surfing is slow but downloading is fast

hi pls help me i cant surf its very slow but wen i download someting its really fast wat do i do here the hijackthis log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:09:41 AM, on 7/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\DOCUME~1\admin\LOCALS~1\Temp\Rar$EX00.562\Firefox Ultimate Optimizer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\ups.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\PROGRA~1\AVG\AVG8\avgscanx.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.in/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AVG Safe Search - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file)
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe "
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [FirefoxUltimateOptimizer] "C:\DOCUME~1\admin\LOCALS~1\Temp\Rar$EX00.562\Firefox Ultimate Optimizer.exe "
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe "
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\CCleaner.exe" /AUTO
O4 - HKUS\S-1-5-18\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user')
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{DF4FCC39-8A6E-44A9-838D-BCB1CFD7ACB5}: NameServer = 125.22.47.125,202.56.250.5
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 5830 bytes


i also have other problems
1. my comp is really slow even wen no program is running my ram is 512 and pf usage is 300 wen nothing is used wat do do


thanks

 

Hi xpcolin,

You have Firefox Ultimate Optimizer running from a temporary location. You need to re-download that and Save it to the hard drive, then extract it from the zip file and install it.

Next, scan again with HijackThsi and place a check next to the following entries.

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O3 - Toolbar: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file)
O4 - HKLM\..\Run: [FirefoxUltimateOptimizer] "C:\DOCUME~1\admin\LOCALS~1\Temp\Rar$EX00.562\Firefox Ultimate Optimizer.exe "


Close all other windows then click Fix Checked. Close HijackThis.


Download ATF Cleaner by Atribune and save it to your Desktop.

• Double click ATF-Cleaner.exe to run the program.
• Check the boxes to the left of:
  
  
  • Windows Temp
  • Current User Temp
  • All Users Temp
  • Temporary Internet Files
  • Prefetch
  • Java Cache
  • Recycle bin
  
  
• The rest are optional - if you want it to remove everything check "Select All ".
• Finally, click Empty Selected. When you get the "Done Cleaning" message, click OK then exit.

Reboot


Now, P2P - I see you have P2P software ([color= "Red"]uTorrent[/color]) installed on your machine. I'm not passing judgment on file-sharing as a concept. However, I will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information.

Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares.

References for the risk of these programs are here,
here and here.

I would strongly recommend that you uninstall them, however that choice is up to you. If you choose to remove these programs, you can do so via Control Panel >> Add or Remove Programs.

Additionally, these apps often run in the background when you start your computer (I see uTorrent running in your log), consuming cpu cycles and bandwidth. This could be a major contributor to your slowdown.

 

thanks man i did it but now comp is going off and restarting suddenly

 

Ummm, just to be sure, did you do everything recommended, part of it, what?

Lets get a better look at things. Download Deckard's System Scanner (dss.exe) and save it to your desktop.

• Close all applications and windows.
• Double click on dss.exe to run it and follow the prompts.
• When the scan is complete, two text files will open; main.txt, which will be maximized and extra.txt, which will be minimized.

Post the contents of main.txt only for now.

 

Deckard's System Scanner v20071014.68
Run by admin on 2008-07-15 23:53:33
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Successfully created a Deckard's System Scanner Restore Point.


-- Last 5 Restore Point(s) --
9: 2008-07-15 18:23:40 UTC - RP24 - Deckard's System Scanner Restore Point
8: 2008-07-14 16:07:53 UTC - RP23 - Revo Uninstaller's restore point - MyPhoneExplorer
7: 2008-07-14 16:04:10 UTC - RP22 - Revo Uninstaller's restore point - MyPhoneExplorer
6: 2008-07-14 15:02:51 UTC - RP21 - Advanced WindowsCare RestorePoint
5: 2008-07-14 14:59:59 UTC - RP20 - Revo Uninstaller's restore point - Advanced WindowsCare Personal


-- First Restore Point --
1: 2008-07-12 20:24:13 UTC - RP16 - System Checkpoint


Backed up registry hives.
Performed disk cleanup.

Total Physical Memory: 447 MiB (512 MiB recommended).


-- HijackThis (run as admin.exe) -----------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:55:00 PM, on 7/15/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\ups.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Documents and Settings\admin\Desktop\dss.exe
C:\PROGRA~1\Trend Micro\HijackThis\admin.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.in/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AVG Safe Search - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe "
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [FirefoxUltimateOptimizer] "C:\Program Files\Firefox Ultimate Optimizer.exe "
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe "
O4 - HKUS\S-1-5-18\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user')
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{DF4FCC39-8A6E-44A9-838D-BCB1CFD7ACB5}: NameServer = 125.22.47.125,202.56.250.5
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

--
End of file - 5257 bytes

-- HijackThis Fixed Entries (C:\PROGRA~1\Trend Micro\HijackThis\backups\) ------

backup-20080712-202820-119 O3 - Toolbar: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file)
backup-20080712-202820-724 O3 - Toolbar: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
backup-20080712-202820-934 O4 - HKLM\..\Run: [FirefoxUltimateOptimizer] "C:\DOCUME~1\admin\LOCALS~1\Temp\Rar$EX00.562\Firefox Ultimate Optimizer.exe "
backup-20080712-202820-945 O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

-- File Associations -----------------------------------------------------------

All associations okay.


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

All drivers whitelisted.


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 Bonjour Service - "c:\program files\bonjour\mdnsresponder.exe" <Not Verified; Apple Inc.; Bonjour>

S3 ServiceLayer - "c:\program files\pc connectivity solution\servicelayer.exe" <Not Verified; Nokia.; PC Connectivity Solution>


-- Device Manager: Disabled ----------------------------------------------------

Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description: PCI Simple Communications Controller
Device ID: PCI\VEN_14F1&DEV_2F30&SUBSYS_205D14F1&REV_01\4&1C88B56&0&50A4
Manufacturer:
Name: PCI Simple Communications Controller
PNP Device ID: PCI\VEN_14F1&DEV_2F30&SUBSYS_205D14F1&REV_01\4&1C88B56&0&50A4
Service:

Class GUID: {4D36E96F-E325-11CE-BFC1-08002BE10318}
Description: PS/2 Compatible Mouse
Device ID: ACPI\PNP0F13\3&61AAA01&0
Manufacturer: Microsoft
Name: PS/2 Compatible Mouse
PNP Device ID: ACPI\PNP0F13\3&61AAA01&0
Service: i8042prt


-- Scheduled Tasks -------------------------------------------------------------

2008-07-15 23:42:00 254 --a----c- C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job
2008-07-15 23:37:46 486 --a----c- C:\WINDOWS\Tasks\1-Click Maintenance.job
2008-07-01 15:10:02 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job


-- Files created between 2008-06-15 and 2008-07-15 -----------------------------

2008-07-15 23:43:08 0 dr-h----- C:\MSOCache
2008-07-15 19:20:02 0 dr-h----- C:\Documents and Settings\admin\Recent
2008-07-14 21:40:22 0 d-------- C:\Documents and Settings\admin\Application Data\MyPhoneExplorer
2008-07-14 21:40:13 0 d-------- C:\Program Files\MyPhoneExplorer
2008-07-12 20:54:01 0 d-------- C:\Program Files\Languages
2008-07-12 20:24:56 114688 --a------ C:\Program Files\Firefox Ultimate Optimizer.exe <Not Verified; felipEx [http://felipex.net]; Firefox Ultimate Optimizer>
2008-07-11 11:08:36 0 d-------- C:\Program Files\Trend Micro
2008-07-10 02:49:27 23 --ahs---- C:\WINDOWS\system32\cbfcabc_z.dll
2008-07-10 02:18:09 0 d-------- C:\Documents and Settings\admin\Application Data\Malwarebytes
2008-07-10 02:18:03 0 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-07-09 17:35:22 0 d-------- C:\Program Files\Yahoo!
2008-07-06 01:58:32 0 d-------- C:\Documents and Settings\admin\Application Data\DivX
2008-07-06 01:18:53 0 d-------- C:\Program Files\DivX
2008-07-04 14:51:57 0 d-------- C:\Documents and Settings\admin\Application Data\Ashampoo
2008-07-04 14:50:48 0 d-------- C:\Documents and Settings\All Users\Application Data\ashampoo
2008-07-04 14:50:20 0 d-------- C:\Program Files\Ashampoo
2008-07-04 12:35:09 53760 --a------ C:\DRTCP021.exe <Not Verified; Tolunay Orkun; Dr. TCP>
2008-07-03 10:52:42 0 d-------- C:\Documents and Settings\admin\Application Data\AD ON Multimedia
2008-07-01 21:33:43 233472 --a------ C:\WINDOWS\system32\TubeFinder.exe <Not Verified; Koyote Soft; Tube Finder>
2008-07-01 21:33:42 101888 --a------ C:\WINDOWS\system32\VB6STKIT.DLL <Not Verified; Microsoft Corporation; Microsoft® Visual Basic for Windows>
2008-07-01 21:33:42 119568 --a------ C:\WINDOWS\system32\VB6FR.DLL <Not Verified; Microsoft Corporation; Environnement Visual Basic>
2008-07-01 21:33:41 9728 --a------ C:\WINDOWS\system32\PCCLPFR.DLL <Not Verified; Microsoft Corporation; PicClip>
2008-07-01 21:33:41 141312 --a------ C:\WINDOWS\system32\MSCMCFR.DLL <Not Verified; Microsoft Corporation; COMCTL>
2008-07-01 21:33:41 32768 --a------ C:\WINDOWS\system32\CMDLGFR.DLL <Not Verified; Microsoft Corporation; CMDIALOG>
2008-07-01 21:33:41 0 d-------- C:\Program Files\Free FLV Converter
2008-07-01 20:21:35 0 d-------- C:\Documents and Settings\admin\dwhelper
2008-06-27 23:12:35 0 d-------- C:\Documents and Settings\admin\Application Data\GlarySoft
2008-06-26 11:23:27 0 d-------- C:\Program Files\Macromedia
2008-06-26 00:49:54 0 d-------- C:\Documents and Settings\All Users\Application Data\Uniblue
2008-06-26 00:07:53 0 d-------- C:\Documents and Settings\admin\Application Data\Uniblue
2008-06-26 00:07:40 0 d-------- C:\Program Files\Uniblue
2008-06-25 20:53:03 0 d-------- C:\Documents and Settings\admin\Application Data\Sony Ericsson
2008-06-25 20:51:27 0 d-------- C:\Documents and Settings\admin\Application Data\Teleca
2008-06-25 20:50:56 0 d-------- C:\Program Files\Common Files\Teleca Shared
2008-06-24 03:59:53 5505024 --a------ C:\Documents and Settings\admin\ntuser.dat
2008-06-18 11:26:29 0 d-------- C:\WINDOWS\pss
2008-06-18 11:09:24 0 d-------- C:\Program Files\YouTube Downloader
2008-06-16 14:54:26 0 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-06-16 14:35:33 0 d-------- C:\Program Files\LimeWire


-- Find3M Report ---------------------------------------------------------------

2008-07-15 23:38:54 0 d-------- C:\Documents and Settings\admin\Application Data\uTorrent
2008-07-14 20:32:10 0 d-------- C:\Program Files\IObit
2008-07-14 20:30:46 0 d-------- C:\Program Files\TuneUp Utilities 2008
2008-07-13 01:41:27 0 d-------- C:\Documents and Settings\admin\Application Data\LimeWire
2008-07-12 20:22:26 64035 --a------ C:\Program Files\firefox-ultimate-optimizer-11.zip
2008-07-11 16:09:40 0 d-------- C:\Documents and Settings\admin\Application Data\Winamp
2008-07-09 01:53:23 0 d-------- C:\Program Files\Java
2008-07-04 15:26:15 0 d-------- C:\Program Files\Common Files\Nero
2008-06-27 23:13:16 0 d-------- C:\Documents and Settings\admin\Application Data\Macromedia
2008-06-26 12:30:13 0 d-------- C:\Program Files\QuickTime
2008-06-26 12:25:26 0 d-------- C:\Program Files\Common Files
2008-06-26 00:29:39 0 d-------- C:\Program Files\MagicISO
2008-06-25 20:47:56 0 d-------- C:\Program Files\Common Files\InstallShield
2008-06-18 11:37:59 0 d-------- C:\Program Files\Windows Doctor
2008-06-18 01:33:29 0 d-------- C:\Documents and Settings\admin\Application Data\Mozilla
2008-06-14 00:03:15 0 d-------- C:\Program Files\VideoLAN
2008-06-11 21:02:48 0 d-------- C:\Program Files\DFX
2008-06-11 20:04:20 0 d-------- C:\Program Files\Common Files\DFX
2008-06-11 19:59:38 0 d-------- C:\Program Files\Winamp
2008-06-01 19:58:03 0 d-------- C:\Program Files\CCleaner
2008-05-28 09:47:00 0 d-------- C:\Program Files\Panda Security
2008-05-26 13:41:44 0 d-------- C:\Documents and Settings\admin\Application Data\AVGTOOLBAR
2008-05-26 13:41:37 0 d-------- C:\Program Files\AVG
2008-05-23 23:34:08 0 d-------- C:\Documents and Settings\admin\Application Data\Thinking Minds Budiling Bytes
2008-05-22 19:57:25 0 d-------- C:\Program Files\Apple Software Update
2008-05-21 18:26:35 0 d-------- C:\Documents and Settings\admin\Application Data\IObit
2008-05-21 17:54:03 0 d-------- C:\Program Files\EvilLyrics


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched "= "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [06/10/2008 04:27 AM]
"AVG8_TRAY "= "C:\PROGRA~1\AVG\AVG8\avgtray.exe" [07/04/2008 12:11 PM]
"FirefoxUltimateOptimizer "= "C:\Program Files\Firefox Ultimate Optimizer.exe" [11/08/2007 07:12 PM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 05:30 PM]
"uTorrent "= "C:\Program Files\uTorrent\uTorrent.exe" [03/05/2008 10:35 AM]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"PcSync "=C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"LinkResolveIgnoreLinkInfo "=0 (0x0)
"NoResolveSearch "=1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"LinkResolveIgnoreLinkInfo "=0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls "=avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WLSetupSvc "=3 (0x3)
"UxTuneUp "=2 (0x2)
"TuneUp.Defrag "=3 (0x3)
"Nero BackItUp Scheduler 3 "=2 (0x2)
"iPod Service "=3 (0x3)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ctfmon.exe "=C:\WINDOWS\system32\ctfmon.exe

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp




-- Hosts -----------------------------------------------------------------------

127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com

8034 more entries in hosts file.


-- End of Deckard's System Scanner: finished at 2008-07-15 23:55:50 ------------

thanks

 

i think ill post both sorry


Deckard's System Scanner v20071014.68
Extra logfile - please post this as an attachment with your post.
--------------------------------------------------------------------------------

-- System Information ----------------------------------------------------------

Microsoft Windows XP Professional (build 2600) SP 2.0
Architecture: X86; Language: English

CPU 0: AMD Athlon(tm) 64 Processor 3000+
Percentage of Memory in Use: 72%
Physical Memory (total/avail): 446.48 MiB / 121.43 MiB
Pagefile Memory (total/avail): 1071.78 MiB / 823.34 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1936.79 MiB

A: is Removable (No Media)
C: is Fixed (NTFS) - 14.65 GiB total, 8.52 GiB free.
D: is Fixed (NTFS) - 36.43 GiB total, 7.02 GiB free.
E: is Fixed (NTFS) - 23.44 GiB total, 7.01 GiB free.
F: is CDROM (No Media)

\\.\PHYSICALDRIVE0 - ST3808110AS - 74.53 GiB - 3 partitions
\PARTITION0 (bootable) - Installable File System - 14.65 GiB - C:
\PARTITION1 - Installable File System - 23.44 GiB - E:
\PARTITION2 - Extended w/Extended Int 13 - 36.43 GiB - D:



-- Security Center -------------------------------------------------------------

AUOptions is scheduled to auto-install.
Windows Internal Firewall is enabled.

FirstRunDisabled is set.

AV: AVG Anti-Virus Free v8.0 (AVG Technologies)

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "= "%windir%\\system32\\sessmgr.exe:*:enabledxpsp2res.dll,-22019 "
"%windir%\\Network Diagnostic\\xpnetdiag.exe "= "%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabledxpsp3res.dll,-20000 "
"C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe "= "C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager "
"C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe "= "C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager "
"C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe "= "C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application "
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "= "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger "
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe "= "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone) "

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "= "%windir%\\system32\\sessmgr.exe:*:enabledxpsp2res.dll,-22019 "
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe "= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe:*:Enabled:hpqtra08.exe "
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe "= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe:*:Enabled:hpqste08.exe "
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe "= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe:*:Enabled:hpofxm08.exe "
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe "= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe:*:Enabled:hposfx08.exe "
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe "= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe:*:Enabled:hposid01.exe "
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe "= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe:*:Enabled:hpqscnvw.exe "
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe "= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe:*:Enabled:hpqkygrp.exe "
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe "= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe:*:Enabled:hpqcopy.exe "
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe "= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe:*:Enabled:hpfccopy.exe "
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe "= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe:*:Enabled:hpzwiz01.exe "
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe "= "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe:*:Enabled:hpqphunl.exe "
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe "= "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe:*:Enabled:hpqdia.exe "
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe "= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe:*:Enabled:hpoews01.exe "
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe "= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe:*:Enabled:hpqnrs08.exe "
"%windir%\\Network Diagnostic\\xpnetdiag.exe "= "%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabledxpsp3res.dll,-20000 "
"C:\\Program Files\\Google\\Google Talk\\googletalk.exe "= "C:\\Program Files\\Google\\Google Talk\\googletalk.exe:*:Enabled:Google Talk "
"C:\\Program Files\\uTorrent\\uTorrent.exe "= "C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:µTorrent "
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe "= "C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe:*:Enabled:Yahoo! Messenger "
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe "= "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe:*:Enabled:Yahoo! FT Server "
"C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe "= "C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager "
"C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe "= "C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager "
"C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe "= "C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application "
"C:\\Program Files\\Bonjour\\mDNSResponder.exe "= "C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour "
"C:\\Program Files\\iTunes\\iTunes.exe "= "C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes "
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe "= "C:\\Program Files\\AVG\\AVG8\\avgupd.exe:*:Enabled:avgupd.exe "
"C:\\Program Files\\AVG\\AVG8\\avgemc.exe "= "C:\\Program Files\\AVG\\AVG8\\avgemc.exe:*:Enabled:avgemc.exe "
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "= "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger "
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe "= "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone) "


-- Environment Variables -------------------------------------------------------

ALLUSERSPROFILE=C:\Documents and Settings\All Users
APPDATA=C:\Documents and Settings\admin\Application Data
CLASSPATH=.;C:\Program Files\Java\jre1.6.0_03\lib\ext\QTJava.zip
CLIENTNAME=Console
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=COLIN
ComSpec=C:\WINDOWS\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Documents and Settings\admin
LOGONSERVER=\\COLIN
NUMBER_OF_PROCESSORS=1
OS=Windows_NT
Path=C:\Program Files\PC Connectivity Solution\;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Program Files\QuickTime\QTSystem\
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 15 Model 47 Stepping 2, AuthenticAMD
PROCESSOR_LEVEL=15
PROCESSOR_REVISION=2f02
ProgramFiles=C:\Program Files
PROMPT=$P$G
QTJAVA=C:\Program Files\Java\jre1.6.0_03\lib\ext\QTJava.zip
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\WINDOWS
TEMP=C:\DOCUME~1\admin\LOCALS~1\Temp
TMP=C:\DOCUME~1\admin\LOCALS~1\Temp
USERDOMAIN=COLIN
USERNAME=admin
USERPROFILE=C:\Documents and Settings\admin
windir=C:\WINDOWS
__COMPAT_LAYER=EnableNXShowUI


-- User Profiles ---------------------------------------------------------------

admin (admin)


-- Add/Remove Programs ---------------------------------------------------------

--> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
µTorrent --> "C:\Program Files\uTorrent\uTorrent.exe" /UNINSTALL
Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742) --> MsiExec.exe /X{6846389C-BAC0-4374-808E-B120F86AF5D7}
Adobe Flash Player ActiveX --> C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player Plugin --> C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 8.1.2 --> MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81200000003}
Advanced WindowsCare Personal --> "C:\Program Files\IObit\Advanced WindowsCare V2\unins000.exe "
Apple Software Update --> MsiExec.exe /I{02DFF6B1-1654-411C-8D7B-FD6052EF016F}
Ashampoo Burning Studio 8.02 --> "C:\Program Files\Ashampoo\Ashampoo Burning Studio 8\unins000.exe "
ATI Display Driver --> rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_classISPLAY -clean
AVG Free 8.0 --> C:\Program Files\AVG\AVG8\setup.exe /UNINSTALL
AviSynth 2.5 --> "C:\Program Files\AviSynth 2.5\Uninstall.exe "
Bonjour --> MsiExec.exe /I{47BF1BD6-DCAC-468F-A0AD-E5DECC2211C3}
CCleaner (remove only) --> "C:\Program Files\CCleaner\uninst.exe "
DFX for Winamp --> C:\Program Files\DFX\uninstall_Winamp.exe
EvilLyrics --> "C:\Program Files\EvilLyrics\uninst.exe "
ffdshow (remove only) --> "C:\Program Files\ffdshow\uninstall.exe "
Free FLV Converter V 5.1 --> "C:\Program Files\Free FLV Converter\unins000.exe "
Free iPod Video Converter 1.26 --> "C:\Program Files\Free iPod Video Converter\unins000.exe "
getPlus(R)_dll --> rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\inf\GETPLUSd.INF, DefaultUninstall
GOM Player --> "C:\Program Files\GRETECH\GomPlayer\Uninstall.exe "
Google Talk (remove only) --> "C:\Program Files\Google\Google Talk\uninstall.exe "
Highlight Viewer (Windows Live Toolbar) --> MsiExec.exe /X{A5C4AD72-25FE-4899-B6DF-6D8DF63C93CF}
HijackThis 2.0.2 --> "C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
HP Photosmart Essential --> MsiExec.exe /X{D7CAE58E-26DE-49B7-A75D-EAEDF76726BE}
HP Software Update --> MsiExec.exe /X{ECFDD6BD-E0C0-41CC-A171-E6D6AF4C0E93}
iTunes --> MsiExec.exe /I{585776BC-4BD6-4BD2-A19A-1D6CB44A403B}
Java(TM) 6 Update 3 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160030}
Java(TM) 6 Update 5 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050}
Java(TM) 6 Update 7 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
LimeWire PRO 4.18.2 --> "C:\Program Files\LimeWire\uninstall.exe "
Logitech Print Service --> C:\PROGRA~1\Logitech\PRINTS~1\UNWISE.EXE C:\PROGRA~1\Logitech\PRINTS~1\INSTALL.LOG
Logitech QuickCam Software --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C43048A9-742C-4DAD-90D2-E3B53C9DB825}\setup.exe" -l0x9
Logitech® Camera Driver --> "C:\Program Files\Common Files\Logitech\QCDRV\BIN\SETUP.EXE" UNINSTALL REMOVEPROMPT
Magic ISO Maker v5.4 (build 0239) --> C:\PROGRA~1\MagicISO\UNWISE.EXE C:\PROGRA~1\MagicISO\INSTALL.LOG
Map Button (Windows Live Toolbar) --> MsiExec.exe /X{7745B7A9-F323-4BB9-9811-01BF57A028DA}
Microsoft ActiveSync 4.0 --> MsiExec.exe /I{B208806F-A231-4FA0-AB3F-5C1B8979223E}
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5 --> "C:\WINDOWS\$NtUninstallWdf01005$\spuninst\spuninst.exe "
Microsoft Office 2000 Professional --> MsiExec.exe /I{00010409-78E1-11D2-B60F-006097C998E7}
Microsoft Office Word Viewer 2003 --> MsiExec.exe /I{90850409-6000-11D3-8CFE-0150048383C9}
Microsoft Visual C++ 2005 Redistributable --> MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Mozilla Firefox (3.0) --> C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MyPhoneExplorer --> C:\Program Files\MyPhoneExplorer\uninstall.exe
Nokia Connectivity Cable Driver --> MsiExec.exe /X{3BFFC6B8-4EC0-4240-858C-998FD4077983}
Nokia PC Suite --> MsiExec.exe /I{02091327-B124-4216-9D71-58C0E24F5392}
PC Connectivity Solution --> MsiExec.exe /I{04F3BF74-9E34-4D3E-93C3-D3D1F24199C8}
QuickTime --> MsiExec.exe /I{1838C5A2-AB32-4145-85C1-BB9B8DFA24CD}
Revo Uninstaller 1.71 --> C:\Program Files\VS Revo Group\Revo Uninstaller\uninst.exe
Security Update for CAPICOM (KB931906) --> MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for CAPICOM (KB931906) --> MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Smart Menus (Windows Live Toolbar) --> MsiExec.exe /X{F084395C-40FB-4DB3-981C-B51E74E1E83D}
TuneUp Utilities 2008 --> MsiExec.exe /I{5888428E-699C-4E71-BF71-94EE06B497DA}
Uniblue RegistryBooster 2 --> "C:\Program Files\Uniblue\RegistryBooster 2\unins000.exe "
VCRedistSetup --> MsiExec.exe /I{3921A67A-5AB1-4E48-9444-C71814CF3027}
VideoLAN VLC media player 0.8.6h --> C:\Program Files\VideoLAN\VLC\uninstall.exe
Winamp --> "C:\Program Files\Winamp\UninstWA.exe "
Windows Driver Package - Nokia (WUDFRd) WPD (11/03/2006 6.82.26.2) --> C:\PROGRA~1\DIFX\D6ACC4BE676423A2B130B78A4B627FC457D98997\dpinst.exe /u C:\WINDOWS\system32\DRVSTORE\pccswpddri_6B630EE2E66584353C6CD8683D447072872F34D8\pccswpddriver.inf
Windows Driver Package - Nokia Modem (11/03/2006 6.82.0.1) --> C:\PROGRA~1\DIFX\D6ACC4BE676423A2B130B78A4B627FC457D98997\dpinst.exe /u C:\WINDOWS\system32\DRVSTORE\nokbtmdm_4EFFAAE27A08EDFDE145390033D8EF099DA65567\nokbtmdm.inf
Windows Live installer --> MsiExec.exe /X{A7E4ECCA-4A8E-4258-8EC8-2DCCF5B11320}
Windows Live Messenger --> MsiExec.exe /X{508CE775-4BA4-4748-82DF-FE28DA9F03B0}
Windows Live Sign-in Assistant --> MsiExec.exe /I{AFA4E5FD-ED70-4D92-99D0-162FD56DC986}
Windows Live Toolbar --> "C:\Program Files\Windows Live Toolbar\UnInstall.exe" {D5A145FC-D00C-4F1A-9119-EB4D9D659750}
Windows Live Toolbar --> MsiExec.exe /X{D5A145FC-D00C-4F1A-9119-EB4D9D659750}
Windows Live Toolbar Extension (Windows Live Toolbar) --> MsiExec.exe /X{341201D4-4F61-4ADB-987E-9CCE4D83A58D}
WinRAR archiver --> C:\Program Files\WinRAR\uninstall.exe
Zune Desktop Theme --> MsiExec.exe /X{7E20EFE6-E604-48C6-8B39-BA4742F2CDB4}


-- Application Event Log -------------------------------------------------------

Event Record #/Type1390 / Warning
Event Submitted/Written: 07/14/2008 08:19:04 PM
Event ID/Source: 1004 / MsiInstaller
Event Description:
Detection of product '{508CE775-4BA4-4748-82DF-FE28DA9F03B0}', feature 'MsgrFeat', component '{7CBC9E83-5D64-4EB3-847B-E628ADDA3D1E}' failed. The resource 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MessengerService\InstallationDirectory' does not exist.

Event Record #/Type1370 / Success
Event Submitted/Written: 07/13/2008 11:03:00 PM
Event ID/Source: 12001 / usnjsvc
Event Description:
The Messenger Sharing USN Journal Reader service started successfully.

Event Record #/Type1368 / Warning
Event Submitted/Written: 07/13/2008 11:02:11 PM
Event ID/Source: 1004 / MsiInstaller
Event Description:
Detection of product '{508CE775-4BA4-4748-82DF-FE28DA9F03B0}', feature 'MsgrFeat', component '{33EF8657-5705-47D4-B01F-E96A27C1D8BD}' failed. The resource 'HKEY_CLASSES_ROOT\Typelib\{53CED51D-432B-45B2-A3E0-0CE2C24235D4}\' does not exist.

Event Record #/Type1356 / Error
Event Submitted/Written: 07/12/2008 10:09:26 AM
Event ID/Source: 1000 / Application Error
Event Description:
Faulting application vlc.exe, version 0.8.6.0, faulting module libvlc.dll, version 0.0.0.0, fault address 0x0001177f.
Processing media-specific event for [vlc.exe!ws!]

Event Record #/Type1354 / Warning
Event Submitted/Written: 07/11/2008 00:07:56 PM
Event ID/Source: 1001 / MsiInstaller
Event Description:
Detection of product '{00010409-78E1-11D2-B60F-006097C998E7}', feature 'TCWP5Files' failed during request for component '{CC29EC7F-7BC2-11D1-A921-00A0C91E2AA2}'



-- Security Event Log ----------------------------------------------------------

No Errors/Warnings found.


-- System Event Log ------------------------------------------------------------

Event Record #/Type15353 / Warning
Event Submitted/Written: 07/15/2008 11:42:51 PM
Event ID/Source: 4226 / Tcpip
Event Description:
TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.

Event Record #/Type15316 / Warning
Event Submitted/Written: 07/14/2008 11:16:08 PM
Event ID/Source: 4226 / Tcpip
Event Description:
TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.

Event Record #/Type15315 / Warning
Event Submitted/Written: 07/14/2008 10:21:10 PM
Event ID/Source: 4226 / Tcpip
Event Description:
TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.

Event Record #/Type15314 / Warning
Event Submitted/Written: 07/14/2008 09:53:45 PM
Event ID/Source: 4226 / Tcpip
Event Description:
TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.

Event Record #/Type15308 / Warning
Event Submitted/Written: 07/14/2008 09:40:01 PM
Event ID/Source: 4226 / Tcpip
Event Description:
TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.



-- End of Deckard's System Scanner: finished at 2008-07-15 23:55:50 ------------

 

thought it might help and make things easier for ya if im wrong sorry

 

Download ComboFix by sUBs from here, saving the file to your desktop.


Please disable realtime protection applications as they sometimes interfere with the tool. Check this link for your applicable programs.

• Close all open programs and windows
• Double click combofix.exe and follow the prompts.
• It may reboot your computer and resume running when you logon. Wait for it to complete. When finished, it will open a log for you. Post that log and a new HijackThis log in your next reply.

Note: Do not mouseclick combofix's window while its running. That may cause it to stall

 

ComboFix 08-07-15.4 - admin 2008-07-16 20:19:41.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.139 [GMT 5.5:30]
Running from: C:\Documents and Settings\admin\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\cbfcabc_z.dll

.
((((((((((((((((((((((((( Files Created from 2008-06-16 to 2008-07-16 )))))))))))))))))))))))))))))))
.

2008-07-16 20:07 . 2008-07-16 20:10 <DIR> d-------- C:\WINDOWS\system32\drivers\Avg
2008-07-16 20:07 . 2008-07-16 20:07 96,520 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys
2008-07-16 20:07 . 2008-07-16 20:07 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll
2008-07-16 20:06 . 2008-07-16 20:06 <DIR> d-------- C:\Program Files\AVG
2008-07-16 20:06 . 2008-07-16 20:06 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg8
2008-07-16 02:43 . 2008-07-16 02:43 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-07-15 23:53 . 2008-07-15 23:53 <DIR> d-------- C:\Deckard
2008-07-15 23:43 . 2008-07-15 23:43 <DIR> dr-h----- C:\MSOCache
2008-07-14 21:40 . 2008-07-14 21:40 <DIR> d-------- C:\Program Files\MyPhoneExplorer
2008-07-14 21:40 . 2008-07-14 21:40 <DIR> d-------- C:\Documents and Settings\admin\Application Data\MyPhoneExplorer
2008-07-14 20:30 . 2008-07-14 20:30 355,584 --a------ C:\WINDOWS\system32\TuneUpDefragService.exe
2008-07-14 20:30 . 2008-05-29 09:28 28,416 --a------ C:\WINDOWS\system32\uxtuneup.dll
2008-07-12 20:54 . 2008-07-12 20:54 <DIR> d-------- C:\Program Files\Languages
2008-07-12 20:24 . 2007-11-08 19:12 114,688 --a------ C:\Program Files\Firefox Ultimate Optimizer.exe
2008-07-12 20:24 . 2008-07-12 20:22 64,035 --a------ C:\Program Files\firefox-ultimate-optimizer-11.zip
2008-07-11 11:08 . 2008-07-11 11:08 <DIR> d-------- C:\Program Files\Trend Micro
2008-07-10 02:49 . 2008-07-10 02:49 23 --a------ C:\WINDOWS\system32\bddbafb_z.ocx
2008-07-10 02:18 . 2008-07-10 02:18 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-07-10 02:18 . 2008-07-10 02:18 <DIR> d-------- C:\Documents and Settings\admin\Application Data\Malwarebytes
2008-07-09 17:35 . 2008-07-14 20:29 <DIR> d-------- C:\Program Files\Yahoo!
2008-07-06 01:58 . 2008-07-06 01:58 <DIR> d-------- C:\Documents and Settings\admin\Application Data\DivX
2008-07-06 01:18 . 2008-07-06 02:14 <DIR> d-------- C:\Program Files\DivX
2008-07-04 14:51 . 2008-07-04 14:51 <DIR> d-------- C:\Documents and Settings\admin\Application Data\Ashampoo
2008-07-04 14:50 . 2008-07-04 14:50 <DIR> d-------- C:\Program Files\Ashampoo
2008-07-04 14:50 . 2008-07-04 14:50 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\ashampoo
2008-07-04 12:35 . 2008-07-04 12:35 53,760 --a------ C:\DRTCP021.exe
2008-07-03 10:52 . 2008-07-03 10:52 <DIR> d-------- C:\Documents and Settings\admin\Application Data\AD ON Multimedia
2008-07-01 21:33 . 2008-07-02 16:53 <DIR> d-------- C:\Program Files\Free FLV Converter
2008-07-01 21:33 . 2008-06-04 18:42 364,544 --a------ C:\WINDOWS\system32\PropertyGrid.ocx
2008-07-01 21:33 . 2008-07-02 02:43 233,472 --a------ C:\WINDOWS\system32\TubeFinder.exe
2008-07-01 21:33 . 2008-06-04 18:42 208,500 --a------ C:\WINDOWS\system32\ReyXpBasics.tlb
2008-07-01 21:33 . 2008-06-04 18:42 141,312 --a------ C:\WINDOWS\system32\MSCMCFR.DLL
2008-07-01 21:33 . 2008-06-04 18:42 119,568 --a------ C:\WINDOWS\system32\VB6FR.DLL
2008-07-01 21:33 . 2008-06-04 18:42 101,888 --a------ C:\WINDOWS\system32\VB6STKIT.DLL
2008-07-01 21:33 . 2008-06-04 18:42 84,512 --a------ C:\WINDOWS\system32\PICCLP32.OCX
2008-07-01 21:33 . 2008-06-04 18:42 32,768 --a------ C:\WINDOWS\system32\CMDLGFR.DLL
2008-07-01 21:33 . 2008-06-04 18:42 24,576 --a------ C:\WINDOWS\system32\ControlSubX.ocx
2008-07-01 21:33 . 2008-06-04 18:42 9,728 --a------ C:\WINDOWS\system32\PCCLPFR.DLL
2008-07-01 20:21 . 2008-07-01 21:01 <DIR> d-------- C:\Documents and Settings\admin\dwhelper
2008-06-28 01:28 . 2008-07-12 01:17 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-06-28 01:28 . 2008-06-28 01:28 1,409 --a------ C:\WINDOWS\QTFont.for
2008-06-27 23:12 . 2008-06-27 23:12 <DIR> d-------- C:\Documents and Settings\admin\Application Data\GlarySoft
2008-06-27 17:32 . 2008-06-27 17:32 96,672 --a------ C:\WINDOWS\system32\drivers\w550mdm.sys
2008-06-27 17:32 . 2008-06-27 17:32 88,080 --a------ C:\WINDOWS\system32\drivers\w550mgmt.sys
2008-06-27 17:32 . 2008-06-27 17:32 85,952 --a------ C:\WINDOWS\system32\drivers\w550obex.sys
2008-06-27 17:32 . 2008-06-27 17:32 60,928 --a------ C:\WINDOWS\system32\drivers\w550bus.sys
2008-06-27 17:32 . 2008-06-27 17:32 8,336 --a------ C:\WINDOWS\system32\drivers\w550mdfl.sys
2008-06-27 17:32 . 2008-06-27 17:32 6,176 --a------ C:\WINDOWS\system32\drivers\w550cmnt.sys
2008-06-27 17:32 . 2008-06-27 17:32 6,176 --a------ C:\WINDOWS\system32\drivers\w550cm.sys
2008-06-27 17:32 . 2008-06-27 17:32 5,808 --a------ C:\WINDOWS\system32\drivers\w550whnt.sys
2008-06-27 17:32 . 2008-06-27 17:32 5,808 --a------ C:\WINDOWS\system32\drivers\w550wh.sys
2008-06-26 11:23 . 2008-06-26 12:30 <DIR> d-------- C:\Program Files\Macromedia
2008-06-26 00:49 . 2008-06-26 00:49 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Uniblue
2008-06-26 00:07 . 2008-06-26 01:20 <DIR> d-------- C:\Program Files\Uniblue
2008-06-26 00:07 . 2008-06-26 01:20 <DIR> d-------- C:\Documents and Settings\admin\Application Data\Uniblue
2008-06-25 23:41 . 2008-06-25 23:41 268 --ah----- C:\sqmdata03.sqm
2008-06-25 23:41 . 2008-06-25 23:41 244 --ah----- C:\sqmnoopt03.sqm
2008-06-25 20:53 . 2008-06-27 17:58 <DIR> d-------- C:\Documents and Settings\admin\Application Data\Sony Ericsson
2008-06-25 20:51 . 2008-06-25 20:52 <DIR> d-------- C:\Documents and Settings\admin\Application Data\Teleca
2008-06-25 20:50 . 2008-06-27 20:32 <DIR> d-------- C:\Program Files\Common Files\Teleca Shared
2008-06-25 10:59 . 2008-06-25 10:59 268 --ah----- C:\sqmdata02.sqm
2008-06-25 10:59 . 2008-06-25 10:59 244 --ah----- C:\sqmnoopt02.sqm
2008-06-18 23:22 . 2008-06-18 23:22 161,096 --a------ C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-06-18 11:09 . 2008-07-01 23:00 <DIR> d-------- C:\Program Files\YouTube Downloader
2008-06-16 14:54 . 2008-06-28 00:23 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-06-16 14:35 . 2008-06-16 14:35 <DIR> d-------- C:\Program Files\LimeWire

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-16 14:35 --------- d-----w C:\Documents and Settings\admin\Application Data\uTorrent
2008-07-14 15:02 --------- d-----w C:\Program Files\IObit
2008-07-14 15:00 --------- d-----w C:\Program Files\TuneUp Utilities 2008
2008-07-12 20:11 --------- d-----w C:\Documents and Settings\admin\Application Data\LimeWire
2008-07-11 10:39 --------- d-----w C:\Documents and Settings\admin\Application Data\Winamp
2008-07-08 20:23 --------- d-----w C:\Program Files\Java
2008-07-04 09:56 --------- d-----w C:\Program Files\Common Files\Nero
2008-06-27 15:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\Sony Ericsson
2008-06-26 07:00 --------- d-----w C:\Program Files\QuickTime
2008-06-25 18:59 --------- d-----w C:\Program Files\MagicISO
2008-06-25 15:17 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-18 06:07 --------- d-----w C:\Program Files\Windows Doctor
2008-06-13 18:33 --------- d-----w C:\Program Files\VideoLAN
2008-06-13 13:10 272,128 ------w C:\WINDOWS\system32\drivers\bthport.sys
2008-06-11 15:32 --------- d-----w C:\Program Files\DFX
2008-06-11 14:34 --------- d-----w C:\Program Files\Common Files\DFX
2008-06-11 14:34 --------- d-----w C:\Documents and Settings\All Users\Application Data\DFX
2008-06-11 14:29 --------- d-----w C:\Program Files\Winamp
2008-06-11 00:07 129,784 -c----w C:\WINDOWS\system32\pxafs.dll
2008-06-01 14:28 --------- d-----w C:\Program Files\CCleaner
2008-05-28 04:17 --------- d-----w C:\Program Files\Panda Security
2008-05-23 18:04 --------- d-----w C:\Documents and Settings\admin\Application Data\Thinking Minds Budiling Bytes
2008-05-22 14:27 --------- d-----w C:\Program Files\Apple Software Update
2008-05-21 12:56 --------- d-----w C:\Documents and Settings\admin\Application Data\IObit
2008-05-21 12:24 --------- d-----w C:\Program Files\EvilLyrics
2008-05-07 05:18 1,287,680 -c--a-w C:\WINDOWS\system32\quartz.dll
2008-04-30 14:32 1,419,232 -c--a-w C:\WINDOWS\system32\wdfcoinstaller01005.dll
2008-04-23 04:16 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 17:30 15360]
"uTorrent "= "C:\Program Files\uTorrent\uTorrent.exe" [2008-03-05 10:35 219952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched "= "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"FirefoxUltimateOptimizer "= "C:\Program Files\Firefox Ultimate Optimizer.exe" [2007-11-08 19:12 114688]
"AVG8_TRAY "= "C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-07-16 20:07 1232152]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"PcSync "= "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-11-09 17:15 1634304]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveSearch "= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs "=avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.ffds "= C:\Program Files\ffdshow\ffdshow.ax
"msacm.divxa32 "= msaud32_divx.acm

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WLSetupSvc "=3 (0x3)
"UxTuneUp "=2 (0x2)
"TuneUp.Defrag "=3 (0x3)
"Nero BackItUp Scheduler 3 "=2 (0x2)
"iPod Service "=3 (0x3)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ctfmon.exe "=C:\WINDOWS\system32\ctfmon.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe "=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe "=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe "=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe "=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe "=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe "=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe "=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe "=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe "=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe "=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe "=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe "=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe "=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"C:\\Program Files\\Google\\Google Talk\\googletalk.exe "=
"C:\\Program Files\\uTorrent\\uTorrent.exe "=
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe "= C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe "= C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe "= C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"C:\\Program Files\\Bonjour\\mDNSResponder.exe "=
"C:\\Program Files\\iTunes\\iTunes.exe "=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe "=
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe "=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP "= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R1 AvgLdx86;AVG Free AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-07-16 20:07]
R2 avg8wd;AVG Free8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-07-16 20:07]
R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [2004-08-04 17:30]
S3 ggflt;SEMC USB Flash Driver Filter;C:\WINDOWS\system32\DRIVERS\ggflt.sys [2008-04-30 20:02]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-07-14 20:30]
S3 w550bus;Sony Ericsson W550 driver (WDM);C:\WINDOWS\system32\DRIVERS\w550bus.sys [2008-06-27 17:32]
S3 w550mdfl;Sony Ericsson W550 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\w550mdfl.sys [2008-06-27 17:32]
S3 w550mdm;Sony Ericsson W550 USB WMC Modem Drivers;C:\WINDOWS\system32\DRIVERS\w550mdm.sys [2008-06-27 17:32]
S3 w550mgmt;Sony Ericsson W550 USB WMC Device Management Drivers;C:\WINDOWS\system32\DRIVERS\w550mgmt.sys [2008-06-27 17:32]
S3 w550obex;Sony Ericsson W550 USB WMC OBEX Interface Drivers;C:\WINDOWS\system32\DRIVERS\w550obex.sys [2008-06-27 17:32]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

*Newly Created Service* - AVG8WD
*Newly Created Service* - AVGLDX86
*Newly Created Service* - AVGMFX86
*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90
.
Contents of the 'Scheduled Tasks' folder
"2008-07-16 14:30:52 C:\WINDOWS\Tasks\1-Click Maintenance.job "
- C:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe
"2008-07-01 09:40:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job "
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-07-16 14:12:00 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job "
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-16 20:20:46
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-07-16 20:21:18
ComboFix-quarantined-files.txt 2008-07-16 14:51:15

Pre-Run: 9,150,537,728 bytes free
Post-Run: 9,137,623,040 bytes free

213 --- E O F --- 2008-07-09 03:48:24





Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:22:31 PM, on 7/16/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\ups.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Firefox Ultimate Optimizer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Google
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Live Search
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Live Search
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe "
O4 - HKLM\..\Run: [FirefoxUltimateOptimizer] "C:\Program Files\Firefox Ultimate Optimizer.exe "
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe "
O4 - HKUS\S-1-5-18\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user')
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{DF4FCC39-8A6E-44A9-838D-BCB1CFD7ACB5}: NameServer = 125.22.47.125,202.56.250.5
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

--
End of file - 4909 bytes


thanks so much

 

Please upload the following file to my submission channel for analysis. Leave a link back to this topic.

C:\WINDOWS\system32\bddbafb_z.ocx

Thanks!

Now delete that file. Let me know if successful.

 

thanks i did that hey was that the reason y my also was being used up so much

 

Run dss.exe again and post the new main.txt log it creates.

 

Deckard's System Scanner v20071014.68
Run by admin on 2008-07-19 00:31:23
Computer is in Normal Mode.
--------------------------------------------------------------------------------

Total Physical Memory: 447 MiB (512 MiB recommended).


-- HijackThis (run as admin.exe) -----------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:31:30 AM, on 7/19/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Firefox Ultimate Optimizer.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wscntfy.exe
D:\colin\software\dss.exe
C:\PROGRA~1\Trend Micro\HijackThis\admin.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Google
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Live Search
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Live Search
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe "
O4 - HKLM\..\Run: [FirefoxUltimateOptimizer] "C:\Program Files\Firefox Ultimate Optimizer.exe "
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe "
O4 - HKUS\S-1-5-18\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user')
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{DF4FCC39-8A6E-44A9-838D-BCB1CFD7ACB5}: NameServer = 125.22.47.125,202.56.250.5
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

--
End of file - 4885 bytes

-- Files created between 2008-06-19 and 2008-07-19 -----------------------------

2008-07-18 22:07:07 0 dr-h----- C:\Documents and Settings\admin\Recent
2008-07-17 12:37:42 0 d-------- C:\Program Files\WhatsRunning
2008-07-16 20:19:09 68096 --a------ C:\WINDOWS\zip.exe
2008-07-16 20:19:09 49152 --a------ C:\WINDOWS\VFind.exe
2008-07-16 20:19:09 212480 --a------ C:\WINDOWS\swxcacls.exe <Not Verified; SteelWerX; SteelWerX Extended Configurator ACLists>
2008-07-16 20:19:09 136704 --a------ C:\WINDOWS\swsc.exe <Not Verified; SteelWerX; SteelWerX Service Controller>
2008-07-16 20:19:09 161792 --a------ C:\WINDOWS\swreg.exe <Not Verified; SteelWerX; SteelWerX Registry Editor>
2008-07-16 20:19:09 98816 --a------ C:\WINDOWS\sed.exe
2008-07-16 20:19:09 80412 --a------ C:\WINDOWS\grep.exe
2008-07-16 20:19:09 89504 --a------ C:\WINDOWS\fdsv.exe <Not Verified; Smallfrogs Studio; >
2008-07-16 20:07:03 0 d-------- C:\WINDOWS\system32\drivers\Avg
2008-07-16 20:06:58 0 d-------- C:\Program Files\AVG
2008-07-16 20:06:58 0 d-------- C:\Documents and Settings\All Users\Application Data\avg8
2008-07-16 02:43:46 0 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-07-15 23:43:08 0 dr-h----- C:\MSOCache
2008-07-14 21:40:22 0 d-------- C:\Documents and Settings\admin\Application Data\MyPhoneExplorer
2008-07-14 21:40:13 0 d-------- C:\Program Files\MyPhoneExplorer
2008-07-12 20:54:01 0 d-------- C:\Program Files\Languages
2008-07-12 20:24:56 114688 --a------ C:\Program Files\Firefox Ultimate Optimizer.exe <Not Verified; felipEx [http://felipex.net]; Firefox Ultimate Optimizer>
2008-07-11 11:08:36 0 d-------- C:\Program Files\Trend Micro
2008-07-10 02:18:09 0 d-------- C:\Documents and Settings\admin\Application Data\Malwarebytes
2008-07-10 02:18:03 0 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-07-09 17:35:22 0 d-------- C:\Program Files\Yahoo!
2008-07-06 01:58:32 0 d-------- C:\Documents and Settings\admin\Application Data\DivX
2008-07-06 01:18:53 0 d-------- C:\Program Files\DivX
2008-07-04 14:51:57 0 d-------- C:\Documents and Settings\admin\Application Data\Ashampoo
2008-07-04 14:50:48 0 d-------- C:\Documents and Settings\All Users\Application Data\ashampoo
2008-07-04 14:50:20 0 d-------- C:\Program Files\Ashampoo
2008-07-04 12:35:09 53760 --a------ C:\DRTCP021.exe <Not Verified; Tolunay Orkun; Dr. TCP>
2008-07-03 10:52:42 0 d-------- C:\Documents and Settings\admin\Application Data\AD ON Multimedia
2008-07-01 21:33:43 233472 --a------ C:\WINDOWS\system32\TubeFinder.exe <Not Verified; Koyote Soft; Tube Finder>
2008-07-01 21:33:42 101888 --a------ C:\WINDOWS\system32\VB6STKIT.DLL <Not Verified; Microsoft Corporation; Microsoft® Visual Basic for Windows>
2008-07-01 21:33:42 119568 --a------ C:\WINDOWS\system32\VB6FR.DLL <Not Verified; Microsoft Corporation; Environnement Visual Basic>
2008-07-01 21:33:41 9728 --a------ C:\WINDOWS\system32\PCCLPFR.DLL <Not Verified; Microsoft Corporation; PicClip>
2008-07-01 21:33:41 141312 --a------ C:\WINDOWS\system32\MSCMCFR.DLL <Not Verified; Microsoft Corporation; COMCTL>
2008-07-01 21:33:41 32768 --a------ C:\WINDOWS\system32\CMDLGFR.DLL <Not Verified; Microsoft Corporation; CMDIALOG>
2008-07-01 21:33:41 0 d-------- C:\Program Files\Free FLV Converter
2008-07-01 20:21:35 0 d-------- C:\Documents and Settings\admin\dwhelper
2008-06-27 23:12:35 0 d-------- C:\Documents and Settings\admin\Application Data\GlarySoft
2008-06-26 11:23:27 0 d-------- C:\Program Files\Macromedia
2008-06-26 00:49:54 0 d-------- C:\Documents and Settings\All Users\Application Data\Uniblue
2008-06-26 00:07:53 0 d-------- C:\Documents and Settings\admin\Application Data\Uniblue
2008-06-26 00:07:40 0 d-------- C:\Program Files\Uniblue
2008-06-25 20:53:03 0 d-------- C:\Documents and Settings\admin\Application Data\Sony Ericsson
2008-06-25 20:51:27 0 d-------- C:\Documents and Settings\admin\Application Data\Teleca
2008-06-25 20:50:56 0 d-------- C:\Program Files\Common Files\Teleca Shared
2008-06-24 03:59:53 5505024 --a------ C:\Documents and Settings\admin\ntuser.dat


-- Find3M Report ---------------------------------------------------------------

2008-07-18 20:42:48 0 d-------- C:\Documents and Settings\admin\Application Data\uTorrent
2008-07-14 20:32:10 0 d-------- C:\Program Files\IObit
2008-07-14 20:30:46 0 d-------- C:\Program Files\TuneUp Utilities 2008
2008-07-13 01:41:27 0 d-------- C:\Documents and Settings\admin\Application Data\LimeWire
2008-07-12 20:22:26 64035 --a------ C:\Program Files\firefox-ultimate-optimizer-11.zip
2008-07-11 16:09:40 0 d-------- C:\Documents and Settings\admin\Application Data\Winamp
2008-07-09 01:53:23 0 d-------- C:\Program Files\Java
2008-07-04 15:26:15 0 d-------- C:\Program Files\Common Files\Nero
2008-07-01 23:00:32 0 d-------- C:\Program Files\YouTube Downloader
2008-06-27 23:13:16 0 d-------- C:\Documents and Settings\admin\Application Data\Macromedia
2008-06-26 12:30:13 0 d-------- C:\Program Files\QuickTime
2008-06-26 12:25:26 0 d-------- C:\Program Files\Common Files
2008-06-26 00:29:39 0 d-------- C:\Program Files\MagicISO
2008-06-25 20:47:56 0 d-------- C:\Program Files\Common Files\InstallShield
2008-06-18 11:37:59 0 d-------- C:\Program Files\Windows Doctor
2008-06-18 01:33:29 0 d-------- C:\Documents and Settings\admin\Application Data\Mozilla
2008-06-16 14:35:41 0 d-------- C:\Program Files\LimeWire
2008-06-14 00:03:15 0 d-------- C:\Program Files\VideoLAN
2008-06-11 21:02:48 0 d-------- C:\Program Files\DFX
2008-06-11 20:04:20 0 d-------- C:\Program Files\Common Files\DFX
2008-06-11 19:59:38 0 d-------- C:\Program Files\Winamp
2008-06-01 19:58:03 0 d-------- C:\Program Files\CCleaner
2008-05-28 09:47:00 0 d-------- C:\Program Files\Panda Security
2008-05-23 23:34:08 0 d-------- C:\Documents and Settings\admin\Application Data\Thinking Minds Budiling Bytes
2008-05-22 19:57:25 0 d-------- C:\Program Files\Apple Software Update
2008-05-21 18:26:35 0 d-------- C:\Documents and Settings\admin\Application Data\IObit
2008-05-21 17:54:03 0 d-------- C:\Program Files\EvilLyrics


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched "= "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [06/10/2008 04:27 AM]
"FirefoxUltimateOptimizer "= "C:\Program Files\Firefox Ultimate Optimizer.exe" [11/08/2007 07:12 PM]
"AVG8_TRAY "= "C:\PROGRA~1\AVG\AVG8\avgtray.exe" [07/16/2008 08:07 PM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 05:30 PM]
"uTorrent "= "C:\Program Files\uTorrent\uTorrent.exe" [03/05/2008 10:35 AM]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"PcSync "=C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools "=0 (0x0)
"HideLegacyLogonScripts "=0 (0x0)
"HideLogoffScripts "=0 (0x0)
"RunLogonScriptSync "=1 (0x1)
"RunStartupScriptSync "=0 (0x0)
"HideStartupScripts "=0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"HideLegacyLogonScripts "=0 (0x0)
"HideLogoffScripts "=0 (0x0)
"RunLogonScriptSync "=1 (0x1)
"RunStartupScriptSync "=0 (0x0)
"HideStartupScripts "=0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"LinkResolveIgnoreLinkInfo "=0 (0x0)
"NoResolveSearch "=1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"LinkResolveIgnoreLinkInfo "=0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls "=avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WLSetupSvc "=3 (0x3)
"UxTuneUp "=2 (0x2)
"TuneUp.Defrag "=3 (0x3)
"Nero BackItUp Scheduler 3 "=2 (0x2)
"iPod Service "=3 (0x3)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ctfmon.exe "=C:\WINDOWS\system32\ctfmon.exe

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp




-- End of Deckard's System Scanner: finished at 2008-07-19 00:31:48 ------------

 

Click Start>Run and type ComboFix /u then hit Enter to uninstall ComboFix and remove the files it has quarantined. This action will also reset the System Restore points, removing the infected files there as well. The C:\Deckard's folder will also be removed. You can delete any logs that were created/saved too.


Download ATF Cleaner by Atribune and save it to your Desktop.

• Double click ATF-Cleaner.exe to run the program.
• Check the boxes to the left of:
  
  
  • Windows Temp
  • Current User Temp
  • All Users Temp
  • Temporary Internet Files
  • Prefetch
  • Java Cache
  • Recycle bin
  
  
• The rest are optional - if you want it to remove everything check "Select All ".
• Finally, click Empty Selected. When you get the "Done Cleaning" message, click OK.

Reboot


Now lets see if we've missed anything. Please scan with Kaspersky WebScanner

You will be promted to install an ActiveX component from Kaspersky, Click Yes.

• The program will launch and then begin downloading the latest definition files:
• Once the files have been downloaded click on NEXT
  
• Now click on Scan Settings
• In the scan settings make that the following are selected:
  • Scan using the following Anti-Virus database:
  • Extended (if available otherwise Standard)
  • Scan Options:
  • Scan Archives
    Scan Mail Bases
• Click OK
• Now under select a target to scan:
  • Select My Computer
• This will program will start and scan your system.
• The scan will take a while so be patient and let it run.
• Once the scan is complete it will display if your system has been infected.
  • Now click on the Save as Text button:
• Save the file to your desktop.

Post the Kaspersky log here.

 

windows cannot find combofix make sure u typed the name correctly

thats wat i got
i think i not installed it properly this is wat i did after downloading i extracted it and clicked on it thats all

is that rite

 

ComboFix.exe was on your desktop. Did you remove it?

Download a fresh copy from here and save it to your desktop.

Now highlight and copy the bolded command below.

"%userprofile%\desktop\combofix.exe" /u

Click Start>Run and paste the command in the Run dialog then hit Enter.
Once ComboFix has finished uninstalling, carry on with the remainder of my instructions above.