --> c:\windows\system32\drivers\RkPavproc1.sys [?]
S3 RkPavproc2;RkPavproc2;\??\c:\windows\system32\drivers\RkPavproc2.sys --> c:\windows\system32\drivers\RkPavproc2.sys [?]
S3 RkPavproc3;RkPavproc3;\??\c:\windows\system32\drivers\RkPavproc3.sys --> c:\windows\system32\drivers\RkPavproc3.sys [?]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2009-01-17 356920]
S3 Secdsxxamd0.5;Secdsxxamd0.5;c:\windows\system32\drivers\nwlnkspx.sys [2001-08-23 55936]

--- Other Services/Drivers In Memory ---

*Deregistered* - mchInjDrv

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
\Shell\AutoRun\command - G:\LaunchU3.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{097b6f1f-ebc2-11dd-beb4-0016ec6229a2}]
\Shell\AutoRun\command - G:\LaunchU3.exe
.
Contents of the 'Scheduled Tasks' folder

2009-02-11 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-01-17 15:01]
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Clean Traces - c:\program files\DAP\Privacy Package\dapcleanerie.htm
IE: &Download with &DAP - c:\program files\DAP\dapextie.htm
IE: Download &all with DAP - c:\program files\DAP\dapextie2.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Nick\Application Data\Mozilla\Firefox\Profiles\kl3je602.default\
FF - prefs.js: browser.startup.homepage - about:blank
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - component: c:\program files\DAP\DAPFireFox\components\DAPFireFox.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1441.4352\npCIDetect13.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPMGWRAP.DLL
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-11 07:16:13
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\autorun]
"ImagePath "= "\??\C:\huadio.tmp "
.
Completion time: 2009-02-11 7:17:41
ComboFix-quarantined-files.txt 2009-02-11 05:17:39

Pre-Run: 143,583,019,008 bytes free
Post-Run: 144,034,234,368 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT= "Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS= "Microsoft Windows XP Professional" /noexecute=optin /fastdetect

222 --- E O F --- 2008-11-23 02:11:56

 

This is likely where the infections are getting in.

Program Files\uTorrent

I'm not passing judgment on file-sharing as a concept. However, I will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information.

Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares.

References for the risk of these programs are here,
here and here.

I would strongly recommend that you uninstall them, however that choice is up to you. If you choose to remove these programs, you can do so via Control Panel >> Add or Remove Programs.



Now, disable any realtime protection applications. Highlight and copy the contents of the code box below and paste it into a blank notepad, then save it to your desktop as;

Filename: CFScript.txt
Save As Type: All Files (*.*)

Code:

File::
c:\recycler\S-1-5-21-6950409265-2475029583-782515356-8489\winlogon.exe
Rootkit::
c:\windows\system32\drivers\services.exe
c:\huadio.tmp
Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
 "Windows Video Drivers "=-
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
 "AntiVirusDisableNotify "=dword:00000000
 "UpdatesDisableNotify "=dword:00000000
 "AntiVirusOverride "=dword:00000000
 "FirewallOverride "=dword:00000000
Driver::
Microsoft Service Controler
autorun

Close all other windows and programs. Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button. Combofix should run and may reboot the computer when it's done. A log will open when it's complete. Post the contents of that log.

Please do not click on the ComboFix window while it is running a scan. This can cause it to stall.


Then, do an online scan with Kaspersky Online Scanner

Click Accept, when prompted to download and install the program files and database of malware definitions.

• Click Run at the Security prompt.
• The program will then begin downloading and installing and will also update the database.
• Please be patient as this can take several minutes.
• Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
• Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
• Click View scan report at the bottom.
• Click the Save Report As... button.
• Click the Save as Text button to save the file to your desktop so that you may post it in your next reply.

**Note**

To optimize scanning time and produce a more sensible report for review:

• Close any open programs.
• Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.

Post the Kaspersky log here. Let me know if the firewall is working now as well.

 

im over riding the combo fix changes to keep google as my default search engine and firefox as my default browser.

ComboFix 09-02-10.02 - Nick 2009-02-11 10:23:12.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.601 [GMT 2:00]
Running from: c:\documents and settings\Nick\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Nick\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated)
* Created a new restore point

FILE ::
c:\recycler\S-1-5-21-6950409265-2475029583-782515356-8489\winlogon.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_AUTORUN
-------\Legacy_MICROSOFT_SERVICE_CONTROLER
-------\Service_autorun
-------\Service_Microsoft Service Controler


((((((((((((((((((((((((( Files Created from 2009-01-11 to 2009-02-11 )))))))))))))))))))))))))))))))
.

2009-02-11 07:01 . 2009-02-11 07:01 <DIR> d-------- c:\documents and settings\Nick\.java
2009-02-11 06:08 . 2009-02-11 06:08 1,005 --a------ C:\BIOSLOCK.INI
2009-02-08 23:47 . 2009-02-08 23:47 268 --ah----- C:\sqmdata02.sqm
2009-02-08 23:47 . 2009-02-08 23:47 244 --ah----- C:\sqmnoopt02.sqm
2009-02-08 23:28 . 2009-02-08 23:28 <DIR> d-------- c:\documents and settings\Roula\Application Data\AVGTOOLBAR
2009-02-04 03:10 . 2009-02-04 03:10 <DIR> d-------- c:\documents and settings\Administrator
2009-02-04 00:26 . 2008-06-19 16:24 28,544 --a------ c:\windows\system32\drivers\pavboot.sys
2009-02-03 23:24 . 2009-02-03 23:24 <DIR> d-------- c:\program files\Panda Security
2009-02-03 10:13 . 2009-02-03 23:19 <DIR> d-------- c:\documents and settings\Nick\.housecall6.6
2009-02-02 23:38 . 2009-02-11 06:46 <DIR> d--h----- C:\$AVG8.VAULT$
2009-01-29 06:47 . 2009-01-29 07:02 <DIR> d-------- c:\documents and settings\Mom\Application Data\AVGTOOLBAR
2009-01-28 15:27 . 2009-01-28 15:29 <DIR> d-------- c:\documents and settings\Dad\Application Data\AVGTOOLBAR
2009-01-27 16:05 . 2008-06-20 19:46 245,248 -----c--- c:\windows\system32\dllcache\mswsock.dll
2009-01-27 16:05 . 2008-06-20 13:08 225,856 -----c--- c:\windows\system32\dllcache\tcpip6.sys
2009-01-27 16:05 . 2008-06-20 19:46 147,968 -----c--- c:\windows\system32\dllcache\dnsapi.dll
2009-01-26 17:57 . 2009-02-11 10:00 <DIR> d-------- c:\windows\system32\drivers\Avg
2009-01-26 17:57 . 2009-01-30 15:17 <DIR> d-------- c:\documents and settings\Nick\Application Data\AVGTOOLBAR
2009-01-26 17:57 . 2009-01-27 14:25 325,128 --a------ c:\windows\system32\drivers\avgldx86.sys
2009-01-26 17:57 . 2009-01-27 14:25 107,272 --a------ c:\windows\system32\drivers\avgtdix.sys
2009-01-26 17:57 . 2009-01-27 14:25 10,520 --a------ c:\windows\system32\avgrsstx.dll
2009-01-22 18:31 . 2009-01-22 19:32 <DIR> d-------- c:\documents and settings\Nick\Application Data\Download Manager
2009-01-19 11:26 . 2003-02-20 16:42 229,487 --a------ c:\windows\system32\jpicpl32.cpl
2009-01-19 11:24 . 2009-01-19 11:26 9,572 --a------ c:\windows\mozver.dat
2009-01-18 10:38 . 2009-01-18 10:38 268 --ah----- C:\sqmdata01.sqm
2009-01-18 10:38 . 2009-01-18 10:38 244 --ah----- C:\sqmnoopt01.sqm
2009-01-17 16:13 . 2009-02-10 14:09 <DIR> d-------- c:\program files\Spyware Doctor
2009-01-17 16:13 . 2009-01-17 16:13 <DIR> d-------- c:\documents and settings\Nick\Application Data\PC Tools
2009-01-17 16:13 . 2009-01-17 16:17 81,288 --a------ c:\windows\system32\drivers\iksyssec.sys
2009-01-17 16:13 . 2009-01-17 16:17 66,952 --a------ c:\windows\system32\drivers\iksysflt.sys
2009-01-17 16:13 . 2009-01-17 16:17 40,840 --a------ c:\windows\system32\drivers\ikfilesec.sys
2009-01-17 16:13 . 2008-06-02 15:19 29,576 --a------ c:\windows\system32\drivers\kcom.sys
2009-01-16 00:29 . 2009-01-16 00:29 <DIR> d-------- c:\program files\Microsoft ActiveSync
2009-01-16 00:28 . 2009-01-16 00:29 <DIR> d-------- c:\windows\SHELLNEW
2009-01-16 00:27 . 2009-01-16 00:27 <DIR> d-------- c:\program files\Microsoft.NET
2009-01-16 00:25 . 2009-01-16 00:25 <DIR> dr-h----- C:\MSOCache
2009-01-15 23:07 . 2009-01-15 23:07 51,355 --a------ c:\windows\system32\muzika.xm
2009-01-15 15:41 . 2009-01-15 18:02 <DIR> d-------- c:\windows\SxsCaPendDel
2009-01-15 15:32 . 2003-06-18 17:31 17,920 --a------ c:\windows\system32\mdimon.dll
2009-01-15 15:32 . 2009-01-21 21:26 376 --a------ c:\windows\ODBC.INI

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-11 08:21 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-02-11 06:40 --------- d-----w c:\documents and settings\All Users\Application Data\Google Updater
2009-02-09 14:07 --------- d-----w c:\documents and settings\Nick\Application Data\uTorrent
2009-02-08 17:02 --------- d-----w c:\program files\SpywareBlaster
2009-01-27 12:25 --------- d-----w c:\documents and settings\All Users\Application Data\avg8
2009-01-26 17:19 --------- d-----w c:\documents and settings\Nick\Application Data\U3
2009-01-19 09:25 --------- d--h--w c:\program files\InstallShield Installation Information
2009-01-19 09:25 --------- d-----w c:\program files\Java
2009-01-17 02:22 --------- d-----w c:\documents and settings\Nick\Application Data\dvdcss
2009-01-15 22:23 --------- d-----w c:\program files\PokerStars
2009-01-13 01:18 31 ----a-w c:\documents and settings\Nick\jagex_runescape_preferences.dat
2009-01-05 02:45 --------- d-----w c:\program files\Hasbro
2008-12-30 00:09 --------- d-----w c:\documents and settings\Roula\Application Data\Autodesk
2008-12-29 06:48 --------- d-----w c:\documents and settings\Mom\Application Data\OpenOffice.org
2008-12-27 00:21 --------- d-----w c:\documents and settings\Roula\Application Data\Skype
2008-12-27 00:02 --------- d-----w c:\documents and settings\Roula\Application Data\skypePM
2008-12-27 00:01 --------- d-----w c:\program files\Skype
2008-12-27 00:01 --------- d-----w c:\program files\Common Files\Skype
2008-12-27 00:01 --------- d-----w c:\documents and settings\All Users\Application Data\Skype
2008-12-19 19:18 --------- d-----w c:\program files\Diablo II
2008-12-11 18:09 --------- d-----w c:\program files\DVDFab 5
2008-12-11 18:01 --------- d-----w c:\documents and settings\Nick\Application Data\Vso
2008-12-11 18:00 47,360 ----a-w c:\windows\system32\drivers\pcouffin.sys
2008-12-11 18:00 47,360 ----a-w c:\documents and settings\Nick\Application Data\pcouffin.sys
2008-12-07 22:57 73,216 ----a-w c:\windows\ST6UNST.EXE
2008-12-07 22:57 249,856 ------w c:\windows\Setup1.exe
2008-12-06 16:05 94,208 ----a-w c:\windows\DIIUnin.exe
2008-12-06 16:05 2,829 ----a-w c:\windows\DIIUnin.pif
2008-11-25 06:40 5,607 ----a-w c:\windows\~GLH0000.TMP
2008-11-25 06:40 104,688 ----a-w c:\windows\~GLC0000.TMP
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE "= "c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"swg "= "c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-11-08 39408]
"DAEMON Tools Lite "= "c:\program files\DAEMON Tools Lite\daemon.exe" [2008-08-08 490952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1 "= "c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"MSPY2002 "= "c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 59392]
"PHIME2002ASync "= "c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"PHIME2002A "= "c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"NvCplDaemon "= "c:\windows\system32\NvCpl.dll" [2006-06-01 7618560]
"NvMediaCenter "= "c:\windows\system32\NvMcTray.dll" [2006-06-01 86016]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"NeroFilterCheck "= "c:\windows\system32\NeroCheck.exe" [2006-01-12 155648]
"QuickTime Task "= "c:\program files\QuickTime\QTTask.exe" [2008-03-28 413696]
"iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2008-03-30 267048]
"DU Meter "= "c:\program files\DU Meter\DUMeter.exe" [2004-08-25 1465856]
"SunJavaUpdateSched "= "c:\program files\Java\jre6\bin\jusched.exe" [2008-11-03 136600]
"AVG8_TRAY "= "c:\progra~1\AVG\AVG8\avgtray.exe" [2009-01-27 1601304]
"PCTVOICE "= "pctspk.exe" [2003-10-30 c:\windows\system32\pctspk.exe]
"PV92TRAY "= "PV92Tray.exe" [2003-10-30 c:\windows\system32\PV92Tray.exe]
"SoundMan "= "SOUNDMAN.EXE" [2005-06-20 c:\windows\SOUNDMAN.EXE]
"nwiz "= "nwiz.exe" [2006-06-01 c:\windows\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE "= "c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-12-03 113664]
AutoCAD Startup Accelerator.lnk - c:\program files\Common Files\Autodesk Shared\acstart16.exe [2004-02-24 10872]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-11 282624]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-01-27 14:25 10520 c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.ivimp3en "= ivimp3en.acm
"vidc.ffds "= c:\progra~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Bonjour\\mDNSResponder.exe "=
"c:\\Program Files\\iTunes\\iTunes.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"c:\\WINDOWS\\system32\\sessmgr.exe "=
"e:\\Documents and Settings\\Nick\\My Documents\\00eMule\\emule.exe "=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe "=
"c:\\Program Files\\Windows Live\\Messenger\\Live Messenger.exe "=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe "=
"c:\\Program Files\\Skype\\Phone\\Skype.exe "=
"c:\\Program Files\\DAP\\DAP.exe "=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe "=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe "=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3587:TCP "= 3587:TCP:Windows Peer-to-Peer Grouping
"3540:UDP "= 3540:UDPeer Name Resolution Protocol (PNRP)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest "= 1 (0x1)

R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2009-02-04 28544]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-01-26 325128]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-01-26 107272]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2009-01-26 903960]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-01-26 298264]
S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [2008-11-06 33752]
S3 RkPavproc1;RkPavproc1;\??\c:\windows\system32\drivers\RkPavproc1.sys --> c:\windows\system32\drivers\RkPavproc1.sys [?]
S3 RkPavproc2;RkPavproc2;\??\c:\windows\system32\drivers\RkPavproc2.sys --> c:\windows\system32\drivers\RkPavproc2.sys [?]
S3 RkPavproc3;RkPavproc3;\??\c:\windows\system32\drivers\RkPavproc3.sys --> c:\windows\system32\drivers\RkPavproc3.sys [?]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2009-01-17 356920]
S3 Secdsxxamd0.5;Secdsxxamd0.5;c:\windows\system32\drivers\nwlnkspx.sys [2001-08-23 55936]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
\Shell\AutoRun\command - G:\LaunchU3.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{097b6f1f-ebc2-11dd-beb4-0016ec6229a2}]
\Shell\AutoRun\command - G:\LaunchU3.exe
.
Contents of the 'Scheduled Tasks' folder

2009-02-11 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-01-17 15:01]
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
mDefault_Search_URL = hxxp://www.google.com/ie
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
IE: &Clean Traces - c:\program files\DAP\Privacy Package\dapcleanerie.htm
IE: &Download with &DAP - c:\program files\DAP\dapextie.htm
IE: Download &all with DAP - c:\program files\DAP\dapextie2.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Nick\Application Data\Mozilla\Firefox\Profiles\kl3je602.default\
FF - prefs.js: browser.startup.homepage - about:blank
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - component: c:\program files\DAP\DAPFireFox\components\DAPFireFox.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1441.4352\npCIDetect13.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPMGWRAP.DLL
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-11 10:26:57
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\HPZipm12.exe
c:\program files\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\program files\AVG\AVG8\avgcsrvx.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\rundll32.exe
c:\program files\HP\Digital Imaging\bin\hpqste08.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\system32\control.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\control.exe
.
**************************************************************************
.
Completion time: 2009-02-11 10:30:42 - machine was rebooted [Nick]
ComboFix-quarantined-files.txt 2009-02-11 08:30:39
ComboFix2.txt 2009-02-11 05:17:42

Pre-Run: 143,917,797,376 bytes free
Post-Run: 143,838,146,560 bytes free

230 --- E O F --- 2008-11-23 02:11:56

 

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Thursday, February 12, 2009
Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Wednesday, February 11, 2009 23:04:35
Records in database: 1784269
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
A:\
C:\
E:\
F:\

Scan statistics:
Files scanned: 172662
Threat name: 2
Infected objects: 2
Suspicious objects: 0
Duration of the scan: 02:57:40


File name / Threat name / Threats count
E:\Documents and Settings\Nick\My Documents\Downloads\Programs\mIRC_v6.16.zip Infected: not-a-virus:Client-IRC.Win32.mIRC.616 1
E:\Documents and Settings\Roula\My Documents\LT 29.11.2006\Set up\Download Accelerator Plus 7.4.exe Infected: not-a-virus:AdWare.Win32.Dap.h 1

The selected area was scanned.
============

ty noahdfear,
I just activated spyware doctor and after its startup scan it gave me 2 threats.
1 for combofix (25 infections, Im fine with those i guess)
but 1 was the generic Trojan, (a registry entry)
ill wait for ur reply before taking any actions.

 

Neither of those detections is a threat. Lets cleanup. Click Start>Run and type ComboFix /u then hit Enter to uninstall ComboFix and remove the files it has quarantined. This action will also reset the System Restore points, removing any infected files there as well.
Verify the C:\Qoobox and C:\ComboFix folders were removed, as well as the C:\ComboFix.txt file.

Delete dds.pif from the desktop.
You can delete any other logs that were created/saved too.
Empty the recycle bin when done.

Uninstall the following Java components via Add/Remove Programs.

Java 2 Runtime Environment, SE v1.4.1_02
Java(TM) 6 Update 10

Then install the latest JRE 6 Update 12 from here

That should finish things up. You can allow Spyware Doctor to remove an registry entries found after completing the above.

 

ok all done, (i haven't had trouble cleaning up my PC since 2001 idk if ur remember something called called xupiter)

tyvm noahdfear.

 

You're most welcome. Glad I could help. Geri has posted some very helpful information and recommendations regarding future protection in the following link.

http://www.windowsbbs.com/showthread.php?t=67958

Surf safe!