Can someone please view this

Started in this thread .....

http://www.windowsbbs.com/showthread.php?t=68411

Hi, as instructed here is the log file. I used spybot and Adaware to clear some
50 or 60 infections. Everytime I launch a program I get this error message.
Message is "The app. or .dll c:\windows\system32\dxclib303562752.dll is not a valid windows image" Seems all these over 10 gig of music files etc are located in C:windows/fonts/ but if I look there, there is no sign of them. I see house call reading from there.

Logfile of HijackThis v1.99.1
Scan saved at 11:22:38 AM, on 10/25/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\PopUp Killer\popupkiller.EXE
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\Fonts\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\pctspk.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\PROGRA~1\mozilla.org\SEAMON~1\SEAMON~1.EXE
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.ca/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {029e02f0-a0e5-4b19-b958-7bf2db29fb13} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {2d7cb618-cc1c-4126-a7e3-f5b12d3bcf71} - (no file)
O2 - BHO: (no name) - {51641ef3-8a7a-4d84-8659-b0911e947cc8} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {54645654-2225-4455-44A1-9F4543D34546} - (no file)
O2 - BHO: (no name) - {6abc861a-31e7-4d91-b43b-d3c98f22a5c0} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {a4a435cf-3583-11d4-91bd-0048546a1450} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O2 - BHO: (no name) - {c2680e10-1655-4a0e-87f8-4259325a84b7} - (no file)
O2 - BHO: (no name) - {c4ca6559-2cf1-48b6-96b2-8340a06fd129} - (no file)
O2 - BHO: IE Redirector - {C68AE9C0-0909-4DDC-B661-C1AFB9F5AE53} - C:\WINDOWS\system32\dnsersnd.dll (file missing)
O2 - BHO: (no name) - {D79E1D43-C805-40EF-8ACB-DFFB17E9A4AF} - (no file)
O2 - BHO: (no name) - {d8efadf1-9009-11d6-8c73-608c5dc19089} - (no file)
O2 - BHO: (no name) - {e9147a0a-a866-4214-b47c-da821891240f} - (no file)
O2 - BHO: (no name) - {e9306072-417e-43e3-81d5-369490beef7c} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [PopUpKiller] C:\Program Files\PopUp Killer\popupkiller.EXE
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Host Process] C:\WINDOWS\Fonts\svchost.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Mozilla Quick Launch] "C:\PROGRA~1\MOZILLA.ORG\SEAMON~1\SEAMON~1.EXE" -turbo
O4 - HKCU\..\Run: [SeaMonkey Quick Launch] "C:\Program Files\mozilla.org\SeaMonkey\SeaMonkey.exe" -turbo
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1190677232906
O16 - DPF: {B7D07999-2ADB-4AEB-997E-F61CB7B2E2CD} (TSEasyInstallX Control) - http://www.trendsecure.com/easy_install/_activex/en-US/TSEasyInstallX.CAB
O20 - AppInit_DLLs: dxclib303562752.dll c:\windows\system32\ldcore.dll
O20 - Winlogon Notify: winzdn32 - winzdn32.dll (file missing)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

 

Hi Bimmer Guy

Download Deckard's System Scanner (dss.exe) and save it to your desktop.

Scan again with HijackThis and place a check next to the following entries, close all other windows and programs, then click Fix Checked.

O2 - BHO: (no name) - {029e02f0-a0e5-4b19-b958-7bf2db29fb13} - (no file)
O2 - BHO: (no name) - {2d7cb618-cc1c-4126-a7e3-f5b12d3bcf71} - (no file)
O2 - BHO: (no name) - {51641ef3-8a7a-4d84-8659-b0911e947cc8} - (no file)
O2 - BHO: (no name) - {54645654-2225-4455-44A1-9F4543D34546} - (no file)
O2 - BHO: (no name) - {6abc861a-31e7-4d91-b43b-d3c98f22a5c0} - (no file)
O2 - BHO: (no name) - {a4a435cf-3583-11d4-91bd-0048546a1450} - (no file)
O2 - BHO: (no name) - {c2680e10-1655-4a0e-87f8-4259325a84b7} - (no file)
O2 - BHO: (no name) - {c4ca6559-2cf1-48b6-96b2-8340a06fd129} - (no file)
O2 - BHO: IE Redirector - {C68AE9C0-0909-4DDC-B661-C1AFB9F5AE53} - C:\WINDOWS\system32\dnsersnd.dll (file missing)
O2 - BHO: (no name) - {D79E1D43-C805-40EF-8ACB-DFFB17E9A4AF} - (no file)
O2 - BHO: (no name) - {d8efadf1-9009-11d6-8c73-608c5dc19089} - (no file)
O2 - BHO: (no name) - {e9147a0a-a866-4214-b47c-da821891240f} - (no file)
O2 - BHO: (no name) - {e9306072-417e-43e3-81d5-369490beef7c} - (no file)
O4 - HKLM\..\Run: [Host Process] C:\WINDOWS\Fonts\svchost.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O20 - AppInit_DLLs: dxclib303562752.dll c:\windows\system32\ldcore.dll
O20 - Winlogon Notify: winzdn32 - winzdn32.dll (file missing)


Download and install AVG Anti-Spyware (AVG-AS)

• When installation completes, start AVG-AS then click the Update tab at the top. Under Manual Update click Start update.
• After the update finishes (the status bar at the bottom will display "Update successful "), click on the Scanner tab at the top.
• Click the "Settings" tab and change the recommended action to Quarantine.
• Select Do Not Automatically Generate a Report after Every Scan.
• Go back to the "Scan" tab and click "Complete System Scan ". This scan can take quite a while to run, so sit back and wait.
• AVG-AS will list any infections found on the left hand side. When the scan has finished, it will automatically set the recommended action.
• Click the Apply all actions button. AVG-AS will display "All actions have been applied" on the right hand side.
• Click on "Save Report ", then "Save Report As ". Save the report where you know you can find it again (like on the Desktop) and take note of the name.
• Close AVG-AS and reboot.

• Close all applications and windows.
• Double click on dss.exe to run it and follow the prompts.
• When the scan is complete, two text files will open; main.txt, which will be maximized and extra.txt, which will be minimized.

Post the contents of main.txt and the AVG-AS report.

 

Hi and thank you noahdfear. Here are the 3 reports. Btw, Almost 250,000 entries were scanned by AVG in c:windows/fonts All music and computer stuff. Can this be removed? Well over 13-14 gig
---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at: 10:00:52 PM 10/25/2007

+ Scan result:



C:\System Volume Information\_restore{F57C394A-9356-4DB8-B4C0-38BA72FA9EAA}\RP40\A0011704.exe -> Trojan.Small.edz : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{F57C394A-9356-4DB8-B4C0-38BA72FA9EAA}\RP40\A0011706.exe -> Trojan.Small.edz : Cleaned with backup (quarantined).

Emulating logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2007-10-25 22:22:34
Platform: Windows XP Service Pack 2 (5.01.2600)
MSIE: Internet Explorer (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\system32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\explorer.exe
C:\Program Files\PopUp Killer\PopUpKiller.exe
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\mozilla.org\SeaMonkey\seamonkey.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Grisoft\AVG7\avgamsvr.exe
C:\Program Files\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Grisoft\AVG7\avgemc.exe
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\j\Desktop\dss.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.ca/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.com/search?q=%s
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
R3 - Default URLSearchHook is missing
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\GoogleToolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\GoogleToolbar1.dll
O3 - Toolbar: (no name) - SITEguard - (no file)
O4 - HKLM\..\Run: [PopUpKiller] C:\Program Files\PopUp Killer\popupkiller.EXE
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Mozilla Quick Launch] "C:\PROGRA~1\MOZILLA.ORG\SEAMON~1\SEAMON~1.EXE" -turbo
O4 - HKCU\..\Run: [SeaMonkey Quick Launch] "C:\Program Files\mozilla.org\SeaMonkey\SeaMonkey.exe" -turbo
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1190677232906
O16 - DPF: {B7D07999-2ADB-4AEB-997E-F61CB7B2E2CD} (TSEasyInstallX Control) - http://www.trendsecure.com/easy_install/_activex/en-US/TSEasyInstallX.CAB
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O18 - Protocol: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL
O18 - Protocol: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL
O18 - Protocol: mso-offdap11 - {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL
O18 - Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\Program Files\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\Program Files\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\Program Files\Grisoft\AVG7\avgemc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: NBService - Unknown owner - C:\Program Files\Nero\Nero 7\Nero
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe


--
End of file - 7126 bytes

-- Files created between 2007-09-25 and 2007-10-25 -----------------------------

2007-10-25 20:50:35 0 dr-h----- C:\Documents and Settings\j\Recent
2007-10-25 20:45:25 0 d-------- C:\Documents and Settings\j\Application Data\Grisoft
2007-10-25 15:57:20 0 d-------- C:\Program Files\Spyware Doctor
2007-10-25 01:07:54 0 d-------- C:\Documents and Settings\j\Application Data\AVG7
2007-10-25 01:07:44 0 d-------- C:\Documents and Settings\LocalService\Application Data\AVG7
2007-10-25 01:07:31 0 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2007-10-25 01:07:31 0 d-------- C:\Documents and Settings\All Users\Application Data\avg7
2007-10-25 00:40:59 0 d-------- C:\WINDOWS\system32\acespy
2007-10-25 00:40:48 28672 --a------ C:\Documents and Settings\j\update.exe <Not Verified; tingtong; iou555iou>
2007-10-24 23:06:53 12032 --a------ C:\WINDOWS\eventlowg.dll
2007-10-24 23:06:53 32256 --a------ C:\WINDOWS\daxtime.dll
2007-10-24 23:06:51 26880 --a------ C:\WINDOWS\liqui-Uninstaller.exe
2007-10-24 23:06:51 17408 --a------ C:\WINDOWS\fhfmm-Uninstaller.exe
2007-10-24 23:06:50 30720 --a------ C:\WINDOWS\xadbrk_.exe
2007-10-24 23:06:50 29952 --a------ C:\WINDOWS\kkcomp$.exe
2007-10-24 23:06:49 25600 --a------ C:\WINDOWS\liqad$.exe
2007-10-24 23:06:47 16640 --a------ C:\WINDOWS\jd2002.dll
2007-10-24 23:06:47 12544 --a------ C:\WINDOWS\adbar.dll
2007-10-24 23:06:46 25856 --a------ C:\WINDOWS\spredirect.dll
2007-10-24 23:06:44 16896 --a------ C:\WINDOWS\ie_32.exe
2007-10-24 23:06:43 12288 --a------ C:\WINDOWS\xxxvideo.exe
2007-10-24 23:06:43 29696 --a------ C:\WINDOWS\ngd.dll
2007-10-24 23:06:43 19456 --a------ C:\WINDOWS\dp0.dll
2007-10-24 23:02:14 200704 --a------ C:\WINDOWS\sys101275350440.exe <Not Verified; ; j159180t>
2007-10-24 23:00:59 0 d-------- C:\Documents and Settings\All Users\Application Data\Trend Micro
2007-10-24 23:00:51 0 d-------- C:\Documents and Settings\LocalService\Desktop
2007-10-24 23:00:49 0 d-------- C:\Documents and Settings\NetworkService\Desktop
2007-10-24 17:30:42 147456 --a------ C:\WINDOWS\system32\vbzip10.dll <Not Verified; Info-ZIP; Info-ZIP's WiZ>
2007-10-24 16:58:08 0 d-------- C:\Documents and Settings\j\Application Data\WinRAR
2007-10-24 15:54:55 0 d-------- C:\Documents and Settings\j\Application Data\PC Tools
2007-10-23 15:21:35 37376 --a------ C:\WINDOWS\system32\VbVfw.dll
2007-10-23 15:20:08 0 d-------- C:\Program Files\Movie Joiners
2007-10-22 13:36:19 27648 --a------ C:\WINDOWS\system32\Hh.exe <Not Verified; Microsoft Corporation; HTML Help>
2007-10-22 13:36:18 72704 --a------ C:\WINDOWS\system32\Odbctl32.dll <Not Verified; Microsoft Corporation; Microsoft Open Database Connectivity>
2007-10-22 13:36:18 415504 --a------ C:\WINDOWS\system32\Msrepl35.dll <Not Verified; Microsoft Corporation; Microsoft® Access>
2007-10-22 13:36:18 262144 --a------ C:\WINDOWS\system32\Msrd2x35.dll <Not Verified; Microsoft Corporation; Microsoft® Jet>
2007-10-22 13:36:18 36864 --a------ C:\WINDOWS\system32\Msjter35.dll <Not Verified; Microsoft Corporation; Microsoft® Jet>
2007-10-22 13:36:18 139264 --a------ C:\WINDOWS\system32\Msjint35.dll <Not Verified; Microsoft Corporation; Microsoft® Jet>
2007-10-22 13:36:18 1050896 --a------ C:\WINDOWS\system32\Msjet35.dll <Not Verified; Microsoft Corporation; Microsoft® Jet>
2007-10-22 13:36:16 0 d-------- C:\Documents and Settings\All Users\Application Data\Individual Software
2007-10-17 20:33:22 0 d-------- C:\Documents and Settings\LocalService\Application Data\iolo
2007-10-17 19:40:05 74703 --a------ C:\WINDOWS\system32\mfc45.dll
2007-10-17 19:39:19 0 d-------- C:\Documents and Settings\j\Application Data\iolo
2007-10-17 19:39:19 0 d-------- C:\Documents and Settings\All Users\Application Data\iolo
2007-10-15 20:53:22 0 d-------- C:\Program Files\MSXML 6.0
2007-10-15 19:50:11 0 d-------- C:\Documents and Settings\j\Application Data\vlc
2007-10-15 19:44:45 0 d-------- C:\Program Files\VideoLAN
2007-10-15 14:49:41 0 d-------- C:\Program Files\Ati
2007-10-15 12:42:25 0 d-------- C:\Program Files\MSBuild
2007-10-15 12:38:45 0 d-------- C:\WINDOWS\system32\XPSViewer
2007-10-15 12:38:17 0 d-------- C:\Program Files\Reference Assemblies
2007-10-15 12:28:30 0 --a------ C:\WINDOWS\ativpsrm.bin
2007-10-15 12:26:49 0 d-------- C:\Program Files\Steam
2007-10-15 12:25:06 593920 -----n--- C:\WINDOWS\system32\ati2sgag.exe <Not Verified; ; ATI Smart>
2007-10-15 12:23:58 0 d-------- C:\ATI
2007-10-14 22:10:50 0 d-------- C:\WINDOWS\system32\LogFiles
2007-10-14 21:05:30 122880 --a------ C:\WINDOWS\UnGins.exe
2007-10-13 15:47:09 0 dr-h----- C:\$VAULT$.AVG
2007-10-13 15:23:58 0 d-------- C:\Program Files\Microsoft Bootvis
2007-10-02 20:39:30 0 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-10-02 20:31:43 0 d-------- C:\WINDOWS\SxsCaPendDel
2007-10-02 20:11:55 0 d-------- C:\Program Files\Common Files\iS3
2007-10-02 20:11:55 0 d-------- C:\Documents and Settings\All Users\Application Data\STOPzilla!
2007-10-02 19:50:49 0 d-------- C:\Documents and Settings\LocalService\Application Data\Mozilla
2007-10-02 19:42:28 0 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2007-10-02 12:42:15 0 d-------- C:\Documents and Settings\j\Application Data\Nokia Multimedia Player
2007-09-25 14:47:08 0 d-------- C:\Documents and Settings\j\.housecall6.6
2007-09-25 13:16:27 0 d-------- C:\divx
2007-09-25 00:24:24 0 d-------- C:\Documents and Settings\All Users\Application Data\PC Suite
2007-09-25 00:24:01 0 d-------- C:\Documents and Settings\j\Application Data\Nokia
2007-09-25 00:23:44 0 d-------- C:\Program Files\Common Files\PCSuite
2007-09-25 00:23:43 0 d-------- C:\Program Files\Common Files\Nokia
2007-09-25 00:23:37 0 d-------- C:\Program Files\DIFX
2007-09-25 00:23:35 0 d-------- C:\Documents and Settings\j\Application Data\PC Suite
2007-09-25 00:23:31 0 d-------- C:\Program Files\PC Connectivity Solution
2007-09-25 00:23:27 0 d------c- C:\WINDOWS\system32\DRVSTORE
2007-09-25 00:23:25 0 d-------- C:\Program Files\Nokia
2007-09-25 00:22:06 0 d-------- C:\Documents and Settings\All Users\Application Data\Installations


-- Find3M Report ---------------------------------------------------------------

2007-10-25 22:01:44 0 d-------- C:\Program Files\PopUp Killer
2007-10-25 15:21:07 0 d-------- C:\Program Files\Common Files
2007-10-25 12:10:11 0 d-------- C:\Documents and Settings\j\Application Data\LimeWire
2007-10-22 12:13:31 0 d-------- C:\Program Files\Visualizer Photo Resize
2007-10-21 16:38:45 118784 --a------ C:\WINDOWS\SeaMonkeyUninstall.exe
2007-10-21 16:38:45 7284 --a------ C:\WINDOWS\mozver.dat
2007-10-21 16:38:34 118784 --a------ C:\WINDOWS\GREUninstall.exe
2007-10-15 23:34:49 0 d-------- C:\Program Files\CCleaner
2007-10-15 12:26:26 0 d-------- C:\Program Files\ATI Technologies
2007-10-15 12:25:56 0 d--h----- C:\Program Files\InstallShield Installation Information
2007-10-15 12:25:21 0 d-------- C:\Program Files\Common Files\InstallShield
2007-10-14 22:30:25 0 d-------- C:\Program Files\Mozilla Thunderbird
2007-10-14 21:41:55 0 d-------- C:\Program Files\Common Files\Symantec Shared
2007-10-14 18:01:29 0 d-------- C:\Program Files\microsoft frontpage
2007-10-14 16:47:09 8 --a------ C:\Documents and Settings\j\Application Data\NMM-MetaData.db
2007-09-30 15:25:57 0 d-------- C:\Program Files\Microsoft Works
2007-09-25 20:13:23 0 d-------- C:\Documents and Settings\j\Application Data\Macromedia
2007-09-25 16:52:25 41 --a------ C:\WINDOWS\WFXDEL.BAT
2007-09-25 14:08:53 0 d-------- C:\Documents and Settings\j\Application Data\Ahead
2007-09-25 13:23:20 0 d-------- C:\Program Files\DivX
2007-09-25 13:22:06 0 d-------- C:\Documents and Settings\j\Application Data\DivX
2007-09-24 21:17:30 0 d-------- C:\Program Files\ACDSee32
2007-09-24 21:04:01 0 d-------- C:\Program Files\TheWeatherNetwork
2007-09-24 21:02:16 0 d-------- C:\Program Files\Google
2007-09-24 20:42:13 0 d-------- C:\Program Files\Messenger
2007-09-24 20:38:59 0 d-------- C:\Program Files\Mp3 to WMA
2007-09-24 20:32:07 0 d-------- C:\Program Files\hp deskjet 930c series
2007-09-24 20:29:06 0 d-------- C:\Program Files\Hewlett-Packard
2007-09-24 19:53:13 0 d-------- C:\Documents and Settings\j\Application Data\Adobe
2007-09-24 19:52:17 0 d-------- C:\Program Files\Common Files\Adobe
2007-09-24 19:49:34 0 d-------- C:\Documents and Settings\j\Application Data\Google
2007-09-24 19:33:43 0 d-------- C:\Program Files\Java
2007-09-24 19:33:23 0 d-------- C:\Program Files\Common Files\Java
2007-09-24 19:33:08 0 d-------- C:\Documents and Settings\j\Application Data\Sun
2007-09-24 19:07:38 0 d-------- C:\Documents and Settings\j\Application Data\Thunderbird
2007-09-24 17:33:12 0 d-------- C:\Documents and Settings\j\Application Data\Mozilla
2007-09-24 17:33:09 335 --a------ C:\WINDOWS\nsreg.dat
2007-09-24 17:32:18 0 d-------- C:\Program Files\mozilla.org
2007-09-24 15:12:31 0 d-------- C:\Documents and Settings\j\Application Data\Symantec
2007-09-24 14:02:37 0 d-------- C:\Program Files\Common Files\Ahead
2007-09-24 14:01:14 0 d-------- C:\Program Files\Nero
2007-09-24 13:54:47 0 d-------- C:\Program Files\Common Files\L&H
2007-09-24 13:54:32 0 d-------- C:\Program Files\Microsoft.NET
2007-09-24 13:54:21 0 d-------- C:\Program Files\Microsoft ActiveSync
2007-09-24 13:39:49 0 d-------- C:\Program Files\Analog Devices
2007-09-24 13:36:32 0 d-------- C:\Documents and Settings\j\Application Data\Help
2007-09-24 13:32:57 502272 --a------ C:\WINDOWS\system32\winlogon.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2007-09-24 13:28:10 0 d-------- C:\Documents and Settings\j\Application Data\Identities
2007-09-24 13:19:34 0 -rahs---- C:\MSDOS.SYS
2007-09-24 13:19:34 0 -rahs---- C:\IO.SYS
2007-09-24 13:19:34 0 --a------ C:\CONFIG.SYS
2007-09-24 13:19:34 0 --a------ C:\AUTOEXEC.BAT
2007-09-24 13:18:12 0 d--h----- C:\Program Files\WindowsUpdate
2007-09-24 13:17:21 0 d-------- C:\Program Files\Common Files\MSSoap
2007-09-24 13:17:12 0 d-------- C:\Program Files\Movie Maker
2007-09-24 13:16:44 21640 --a------ C:\WINDOWS\system32\emptyregdb.dat
2007-09-24 13:15:53 0 d-------- C:\Program Files\Online Services
2007-09-24 13:15:45 0 d-------- C:\Program Files\MSN Gaming Zone
2007-09-24 13:15:38 0 d-------- C:\Program Files\Windows NT
2007-09-24 09:10:28 1536 --a------ C:\WINDOWS\system32\TrueSoft.dat
2007-09-24 09:08:54 0 d-------- C:\Program Files\Common Files\ODBC
2007-09-24 09:08:50 0 d-------- C:\Program Files\Common Files\SpeechEngines
2007-09-24 09:08:18 62 --ahs---- C:\Documents and Settings\j\Application Data\desktop.ini
2007-09-17 14:23:00 823296 --a------ C:\WINDOWS\system32\divx_xx0c.dll <Not Verified; DivX, Inc.; DivX®>
2007-09-17 14:23:00 823296 --a------ C:\WINDOWS\system32\divx_xx07.dll <Not Verified; DivX, Inc.; DivX®>
2007-09-17 14:22:58 802816 --a------ C:\WINDOWS\system32\divx_xx11.dll <Not Verified; DivX, Inc.; DivX?>
2007-09-17 14:22:58 739840 --a------ C:\WINDOWS\system32\DivX.dll <Not Verified; DivX, Inc.; DivX®>
2007-08-20 20:26:52 196608 --a------ C:\WINDOWS\system32\dtu100.dll <Not Verified; DivX, Inc.; DivX, Inc. dtu100>
2007-08-20 20:26:52 81920 --a------ C:\WINDOWS\system32\dpl100.dll <Not Verified; DivX, Inc.; DivX, Inc. dpl100>
2007-08-15 18:33:14 3596288 --a------ C:\WINDOWS\system32\qt-dx331.dll
2007-08-15 18:30:26 12288 --a------ C:\WINDOWS\system32\DivXWMPExtType.dll


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PopUpKiller "= "C:\Program Files\PopUp Killer\popupkiller.EXE" [03/23/2002 02:09 PM]
"AVG7_CC "= "C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [10/25/2007 01:07 AM]
"!AVG Anti-Spyware "= "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [06/11/2007 05:25 AM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 08:00 AM]
"Mozilla Quick Launch "= "C:\PROGRA~1\MOZILLA.ORG\SEAMON~1\SEAMON~1.exe" [10/09/2007 08:12 AM]
"SeaMonkey Quick Launch "= "C:\Program Files\mozilla.org\SeaMonkey\SeaMonkey.exe" [10/09/2007 08:12 AM]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Nokia.PCSync "=C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr "=0 (0x0)
"DisableRegistryTools "=0 (0x0)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr "=0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice "

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice "

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Controller.LNK]
backup=C:\WINDOWS\pss\Controller.LNKCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]
backup=C:\WINDOWS\pss\Google Updater.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
"C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe "

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
"C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe "

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\g4356cbvy63]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\High Definition Audio Property Page Shortcut]
HDAShCut.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Host Process]
C:\WINDOWS\Fonts\svchost.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
C:\Program Files\Nero\Nero 7\InCD\InCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
%systemroot%\system32\dumprep 0 -k

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Mozilla Quick Launch]
"C:\PROGRA~1\MOZILLA.ORG\SEAMON~1\SEAMON~1.EXE" -turbo

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nokia.PCSync]
C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe /NoDialog

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SecurDisc]
C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAX]
"C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]
C:\Program Files\Analog Devices\Core\smax4pnp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
"C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe "

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
"C:\Program Files\Steam\Steam.exe" -silent

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe "

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\sys101275350440]
C:\WINDOWS\sys101275350440.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TMT]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WFXSwtch]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinFaxAppPortStarter]
wfxsnt40.exe

*Newly Created Service* - AVGASCLN



-- End of Deckard's System Scanner: finished at 2007-10-25 22:22:54 ------------

 

I sure expected AVG-AS to find more than that. Are you sure that log is complete?

Yes, all of those files can be removed from the Fonts folder. The only files that should be there are .ttf and .fon files. You can delete all of those other files quickly and easily from the command line if you know the extension. For example;

Click Start>Run and type (or copy and paste) del /q C:\Windows\Fonts\*.mpg then hit enter to delete all .mpg files. del /q C:\Windows\Fonts\*.wmv will delete all .wmv files.

Download ComboFix by sUBs from here or here, saving the file to your desktop.

• Close all open programs and windows
• Double click combofix.exe and follow the prompts.
• When finished, it will open a log for you. Post that log and a new HijackThis log in your next reply.

Note: Do not mouseclick combofix's window while its running. That may cause it to stall

 

Hi and thank you noahdfear:I had someone over cause this stuff was a bit over my head. I had the hd formatted. No biggie cause I had very little on this computer. Thanks for your help. I learned alot

 

You're most welcome. Be sure to read through this topic by Geri that contains good information regarding future protection for your computer.