Active Disables sound, changes taskbar

[Active] Disables sound, changes taskbar

Im infected with something that is disabling programs from initializing the sound device and most of the time changes my blue taskbar with a green button, to a grey taskbar windows 95/98 style. Any programs using sound before the virus activates can continue using sound.

I performed various scans, Im going to remove norton internet security because it hasn't done anything usefull. Explorer1.exe in the logs was made by me

 

DDS (Ver_09-05-14.01) - NTFSx86
Run by Jeramy at 14:14:53.26 on Tue 06/09/2009
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1431 [GMT -7:00]

AV: Norton Internet Security *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Security *disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}

============== Running Processes ===============

C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\Explorer1.exe
C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
C:\Program Files\ASUS\TurboV\TurboV.exe
C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
svchost.exe
C:\Program Files\ASUS\AsSysCtrlService\1.00.00\AsSysCtrlService.exe
C:\ASUS.SYS\config\DVMExportService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Norton Internet Security\Engine\16.5.0.135\ccSvcHst.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\Norton Internet Security\Engine\16.5.0.135\ccSvcHst.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Jeramy\Desktop\VirusTools\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://google.com/
mWinlogon: Shell=Explorer1.exe
BHO: {1392b8d2-5c05-419f-a8f6-b9f15a596612} - No File
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Symantec NCO BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - c:\program files\norton internet security\engine\16.5.0.135\coIEPlg.dll
BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - c:\program files\norton internet security\engine\16.5.0.135\IPSBHO.DLL
BHO: snappyads browser enhancer: {82569cba-81dc-669b-ae11-bacd42de7e17} - c:\windows\system32\wlkihqfidc.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.1.1309.3572\swg.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - c:\program files\norton internet security\engine\16.5.0.135\coIEPlg.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
mRun: [TurboV] "c:\program files\asus\turbov\TurboV.exe "
mRun: [HDAudDeck] c:\program files\via\viaudioi\hdadeck\HDeck.exe 1
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe "
mRun: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe "
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} - hxxp://www.musicnotes.com/download/mnviewer.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/C/0/C/C0CBBA88-A6F2-48D9-9B0E-1719D1177202/LegitCheckControl.cab
DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - hxxp://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.8.110.cab
DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} - hxxp://www.eset.eu/buxus/docs/OnlineScanner.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} - hxxp://www.yougamers.com/systeminfo/FMSI.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
Handler: symres - {AA1061FE-6C41-421f-9344-69640C9732AB} - c:\program files\norton internet security\engine\16.5.0.135\CoIEPlg.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath -

============= SERVICES / DRIVERS ===============

R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\nis\1005000.087\SymEFA.sys [2009-3-23 310320]
R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\nis\1005000.087\BHDrvx86.sys [2009-3-23 258608]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\nis\1005000.087\cchpx86.sys [2009-3-23 482352]
R1 IDSxpx86;IDSxpx86;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\definitions\ipsdefs\20090604.001\IDSXpx86.sys [2009-6-8 276344]
R2 AsSysCtrlService;ASUS System Control Service;c:\program files\asus\assysctrlservice\1.00.00\AsSysCtrlService.exe [2009-3-21 86016]
R2 DvmMDES;DeviceVM Meta Data Export Service;c:\asus.sys\config\DVMExportService.exe [2008-11-26 323584]
R2 Norton Internet Security;Norton Internet Security;c:\program files\norton internet security\engine\16.5.0.135\ccSvcHst.exe [2009-3-23 115560]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2009-3-22 101936]
R3 NAVENG;NAVENG;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\definitions\virusdefs\20090608.051\NAVENG.SYS [2009-6-9 89104]
R3 NAVEX15;NAVEX15;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\definitions\virusdefs\20090608.051\NAVEX15.SYS [2009-6-9 876144]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2009-3-21 993280]
S2 gupdate1c98b30e66f1360;Google Update Service (gupdate1c98b30e66f1360);c:\program files\google\update\GoogleUpdate.exe [2009-2-9 133104]
S3 cpuz130;cpuz130;\??\c:\docume~1\jeramy\locals~1\temp\cpuz130\cpuz_x32.sys --> c:\docume~1\jeramy\locals~1\temp\cpuz130\cpuz_x32.sys [?]
S3 SaiH0461;SaiH0461;c:\windows\system32\drivers\SaiH0461.sys [2007-5-1 132232]

============== File Associations ===============

regfile= "regedit.exe" "%1 "

=============== Created Last 30 ================

2009-05-21 23:01 <DIR> --d----- c:\program files\Sun
2009-05-21 23:01 410,984 a------- c:\windows\system32\deploytk.dll
2009-05-21 21:01 0 a------- c:\windows\cdplayer.ini
2009-05-21 21:01 <DIR> --d----- c:\program files\Feurio
2009-05-21 20:54 344,064 a------- c:\windows\system32\msvcr70.dll
2009-05-21 20:54 <DIR> --d----- c:\program files\common files\DVDVideoSoft
2009-05-21 12:52 4,984 a------- c:\windows\system32\drivers\nvphy.bin
2009-05-21 12:52 446,464 a------- c:\windows\system32\nvunrm.exe
2009-05-21 12:52 6,045 a------- c:\windows\system32\nvnrm.nvu
2009-05-21 12:51 955,520 a------- c:\windows\system32\drivers\nvnrm.sys
2009-05-21 12:51 22,016 a------- c:\windows\system32\drivers\nvnetbus.sys
2009-05-21 12:51 122,880 a------- c:\windows\system32\nvconrm.dll
2009-05-21 12:51 54,784 a------- c:\windows\system32\drivers\NVENETFD.sys
2009-05-21 12:51 200,704 a------- c:\windows\system32\fdco1.dll
2009-05-21 12:51 9,216 a------- c:\windows\system32\bdco1.dll
2009-05-18 01:04 103,424 a------- c:\windows\system32\nUI_nat.dll
2009-05-18 01:04 <DIR> --d----- c:\program files\Universe Sandbox
2009-05-11 18:02 26,368 ac------ c:\windows\system32\dllcache\usbstor.sys

==================== Find3M ====================

2009-05-19 21:49 138,832 a------- c:\windows\system32\drivers\PnkBstrK.sys
2009-05-19 21:49 202,024 a------- c:\windows\system32\PnkBstrB.exe
2009-05-06 16:03 86,327 a------- c:\windows\pchealth\helpctr\offlinecache\index.dat
2009-05-01 18:21 262,144 a------- c:\windows\system32\wrap_oal.dll
2009-05-01 18:21 86,016 a------- c:\windows\system32\OpenAL32.dll
2009-05-01 00:31 1,657,376 a------- c:\windows\system32\nwiz.exe
2009-05-01 00:31 449,056 a------- c:\windows\system32\nvappbar.exe
2009-05-01 00:31 436,768 a------- c:\windows\system32\keystone.exe
2009-05-01 00:31 1,724,416 a------- c:\windows\system32\nvwdmcpl.dll
2009-05-01 00:31 1,507,328 a------- c:\windows\system32\nview.dll
2009-05-01 00:31 1,101,824 a------- c:\windows\system32\nvwimg.dll
2009-05-01 00:31 466,944 a------- c:\windows\system32\nvshell.dll
2009-04-30 22:02 9,994,240 a------- c:\windows\system32\nvoglnt.dll
2009-04-30 22:02 8,055,584 a------- c:\windows\system32\drivers\nv4_mini.sys
2009-04-30 22:02 5,896,320 a------- c:\windows\system32\nv4_disp.dll
2009-04-30 22:02 1,720,320 a------- c:\windows\system32\nvcuda.dll
2009-04-30 22:02 1,579,630 a------- c:\windows\system32\nvdata.bin
2009-04-30 22:02 1,314,816 a------- c:\windows\system32\nvcuvenc.dll
2009-04-30 22:02 806,912 a------- c:\windows\system32\nvapi.dll
2009-04-30 22:02 663,552 a------- c:\windows\system32\nvcuvid.dll
2009-04-30 22:02 457,248 a------- c:\windows\system32\nvudisp.exe
2009-04-30 22:02 143,360 a------- c:\windows\system32\nvcodins.dll
2009-04-30 22:02 143,360 a------- c:\windows\system32\nvcod.dll
2009-04-27 00:42 457,248 a------- c:\windows\system32\NVUNINST.EXE
2009-04-22 00:20 14,311,680 a------- c:\windows\system32\xlive.dll
2009-04-22 00:20 13,642,496 a------- c:\windows\system32\xlivefnt.dll
2009-04-06 05:19 96 a------- c:\docume~1\alluse~1\applic~1\0a4dde28.dat
2009-04-05 18:44 85,665 a------- c:\windows\system32\96c15e00-1d1b-ef9c-f7d0-c1de85f7e37e.exe
2009-04-05 18:44 48,275 a------- c:\windows\system32\olrcmnoanyxjqtfid.exe
2009-04-03 03:50 400,384 a------- c:\windows\system32\wlkihqfidc.dll
2009-03-26 11:56 107,888 a------- c:\windows\system32\CmdLineExt.dll
2009-03-26 11:09 22,328 a------- c:\docume~1\jeramy\applic~1\PnkBstrK.sys
2009-03-26 11:09 669,184 a------- c:\windows\system32\pbsvc.exe
2009-03-26 11:09 66,872 a------- c:\windows\system32\PnkBstrA.exe
2009-03-25 15:36 60,808 a------- c:\windows\system32\S32EVNT1.DLL
2006-05-03 03:06 163,328 ---shr-- c:\windows\system32\flvDX.dll
2007-02-21 04:47 31,232 ---shr-- c:\windows\system32\msfDX.dll
2008-03-16 06:30 216,064 ---shr-- c:\windows\system32\nbDX.dll

============= FINISH: 14:15:04.43 ===============

 

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-05-14.01)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 2/3/2009 9:37:09 AM
System Uptime: 6/9/2009 12:46:21 PM (2 hours ago)

Motherboard: ASUSTeK Computer INC. | | M4N72-E
Processor: AMD Phenom(tm) II X4 920 Processor | AM2 | 2799/200mhz

==== Disk Partitions =========================

A: is Removable
C: is FIXED (NTFS) - 373 GiB total, 208.433 GiB free.
D: is CDROM ()

==== Disabled Device Manager Items =============

==== System Restore Points ===================

No restore point in system.

==== Installed Programs ======================

3DMark06
Acrobat.com
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Reader 9.1
AMD Processor Driver
Any Video Converter 2.7.1
ASIO4ALL
ASUSUpdate
Audacity 1.2.6
Collab
Contextual Tool Snappyads
Critical Update for Windows Media Player 11 (KB959772)
Crysis Warhead
Crysis Wars
Dead Space
Debugging Tools for Windows (x86)
Download Manager 2.3.7
Dual-Core Optimizer
EA Download Manager
EPU
ESET Online Scanner
Express Gate
F.E.A.R. 2
F.E.A.R. 2 SP Demo
Fallout 3
Fallout 3 - The Garden of Eden Creation Kit
Fallout 3: Operation Anchorage™
Fallout Mod Manager 0.9.10
FL Studio 8
Fraps (remove only)
Freecorder Toolbar 3.02 Application
Futuremark SystemInfo
GameSpy Comrade
Garry's Mod
Google Earth
Google Update Helper
Google Updater
Grand Theft Auto IV
Half-Life 2
Half-Life 2: Episode One
High Definition Audio Driver Package - KB888111
HLSW v1.3.1
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB938759)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
IL Download Manager
Java DB 10.4.1.3
Java(TM) 6 Update 13
Java(TM) 6 Update 2
Java(TM) SE Development Kit 6 Update 13
JGRotPro
K-Lite Codec Pack 3.2.5 Standard
Left 4 Dead
LimeWire 4.16.2
Magic ISO Maker v5.5 (build 0273)
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Games for Windows - LIVE
Microsoft Games for Windows - LIVE Redistributable
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
MilkShape 3D 1.8.4
Mirror's Edge™
Mozilla Firefox (3.0.10)
MP4 Player
MSXML 6 Service Pack 2 (KB954459)
Norton Internet Security
NVIDIA Drivers
NVIDIA PhysX
Obsidian Conflict Beta 1.34
Performance Dashboard Snappyads
Platform
PoiZone
PunkBuster Services
RegCure 1.5.2.7
Rockstar Games Social Club
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB938464-v2)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB961373)
Source SDK Base - Orange Box
Steam
SUPER © Version 2009.bld.35 (Jan 5, 2009)
Team Fortress 2
TeamSpeak 2 RC2
TortoiseSVN 1.5.7.15182 (32 bit)
Toxic Biohazard
TurboV
TweakManager Ultimate
Uninstall 1.0.0.1
Universe Sandbox
Update for Windows Internet Explorer 8 (KB968220)
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Ventrilo Client
VIA Platform Device Manager
WebFldrs XP
Winamp
Windows Genuine Advantage Notifications (KB905474)
Windows Imaging Component
Windows Internet Explorer 8
Windows Media Format 11 runtime
Windows Media Player 11
Windows Presentation Foundation
Windows Support Tools
Windows XP Service Pack 3
WinRAR archiver
XML Paper Specification Shared Components Pack 1.0

==== Event Viewer Messages From Past Week ========

6/3/2009 11:47:10 AM, error: Service Control Manager [7000] - The Parallel port driver service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.

==== End Of File ===========================

 

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:15:45 PM, on 6/9/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\Explorer1.exe
C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
C:\Program Files\ASUS\TurboV\TurboV.exe
C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\ASUS\AsSysCtrlService\1.00.00\AsSysCtrlService.exe
C:\ASUS.SYS\config\DVMExportService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Norton Internet Security\Engine\16.5.0.135\ccSvcHst.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\Norton Internet Security\Engine\16.5.0.135\ccSvcHst.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
F2 - REG:system.ini: Shell=Explorer1.exe
O2 - BHO: (no name) - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\16.5.0.135\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\16.5.0.135\IPSBHO.DLL
O2 - BHO: snappyads browser enhancer - {82569CBA-81DC-669B-AE11-BACD42DE7E17} - C:\WINDOWS\system32\wlkihqfidc.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\16.5.0.135\coIEPlg.dll
O4 - HKLM\..\Run: [TurboV] "C:\Program Files\ASUS\TurboV\TurboV.exe "
O4 - HKLM\..\Run: [HDAudDeck] C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe 1
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe "
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe "
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (CDownloadCtrl Object) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.8.110.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} (Futuremark SystemInfo) - http://www.yougamers.com/systeminfo/FMSI.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files\Norton Internet Security\Engine\16.5.0.135\coIEPlg.dll
O23 - Service: ASUS System Control Service (AsSysCtrlService) - Unknown owner - C:\Program Files\ASUS\AsSysCtrlService\1.00.00\AsSysCtrlService.exe
O23 - Service: DeviceVM Meta Data Export Service (DvmMDES) - DeviceVM - C:\ASUS.SYS\config\DVMExportService.exe
O23 - Service: Google Update Service (gupdate1c98b30e66f1360) (gupdate1c98b30e66f1360) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Norton Internet Security - Symantec Corporation - C:\Program Files\Norton Internet Security\Engine\16.5.0.135\ccSvcHst.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe

--
End of file - 6385 bytes

 

Malwarebytes' Anti-Malware 1.37
Database version: 2255
Windows 5.1.2600 Service Pack 3

6/9/2009 2:27:25 PM
mbam-log-2009-06-09 (14-27-20).txt

Scan type: Quick Scan
Objects scanned: 96135
Time elapsed: 9 minute(s), 8 second(s)

Memory Processes Infected: 1
Memory Modules Infected: 0
Registry Keys Infected: 4
Registry Values Infected: 0
Registry Data Items Infected: 3
Folders Infected: 0
Files Infected: 4

Memory Processes Infected:
C:\WINDOWS\Explorer1.exe (Trojan.Agent) -> No action taken.

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\96c15e00-1d1b-ef9c-f7d0-c1de85f7e37e (Adware.Adrotator) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\olrcmnoanyxjqtfid (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{82569cba-81dc-669b-ae11-bacd42de7e17} (Adware.BHO) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{82569cba-81dc-669b-ae11-bacd42de7e17} (Adware.BHO) -> No action taken.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_CLASSES_ROOT\regfile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: ( "regedit.exe" "%1 ") Good: (regedit.exe "%1 ") -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

Folders Infected:
(No malicious items detected)

Files Infected:
c:\WINDOWS\system32\96c15e00-1d1b-ef9c-f7d0-c1de85f7e37e.exe (Adware.Adrotator) -> No action taken.
c:\WINDOWS\system32\olrcmnoanyxjqtfid.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\Explorer1.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\wlkihqfidc.dll (Adware.BHO) -> No action taken.

 

ComboFix 09-06-09.06 - Jeramy 06/09/2009 14:37.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1401 [GMT -7:00]
Running from: c:\documents and settings\Jeramy\Desktop\VirusTools\ComboFix.exe
AV: Norton Internet Security *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Security *disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\wlkihqfidc.dll

.
((((((((((((((((((((((((( Files Created from 2009-05-09 to 2009-06-09 )))))))))))))))))))))))))))))))
.

2009-06-09 21:23 . 2009-06-09 21:23 0 ----a-w- c:\windows\nsreg.dat
2009-06-09 21:23 . 2009-06-09 21:23 -------- d-----w- c:\documents and settings\Jeramy\Local Settings\Application Data\Mozilla
2009-06-09 21:17 . 2009-06-09 21:17 -------- d-----w- c:\documents and settings\Jeramy\Application Data\Malwarebytes
2009-06-09 21:16 . 2009-05-26 20:20 40160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-09 21:16 . 2009-06-09 21:17 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-06-09 21:16 . 2009-06-09 21:16 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-06-09 21:16 . 2009-05-26 20:19 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-06-09 21:15 . 2009-06-09 21:15 -------- d-----w- c:\program files\Trend Micro
2009-06-09 21:06 . 2009-03-12 08:42 554352 ----a-r- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn\components\coFFPlgn.dll
2009-06-09 21:06 . 2009-03-12 08:42 165240 ----a-r- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\IPSFFPlgn\components\IPSFFPl.dll
2009-06-09 19:58 . 2009-03-22 08:00 89104 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090608.051\NAVENG.SYS
2009-06-09 19:58 . 2009-03-22 08:00 876144 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090608.051\NAVEX15.SYS
2009-06-09 19:58 . 2009-03-22 08:00 371248 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090608.051\EECTRL.SYS
2009-06-09 19:58 . 2009-03-22 08:00 259368 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090608.051\ECMSVR32.DLL
2009-06-09 19:58 . 2009-03-22 08:00 2414128 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090608.051\CCERASER.DLL
2009-06-09 19:58 . 2009-03-22 08:00 177520 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090608.051\NAVENG32.DLL
2009-06-09 19:58 . 2009-03-22 08:00 1181040 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090608.051\NAVEX32A.DLL
2009-06-09 19:58 . 2009-03-22 08:00 101936 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090608.051\ERASER.SYS
2009-06-09 00:18 . 2009-03-16 20:03 533880 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090604.001\Scxpx86.dll
2009-06-09 00:18 . 2009-01-29 21:50 276344 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090604.001\IDSXpx86.sys
2009-06-09 00:18 . 2009-01-29 21:50 292912 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090604.001\IDSvix86.sys
2009-06-09 00:18 . 2009-01-29 21:50 447864 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090604.001\IDSxpx86.dll
2009-06-09 00:18 . 2009-01-29 21:50 396848 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090604.001\IDSviA64.sys
2009-05-29 18:40 . 2009-03-16 20:03 533880 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090528.001\Scxpx86.dll
2009-05-29 18:40 . 2009-01-29 21:50 276344 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090528.001\IDSXpx86.sys
2009-05-29 18:40 . 2009-01-29 21:50 292912 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090528.001\IDSvix86.sys
2009-05-29 18:40 . 2009-01-29 21:50 447864 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090528.001\IDSxpx86.dll
2009-05-29 18:40 . 2009-01-29 21:50 396848 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090528.001\IDSviA64.sys
2009-05-22 06:02 . 2009-05-22 06:02 -------- d-----w- c:\windows\Sun
2009-05-22 06:01 . 2009-05-22 06:01 -------- d-----w- c:\program files\Sun
2009-05-22 06:01 . 2009-05-22 06:01 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-05-22 04:01 . 2009-05-22 04:06 -------- d-----w- c:\program files\Feurio
2009-05-22 03:54 . 2002-01-05 22:37 344064 ----a-w- c:\windows\system32\msvcr70.dll
2009-05-22 03:54 . 2009-05-22 04:06 -------- d-----w- c:\program files\Common Files\DVDVideoSoft
2009-05-21 19:52 . 2008-07-09 00:45 4984 ----a-w- c:\windows\system32\drivers\nvphy.bin
2009-05-21 19:52 . 2008-07-30 12:33 446464 ----a-w- c:\windows\system32\nvunrm.exe
2009-05-21 19:51 . 2008-08-02 10:36 22016 ----a-w- c:\windows\system32\drivers\nvnetbus.sys
2009-05-21 19:51 . 2008-08-02 10:35 955520 ----a-w- c:\windows\system32\drivers\nvnrm.sys
2009-05-21 19:51 . 2008-08-02 10:36 54784 ----a-w- c:\windows\system32\drivers\NVENETFD.sys
2009-05-21 19:51 . 2008-07-30 12:33 122880 ----a-w- c:\windows\system32\nvconrm.dll
2009-05-21 19:51 . 2008-08-02 10:35 200704 ----a-w- c:\windows\system32\fdco1.dll
2009-05-21 19:51 . 2008-08-02 10:34 9216 ----a-w- c:\windows\system32\bdco1.dll
2009-05-18 08:04 . 2009-05-18 08:04 -------- d-----w- c:\documents and settings\Jeramy\Local Settings\Application Data\Dan_Dixon
2009-05-18 08:04 . 2009-05-18 08:04 -------- d-----w- c:\documents and settings\Jeramy\Local Settings\Application Data\Dan Dixon
2009-05-18 08:04 . 2009-05-18 08:04 103424 ----a-w- c:\windows\system32\nUI_nat.dll
2009-05-18 08:04 . 2009-06-04 02:11 -------- d-----w- c:\program files\Universe Sandbox
2009-05-16 01:17 . 2009-05-16 01:17 -------- d-----w- c:\documents and settings\Jeramy\Local Settings\Application Data\Electronic Arts
2009-05-14 02:31 . 2009-05-25 02:54 440072 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-05-12 01:02 . 2008-04-13 18:45 26368 -c--a-w- c:\windows\system32\dllcache\usbstor.sys
2009-05-11 18:52 . 2009-05-12 01:30 -------- d-----w- c:\documents and settings\Jeramy\Local Settings\Application Data\Deployment

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-08 21:54 . 2009-02-10 03:37 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater
2009-06-08 19:09 . 2009-03-21 17:30 -------- d-----w- c:\program files\VIA
2009-06-05 02:29 . 2009-02-11 02:05 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-06-04 09:04 . 2009-02-20 21:06 -------- d-----w- c:\program files\Ollydbg
2009-05-28 03:14 . 2009-03-01 06:57 -------- d-----w- c:\documents and settings\Jeramy\Application Data\LimeWire
2009-05-28 00:47 . 2009-02-09 05:43 -------- d-----w- c:\program files\Common Files\Adobe
2009-05-22 06:01 . 2009-03-01 06:57 -------- d-----w- c:\program files\Java
2009-05-22 04:10 . 2009-03-06 19:26 -------- d-----w- c:\documents and settings\Jeramy\Application Data\Audacity
2009-05-21 19:39 . 2009-03-21 17:33 -------- d-----w- c:\program files\ASUS
2009-05-21 19:39 . 2009-02-19 18:25 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-05-20 21:11 . 2009-02-03 21:48 -------- d-----w- c:\documents and settings\Jeramy\Application Data\teamspeak2
2009-05-20 04:49 . 2009-03-26 18:09 138832 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2009-05-20 04:49 . 2009-03-26 18:09 202024 ----a-w- c:\windows\system32\PnkBstrB.exe
2009-05-17 19:28 . 2009-02-10 03:37 -------- d-----w- c:\program files\Google
2009-05-12 01:31 . 2009-05-09 01:39 -------- d-----w- c:\documents and settings\Jeramy\Application Data\nHancer
2009-05-12 01:30 . 2009-04-16 22:12 80896 ----a-w- c:\documents and settings\Jeramy\Application Data\Seven Zip\Codecs\LZMA.dll
2009-05-12 01:30 . 2009-04-16 22:12 5632 ----a-w- c:\documents and settings\Jeramy\Application Data\Seven Zip\Codecs\Swap.dll
2009-05-12 01:30 . 2009-04-16 22:12 5120 ----a-w- c:\documents and settings\Jeramy\Application Data\Seven Zip\Codecs\Copy.dll
2009-05-12 01:30 . 2009-04-16 22:12 32256 ----a-w- c:\documents and settings\Jeramy\Application Data\Seven Zip\Codecs\Aes.dll
2009-05-12 01:30 . 2009-04-16 22:12 18944 ----a-w- c:\documents and settings\Jeramy\Application Data\Seven Zip\Codecs\Branch.dll
2009-05-12 01:30 . 2009-04-16 22:12 13824 ----a-w- c:\documents and settings\Jeramy\Application Data\Seven Zip\Codecs\7zAes.dll
2009-05-12 01:30 . 2009-04-16 22:12 129024 ----a-w- c:\documents and settings\Jeramy\Application Data\Seven Zip\Formats\7z.dll
2009-05-08 23:30 . 2009-05-08 23:21 -------- d-----w- c:\documents and settings\All Users\Application Data\nHancer
2009-05-08 23:30 . 2009-05-08 23:29 -------- d-----w- c:\documents and settings\All Users\Application Data\NVIDIA
2009-05-08 23:29 . 2009-02-03 21:30 14592 ----a-w- c:\documents and settings\Jeramy\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-08 23:18 . 2009-02-03 21:32 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-05-06 23:03 . 2009-02-03 17:35 86327 ----a-w- c:\windows\PCHealth\HelpCtr\OfflineCache\index.dat
2009-05-06 22:25 . 2009-02-19 02:17 -------- d-----w- c:\documents and settings\Jeramy\Application Data\IGN_DLM
2009-05-06 22:05 . 2009-05-06 22:05 -------- d-----w- c:\program files\Rockstar Games
2009-05-06 18:28 . 2009-02-19 02:17 -------- d-----w- c:\program files\Download Manager
2009-05-06 18:12 . 2009-05-06 18:12 -------- d-----w- c:\program files\Common Files\Futuremark Shared
2009-05-02 01:21 . 2009-05-02 01:21 262144 ----a-w- c:\windows\system32\wrap_oal.dll
2009-05-02 01:21 . 2009-05-02 01:21 86016 ----a-w- c:\windows\system32\OpenAL32.dll
2009-05-02 00:29 . 2009-05-02 00:29 -------- d-----w- c:\program files\Futuremark
2009-05-01 07:31 . 2009-05-01 07:31 1657376 ----a-w- c:\windows\system32\nwiz.exe
2009-05-01 07:31 . 2009-05-01 07:31 449056 ----a-w- c:\windows\system32\nvappbar.exe
2009-05-01 07:31 . 2009-05-01 07:31 436768 ----a-w- c:\windows\system32\keystone.exe
2009-05-01 07:31 . 2009-05-01 07:31 466944 ----a-w- c:\windows\system32\nvshell.dll
2009-05-01 07:31 . 2009-05-01 07:31 1724416 ----a-w- c:\windows\system32\nvwdmcpl.dll
2009-05-01 07:31 . 2009-05-01 07:31 1507328 ----a-w- c:\windows\system32\nview.dll
2009-05-01 07:31 . 2009-05-01 07:31 1101824 ----a-w- c:\windows\system32\nvwimg.dll
2009-05-01 05:02 . 2009-05-01 05:02 1579630 ----a-w- c:\windows\system32\nvdata.bin
2009-05-01 05:02 . 2009-05-01 05:02 1314816 ----a-w- c:\windows\system32\nvcuvenc.dll
2009-05-01 05:02 . 2009-02-09 21:18 663552 ----a-w- c:\windows\system32\nvcuvid.dll
2009-05-01 05:02 . 2009-02-03 21:32 457248 ----a-w- c:\windows\system32\nvudisp.exe
2009-05-01 05:02 . 2009-02-03 21:25 8055584 ----a-w- c:\windows\system32\drivers\nv4_mini.sys
2009-05-01 05:02 . 2009-02-03 21:25 5896320 ----a-w- c:\windows\system32\nv4_disp.dll
2009-05-01 05:02 . 2008-08-02 19:20 9994240 ----a-w- c:\windows\system32\nvoglnt.dll
2009-05-01 05:02 . 2008-08-02 19:20 806912 ----a-w- c:\windows\system32\nvapi.dll
2009-05-01 05:02 . 2008-08-02 19:20 1720320 ----a-w- c:\windows\system32\nvcuda.dll
2009-05-01 05:02 . 2008-08-02 19:20 143360 ----a-w- c:\windows\system32\nvcodins.dll
2009-05-01 05:02 . 2008-08-02 19:20 143360 ----a-w- c:\windows\system32\nvcod.dll
2009-04-27 07:42 . 2009-02-03 20:50 457248 ----a-w- c:\windows\system32\NVUNINST.EXE
2009-04-22 07:20 . 2009-04-22 07:20 14311680 ----a-w- c:\windows\system32\xlive.dll
2009-04-22 07:20 . 2009-04-22 07:20 13642496 ----a-w- c:\windows\system32\xlivefnt.dll
2009-04-16 22:12 . 2009-04-16 22:12 -------- d-----w- c:\documents and settings\Jeramy\Application Data\Seven Zip
2009-04-06 12:19 . 2009-04-06 12:19 96 ----a-w- c:\documents and settings\All Users\Application Data\0a4dde28.dat
2009-04-06 01:44 . 2009-04-06 01:44 85665 ----a-w- c:\windows\system32\96c15e00-1d1b-ef9c-f7d0-c1de85f7e37e.exe
2009-04-06 01:44 . 2009-04-06 01:44 48275 ----a-w- c:\windows\system32\olrcmnoanyxjqtfid.exe
2009-03-26 18:56 . 2009-03-26 18:56 107888 ----a-w- c:\windows\system32\CmdLineExt.dll
2009-03-26 18:09 . 2009-03-26 18:09 22328 ----a-w- c:\documents and settings\Jeramy\Application Data\PnkBstrK.sys
2009-03-26 18:09 . 2009-03-26 18:09 22328 ----a-w- c:\documents and settings\Jeramy\Application Data\PnkBstrK.sys
2009-03-26 18:09 . 2009-03-26 18:09 669184 ----a-w- c:\windows\system32\pbsvc.exe
2009-03-26 18:09 . 2009-03-26 18:09 66872 ----a-w- c:\windows\system32\PnkBstrA.exe
2009-03-25 22:36 . 2009-03-22 22:44 60808 ----a-w- c:\windows\system32\S32EVNT1.DLL
2009-03-25 22:36 . 2009-03-22 22:44 124464 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2009-03-22 22:43 . 2009-03-22 22:43 1294680 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\SyKnAppS\SyKnAppS.dll
2009-03-22 22:43 . 2009-03-22 22:43 136840 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\SyKnAppS\patch25.dll
2009-03-22 22:43 . 2009-03-22 22:43 796016 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\CLT\cltLMSx.dll
2009-03-22 22:43 . 2009-03-22 22:43 288104 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\CPDOEM\CPDOEM.dll
2009-03-16 20:03 . 2009-03-16 20:03 533880 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\Scxpx86.dll
2009-03-12 08:42 . 2009-03-22 22:44 36400 ----a-r- c:\windows\system32\drivers\SymIM.sys
2006-05-03 10:06 . 2009-03-24 17:58 163328 --sh--r- c:\windows\system32\flvDX.dll
2007-02-21 11:47 . 2009-03-24 17:58 31232 --sh--r- c:\windows\system32\msfDX.dll
2008-03-16 13:30 . 2009-03-24 17:58 216064 --sh--r- c:\windows\system32\nbDX.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal]
@= "{C5994560-53D9-4125-87C9-F193FC689CB2} "
[HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}]
2008-01-17 01:52 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified]
@= "{C5994561-53D9-4125-87C9-F193FC689CB2} "
[HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}]
2008-01-17 01:52 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict]
@= "{C5994562-53D9-4125-87C9-F193FC689CB2} "
[HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}]
2008-01-17 01:52 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked]
@= "{C5994563-53D9-4125-87C9-F193FC689CB2} "
[HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}]
2008-01-17 01:52 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly]
@= "{C5994564-53D9-4125-87C9-F193FC689CB2} "
[HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}]
2008-01-17 01:52 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted]
@= "{C5994565-53D9-4125-87C9-F193FC689CB2} "
[HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}]
2008-01-17 01:52 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded]
@= "{C5994566-53D9-4125-87C9-F193FC689CB2} "
[HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}]
2008-01-17 01:52 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored]
@= "{C5994567-53D9-4125-87C9-F193FC689CB2} "
[HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}]
2008-01-17 01:52 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned]
@= "{C5994568-53D9-4125-87C9-F193FC689CB2} "
[HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}]
2008-01-17 01:52 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe "= "c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"MSMSGS "= "c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UserFaultCheck "= "c:\windows\system32\dumprep 0 -u" [X]
"TurboV "= "c:\program files\ASUS\TurboV\TurboV.exe" [2009-01-03 5381632]
"HDAudDeck "= "c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe" [2008-12-31 33546240]
"NvCplDaemon "= "c:\windows\system32\NvCpl.dll" [2009-05-01 13750272]
"NvMediaCenter "= "c:\windows\system32\NvMcTray.dll" [2009-05-01 86016]
"SunJavaUpdateSched "= "c:\program files\Java\jre6\bin\jusched.exe" [2009-05-22 148888]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-28 35696]
"nwiz "= "nwiz.exe" - c:\windows\system32\nwiz.exe [2009-05-01 1657376]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0sprecovr \SystemRoot\sprecovr.txt

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]
@= "FSFilter Activity Monitor "

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall "= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"c:\\Games\\F.E.A.R. 2 SP Demo\\FEAR2SPDemo.exe "=
"c:\\Games\\F.E.A.R. 2\\FEAR2.exe "=
"c:\\Program Files\\LimeWire\\LimeWire.exe "=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe "=
"c:\\Games\\Mirror's Edge\\Binaries\\MirrorsEdge.exe "=
"c:\\WINDOWS\\system32\\PnkBstrA.exe "=
"c:\\WINDOWS\\system32\\PnkBstrB.exe "=
"c:\\Games\\Steam\\steamapps\\common\\crysis warhead\\Bin32\\Crysis.exe "=
"c:\\Program Files\\Rockstar Games\\Rockstar Games Social Club\\RGSCLauncher.exe "=
"c:\\Games\\GTA4\\Grand Theft Auto IV\\LaunchGTAIV.exe "=
"c:\\Games\\GTA4\\Grand Theft Auto IV\\GTAIV.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"c:\\Games\\Steam\\steamapps\\common\\crysis wars\\Bin32\\Crysis.exe "=
"c:\\Games\\Steam\\steamapps\\common\\left 4 dead\\left4dead.exe "=

R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NIS\1005000.087\SymEFA.sys [3/23/2009 2:09 PM 310320]
R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\NIS\1005000.087\BHDrvx86.sys [3/23/2009 2:09 PM 258608]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\NIS\1005000.087\cchpx86.sys [3/23/2009 2:08 PM 482352]
R1 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090604.001\IDSXpx86.sys [6/8/2009 5:18 PM 276344]
R2 AsSysCtrlService;ASUS System Control Service;c:\program files\ASUS\AsSysCtrlService\1.00.00\AsSysCtrlService.exe [3/21/2009 10:33 AM 86016]
R2 DvmMDES;DeviceVM Meta Data Export Service;c:\asus.sys\config\DVMExportService.exe [11/26/2008 10:36 AM 323584]
R2 Norton Internet Security;Norton Internet Security;c:\program files\Norton Internet Security\Engine\16.5.0.135\ccSvcHst.exe [3/23/2009 2:08 PM 115560]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [3/22/2009 1:00 AM 101936]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [3/21/2009 10:31 AM 993280]
S2 gupdate1c98b30e66f1360;Google Update Service (gupdate1c98b30e66f1360);c:\program files\Google\Update\GoogleUpdate.exe [2/9/2009 8:37 PM 133104]
S3 cpuz130;cpuz130;\??\c:\docume~1\Jeramy\LOCALS~1\Temp\cpuz130\cpuz_x32.sys --> c:\docume~1\Jeramy\LOCALS~1\Temp\cpuz130\cpuz_x32.sys [?]
S3 SaiH0461;SaiH0461;c:\windows\system32\drivers\SaiH0461.sys [5/1/2007 4:33 PM 132232]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll ",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-06-09 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-02-10 17:25]

2009-06-09 c:\windows\Tasks\GoogleUpdateTaskMachine.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-10 03:37]

2009-06-09 c:\windows\Tasks\RegCure Program Check.job
- c:\program files\RegCure\RegCure.exe [2008-12-29 14:11]

2009-03-26 c:\windows\Tasks\RegCure.job
- c:\program files\RegCure\RegCure.exe [2008-12-29 14:11]
.
- - - - ORPHANS REMOVED - - - -

BHO-{1392b8d2-5c05-419f-a8f6-b9f15a596612} - (no file)
BHO-{82569CBA-81DC-669B-AE11-BACD42DE7E17} - c:\windows\system32\wlkihqfidc.dll


.
------- Supplementary Scan -------
.
uStart Page = hxxp://google.com/
FF - ProfilePath - c:\documents and settings\Jeramy\Application Data\Mozilla\Firefox\Profiles\1kmpl9il.default\
FF - prefs.js: browser.startup.homepage - hxxp://google.com/
FF - component: c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn\components\coFFPlgn.dll
FF - component: c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\IPSFFPlgn\components\IPSFFPl.dll
FF - plugin: c:\program files\Download Manager\npfpdlm.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.141.5\npGoogleOneClick7.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-09 14:39
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HDAudDeck = c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe 1????????????????????????????????????????????????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Norton Internet Security]
"ImagePath "= "\ "c:\program files\Norton Internet Security\Engine\16.5.0.135\ccSvcHst.exe\" /s \ "Norton Internet Security\" /m \ "c:\program files\Norton Internet Security\Engine\16.5.0.135\diMaster.dll\" /prefetch:1 "
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-839522115-790525478-2146225731-1003\Software\SecuROM\License information*]
"datasecu "=hex:16,b3,3e,2a,71,a0,04,48,84,0e,e2,7c,69,e9,e1,7d,65,e7,b1,65,9f,
af,f5,e0,1d,3a,32,1a,da,4d,cf,88,82,ce,e6,b7,91,00,9d,bb,ab,56,70,1e,8f,ca,\
"rkeysecu "=hex:2f,0f,d5,3e,02,2b,06,63,b1,0b,dd,b6,71,e2,54,98
.
Completion time: 2009-06-09 14:40
ComboFix-quarantined-files.txt 2009-06-09 21:40

Pre-Run: 227,941,470,208 bytes free
Post-Run: 231,297,208,320 bytes free

283 --- E O F --- 2009-05-14 02:31

 

I dont see anything left that looks unordinary. Really appriciate your help. Time will tell if its gone for good or not. Sometimes it took forever for the virus to do anything, and somtimes it would activate 10 minutes after powerup.

I did combofix first, then hijackthis.


ComboFix 09-06-09.06 - Jeramy 06/09/2009 23:22.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1605 [GMT -7:00]
Running from: c:\documents and settings\Jeramy\Desktop\VirusTools\ComboFix.exe
Command switches used :: c:\documents and settings\Jeramy\Desktop\VirusTools\CFScript.txt

FILE ::
"c:\docume~1\Jeramy\LOCALS~1\Temp\cpuz130\cpuz_x32.sys "
"c:\documents and settings\All Users\Application Data\0a4dde28.dat "
"c:\windows\system32\96c15e00-1d1b-ef9c-f7d0-c1de85f7e37e.exe "
"c:\windows\system32\olrcmnoanyxjqtfid.exe "
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\0a4dde28.dat
c:\windows\system32\Drivers\zaixosye.sys

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_CPUZ130
-------\Service_cpuz130
-------\Service_hfyj


((((((((((((((((((((((((( Files Created from 2009-05-10 to 2009-06-10 )))))))))))))))))))))))))))))))
.

2009-06-09 21:23 . 2009-06-09 21:23 0 ----a-w- c:\windows\nsreg.dat
2009-06-09 21:23 . 2009-06-09 21:23 -------- d-----w- c:\documents and settings\Jeramy\Local Settings\Application Data\Mozilla
2009-06-09 21:17 . 2009-06-09 21:17 -------- d-----w- c:\documents and settings\Jeramy\Application Data\Malwarebytes
2009-06-09 21:16 . 2009-05-26 20:20 40160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-09 21:16 . 2009-06-09 21:17 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-06-09 21:16 . 2009-06-09 21:16 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-06-09 21:16 . 2009-05-26 20:19 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-06-09 21:15 . 2009-06-09 21:15 -------- d-----w- c:\program files\Trend Micro
2009-05-22 06:02 . 2009-05-22 06:02 -------- d-----w- c:\windows\Sun
2009-05-22 06:01 . 2009-05-22 06:01 -------- d-----w- c:\program files\Sun
2009-05-22 06:01 . 2009-05-22 06:01 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-05-22 04:01 . 2009-05-22 04:06 -------- d-----w- c:\program files\Feurio
2009-05-22 03:54 . 2002-01-05 22:37 344064 ----a-w- c:\windows\system32\msvcr70.dll
2009-05-22 03:54 . 2009-05-22 04:06 -------- d-----w- c:\program files\Common Files\DVDVideoSoft
2009-05-21 19:52 . 2008-07-09 00:45 4984 ----a-w- c:\windows\system32\drivers\nvphy.bin
2009-05-21 19:52 . 2008-07-30 12:33 446464 ----a-w- c:\windows\system32\nvunrm.exe
2009-05-21 19:51 . 2008-08-02 10:36 22016 ----a-w- c:\windows\system32\drivers\nvnetbus.sys
2009-05-21 19:51 . 2008-08-02 10:35 955520 ----a-w- c:\windows\system32\drivers\nvnrm.sys
2009-05-21 19:51 . 2008-08-02 10:36 54784 ----a-w- c:\windows\system32\drivers\NVENETFD.sys
2009-05-21 19:51 . 2008-07-30 12:33 122880 ----a-w- c:\windows\system32\nvconrm.dll
2009-05-21 19:51 . 2008-08-02 10:35 200704 ----a-w- c:\windows\system32\fdco1.dll
2009-05-21 19:51 . 2008-08-02 10:34 9216 ----a-w- c:\windows\system32\bdco1.dll
2009-05-18 08:04 . 2009-05-18 08:04 -------- d-----w- c:\documents and settings\Jeramy\Local Settings\Application Data\Dan_Dixon
2009-05-18 08:04 . 2009-05-18 08:04 -------- d-----w- c:\documents and settings\Jeramy\Local Settings\Application Data\Dan Dixon
2009-05-18 08:04 . 2009-05-18 08:04 103424 ----a-w- c:\windows\system32\nUI_nat.dll
2009-05-18 08:04 . 2009-06-04 02:11 -------- d-----w- c:\program files\Universe Sandbox
2009-05-16 01:17 . 2009-05-16 01:17 -------- d-----w- c:\documents and settings\Jeramy\Local Settings\Application Data\Electronic Arts
2009-05-14 02:31 . 2009-05-25 02:54 440072 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-05-12 01:02 . 2008-04-13 18:45 26368 -c--a-w- c:\windows\system32\dllcache\usbstor.sys
2009-05-11 18:52 . 2009-05-12 01:30 -------- d-----w- c:\documents and settings\Jeramy\Local Settings\Application Data\Deployment

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-10 06:14 . 2009-03-01 06:57 -------- d-----w- c:\program files\Java
2009-06-09 22:55 . 2009-02-10 03:37 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater
2009-06-09 21:52 . 2009-03-21 17:28 -------- d-----w- c:\documents and settings\All Users\Application Data\Norton
2009-06-08 19:09 . 2009-03-21 17:30 -------- d-----w- c:\program files\VIA
2009-06-05 02:29 . 2009-02-11 02:05 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-06-04 09:04 . 2009-02-20 21:06 -------- d-----w- c:\program files\Ollydbg
2009-05-28 03:14 . 2009-03-01 06:57 -------- d-----w- c:\documents and settings\Jeramy\Application Data\LimeWire
2009-05-28 00:47 . 2009-02-09 05:43 -------- d-----w- c:\program files\Common Files\Adobe
2009-05-22 04:10 . 2009-03-06 19:26 -------- d-----w- c:\documents and settings\Jeramy\Application Data\Audacity
2009-05-21 19:39 . 2009-03-21 17:33 -------- d-----w- c:\program files\ASUS
2009-05-21 19:39 . 2009-02-19 18:25 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-05-20 21:11 . 2009-02-03 21:48 -------- d-----w- c:\documents and settings\Jeramy\Application Data\teamspeak2
2009-05-20 04:49 . 2009-03-26 18:09 138832 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2009-05-20 04:49 . 2009-03-26 18:09 202024 ----a-w- c:\windows\system32\PnkBstrB.exe
2009-05-17 19:28 . 2009-02-10 03:37 -------- d-----w- c:\program files\Google
2009-05-12 01:31 . 2009-05-09 01:39 -------- d-----w- c:\documents and settings\Jeramy\Application Data\nHancer
2009-05-12 01:30 . 2009-04-16 22:12 80896 ----a-w- c:\documents and settings\Jeramy\Application Data\Seven Zip\Codecs\LZMA.dll
2009-05-12 01:30 . 2009-04-16 22:12 5632 ----a-w- c:\documents and settings\Jeramy\Application Data\Seven Zip\Codecs\Swap.dll
2009-05-12 01:30 . 2009-04-16 22:12 5120 ----a-w- c:\documents and settings\Jeramy\Application Data\Seven Zip\Codecs\Copy.dll
2009-05-12 01:30 . 2009-04-16 22:12 32256 ----a-w- c:\documents and settings\Jeramy\Application Data\Seven Zip\Codecs\Aes.dll
2009-05-12 01:30 . 2009-04-16 22:12 18944 ----a-w- c:\documents and settings\Jeramy\Application Data\Seven Zip\Codecs\Branch.dll
2009-05-12 01:30 . 2009-04-16 22:12 13824 ----a-w- c:\documents and settings\Jeramy\Application Data\Seven Zip\Codecs\7zAes.dll
2009-05-12 01:30 . 2009-04-16 22:12 129024 ----a-w- c:\documents and settings\Jeramy\Application Data\Seven Zip\Formats\7z.dll
2009-05-08 23:30 . 2009-05-08 23:21 -------- d-----w- c:\documents and settings\All Users\Application Data\nHancer
2009-05-08 23:30 . 2009-05-08 23:29 -------- d-----w- c:\documents and settings\All Users\Application Data\NVIDIA
2009-05-08 23:29 . 2009-02-03 21:30 14592 ----a-w- c:\documents and settings\Jeramy\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-08 23:18 . 2009-02-03 21:32 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-05-06 23:03 . 2009-02-03 17:35 86327 ----a-w- c:\windows\PCHealth\HelpCtr\OfflineCache\index.dat
2009-05-06 22:25 . 2009-02-19 02:17 -------- d-----w- c:\documents and settings\Jeramy\Application Data\IGN_DLM
2009-05-06 22:05 . 2009-05-06 22:05 -------- d-----w- c:\program files\Rockstar Games
2009-05-06 18:28 . 2009-02-19 02:17 -------- d-----w- c:\program files\Download Manager
2009-05-06 18:12 . 2009-05-06 18:12 -------- d-----w- c:\program files\Common Files\Futuremark Shared
2009-05-02 01:21 . 2009-05-02 01:21 262144 ----a-w- c:\windows\system32\wrap_oal.dll
2009-05-02 01:21 . 2009-05-02 01:21 86016 ----a-w- c:\windows\system32\OpenAL32.dll
2009-05-02 00:29 . 2009-05-02 00:29 -------- d-----w- c:\program files\Futuremark
2009-05-01 07:31 . 2009-05-01 07:31 1657376 ----a-w- c:\windows\system32\nwiz.exe
2009-05-01 07:31 . 2009-05-01 07:31 449056 ----a-w- c:\windows\system32\nvappbar.exe
2009-05-01 07:31 . 2009-05-01 07:31 436768 ----a-w- c:\windows\system32\keystone.exe
2009-05-01 07:31 . 2009-05-01 07:31 466944 ----a-w- c:\windows\system32\nvshell.dll
2009-05-01 07:31 . 2009-05-01 07:31 1724416 ----a-w- c:\windows\system32\nvwdmcpl.dll
2009-05-01 07:31 . 2009-05-01 07:31 1507328 ----a-w- c:\windows\system32\nview.dll
2009-05-01 07:31 . 2009-05-01 07:31 1101824 ----a-w- c:\windows\system32\nvwimg.dll
2009-05-01 05:02 . 2009-05-01 05:02 1579630 ----a-w- c:\windows\system32\nvdata.bin
2009-05-01 05:02 . 2009-05-01 05:02 1314816 ----a-w- c:\windows\system32\nvcuvenc.dll
2009-05-01 05:02 . 2009-02-09 21:18 663552 ----a-w- c:\windows\system32\nvcuvid.dll
2009-05-01 05:02 . 2009-02-03 21:32 457248 ----a-w- c:\windows\system32\nvudisp.exe
2009-05-01 05:02 . 2009-02-03 21:25 8055584 ----a-w- c:\windows\system32\drivers\nv4_mini.sys
2009-05-01 05:02 . 2009-02-03 21:25 5896320 ----a-w- c:\windows\system32\nv4_disp.dll
2009-05-01 05:02 . 2008-08-02 19:20 9994240 ----a-w- c:\windows\system32\nvoglnt.dll
2009-05-01 05:02 . 2008-08-02 19:20 806912 ----a-w- c:\windows\system32\nvapi.dll
2009-05-01 05:02 . 2008-08-02 19:20 1720320 ----a-w- c:\windows\system32\nvcuda.dll
2009-05-01 05:02 . 2008-08-02 19:20 143360 ----a-w- c:\windows\system32\nvcodins.dll
2009-05-01 05:02 . 2008-08-02 19:20 143360 ----a-w- c:\windows\system32\nvcod.dll
2009-04-27 07:42 . 2009-02-03 20:50 457248 ----a-w- c:\windows\system32\NVUNINST.EXE
2009-04-22 07:20 . 2009-04-22 07:20 14311680 ----a-w- c:\windows\system32\xlive.dll
2009-04-22 07:20 . 2009-04-22 07:20 13642496 ----a-w- c:\windows\system32\xlivefnt.dll
2009-04-16 22:12 . 2009-04-16 22:12 -------- d-----w- c:\documents and settings\Jeramy\Application Data\Seven Zip
2009-03-26 18:56 . 2009-03-26 18:56 107888 ----a-w- c:\windows\system32\CmdLineExt.dll
2009-03-26 18:09 . 2009-03-26 18:09 22328 ----a-w- c:\documents and settings\Jeramy\Application Data\PnkBstrK.sys
2009-03-26 18:09 . 2009-03-26 18:09 22328 ----a-w- c:\documents and settings\Jeramy\Application Data\PnkBstrK.sys
2009-03-26 18:09 . 2009-03-26 18:09 669184 ----a-w- c:\windows\system32\pbsvc.exe
2009-03-26 18:09 . 2009-03-26 18:09 66872 ----a-w- c:\windows\system32\PnkBstrA.exe
2006-05-03 10:06 . 2009-03-24 17:58 163328 --sh--r- c:\windows\system32\flvDX.dll
2007-02-21 11:47 . 2009-03-24 17:58 31232 --sh--r- c:\windows\system32\msfDX.dll
2008-03-16 13:30 . 2009-03-24 17:58 216064 --sh--r- c:\windows\system32\nbDX.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-06-09_21.39.15 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-06-10 06:25 . 2009-06-10 06:25 16384 c:\windows\Temp\Perflib_Perfdata_468.dat
+ 2003-03-31 12:00 . 2009-06-10 06:17 71002 c:\windows\system32\perfc009.dat
- 2003-03-31 12:00 . 2009-06-09 20:27 71002 c:\windows\system32\perfc009.dat
+ 2003-03-31 12:00 . 2009-06-10 06:17 440684 c:\windows\system32\perfh009.dat
- 2003-03-31 12:00 . 2009-06-09 20:27 440684 c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal]
@= "{C5994560-53D9-4125-87C9-F193FC689CB2} "
[HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}]
2008-01-17 01:52 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified]
@= "{C5994561-53D9-4125-87C9-F193FC689CB2} "
[HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}]
2008-01-17 01:52 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict]
@= "{C5994562-53D9-4125-87C9-F193FC689CB2} "
[HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}]
2008-01-17 01:52 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked]
@= "{C5994563-53D9-4125-87C9-F193FC689CB2} "
[HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}]
2008-01-17 01:52 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly]
@= "{C5994564-53D9-4125-87C9-F193FC689CB2} "
[HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}]
2008-01-17 01:52 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted]
@= "{C5994565-53D9-4125-87C9-F193FC689CB2} "
[HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}]
2008-01-17 01:52 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded]
@= "{C5994566-53D9-4125-87C9-F193FC689CB2} "
[HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}]
2008-01-17 01:52 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored]
@= "{C5994567-53D9-4125-87C9-F193FC689CB2} "
[HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}]
2008-01-17 01:52 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned]
@= "{C5994568-53D9-4125-87C9-F193FC689CB2} "
[HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}]
2008-01-17 01:52 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe "= "c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"MSMSGS "= "c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TurboV "= "c:\program files\ASUS\TurboV\TurboV.exe" [2009-01-03 5381632]
"HDAudDeck "= "c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe" [2008-12-31 33546240]
"NvCplDaemon "= "c:\windows\system32\NvCpl.dll" [2009-05-01 13750272]
"NvMediaCenter "= "c:\windows\system32\NvMcTray.dll" [2009-05-01 86016]
"SunJavaUpdateSched "= "c:\program files\Java\jre6\bin\jusched.exe" [2009-05-22 148888]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-28 35696]
"nwiz "= "nwiz.exe" - c:\windows\system32\nwiz.exe [2009-05-01 1657376]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0sprecovr \SystemRoot\sprecovr.txt

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall "= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"c:\\Games\\F.E.A.R. 2 SP Demo\\FEAR2SPDemo.exe "=
"c:\\Games\\F.E.A.R. 2\\FEAR2.exe "=
"c:\\Program Files\\LimeWire\\LimeWire.exe "=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe "=
"c:\\Games\\Mirror's Edge\\Binaries\\MirrorsEdge.exe "=
"c:\\WINDOWS\\system32\\PnkBstrA.exe "=
"c:\\WINDOWS\\system32\\PnkBstrB.exe "=
"c:\\Games\\Steam\\steamapps\\common\\crysis warhead\\Bin32\\Crysis.exe "=
"c:\\Program Files\\Rockstar Games\\Rockstar Games Social Club\\RGSCLauncher.exe "=
"c:\\Games\\GTA4\\Grand Theft Auto IV\\LaunchGTAIV.exe "=
"c:\\Games\\GTA4\\Grand Theft Auto IV\\GTAIV.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"c:\\Games\\Steam\\steamapps\\common\\crysis wars\\Bin32\\Crysis.exe "=
"c:\\Games\\Steam\\steamapps\\common\\left 4 dead\\left4dead.exe "=

R2 AsSysCtrlService;ASUS System Control Service;c:\program files\ASUS\AsSysCtrlService\1.00.00\AsSysCtrlService.exe [3/21/2009 10:33 AM 86016]
R2 DvmMDES;DeviceVM Meta Data Export Service;c:\asus.sys\config\DVMExportService.exe [11/26/2008 10:36 AM 323584]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [3/21/2009 10:31 AM 993280]
S2 gupdate1c98b30e66f1360;Google Update Service (gupdate1c98b30e66f1360);c:\program files\Google\Update\GoogleUpdate.exe [2/9/2009 8:37 PM 133104]
S3 SaiH0461;SaiH0461;c:\windows\system32\drivers\SaiH0461.sys [5/1/2007 4:33 PM 132232]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll ",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-06-10 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-02-10 17:25]

2009-06-10 c:\windows\Tasks\GoogleUpdateTaskMachine.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-10 03:37]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://google.com/
FF - ProfilePath - c:\documents and settings\Jeramy\Application Data\Mozilla\Firefox\Profiles\1kmpl9il.default\
FF - prefs.js: browser.startup.homepage - hxxp://google.com/
FF - plugin: c:\program files\Download Manager\npfpdlm.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.141.5\npGoogleOneClick7.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-09 23:25
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HDAudDeck = c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe 1????????????????????????????????????????????????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-839522115-790525478-2146225731-1003\Software\SecuROM\License information*]
"datasecu "=hex:16,b3,3e,2a,71,a0,04,48,84,0e,e2,7c,69,e9,e1,7d,65,e7,b1,65,9f,
af,f5,e0,1d,3a,32,1a,da,4d,cf,88,82,ce,e6,b7,91,00,9d,bb,ab,56,70,1e,8f,ca,\
"rkeysecu "=hex:2f,0f,d5,3e,02,2b,06,63,b1,0b,dd,b6,71,e2,54,98
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(2588)
c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
c:\program files\TortoiseSVN\bin\TortoiseStub.dll
c:\program files\TortoiseSVN\bin\TortoiseSVN.dll
c:\program files\TortoiseSVN\bin\intl3_tsvn.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\OneX.DLL
c:\windows\system32\eappprxy.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\nvsvc32.exe
c:\program files\TortoiseSVN\bin\TSVNCache.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\PnkBstrB.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-06-10 23:27 - machine was rebooted
ComboFix-quarantined-files.txt 2009-06-10 06:27
ComboFix2.txt 2009-06-09 21:40

Pre-Run: 231,668,854,784 bytes free
Post-Run: 231,610,220,544 bytes free

275 --- E O F --- 2009-05-14 02:31

 

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:28:45 PM, on 6/9/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\ASUS\AsSysCtrlService\1.00.00\AsSysCtrlService.exe
C:\ASUS.SYS\config\DVMExportService.exe
C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\ASUS\TurboV\TurboV.exe
C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [TurboV] "C:\Program Files\ASUS\TurboV\TurboV.exe "
O4 - HKLM\..\Run: [HDAudDeck] C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe 1
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe "
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe "
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (CDownloadCtrl Object) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.8.110.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} (Futuremark SystemInfo) - http://www.yougamers.com/systeminfo/FMSI.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
O23 - Service: ASUS System Control Service (AsSysCtrlService) - Unknown owner - C:\Program Files\ASUS\AsSysCtrlService\1.00.00\AsSysCtrlService.exe
O23 - Service: DeviceVM Meta Data Export Service (DvmMDES) - DeviceVM - C:\ASUS.SYS\config\DVMExportService.exe
O23 - Service: Google Update Service (gupdate1c98b30e66f1360) (gupdate1c98b30e66f1360) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe

--
End of file - 5155 bytes

 

The sound disabling virus appears to be gone but a new issue has come up since the last action taken. Outlook looses all emails accounts and all emails are deleted every reboot.

edit: i have 2 accounts, both dissapear after reboot, emails are deleted only in hotmail.

could this be caused by combofix?