1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Solved Is my system realy unsecure?

Discussion in 'Malware and Virus Removal Archive' started by Naj, 2008/04/08.

  1. 2008/04/08
    Naj

    Naj Inactive Thread Starter

    Joined:
    2008/04/08
    Messages:
    45
    Likes Received:
    0
    [Resolved] Is my system realy unsecure?

    hi
    After reinstalling windows last week my system was without any antivirus for like 23 or 24 hrs ...after installing antivirus ,pop ups and viruses were attacking like crazy ,even dough i hav antivirus and anti spyware installed pluse 2 pop up blockers but i still getting those Pop-ups telling me my system has error and unsecure....after putting those sites in restrected list still comming...and now the system is slowing down too...

    here is log file of hijackthis...:Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 11:55:27 AM, on 4/8/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16608)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\WINDOWS\System32\igfxtray.exe
    C:\WINDOWS\System32\hkcmd.exe
    C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\WINDOWS\CameraFixer.exe
    C:\WINDOWS\vsnp325.exe
    C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
    C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe
    C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
    C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
    C:\WINDOWS\explorer.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\Documents and Settings\N A J O\Local Settings\Temporary Internet Files\Content.IE5\5WU60AHL\dss[1].exe
    C:\PROGRA~1\TRENDM~1\HIJACK~1\N A J O.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ca.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://ca.search.yahoo.com
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.ca/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ca.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://ca.search.yahoo.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ca.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://ca.search.yahoo.com
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://ca.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://ca.search.yahoo.com
    R3 - URLSearchHook: Yahoo! ¤u¨Ã£¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: (no name) - {826A5ED9-1316-4EFD-87F8-AA400C5D551A} - C:\WINDOWS\system32\cbXQjKaB.dll (file missing)
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: (no name) - {B1B9CF94-76BF-40B5-9DC4-580EF5B8C620} - C:\WINDOWS\system32\byXQIXnm.dll (file missing)
    O2 - BHO: Me.dium IE Add-on - {D5E5C1E6-78DB-49F0-A137-8D594F342FD6} - "C:\Program Files\Me.dium\Me.dium IE Add-on\MediumIEAddOn.dll" (file missing)
    O3 - Toolbar: Yahoo! ¤u¨Ã£¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe "
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
    O4 - HKLM\..\Run: [CameraFixer] C:\WINDOWS\CameraFixer.exe
    O4 - HKLM\..\Run: [tsnpstd3] C:\WINDOWS\tsnpstd3.exe
    O4 - HKLM\..\Run: [snp325] C:\WINDOWS\vsnp325.exe
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe "
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
    O4 - HKCU\..\Run: [Shim soft] C:\DOCUME~1\NAJO~1\APPLIC~1\EACHLO~1\Bind iso admin.exe
    O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
    O4 - Global Startup: Bluetooth.lnk = ?
    O4 - Global Startup: ZDWLan Utility.lnk = C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe
    O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: Me.dium - {47F8FF58-8C1E-4584-92CD-CE8B1FE1AF44} - "C:\Program Files\Me.dium\Me.dium IE Add-on\MediumIEAddOn.dll" (file missing)
    O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O15 - Trusted Zone: http://www.atribune.org
    O15 - Trusted Zone: http://deckard.geekstogo.com
    O15 - Trusted Zone: http://www.java.com
    O15 - Trusted Zone: http://by108w.bay108.mail.live.com
    O15 - Trusted Zone: http://www.trendsecure.com
    O15 - Trusted Zone: http://www.windowsbbs.com
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1207359593092
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1207360033748
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://sdlc-esd.sun.com/ESD39/JSCDL...-jc.cab&File=jinstall-6u5-windows-i586-jc.cab
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (file missing)
    O20 - Winlogon Notify: cbXQjKaB - cbXQjKaB.dll (file missing)
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe

    --
    End of file - 9118 bytes
     
    Naj,
    #1
  2. 2008/04/08
    Naj

    Naj Inactive Thread Starter

    Joined:
    2008/04/08
    Messages:
    45
    Likes Received:
    0
    Is my system realy unsecure?

    Deckard's System Scanner v20071014.68
    Run by N A J O on 2008-04-08 11:53:38
    Computer is in Normal Mode.
    --------------------------------------------------------------------------------

    -- System Restore --------------------------------------------------------------

    Successfully created a Deckard's System Scanner Restore Point.


    -- Last 5 Restore Point(s) --
    51: 2008-04-08 15:53:52 UTC - RP51 - Deckard's System Scanner Restore Point
    50: 2008-04-08 06:25:29 UTC - RP50 - Installed Java(TM) 6 Update 5
    49: 2008-04-08 06:22:28 UTC - RP49 - Software Distribution Service 3.0
    48: 2008-04-07 23:49:07 UTC - RP48 - Software Distribution Service 3.0
    47: 2008-04-07 20:35:45 UTC - RP47 - Software Distribution Service 3.0


    -- First Restore Point --
    1: 2008-04-05 20:06:07 UTC - RP1 - System Checkpoint


    Backed up registry hives.
    Performed disk cleanup.



    -- HijackThis (run as N A J O.exe) -------------------------------------------

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 11:55:27 AM, on 4/8/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16608)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\WINDOWS\System32\igfxtray.exe
    C:\WINDOWS\System32\hkcmd.exe
    C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\WINDOWS\CameraFixer.exe
    C:\WINDOWS\vsnp325.exe
    C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
    C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe
    C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
    C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
    C:\WINDOWS\explorer.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\Documents and Settings\N A J O\Local Settings\Temporary Internet Files\Content.IE5\5WU60AHL\dss[1].exe
    C:\PROGRA~1\TRENDM~1\HIJACK~1\N A J O.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ca.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://ca.search.yahoo.com
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.ca/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ca.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://ca.search.yahoo.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ca.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://ca.search.yahoo.com
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://ca.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://ca.search.yahoo.com
    R3 - URLSearchHook: Yahoo! ¤u¨Ã£¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: (no name) - {826A5ED9-1316-4EFD-87F8-AA400C5D551A} - C:\WINDOWS\system32\cbXQjKaB.dll (file missing)
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: (no name) - {B1B9CF94-76BF-40B5-9DC4-580EF5B8C620} - C:\WINDOWS\system32\byXQIXnm.dll (file missing)
    O2 - BHO: Me.dium IE Add-on - {D5E5C1E6-78DB-49F0-A137-8D594F342FD6} - "C:\Program Files\Me.dium\Me.dium IE Add-on\MediumIEAddOn.dll" (file missing)
    O3 - Toolbar: Yahoo! ¤u¨Ã£¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe "
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
    O4 - HKLM\..\Run: [CameraFixer] C:\WINDOWS\CameraFixer.exe
    O4 - HKLM\..\Run: [tsnpstd3] C:\WINDOWS\tsnpstd3.exe
    O4 - HKLM\..\Run: [snp325] C:\WINDOWS\vsnp325.exe
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe "
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
    O4 - HKCU\..\Run: [Shim soft] C:\DOCUME~1\NAJO~1\APPLIC~1\EACHLO~1\Bind iso admin.exe
    O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
    O4 - Global Startup: Bluetooth.lnk = ?
    O4 - Global Startup: ZDWLan Utility.lnk = C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe
    O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: Me.dium - {47F8FF58-8C1E-4584-92CD-CE8B1FE1AF44} - "C:\Program Files\Me.dium\Me.dium IE Add-on\MediumIEAddOn.dll" (file missing)
    O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O15 - Trusted Zone: http://www.atribune.org
    O15 - Trusted Zone: http://deckard.geekstogo.com
    O15 - Trusted Zone: http://www.java.com
    O15 - Trusted Zone: http://by108w.bay108.mail.live.com
    O15 - Trusted Zone: http://www.trendsecure.com
    O15 - Trusted Zone: http://www.windowsbbs.com
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1207359593092
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1207360033748
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://sdlc-esd.sun.com/ESD39/JSCDL...-jc.cab&File=jinstall-6u5-windows-i586-jc.cab
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (file missing)
    O20 - Winlogon Notify: cbXQjKaB - cbXQjKaB.dll (file missing)
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe

    --
    End of file - 9118 bytes
     
    Naj,
    #2


  3. to hide this advert.

  4. 2008/04/08
    Naj

    Naj Inactive Thread Starter

    Joined:
    2008/04/08
    Messages:
    45
    Likes Received:
    0
    Is my system realy unsecure?

    -- File Associations -----------------------------------------------------------

    All associations okay.


    -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

    R0 IdeBusDr - c:\windows\system32\drivers\idebusdr.sys <Not Verified; Intel Corporation; Intel Application Accelerator Driver>
    R0 IdeChnDr (Intel(R) Ultra ATA Controller) - c:\windows\system32\drivers\idechndr.sys <Not Verified; Intel Corporation; Intel Application Accelerator Driver>
    R3 btwhid - c:\windows\system32\drivers\btwhid.sys <Not Verified; Broadcom Corporation.; Bluetooth Software 5.0.1.801>
    R3 btwmodem (Bluetooth Modem) - c:\windows\system32\drivers\btwmodem.sys <Not Verified; Broadcom Corporation.; Bluetooth Software 5.0.1.801>
    R3 ialm - c:\windows\system32\drivers\ialmnt5.sys <Not Verified; Intel Corporation; Intel Graphics Accelerator Drivers for Windows NT(R)>
    R3 ZDPSp50 (ZDPSp50 NDIS Protocol Driver) - c:\windows\system32\drivers\zdpsp50.sys <Not Verified; Printing Communications Assoc., Inc. (PCAUSA); PCAUSA Rawether for Windows>

    S3 SNP325 (USB PC Camera (SNPSTD325)) - c:\windows\system32\drivers\snp325.sys <Not Verified; Sonix Co. Ltd.; USB PC Camera>
    S3 ZD1211BU(ZyDAS) (ZyDAS ZD1211B IEEE 802.11 b+g Wireless LAN Driver (USB)(ZyDAS)) - c:\windows\system32\drivers\zd1211bu.sys <Not Verified; ZyDAS Technology Corporation; ZD1211B 802.11 b+g USB LAN Adapter>


    -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

    All services whitelisted.


    -- Device Manager: Disabled ----------------------------------------------------

    Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
    Description: Intel(R) PRO/100 VE Network Connection
    Device ID: PCI\VEN_8086&DEV_1039&SUBSYS_30488086&REV_81\4&2AF9ED5&0&40F0
    Manufacturer: Intel
    Name: Intel(R) PRO/100 VE Network Connection
    PNP Device ID: PCI\VEN_8086&DEV_1039&SUBSYS_30488086&REV_81\4&2AF9ED5&0&40F0
    Service: E100B

    Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
    Description: Bluetooth LAN Access Server Driver
    Device ID: {95C7A0A0-3094-11D7-A202-00508B9D7D5A}\BTWDNDIS\1&30EE4AD&0&1000000020000
    Manufacturer: WIDCOMM, Inc.
    Name: Bluetooth LAN Access Server Driver
    PNP Device ID: {95C7A0A0-3094-11D7-A202-00508B9D7D5A}\BTWDNDIS\1&30EE4AD&0&1000000020000
    Service: BTWDNDIS


    -- Scheduled Tasks -------------------------------------------------------------

    2008-04-08 11:14:58 330 --ah----- C:\WINDOWS\Tasks\MP Scheduled Scan.job
    2008-04-08 06:00:00 274 --ah----- C:\WINDOWS\Tasks\A908293E9107A086.job
    2008-04-08 02:36:38 430 --ah----- C:\WINDOWS\Tasks\User_Feed_Synchronization-{54DB8B2F-312A-4218-961B-499CAD9E55B2}.job


    -- Files created between 2008-03-08 and 2008-04-08 -----------------------------

    2008-04-08 11:51:04 0 d-------- C:\Program Files\Trend Micro
    2008-04-08 06:19:53 0 dr-h----- C:\Documents and Settings\N A J O\Recent
    2008-04-08 02:31:00 0 d-------- C:\WINDOWS\Sun
    2008-04-08 02:31:00 0 d-------- C:\Documents and Settings\N A J O\Application Data\Sun
    2008-04-08 02:30:04 0 d-------- C:\Program Files\Java
    2008-04-08 02:25:35 0 d-------- C:\Program Files\Common Files\Java
    2008-04-07 19:50:28 0 d-------- C:\Program Files\MSXML 6.0
    2008-04-07 16:57:25 0 d-------- C:\Program Files\Microsoft Silverlight
    2008-04-07 16:55:58 0 d-------- C:\Program Files\MSBuild
    2008-04-07 16:48:38 0 d-------- C:\WINDOWS\system32\XPSViewer
    2008-04-07 16:47:55 0 d-------- C:\Program Files\Reference Assemblies
    2008-04-07 16:46:36 0 d-------- C:\5f401a6308c064421ba5d2d7fb50823f
    2008-04-07 16:45:16 0 d-------- C:\Program Files\Windows Media Connect 2
    2008-04-07 16:43:07 0 d-------- C:\WINDOWS\system32\LogFiles
    2008-04-07 16:43:07 0 d-------- C:\WINDOWS\system32\drivers\UMDF
    2008-04-07 16:03:14 0 d-------- C:\WINDOWS\system32\URTTemp
    2008-04-07 14:51:52 0 d-------- C:\Program Files\Common Files\Scanner
    2008-04-07 14:51:47 0 d-------- C:\Program Files\CA Yahoo! Anti-Spy
    2008-04-07 14:48:12 0 d-------- C:\Documents and Settings\N A J O\Application Data\Yahoo!
    2008-04-07 14:48:12 0 d-------- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
    2008-04-07 14:36:54 0 d-------- C:\WINDOWS\SxsCaPendDel
    2008-04-07 14:28:09 0 d-------- C:\Program Files\Me.dium
    2008-04-06 10:56:46 0 d-------- C:\Documents and Settings\N A J O\Application Data\Grisoft
    2008-04-06 10:48:13 0 d-------- C:\Program Files\Windows Defender
    2008-04-06 02:36:33 0 dr-h----- C:\$VAULT$.AVG
    2008-04-06 00:40:55 0 d-------- C:\Documents and Settings\N A J O\Application Data\AVG7
    2008-04-06 00:40:32 0 d-------- C:\Documents and Settings\LocalService\Application Data\AVG7
    2008-04-06 00:40:16 0 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
    2008-04-06 00:40:16 0 d-------- C:\Documents and Settings\All Users\Application Data\avg7
    2008-04-05 21:00:17 24576 --a------ C:\WINDOWS\system32\ZyDelReg.exe <Not Verified; ; ZyDelReg Application>
    2008-04-05 21:00:17 17151 --a------ C:\WINDOWS\system32\ZDPNDIS5.SYS <Not Verified; Printing Communications Assoc., Inc. (PCAUSA); PCAUSA Rawether for Windows>
    2008-04-05 21:00:17 81920 --a------ C:\WINDOWS\system32\ZDPN50.DLL <Not Verified; Printing Communications Assoc., Inc. (PCAUSA); PCAUSA Rawether for Windows>
    2008-04-05 21:00:17 31744 --a------ C:\WINDOWS\system32\drivers\ZDPSp50a64.sys <Not Verified; Printing Communications Assoc., Inc. (PCAUSA); PCAUSA Rawether for Windows>
    2008-04-05 21:00:17 17664 --a------ C:\WINDOWS\system32\drivers\ZDPSp50.sys <Not Verified; Printing Communications Assoc., Inc. (PCAUSA); PCAUSA Rawether for Windows>
    2008-04-05 21:00:17 330240 --a------ C:\WINDOWS\system32\drivers\ZD1211BU.sys <Not Verified; ZyDAS Technology Corporation; ZD1211B 802.11 b+g USB LAN Adapter>
    2008-04-05 21:00:17 29184 --a------ C:\WINDOWS\system32\drivers\BRGSp50a64.sys <Not Verified; Printing Communications Assoc., Inc. (PCAUSA); PCAUSA Rawether for Windows>
    2008-04-05 21:00:17 20608 --a------ C:\WINDOWS\system32\drivers\BRGSp50.sys <Not Verified; Printing Communications Assoc., Inc. (PCAUSA); PCAUSA Rawether for Windows>
    2008-04-05 21:00:16 15872 --a------ C:\WINDOWS\system32\InsDrvZD64.DLL <Not Verified; ; InsDrvZD Dynamic Link Library>
    2008-04-05 21:00:16 28672 --a------ C:\WINDOWS\system32\InsDrvZD.dll <Not Verified; ; InsDrvZD Dynamic Link Library>
    2008-04-05 21:00:16 0 d-------- C:\Program Files\ZyDAS Technology Corporation
    2008-04-05 20:29:09 0 d-------- C:\Documents and Settings\All Users\Application Data\Messenger Plus!
    2008-04-05 17:21:08 0 d-------- C:\Documents and Settings\All Users\Application Data\INTERNET SPAM SUPPORT AUDIO
    2008-04-05 17:18:17 0 d-------- C:\Documents and Settings\N A J O\Application Data\Each long sect
    2008-04-05 17:16:57 0 d-------- C:\Program Files\Messenger Plus! Live
    2008-04-05 16:16:13 0 d-------- C:\Program Files\JetAudio
    2008-04-05 16:16:13 0 d-------- C:\Program Files\Common Files\COWON
    2008-04-05 16:05:57 283806 --ahs---- C:\WINDOWS\system32\mnXIQXyb.ini2
    2008-04-05 14:51:06 113596 --a------ C:\WINDOWS\system32\awtsQJYs.dll
    2008-04-05 14:50:07 0 d-------- C:\Documents and Settings\All Users\Application Data\avg8
    2008-04-05 14:39:13 57344 --a------ C:\WINDOWS\system32\vsnpx32.dll
    2008-04-05 14:38:46 94208 --a------ C:\WINDOWS\amcap.exe <Not Verified; Microsoft Corporation; DirectX 8.1 Sample>
    2008-04-05 14:38:45 20480 --a------ C:\WINDOWS\CameraFixer.exe <Not Verified; ; CameraFixer Application>
    2008-04-05 14:38:42 827392 --a------ C:\WINDOWS\vsnp325.exe <Not Verified; ; CameraMonitor Application>
    2008-04-05 14:38:41 270336 --a------ C:\WINDOWS\tsnp325.exe <Not Verified; ; tsnp2std>
    2008-04-05 14:38:40 10218624 --a------ C:\WINDOWS\system32\drivers\snp325.sys <Not Verified; Sonix Co. Ltd.; USB PC Camera>
    2008-04-05 14:38:37 57344 --a------ C:\WINDOWS\system32\vsnp325.dll
    2008-04-05 14:38:37 147456 --a------ C:\WINDOWS\system32\rsnp325.dll <Not Verified; ; ResourceDLL>
    2008-04-05 14:38:37 53248 --a------ C:\WINDOWS\system32\csnp325.dll <Not Verified; ; InstallUtil>
    2008-04-05 14:38:37 0 d-------- C:\Program Files\Common Files\snp325
    2008-04-05 14:29:07 0 d-------- C:\Documents and Settings\N A J O\Bluetooth Software
    2008-04-05 14:25:40 0 d-------- C:\Program Files\WIDCOMM
    2008-04-05 14:14:43 0 d-------- C:\Program Files\MyPhoneExplorer
    2008-04-05 14:04:02 0 d-------- C:\Documents and Settings\N A J O\Application Data\Real
    2008-04-05 14:01:28 10022 --ahs---- C:\WINDOWS\system32\KGyGaAvL.sys
    2008-04-05 14:01:28 56 -r-hs---- C:\WINDOWS\system32\AB8F8F2446.sys
    2008-04-05 13:38:19 0 d-------- C:\Documents and Settings\All Users\Application Data\Yahoo!
    2008-04-05 13:13:39 0 d-------- C:\Program Files\Yahoo!
    2008-04-05 12:33:38 0 d-------- C:\Documents and Settings\All Users\Application Data\CyberLink
    2008-04-05 12:32:14 0 d-------- C:\Documents and Settings\N A J O\Application Data\CyberLink
    2008-04-05 12:27:20 0 d-------- C:\WINDOWS\Profiles
    2008-04-05 12:27:19 0 d-------- C:\WINDOWS\system32\Adobe
    2008-04-05 12:27:19 0 d-------- C:\Program Files\Common Files\Adobe
    2008-04-05 12:27:19 0 d-------- C:\Documents and Settings\N A J O\Application Data\InterTrust
    2008-04-05 12:27:19 0 d-------- C:\Documents and Settings\N A J O\Application Data\Adobe
    2008-04-05 12:14:55 306688 --a------ C:\WINDOWS\IsUninst.exe <Not Verified; InstallShield Software Corporation; InstallShield® unInstaller>
    2008-04-05 12:13:24 364544 --a------ C:\WINDOWS\system32\TwnLib4.dll <Not Verified; Pegasus Imaging Corp.; TwnLib4>
    2008-04-05 12:13:24 106496 --a------ C:\WINDOWS\system32\TwnLib20.dll <Not Verified; Pegasus Software; TWNLIB20>
    2008-04-05 12:13:21 471040 --a------ C:\WINDOWS\system32\ImagXRA7.dll <Not Verified; Pegasus Imaging Corp.; ImagXpress7>
    2008-04-05 12:13:21 262144 --a------ C:\WINDOWS\system32\ImagXR7.dll <Not Verified; Pegasus Imaging Corp.; ImagXpress7>
    2008-04-05 12:13:20 1568768 --a------ C:\WINDOWS\system32\ImagX7.dll <Not Verified; Pegasus Imaging Corp.; ImagXpress7>
    2008-04-05 12:13:19 155648 --a------ C:\WINDOWS\system32\NeroCheck.exe <Not Verified; Ahead Software Gmbh; Ahead Software Gmbh NeroCheck>
    2008-04-05 12:13:16 0 d-------- C:\Program Files\Common Files\Ahead
    2008-04-05 12:13:14 0 d-------- C:\Program Files\Ahead
    2008-04-05 12:11:13 0 d-------- C:\Program Files\CyberLink
    2008-04-05 12:10:39 0 d-------- C:\MyWorks
    2008-04-05 12:10:30 40960 --a------ C:\Program Files\Uninstall_CDS.exe
    2008-04-05 12:10:13 0 d-------- C:\Program Files\CyberLink DVD Solution
    2008-04-05 12:08:47 102912 --a------ C:\WINDOWS\system32\Vb6stkit.dll <Not Verified; Microsoft Corporation; Microsoft(R) Visual Basic for Windows>
    2008-04-05 12:08:47 102160 --a------ C:\WINDOWS\system32\VB6KO.DLL <Not Verified; Microsoft Corporation; Visual Basic Environment>
    2008-04-05 11:41:52 40960 --a------ C:\WINDOWS\system32\IsUser11b.dll
    2008-04-05 02:28:09 0 d-------- C:\Documents and Settings\N A J O\Contacts
    2008-04-05 02:27:39 0 d------c- C:\WINDOWS\system32\DRVSTORE
    2008-04-05 02:18:10 0 d-------- C:\WINDOWS\network diagnostic
    2008-04-05 00:25:55 0 d--hs--c- C:\Program Files\Common Files\WindowsLiveInstaller
    2008-04-05 00:25:52 0 d-------- C:\Program Files\Windows Live
    2008-04-05 00:25:41 0 d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
    2008-04-05 00:17:29 0 d-------- C:\Documents and Settings\N A J O\Application Data\COWON
    2008-04-05 00:06:55 0 d-------- C:\Documents and Settings\N A J O\Application Data\PoivY
    2008-04-05 00:05:07 0 d-------- C:\Program Files\PoivY.com
    2008-04-04 23:55:32 0 dr------- C:\Naj`s
    2008-04-04 23:54:57 0 d-------- C:\Documents and Settings\N A J O\Application Data\vlc
    2008-04-04 23:54:44 0 d-------- C:\Program Files\VideoLAN
    2008-04-04 23:54:03 0 d-------- C:\Program Files\WinAVI Video Converter
    2008-04-04 23:53:45 3082 --a------ C:\WINDOWS\system32\affv9869p2now.sys
    2008-04-04 23:43:52 0 d-------- C:\Documents and Settings\N A J O\Application Data\Macromedia
    2008-04-04 23:40:28 0 d--hs---- C:\Documents and Settings\N A J O\UserData
    2008-04-04 23:32:10 0 d-------- C:\Documents and Settings\N A J O\Application Data\Identities
    2008-04-04 23:32:02 0 d--h----- C:\Documents and Settings\N A J O\Templates
    2008-04-04 23:32:02 0 dr------- C:\Documents and Settings\N A J O\Start Menu
    2008-04-04 23:32:02 0 dr-h----- C:\Documents and Settings\N A J O\SendTo
    2008-04-04 23:32:02 0 d--h----- C:\Documents and Settings\N A J O\PrintHood
    2008-04-04 23:32:02 2097152 --ah----- C:\Documents and Settings\N A J O\NTUSER.DAT
    2008-04-04 23:32:02 0 d--h----- C:\Documents and Settings\N A J O\NetHood
    2008-04-04 23:32:02 0 dr------- C:\Documents and Settings\N A J O\My Documents
    2008-04-04 23:32:02 0 d--h----- C:\Documents and Settings\N A J O\Local Settings
    2008-04-04 23:32:02 0 dr------- C:\Documents and Settings\N A J O\Favorites
    2008-04-04 23:32:02 0 d-------- C:\Documents and Settings\N A J O\Desktop
    2008-04-04 23:32:02 0 d--hs---- C:\Documents and Settings\N A J O\Cookies
    2008-04-04 23:32:02 0 dr-h----- C:\Documents and Settings\N A J O\Application Data
    2008-04-04 23:28:38 139536 --a------ C:\WINDOWS\system32\javaee.dll <Not Verified; Microsoft Corporation; Microsoft(R) Windows (R) Operating System>
    2008-04-04 23:28:38 46352 --a------ C:\WINDOWS\setdebug.exe <Not Verified; Microsoft Corporation; Microsoft(R) Windows (R) Operating System>
    2008-04-04 23:28:38 6550 --a------ C:\WINDOWS\jautoexp.dat
    2008-04-04 23:28:34 113 --a------ C:\WINDOWS\system32\zonedon.reg
    2008-04-04 23:28:34 113 --a------ C:\WINDOWS\system32\zonedoff.reg
    2008-04-04 23:24:44 0 d-------- C:\Documents and Settings\LocalService\Start Menu
    2008-04-04 23:24:11 0 d-------- C:\WINDOWS\Prefetch
    2008-04-04 23:19:48 0 d-------- C:\WINDOWS\provisioning
    2008-04-04 23:19:48 0 d-------- C:\WINDOWS\peernet
    2008-04-04 23:17:43 0 d-------- C:\WINDOWS\ServicePackFiles
    2008-04-04 23:13:09 0 d-------- C:\WINDOWS\EHome
    2008-04-04 22:34:21 0 d-------- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
    2008-04-04 22:26:23 0 d-------- C:\Documents and Settings\All Users\Application Data\MSN6
    2008-04-04 22:08:34 0 d-------- C:\WINDOWS\RegisteredPackages
    2008-04-04 22:00:05 0 d-------- C:\Intel
    2008-04-04 21:54:46 163840 --a------ C:\WINDOWS\system32\igfxres.dll <Not Verified; Intel Corporation; Intel(R) Common User Interface>
    2008-04-04 21:54:31 0 d-------- C:\WINDOWS\system32\PreInstall
    2008-04-04 21:54:29 0 d--h----- C:\WINDOWS\$hf_mig$
    2008-04-04 21:54:04 0 d-------- C:\WINDOWS\system32\bits
    2008-04-04 21:49:21 0 d---s---- C:\WINDOWS\system32\Microsoft
    2008-04-04 21:49:10 0 d-------- C:\WINDOWS\system32\ReinstallBackups
    2008-04-04 21:49:08 44875 --a------ C:\WINDOWS\system32\IPrtCnst.dll <Not Verified; Intel Corporation; Intel Application Accelerator Coinstaller>
    2008-04-04 21:49:08 101431 --a------ C:\WINDOWS\system32\drivers\IdeChnDr.sys <Not Verified; Intel Corporation; Intel Application Accelerator Driver>
    2008-04-04 21:49:08 13891 --a------ C:\WINDOWS\system32\drivers\IdeBusDr.sys <Not Verified; Intel Corporation; Intel Application Accelerator Driver>
    2008-04-04 21:49:08 0 d-------- C:\Program Files\Intel
    2008-04-04 21:49:08 0 d--h----- C:\Program Files\InstallShield Installation Information
    2008-04-04 21:49:02 0 d-------- C:\Program Files\Common Files\InstallShield
    2008-04-04 21:43:51 0 d--hs---- C:\WINDOWS\Installer
    2008-04-04 21:43:33 0 d--hs---- C:\System Volume Information
    2008-04-04 21:43:29 229376 --ah----- C:\Documents and Settings\NetworkService\NTUSER.DAT
    2008-04-04 21:43:29 0 d--h----- C:\Documents and Settings\NetworkService\Local Settings
    2008-04-04 21:43:29 0 d---s---- C:\Documents and Settings\NetworkService\Cookies
    2008-04-04 21:43:29 0 d-------- C:\Documents and Settings\NetworkService\Application Data
    2008-04-04 21:43:29 0 d---s---- C:\Documents and Settings\NetworkService\Application Data\Microsoft
    2008-04-04 21:43:29 229376 --ah----- C:\Documents and Settings\LocalService\NTUSER.DAT
    2008-04-04 21:43:29 0 d--h----- C:\Documents and Settings\LocalService\Local Settings
    2008-04-04 21:43:29 0 d--hs---- C:\Documents and Settings\LocalService\Cookies
    2008-04-04 21:43:29 0 d-------- C:\Documents and Settings\LocalService\Application Data
    2008-04-04 21:43:29 0 d---s---- C:\Documents and Settings\LocalService\Application Data\Microsoft
    2008-04-04 21:40:02 0 d-------- C:\WINDOWS\SoftwareDistribution
    2008-04-04 21:29:24 0 d-------- C:\WINDOWS\system32\xircom
    2008-04-04 21:29:24 0 d-------- C:\Program Files\microsoft frontpage
    2008-04-04 21:29:22 229376 ---h----- C:\Documents and Settings\Default User\NTUSER.DAT
    2008-04-04 21:29:16 0 -rahs---- C:\MSDOS.SYS
    2008-04-04 21:29:16 0 -rahs---- C:\IO.SYS
    2008-04-04 21:29:16 0 --a------ C:\CONFIG.SYS
    2008-04-04 21:29:16 0 --a------ C:\AUTOEXEC.BAT
    2008-04-04 21:28:22 0 d--hs---- C:\Documents and Settings\All Users\DRM
    2008-04-04 21:28:12 0 dr------- C:\WINDOWS\Offline Web Pages
    2008-04-04 21:28:12 0 d---s---- C:\WINDOWS\Downloaded Program Files
    2008-04-04 21:27:45 0 d-------- C:\WINDOWS\system32\DirectX
    2008-04-04 21:27:08 0 d---s---- C:\WINDOWS\Tasks
    2008-04-04 21:27:06 0 d-------- C:\Program Files\Common Files\MSSoap
    2008-04-04 21:27:02 0 d-------- C:\WINDOWS\srchasst
    2008-04-04 21:27:01 0 d-------- C:\WINDOWS\system32\Macromed
    2008-04-04 21:27:00 0 d-------- C:\Program Files\Movie Maker
    2008-04-04 21:26:56 0 d-------- C:\WINDOWS\system32\Restore
    2008-04-04 21:26:56 0 d-------- C:\WINDOWS\PCHealth
    2008-04-04 21:26:42 21640 --a------ C:\WINDOWS\system32\emptyregdb.dat
    2008-04-04 21:26:28 0 d-------- C:\WINDOWS\Registration
    2008-04-04 21:25:58 0 d--h----- C:\Program Files\WindowsUpdate
    2008-04-04 21:25:58 0 d-------- C:\Program Files\Online Services
    2008-04-04 21:25:53 0 d-------- C:\Program Files\Messenger
    2008-04-04 21:25:48 0 d-------- C:\Program Files\MSN Gaming Zone
    2008-04-04 21:25:17 0 d-------- C:\Program Files\Windows NT
    2008-04-04 21:25:15 0 d-------- C:\WINDOWS\system32\MsDtc
    2008-04-04 21:25:14 0 d-------- C:\WINDOWS\system32\Com
    2008-04-04 16:16:34 0 d-------- C:\Program Files\Common Files\ODBC
    2008-04-04 16:16:31 0 dr------- C:\Program Files
    2008-04-04 16:16:31 0 d-------- C:\Program Files\Common Files
    2008-04-04 16:16:31 0 d-------- C:\Program Files\Common Files\SpeechEngines
    2008-04-04 16:16:11 0 d--h----- C:\Documents and Settings\Default User\Templates
    2008-04-04 16:16:11 0 dr------- C:\Documents and Settings\Default User\Start Menu
    2008-04-04 16:16:11 0 dr-h----- C:\Documents and Settings\Default User\SendTo
    2008-04-04 16:16:11 0 d--h----- C:\Documents and Settings\Default User\Recent
    2008-04-04 16:16:11 0 d--h----- C:\Documents and Settings\Default User\PrintHood
    2008-04-04 16:16:11 0 d--h----- C:\Documents and Settings\Default User\NetHood
    2008-04-04 16:16:11 0 d-------- C:\Documents and Settings\Default User\My Documents
    2008-04-04 16:16:11 0 dr-h----- C:\Documents and Settings\Default User\Local Settings
    2008-04-04 16:16:11 0 d-------- C:\Documents and Settings\Default User\Favorites
    2008-04-04 16:16:11 0 d-------- C:\Documents and Settings\Default User\Desktop
    2008-04-04 16:16:11 0 d---s---- C:\Documents and Settings\Default User\Cookies
    2008-04-04 16:16:11 0 d--h----- C:\Documents and Settings\All Users\Templates
    2008-04-04 16:16:11 0 dr------- C:\Documents and Settings\All Users\Start Menu
    2008-04-04 16:16:11 0 d-------- C:\Documents and Settings\All Users\Favorites
    2008-04-04 16:16:11 0 dr------- C:\Documents and Settings\All Users\Documents
    2008-04-04 16:16:11 0 d-------- C:\Documents and Settings\All Users\Desktop
    2008-04-04 16:15:58 0 d-------- C:\WINDOWS\system32\CatRoot2
    2008-04-04 16:15:58 0 d-------- C:\WINDOWS\system32\CatRoot
    2008-04-04 16:15:52 0 dr-h----- C:\Documents and Settings\Default User\Application Data
    2008-04-04 16:15:52 0 d---s---- C:\Documents and Settings\Default User\Application Data\Microsoft
    2008-04-04 16:15:52 0 dr-h----- C:\Documents and Settings\All Users\Application Data
    2008-04-04 16:15:52 0 d---s---- C:\Documents and Settings\All Users\Application Data\Microsoft
    2008-04-04 16:15:30 0 d-------- C:\Documents and Settings
    2008-04-04 16:10:45 0 d-------- C:\WINDOWS
    2008-04-04 16:10:45 0 d-------- C:\WINDOWS\WinSxS
    2008-04-04 16:10:45 0 dr------- C:\WINDOWS\Web
    2008-04-04 16:10:45 0 d-------- C:\WINDOWS\twain_32
    2008-04-04 16:10:45 0 d-------- C:\WINDOWS\system32
    2008-04-04 16:10:45 0 d-------- C:\WINDOWS\system32\wins
    2008-04-04 16:10:45 0 d-------- C:\WINDOWS\system32\wbem
    2008-04-04 16:10:45 0 d-------- C:\WINDOWS\system32\usmt
    2008-04-04 16:10:45 0 d-------- C:\WINDOWS\system32\spool
    2008-04-04 16:10:45 0 d-------- C:\WINDOWS\system32\ShellExt
    2008-04-04 16:10:45 0 d-------- C:\WINDOWS\system32\Setup
    2008-04-04 16:10:45 0 d-------- C:\WINDOWS\system32\ras
    2008-04-04 16:10:45 0 d-------- C:\WINDOWS\system32\oobe
    2008-04-04 16:10:45 0 d-------- C:\WINDOWS\system32\npp
    2008-04-04 16:10:45 0 d-------- C:\WINDOWS\system32\mui
    2008-04-04 16:10:45 0 d-------- C:\WINDOWS\system32\inetsrv
    2008-04-04 16:10:45 0 d-------- C:\WINDOWS\system32\IME
    2008-04-04 16:10:45 0 d-------- C:\WINDOWS\system32\icsxml
    2008-04-04 16:10:45 0 d-------- C:\WINDOWS\system32\ias
    2008-04-04 16:10:45 0 d-------- C:\WINDOWS\system32\export
    2008-04-04 16:10:45 0 d-------- C:\WINDOWS\system32\drivers
    2008-04-04 16:10:45 0 d-------- C:\WINDOWS\system32\drivers\etc
    2008-04-04 16:10:45 0 d-------- C:\WINDOWS\system32\drivers\disdn
    2008-04-04 16:10:45 0 dr-hs--c- C:\WINDOWS\system32\dllcache
    2008-04-04 16:10:45 0 d-------- C:\WINDOWS\system32\dhcp
    2008-04-04 16:10:45 0 d-------- C:\WINDOWS\system32\config
    2008-04-04 16:10:45 0 d-------- C:\WINDOWS\system32\3com_dmi
    2008-04-04 16:10:45 0 d-------- C:\WINDOWS\system32\3076
    2008-04-04 16:10:45 0 d-------- C:\WINDOWS\system32\2052
    2008-04-04 16:10:45 0 d-------- C:\WINDOWS\system32\1054
    2008-04-04 16:10:45 0 d-------- C:\WINDOWS\system32\1042
    2008-04-04 16:10:45 0 d-------- C:\WINDOWS\system32\1041
    2008-04-04 16:10:45 0 d-------- C:\WINDOWS\system32\1037
    2008-04-04 16:10:45 0 d-------- C:\WINDOWS\system32\1033
    2008-04-04 16:10:45 0 d-------- C:\WINDOWS\system32\1031
    2008-04-04 16:10:45 0 d-------- C:\WINDOWS\system32\1028
    2008-04-04 16:10:45 0 d-------- C:\WINDOWS\system32\1025
    2008-04-04 16:10:45 0 d-------- C:\WINDOWS\system
    2008-04-04 16:10:45 0 d-------- C:\WINDOWS\security
    2008-04-04 16:10:45 0 d-------- C:\WINDOWS\Resources
    2008-04-04 16:10:45 0 d-------- C:\WINDOWS\repair
    2008-04-04 16:10:45 0 d-------- C:\WINDOWS\mui
    2008-04-04 16:10:45 0 d-------- C:\WINDOWS\msapps
    2008-04-04 16:10:45 0 d-------- C:\WINDOWS\msagent
    2008-04-04 16:10:45 0 d-------- C:\WINDOWS\Media
    2008-04-04 16:10:45 0 d-------- C:\WINDOWS\java
    2008-04-04 16:10:45 0 d--h----- C:\WINDOWS\inf
    2008-04-04 16:10:45 0 d-------- C:\WINDOWS\ime
    2008-04-04 16:10:45 0 d-------- C:\WINDOWS\Help
    2008-04-04 16:10:45 0 dr--s---- C:\WINDOWS\Fonts
    2008-04-04 16:10:45 0 d-------- C:\WINDOWS\Driver Cache
    2008-04-04 16:10:45 0 d-------- C:\WINDOWS\Debug
    2008-04-04 16:10:45 0 d-------- C:\WINDOWS\Cursors
    2008-04-04 16:10:45 0 d-------- C:\WINDOWS\Connection Wizard
    2008-04-04 16:10:45 0 d-------- C:\WINDOWS\Config
    2008-04-04 16:10:45 0 d-------- C:\WINDOWS\AppPatch
    2008-04-04 16:10:45 0 d-------- C:\WINDOWS\addins


    -- Find3M Report ---------------------------------------------------------------

    2008-04-04 16:16:11 62 --ahs---- C:\Documents and Settings\N A J O\Application Data\desktop.ini


    -- Registry Dump ---------------------------------------------------------------

    *Note* empty entries & legit default entries are not shown


    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{826A5ED9-1316-4EFD-87F8-AA400C5D551A}]
    C:\WINDOWS\system32\cbXQjKaB.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B1B9CF94-76BF-40B5-9DC4-580EF5B8C620}]
    C:\WINDOWS\system32\byXQIXnm.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D5E5C1E6-78DB-49F0-A137-8D594F342FD6}]
    03/17/2008 06:33 AM 577816 --a------ C:\Program Files\Me.dium\Me.dium IE Add-on\MediumIEAddOn.dll

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SoundMan "= "SOUNDMAN.EXE" [01/11/2006 03:08 PM C:\WINDOWS\SOUNDMAN.EXE]
    "IgfxTray "= "C:\WINDOWS\System32\igfxtray.exe" [06/21/2005 05:48 PM]
    "HotKeysCmds "= "C:\WINDOWS\System32\hkcmd.exe" [06/21/2005 05:44 PM]
    "RemoteControl "= "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" [11/02/2004 08:24 PM]
    "NeroFilterCheck "= "C:\WINDOWS\system32\NeroCheck.exe" [07/09/2001 10:50 AM]
    "BluetoothAuthenticationAgent "= "bthprops.cpl" [08/04/2004 02:56 AM C:\WINDOWS\system32\bthprops.cpl]
    "CameraFixer "= "C:\WINDOWS\CameraFixer.exe" [10/09/2006 05:32 PM]
    "tsnpstd3 "= "C:\WINDOWS\tsnpstd3.exe" []
    "snp325 "= "C:\WINDOWS\vsnp325.exe" [10/10/2006 02:11 PM]
    "AVG7_CC "= "C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [04/06/2008 12:40 AM]
    "Windows Defender "= "C:\Program Files\Windows Defender\MSASCui.exe" [11/03/2006 07:20 PM]
    "!AVG Anti-Spyware "= "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [06/11/2007 05:25 AM]
    "SunJavaUpdateSched "= "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [02/22/2008 04:25 AM]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 03:56 AM]
    "Yahoo! Pager "= "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [08/30/2007 05:43 PM]
    "Shim soft "= "C:\DOCUME~1\NAJO~1\APPLIC~1\EACHLO~1\Bind iso admin.exe" []

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [10/9/2005 1:16:54 AM]
    ZDWLan Utility.lnk - C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe [4/5/2008 9:00:17 PM]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
    "DisableRegistryTools "=0 (0x0)

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
    "ClearRecentDocsOnExit "=1 (0x1)
    "NoRecentDocsMenu "=1 (0x1)

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    "{826A5ED9-1316-4EFD-87F8-AA400C5D551A} "= C:\WINDOWS\system32\cbXQjKaB.dll [ ]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cbXQjKaB]
    cbXQjKaB.dll

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
    "Authentication Packages "= msv1_0 C:\WINDOWS\system32\byXQIXnm

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
    @= "Service "

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
    @= "Volume shadow copy "

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    bthsvcs BthServ




    -- End of Deckard's System Scanner: finished at 2008-04-08 12:01:50 ------------
     
    Naj,
    #3
  5. 2008/04/08
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Welcome to WindowsBBS Naj :)

    Download ComboFix by sUBs from here, saving the file to your desktop.



    Please disable realtime protection applications as they sometime interfere with the tool. Check this link for your applicable programs.

    • Close all open programs and windows
    • Double click combofix.exe and follow the prompts.
    • It may reboot your computer and resume running when you logon. Wait for it to complete. When finished, it will open a log for you. Post that log and a new HijackThis log in your next reply.
    Note: Do not mouseclick combofix's window while its running. That may cause it to stall
     
    noahdfear,
    #4
  6. 2008/04/09
    Naj

    Naj Inactive Thread Starter

    Joined:
    2008/04/08
    Messages:
    45
    Likes Received:
    0
    ComboFix 08-04-08.7 - N A J O 2008-04-09 0:44:49.1 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.651 [GMT -4:00]
    Running from: C:\Naj`s\ComboFix.exe
    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\WINDOWS\pskt.ini
    C:\WINDOWS\system32\mnXIQXyb.ini
    C:\WINDOWS\system32\mnXIQXyb.ini2

    .
    ((((((((((((((((((((((((( Files Created from 2008-03-09 to 2008-04-09 )))))))))))))))))))))))))))))))
    .

    2008-04-08 19:47 . 2008-04-08 21:02 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
    2008-04-08 19:47 . 2008-04-08 19:47 <DIR> d-------- C:\Documents and Settings\N A J O\Application Data\SUPERAntiSpyware.com
    2008-04-08 19:47 . 2008-04-08 19:47 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
    2008-04-08 19:46 . 2008-04-08 19:46 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
    2008-04-08 11:53 . 2008-04-08 11:53 <DIR> d-------- C:\Deckard
    2008-04-08 11:51 . 2008-04-08 11:51 <DIR> d-------- C:\Program Files\Trend Micro
    2008-04-08 02:31 . 2008-04-08 02:31 <DIR> d-------- C:\WINDOWS\Sun
    2008-04-08 02:30 . 2008-04-08 02:30 <DIR> d-------- C:\Program Files\Java
    2008-04-08 02:30 . 2008-02-22 02:33 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
    2008-04-08 02:25 . 2008-04-08 02:25 <DIR> d-------- C:\Program Files\Common Files\Java
    2008-04-07 19:50 . 2008-04-07 19:50 <DIR> d-------- C:\Program Files\MSXML 6.0
    2008-04-07 16:57 . 2008-04-07 16:57 <DIR> d-------- C:\Program Files\Microsoft Silverlight
    2008-04-07 16:55 . 2008-04-07 16:55 <DIR> d-------- C:\Program Files\MSBuild
    2008-04-07 16:48 . 2008-04-07 16:48 <DIR> d-------- C:\WINDOWS\system32\XPSViewer
    2008-04-07 16:47 . 2008-04-07 16:47 <DIR> d-------- C:\Program Files\Reference Assemblies
    2008-04-07 16:47 . 2006-06-29 13:07 14,048 --a------ C:\WINDOWS\system32\spmsg2.dll
    2008-04-07 16:46 . 2006-10-04 10:06 1,197,294 -----c--- C:\WINDOWS\system32\dllcache\sysmain.sdb
    2008-04-07 16:46 . 2006-10-04 10:06 764,868 -----c--- C:\WINDOWS\system32\dllcache\apph_sp.sdb
    2008-04-07 16:46 . 2006-10-04 10:06 217,118 -----c--- C:\WINDOWS\system32\dllcache\apphelp.sdb
    2008-04-07 16:45 . 2008-04-07 16:45 <DIR> d-------- C:\Program Files\Windows Media Connect 2
    2008-04-07 16:43 . 2008-04-07 16:43 <DIR> d-------- C:\WINDOWS\system32\LogFiles
    2008-04-07 16:43 . 2008-04-07 16:43 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF
    2008-04-07 16:30 . 2006-11-13 02:02 288,768 --a------ C:\WINDOWS\system32\rhttpaa.dll
    2008-04-07 16:30 . 2006-11-13 02:02 116,736 --a------ C:\WINDOWS\system32\aaclient.dll
    2008-04-07 16:30 . 2006-11-13 02:02 36,352 --a------ C:\WINDOWS\system32\tsgqec.dll
    2008-04-07 16:03 . 2008-04-07 16:03 <DIR> d-------- C:\WINDOWS\system32\URTTemp
    2008-04-07 14:51 . 2008-04-07 14:51 <DIR> d-------- C:\Program Files\Common Files\Scanner
    2008-04-07 14:51 . 2008-04-07 15:24 <DIR> d-------- C:\Program Files\CA Yahoo! Anti-Spy
    2008-04-07 14:48 . 2008-04-07 14:48 <DIR> d-------- C:\Documents and Settings\N A J O\Application Data\Yahoo!
    2008-04-07 14:48 . 2008-04-07 14:48 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
    2008-04-07 14:36 . 2008-04-07 16:10 <DIR> d-------- C:\WINDOWS\SxsCaPendDel
    2008-04-07 14:28 . 2008-04-07 14:28 <DIR> d-------- C:\Program Files\Me.dium
    2008-04-06 10:56 . 2008-04-06 10:56 <DIR> d-------- C:\Documents and Settings\N A J O\Application Data\Grisoft
    2008-04-06 10:56 . 2007-05-30 08:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
    2008-04-06 10:48 . 2008-04-06 10:48 <DIR> d-------- C:\Program Files\Windows Defender
    2008-04-06 00:40 . 2008-04-08 13:12 <DIR> d-------- C:\Documents and Settings\N A J O\Application Data\AVG7
    2008-04-06 00:40 . 2008-04-06 00:40 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\AVG7
    2008-04-06 00:40 . 2008-04-06 10:56 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
    2008-04-06 00:40 . 2008-04-06 10:27 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg7
    2008-04-06 00:40 . 2008-04-06 00:40 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll
    2008-04-06 00:40 . 2008-04-06 00:40 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll
    2008-04-05 21:00 . 2008-04-05 21:00 <DIR> d-------- C:\Program Files\ZyDAS Technology Corporation
    2008-04-05 21:00 . 2005-08-17 14:43 330,240 --a------ C:\WINDOWS\system32\drivers\ZD1211BU.sys
    2008-04-05 21:00 . 2004-01-14 11:25 81,920 --a------ C:\WINDOWS\system32\ZDPN50.DLL
    2008-04-05 21:00 . 2005-03-18 15:35 31,744 --a------ C:\WINDOWS\system32\drivers\ZDPSp50a64.sys
    2008-04-05 21:00 . 2005-06-08 18:44 29,184 --a------ C:\WINDOWS\system32\drivers\BRGSp50a64.sys
    2008-04-05 21:00 . 2004-03-23 16:38 28,672 --a------ C:\WINDOWS\system32\InsDrvZD.dll
    2008-04-05 21:00 . 2003-03-14 12:24 24,576 --a------ C:\WINDOWS\system32\ZyDelReg.exe
    2008-04-05 21:00 . 2005-06-08 18:44 20,608 --a------ C:\WINDOWS\system32\drivers\BRGSp50.sys
    2008-04-05 21:00 . 2004-10-25 13:40 17,664 --a------ C:\WINDOWS\system32\drivers\ZDPSp50.sys
    2008-04-05 21:00 . 2004-01-14 11:30 17,151 --a------ C:\WINDOWS\system32\ZDPNDIS5.SYS
    2008-04-05 21:00 . 2005-07-12 14:44 15,872 --a------ C:\WINDOWS\system32\InsDrvZD64.DLL
    2008-04-05 20:29 . 2008-04-05 20:29 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Messenger Plus!
    2008-04-05 17:21 . 2008-04-06 03:50 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\INTERNET SPAM SUPPORT AUDIO
    2008-04-05 17:18 . 2008-04-06 11:00 <DIR> d-------- C:\Documents and Settings\N A J O\Application Data\Each long sect
    2008-04-05 17:16 . 2008-04-05 17:16 <DIR> d-------- C:\Program Files\Messenger Plus! Live
    2008-04-05 16:56 . 2004-08-04 00:58 14,848 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys
    2008-04-05 16:56 . 2004-08-04 00:58 14,848 --a--c--- C:\WINDOWS\system32\dllcache\kbdhid.sys
    2008-04-05 16:22 . 2008-04-05 16:22 42 --a------ C:\WINDOWS\JFEXRMC.INI
    2008-04-05 16:16 . 2008-04-05 16:19 <DIR> d-------- C:\Program Files\JetAudio
    2008-04-05 16:16 . 2008-04-05 16:16 <DIR> d-------- C:\Program Files\Common Files\COWON
    2008-04-05 16:06 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
    2008-04-05 16:06 . 2007-07-30 19:19 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
    2008-04-05 14:50 . 2008-04-05 14:55 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg8
    2008-04-05 14:40 . 2004-08-04 02:56 53,760 --a------ C:\WINDOWS\system32\vfwwdm32.dll
    2008-04-05 14:40 . 2004-08-04 02:56 53,760 --a--c--- C:\WINDOWS\system32\dllcache\vfwwdm32.dll
    2008-04-05 14:39 . 2006-08-28 11:53 57,344 --a------ C:\WINDOWS\system32\vsnpx32.dll
    2008-04-05 14:38 . 2008-04-05 14:39 <DIR> d-------- C:\Program Files\Common Files\snp325
    2008-04-05 14:38 . 2006-09-27 12:28 10,218,624 --a------ C:\WINDOWS\system32\drivers\snp325.sys
    2008-04-05 14:38 . 2006-10-10 14:11 827,392 --a------ C:\WINDOWS\vsnp325.exe
    2008-04-05 14:38 . 2006-10-10 15:49 270,336 --a------ C:\WINDOWS\tsnp325.exe
    2008-04-05 14:38 . 2006-04-12 12:11 147,456 --a------ C:\WINDOWS\system32\rsnp325.dll
    2008-04-05 14:38 . 2006-07-03 10:31 94,208 --a------ C:\WINDOWS\amcap.exe
    2008-04-05 14:38 . 2006-08-28 11:53 57,344 --a------ C:\WINDOWS\system32\vsnp325.dll
    2008-04-05 14:38 . 2005-11-23 13:55 53,248 --a------ C:\WINDOWS\system32\csnp325.dll
    2008-04-05 14:38 . 2006-10-09 17:32 20,480 --a------ C:\WINDOWS\CameraFixer.exe
    2008-04-05 14:38 . 2004-02-27 17:36 15,498 --a------ C:\WINDOWS\snp325.ini
    2008-04-05 14:38 . 2004-02-27 17:36 13,023 --a------ C:\WINDOWS\snp325.src
    2008-04-05 14:29 . 2008-04-05 14:29 <DIR> d-------- C:\Documents and Settings\N A J O\Bluetooth Software
    2008-04-05 14:26 . 2004-08-04 02:56 152,576 --a------ C:\WINDOWS\system32\irftp.exe
    2008-04-05 14:26 . 2004-08-04 02:56 152,576 --a--c--- C:\WINDOWS\system32\dllcache\irftp.exe
    2008-04-05 14:26 . 2004-08-04 02:56 27,136 --a------ C:\WINDOWS\system32\irmon.dll
    2008-04-05 14:26 . 2004-08-04 02:56 27,136 --a--c--- C:\WINDOWS\system32\dllcache\irmon.dll
    2008-04-05 14:26 . 2004-08-04 02:56 8,192 --a------ C:\WINDOWS\system32\wshirda.dll
    2008-04-05 14:26 . 2004-08-04 02:56 8,192 --a--c--- C:\WINDOWS\system32\dllcache\wshirda.dll
    2008-04-05 14:25 . 2008-04-05 14:25 <DIR> d-------- C:\Program Files\WIDCOMM
    2008-04-05 14:14 . 2008-04-05 14:14 <DIR> d-------- C:\Program Files\MyPhoneExplorer
    2008-04-05 14:01 . 2008-04-05 14:01 10,022 --ahs---- C:\WINDOWS\system32\KGyGaAvL.sys
    2008-04-05 14:01 . 2008-04-05 14:01 56 -r-hs---- C:\WINDOWS\system32\AB8F8F2446.sys
    2008-04-05 13:58 . 2008-04-05 13:58 69 --a------ C:\WINDOWS\NeroDigital.ini
    2008-04-05 13:38 . 2008-04-05 13:38 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Yahoo!
    2008-04-05 13:13 . 2008-04-07 14:47 <DIR> d-------- C:\Program Files\Yahoo!
    2008-04-05 12:33 . 2008-04-05 12:33 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\CyberLink
    2008-04-05 12:32 . 2008-04-05 12:32 <DIR> d-------- C:\Documents and Settings\N A J O\Application Data\CyberLink
    2008-04-05 12:27 . 2008-04-05 12:27 <DIR> d-------- C:\WINDOWS\system32\Adobe
    2008-04-05 12:27 . 2008-04-05 12:27 <DIR> d-------- C:\WINDOWS\Profiles
    2008-04-05 12:27 . 2008-04-05 12:27 <DIR> d-------- C:\Program Files\Common Files\Adobe
    2008-04-05 12:27 . 2008-04-05 12:27 <DIR> d-------- C:\Documents and Settings\N A J O\Application Data\InterTrust
    2008-04-05 12:14 . 1998-10-29 16:45 306,688 --a------ C:\WINDOWS\IsUninst.exe
    2008-04-05 12:13 . 2008-04-05 12:13 <DIR> d-------- C:\Program Files\Common Files\Ahead

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-04-06 01:00 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-04-05 18:38 --------- d-----w C:\Program Files\Common Files\InstallShield
    2008-04-05 01:49 --------- d-----w C:\Program Files\Intel
    2008-04-05 01:29 --------- d-----w C:\Program Files\microsoft frontpage
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B1B9CF94-76BF-40B5-9DC4-580EF5B8C620}]
    C:\WINDOWS\system32\byXQIXnm.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D5E5C1E6-78DB-49F0-A137-8D594F342FD6}]
    2008-03-17 06:33 577816 --a------ C:\Program Files\Me.dium\Me.dium IE Add-on\MediumIEAddOn.dll

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:56 15360]
    "Yahoo! Pager "= "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [2007-08-30 17:43 4670704]
    "Shim soft "= "C:\DOCUME~1\NAJO~1\APPLIC~1\EACHLO~1\Bind iso admin.exe" [ ]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SoundMan "= "SOUNDMAN.EXE" [2006-01-11 15:08 577536 C:\WINDOWS\SOUNDMAN.EXE]
    "IgfxTray "= "C:\WINDOWS\System32\igfxtray.exe" [2005-06-21 17:48 155648]
    "HotKeysCmds "= "C:\WINDOWS\System32\hkcmd.exe" [2005-06-21 17:44 126976]
    "RemoteControl "= "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" [2004-11-02 20:24 32768]
    "NeroFilterCheck "= "C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648]
    "BluetoothAuthenticationAgent "= "bthprops.cpl" [2004-08-04 02:56 110592 C:\WINDOWS\system32\bthprops.cpl]
    "CameraFixer "= "C:\WINDOWS\CameraFixer.exe" [2006-10-09 17:32 20480]
    "tsnpstd3 "= "C:\WINDOWS\tsnpstd3.exe" [ ]
    "snp325 "= "C:\WINDOWS\vsnp325.exe" [2006-10-10 14:11 827392]
    "AVG7_CC "= "C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-04-06 00:40 579072]
    "Windows Defender "= "C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20 866584]
    "!AVG Anti-Spyware "= "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 05:25 6731312]
    "SunJavaUpdateSched "= "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "AVG7_Run "= "C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-04-06 00:40 219136]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2005-10-09 01:16:54 610365]
    ZDWLan Utility.lnk - C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe [2008-04-05 21:00:17 475136]

    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
    "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} "= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 12:55 77824]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
    C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 12:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cbXQjKaB]
    cbXQjKaB.dll

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe "=
    "C:\\Program Files\\PoivY.com\\PoivY\\PoivY.exe "=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe "=
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe "=
    "C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe "=
    "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe "=
    "C:\\Program Files\\Grisoft\\AVG7\\avginet.exe "=
    "C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe "=
    "C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe "=
    "C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe "=

    S3 m4301a;Linksys Wireless-B USB Network Adapter v4.0 Driver;C:\WINDOWS\system32\DRIVERS\m4301A.sys [2005-03-09 07:11]
    S3 SNP325;USB PC Camera (SNPSTD325);C:\WINDOWS\system32\DRIVERS\snp325.sys [2006-09-27 12:28]
    S3 ZD1211BU(ZyDAS);ZyDAS ZD1211B IEEE 802.11 b+g Wireless LAN Driver (USB)(ZyDAS);C:\WINDOWS\system32\DRIVERS\zd1211Bu.sys [2005-08-17 14:43]

    .
    Contents of the 'Scheduled Tasks' folder
    "2008-04-09 04:00:00 C:\WINDOWS\Tasks\A908293E9107A086.job "
    - c:\docume~1\najo~1\applic~1\eachlo~1\jump funk stop.exe
    "2008-04-09 01:34:54 C:\WINDOWS\Tasks\MP Scheduled Scan.job "
    - C:\Program Files\Windows Defender\MpCmdRun.exe
    "2008-04-08 20:15:03 C:\WINDOWS\Tasks\User_Feed_Synchronization-{54DB8B2F-312A-4218-961B-499CAD9E55B2}.job "
    - C:\WINDOWS\system32\msfeedssync.exe
    .
    **************************************************************************

    catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-04-09 00:48:46
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    ------------------------ Other Running Processes ------------------------
    .
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
    C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
    .
    **************************************************************************
    .
    Completion time: 2008-04-09 0:50:12 - machine was rebooted
    ComboFix-quarantined-files.txt 2008-04-09 04:50:08
    Pre-Run: 68,365,479,936 bytes free
    Post-Run: 68,303,851,520 bytes free
    .
    2008-04-09 01:13:51 --- E O F ---

    and hijack this:Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 1:02:02 AM, on 4/9/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16608)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\WINDOWS\System32\igfxtray.exe
    C:\WINDOWS\System32\hkcmd.exe
    C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\WINDOWS\CameraFixer.exe
    C:\WINDOWS\vsnp325.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
    C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe
    C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
    C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
    C:\WINDOWS\explorer.exe
    C:\WINDOWS\system32\notepad.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.ca/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://ca.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://ca.search.yahoo.com
    R3 - URLSearchHook: Yahoo! ¤u¨Ã£¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: (no name) - {B1B9CF94-76BF-40B5-9DC4-580EF5B8C620} - C:\WINDOWS\system32\byXQIXnm.dll (file missing)
    O2 - BHO: Me.dium IE Add-on - {D5E5C1E6-78DB-49F0-A137-8D594F342FD6} - "C:\Program Files\Me.dium\Me.dium IE Add-on\MediumIEAddOn.dll" (file missing)
    O3 - Toolbar: Yahoo! ¤u¨Ã£¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe "
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
    O4 - HKLM\..\Run: [CameraFixer] C:\WINDOWS\CameraFixer.exe
    O4 - HKLM\..\Run: [tsnpstd3] C:\WINDOWS\tsnpstd3.exe
    O4 - HKLM\..\Run: [snp325] C:\WINDOWS\vsnp325.exe
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe "
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
    O4 - HKCU\..\Run: [Shim soft] C:\DOCUME~1\NAJO~1\APPLIC~1\EACHLO~1\Bind iso admin.exe
    O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
    O4 - Global Startup: Bluetooth.lnk = ?
    O4 - Global Startup: ZDWLan Utility.lnk = C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe
    O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: Me.dium - {47F8FF58-8C1E-4584-92CD-CE8B1FE1AF44} - "C:\Program Files\Me.dium\Me.dium IE Add-on\MediumIEAddOn.dll" (file missing)
    O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O15 - Trusted Zone: http://www.atribune.org
    O15 - Trusted Zone: http://deckard.geekstogo.com
    O15 - Trusted Zone: http://www.java.com
    O15 - Trusted Zone: http://by108w.bay108.mail.live.com
    O15 - Trusted Zone: http://www.trendsecure.com
    O15 - Trusted Zone: http://www.windowsbbs.com
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1207359593092
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1207360033748
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://sdlc-esd.sun.com/ESD39/JSCDL...-jc.cab&File=jinstall-6u5-windows-i586-jc.cab
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (file missing)
    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
    O20 - Winlogon Notify: cbXQjKaB - cbXQjKaB.dll (file missing)
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe

    --
    End of file - 8443 bytes
     
    Naj,
    #5
  7. 2008/04/09
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Did you install the Me.dium software?


    Once again, please disable any realtime protection applications. Highlight and copy the contents of the code box below and paste it into a blank notepad, then save it to your desktop as;

    Filename: CFScript.txt
    Save As Type: All Files (*.*)

    Code:
    File::
C:\WINDOWS\Tasks\A908293E9107A086.job
Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B1B9CF94-76BF-40B5-9DC4-580EF5B8C620}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
 "Shim soft "=-
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cbXQjKaB]
    Close all other windows and programs. Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button. Combofix should run and may reboot the computer when it's done. A log will open when it's complete. Post the contents of that log.

    Please do not click on the ComboFix window while it is running a scan. This can cause it to stall.
     
    noahdfear,
    #6
  8. 2008/04/09
    Naj

    Naj Inactive Thread Starter

    Joined:
    2008/04/08
    Messages:
    45
    Likes Received:
    0
    Yeah I Did install Me.dium.
    and ...comboFix didnt reboot system.

    ComboFix 08-04-08.7 - N A J O 2008-04-09 22:57:24.2 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.586 [GMT -4:00]
    Running from: C:\Documents and Settings\N A J O\Desktop\ComboFix.exe
    Command switches used :: C:\Documents and Settings\N A J O\Desktop\CFScript.txt
    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

    FILE ::
    C:\WINDOWS\Tasks\A908293E9107A086.job
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\WINDOWS\Tasks\A908293E9107A086.job

    .
    ((((((((((((((((((((((((( Files Created from 2008-03-10 to 2008-04-10 )))))))))))))))))))))))))))))))
    .

    2008-04-08 19:47 . 2008-04-08 21:02 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
    2008-04-08 19:47 . 2008-04-08 19:47 <DIR> d-------- C:\Documents and Settings\N A J O\Application Data\SUPERAntiSpyware.com
    2008-04-08 19:47 . 2008-04-08 19:47 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
    2008-04-08 19:46 . 2008-04-08 19:46 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
    2008-04-08 11:53 . 2008-04-08 11:53 <DIR> d-------- C:\Deckard
    2008-04-08 11:51 . 2008-04-08 11:51 <DIR> d-------- C:\Program Files\Trend Micro
    2008-04-08 02:31 . 2008-04-08 02:31 <DIR> d-------- C:\WINDOWS\Sun
    2008-04-08 02:30 . 2008-04-08 02:30 <DIR> d-------- C:\Program Files\Java
    2008-04-08 02:30 . 2008-02-22 02:33 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
    2008-04-08 02:25 . 2008-04-08 02:25 <DIR> d-------- C:\Program Files\Common Files\Java
    2008-04-07 19:50 . 2008-04-07 19:50 <DIR> d-------- C:\Program Files\MSXML 6.0
    2008-04-07 16:57 . 2008-04-07 16:57 <DIR> d-------- C:\Program Files\Microsoft Silverlight
    2008-04-07 16:55 . 2008-04-07 16:55 <DIR> d-------- C:\Program Files\MSBuild
    2008-04-07 16:48 . 2008-04-07 16:48 <DIR> d-------- C:\WINDOWS\system32\XPSViewer
    2008-04-07 16:47 . 2008-04-07 16:47 <DIR> d-------- C:\Program Files\Reference Assemblies
    2008-04-07 16:47 . 2006-06-29 13:07 14,048 --a------ C:\WINDOWS\system32\spmsg2.dll
    2008-04-07 16:46 . 2006-10-04 10:06 1,197,294 -----c--- C:\WINDOWS\system32\dllcache\sysmain.sdb
    2008-04-07 16:46 . 2006-10-04 10:06 764,868 -----c--- C:\WINDOWS\system32\dllcache\apph_sp.sdb
    2008-04-07 16:46 . 2006-10-04 10:06 217,118 -----c--- C:\WINDOWS\system32\dllcache\apphelp.sdb
    2008-04-07 16:45 . 2008-04-07 16:45 <DIR> d-------- C:\Program Files\Windows Media Connect 2
    2008-04-07 16:43 . 2008-04-07 16:43 <DIR> d-------- C:\WINDOWS\system32\LogFiles
    2008-04-07 16:43 . 2008-04-07 16:43 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF
    2008-04-07 16:30 . 2006-11-13 02:02 288,768 --a------ C:\WINDOWS\system32\rhttpaa.dll
    2008-04-07 16:30 . 2006-11-13 02:02 116,736 --a------ C:\WINDOWS\system32\aaclient.dll
    2008-04-07 16:30 . 2006-11-13 02:02 36,352 --a------ C:\WINDOWS\system32\tsgqec.dll
    2008-04-07 16:03 . 2008-04-07 16:03 <DIR> d-------- C:\WINDOWS\system32\URTTemp
    2008-04-07 14:51 . 2008-04-07 14:51 <DIR> d-------- C:\Program Files\Common Files\Scanner
    2008-04-07 14:51 . 2008-04-07 15:24 <DIR> d-------- C:\Program Files\CA Yahoo! Anti-Spy
    2008-04-07 14:48 . 2008-04-07 14:48 <DIR> d-------- C:\Documents and Settings\N A J O\Application Data\Yahoo!
    2008-04-07 14:48 . 2008-04-07 14:48 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
    2008-04-07 14:36 . 2008-04-09 21:18 <DIR> d-------- C:\WINDOWS\SxsCaPendDel
    2008-04-07 14:28 . 2008-04-07 14:28 <DIR> d-------- C:\Program Files\Me.dium
    2008-04-06 10:56 . 2008-04-06 10:56 <DIR> d-------- C:\Documents and Settings\N A J O\Application Data\Grisoft
    2008-04-06 10:56 . 2007-05-30 08:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
    2008-04-06 10:48 . 2008-04-06 10:48 <DIR> d-------- C:\Program Files\Windows Defender
    2008-04-06 00:40 . 2008-04-09 12:27 <DIR> d-------- C:\Documents and Settings\N A J O\Application Data\AVG7
    2008-04-06 00:40 . 2008-04-06 00:40 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\AVG7
    2008-04-06 00:40 . 2008-04-06 10:56 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
    2008-04-06 00:40 . 2008-04-06 10:27 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg7
    2008-04-06 00:40 . 2008-04-06 00:40 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll
    2008-04-06 00:40 . 2008-04-06 00:40 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll
    2008-04-05 21:00 . 2008-04-05 21:00 <DIR> d-------- C:\Program Files\ZyDAS Technology Corporation
    2008-04-05 21:00 . 2005-08-17 14:43 330,240 --a------ C:\WINDOWS\system32\drivers\ZD1211BU.sys
    2008-04-05 21:00 . 2004-01-14 11:25 81,920 --a------ C:\WINDOWS\system32\ZDPN50.DLL
    2008-04-05 21:00 . 2005-03-18 15:35 31,744 --a------ C:\WINDOWS\system32\drivers\ZDPSp50a64.sys
    2008-04-05 21:00 . 2005-06-08 18:44 29,184 --a------ C:\WINDOWS\system32\drivers\BRGSp50a64.sys
    2008-04-05 21:00 . 2004-03-23 16:38 28,672 --a------ C:\WINDOWS\system32\InsDrvZD.dll
    2008-04-05 21:00 . 2003-03-14 12:24 24,576 --a------ C:\WINDOWS\system32\ZyDelReg.exe
    2008-04-05 21:00 . 2005-06-08 18:44 20,608 --a------ C:\WINDOWS\system32\drivers\BRGSp50.sys
    2008-04-05 21:00 . 2004-10-25 13:40 17,664 --a------ C:\WINDOWS\system32\drivers\ZDPSp50.sys
    2008-04-05 21:00 . 2004-01-14 11:30 17,151 --a------ C:\WINDOWS\system32\ZDPNDIS5.SYS
    2008-04-05 21:00 . 2005-07-12 14:44 15,872 --a------ C:\WINDOWS\system32\InsDrvZD64.DLL
    2008-04-05 20:29 . 2008-04-05 20:29 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Messenger Plus!
    2008-04-05 17:21 . 2008-04-06 03:50 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\INTERNET SPAM SUPPORT AUDIO
    2008-04-05 17:18 . 2008-04-06 11:00 <DIR> d-------- C:\Documents and Settings\N A J O\Application Data\Each long sect
    2008-04-05 17:16 . 2008-04-05 17:16 <DIR> d-------- C:\Program Files\Messenger Plus! Live
    2008-04-05 16:56 . 2004-08-04 00:58 14,848 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys
    2008-04-05 16:56 . 2004-08-04 00:58 14,848 --a--c--- C:\WINDOWS\system32\dllcache\kbdhid.sys
    2008-04-05 16:22 . 2008-04-05 16:22 42 --a------ C:\WINDOWS\JFEXRMC.INI
    2008-04-05 16:16 . 2008-04-05 16:19 <DIR> d-------- C:\Program Files\JetAudio
    2008-04-05 16:16 . 2008-04-05 16:16 <DIR> d-------- C:\Program Files\Common Files\COWON
    2008-04-05 16:06 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
    2008-04-05 16:06 . 2007-07-30 19:19 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
    2008-04-05 14:50 . 2008-04-05 14:55 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg8
    2008-04-05 14:40 . 2004-08-04 02:56 53,760 --a------ C:\WINDOWS\system32\vfwwdm32.dll
    2008-04-05 14:40 . 2004-08-04 02:56 53,760 --a--c--- C:\WINDOWS\system32\dllcache\vfwwdm32.dll
    2008-04-05 14:39 . 2006-08-28 11:53 57,344 --a------ C:\WINDOWS\system32\vsnpx32.dll
    2008-04-05 14:38 . 2008-04-05 14:39 <DIR> d-------- C:\Program Files\Common Files\snp325
    2008-04-05 14:38 . 2006-09-27 12:28 10,218,624 --a------ C:\WINDOWS\system32\drivers\snp325.sys
    2008-04-05 14:38 . 2006-10-10 14:11 827,392 --a------ C:\WINDOWS\vsnp325.exe
    2008-04-05 14:38 . 2006-10-10 15:49 270,336 --a------ C:\WINDOWS\tsnp325.exe
    2008-04-05 14:38 . 2006-04-12 12:11 147,456 --a------ C:\WINDOWS\system32\rsnp325.dll
    2008-04-05 14:38 . 2006-07-03 10:31 94,208 --a------ C:\WINDOWS\amcap.exe
    2008-04-05 14:38 . 2006-08-28 11:53 57,344 --a------ C:\WINDOWS\system32\vsnp325.dll
    2008-04-05 14:38 . 2005-11-23 13:55 53,248 --a------ C:\WINDOWS\system32\csnp325.dll
    2008-04-05 14:38 . 2006-10-09 17:32 20,480 --a------ C:\WINDOWS\CameraFixer.exe
    2008-04-05 14:38 . 2004-02-27 17:36 15,498 --a------ C:\WINDOWS\snp325.ini
    2008-04-05 14:38 . 2004-02-27 17:36 13,023 --a------ C:\WINDOWS\snp325.src
    2008-04-05 14:29 . 2008-04-05 14:29 <DIR> d-------- C:\Documents and Settings\N A J O\Bluetooth Software
    2008-04-05 14:26 . 2004-08-04 02:56 152,576 --a------ C:\WINDOWS\system32\irftp.exe
    2008-04-05 14:26 . 2004-08-04 02:56 152,576 --a--c--- C:\WINDOWS\system32\dllcache\irftp.exe
    2008-04-05 14:26 . 2004-08-04 02:56 27,136 --a------ C:\WINDOWS\system32\irmon.dll
    2008-04-05 14:26 . 2004-08-04 02:56 27,136 --a--c--- C:\WINDOWS\system32\dllcache\irmon.dll
    2008-04-05 14:26 . 2004-08-04 02:56 8,192 --a------ C:\WINDOWS\system32\wshirda.dll
    2008-04-05 14:26 . 2004-08-04 02:56 8,192 --a--c--- C:\WINDOWS\system32\dllcache\wshirda.dll
    2008-04-05 14:25 . 2008-04-05 14:25 <DIR> d-------- C:\Program Files\WIDCOMM
    2008-04-05 14:14 . 2008-04-05 14:14 <DIR> d-------- C:\Program Files\MyPhoneExplorer
    2008-04-05 14:01 . 2008-04-05 14:01 10,022 --ahs---- C:\WINDOWS\system32\KGyGaAvL.sys
    2008-04-05 14:01 . 2008-04-05 14:01 56 -r-hs---- C:\WINDOWS\system32\AB8F8F2446.sys
    2008-04-05 13:58 . 2008-04-05 13:58 69 --a------ C:\WINDOWS\NeroDigital.ini
    2008-04-05 13:38 . 2008-04-05 13:38 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Yahoo!
    2008-04-05 13:13 . 2008-04-07 14:47 <DIR> d-------- C:\Program Files\Yahoo!
    2008-04-05 12:33 . 2008-04-05 12:33 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\CyberLink
    2008-04-05 12:32 . 2008-04-05 12:32 <DIR> d-------- C:\Documents and Settings\N A J O\Application Data\CyberLink
    2008-04-05 12:27 . 2008-04-05 12:27 <DIR> d-------- C:\WINDOWS\system32\Adobe
    2008-04-05 12:27 . 2008-04-05 12:27 <DIR> d-------- C:\WINDOWS\Profiles
    2008-04-05 12:27 . 2008-04-05 12:27 <DIR> d-------- C:\Program Files\Common Files\Adobe
    2008-04-05 12:27 . 2008-04-05 12:27 <DIR> d-------- C:\Documents and Settings\N A J O\Application Data\InterTrust
    2008-04-05 12:14 . 1998-10-29 16:45 306,688 --a------ C:\WINDOWS\IsUninst.exe
    2008-04-05 12:13 . 2008-04-05 12:13 <DIR> d-------- C:\Program Files\Common Files\Ahead

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-04-06 01:00 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-04-05 18:38 --------- d-----w C:\Program Files\Common Files\InstallShield
    2008-04-05 01:49 --------- d-----w C:\Program Files\Intel
    2008-04-05 01:29 558,142 ----a-w C:\WINDOWS\java\Packages\NLJFPB3P.ZIP
    2008-04-05 01:29 155,995 ----a-w C:\WINDOWS\java\Packages\731RV1R1.ZIP
    2008-04-05 01:29 --------- d-----w C:\Program Files\microsoft frontpage
    2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys
    2008-03-01 13:06 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
    2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
    2008-02-20 05:32 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
    .

    ((((((((((((((((((((((((((((( snapshot@2008-04-09_ 0.49.52.29 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2007-12-07 02:21:45 124,928 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\advpack.dll
    + 2007-12-19 23:01:06 347,136 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\dxtmsft.dll
    + 2007-12-07 02:21:45 214,528 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\dxtrans.dll
    + 2007-12-07 02:21:45 133,120 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\extmgr.dll
    + 2007-12-07 02:21:45 63,488 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\icardie.dll
    + 2007-12-06 11:00:57 70,656 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\ie4uinit.exe
    + 2007-12-07 02:21:45 153,088 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\ieakeng.dll
    + 2007-12-07 02:21:45 230,400 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\ieaksie.dll
    + 2007-12-06 04:59:51 161,792 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\ieakui.dll
    + 2007-12-07 02:21:45 383,488 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\ieapfltr.dll
    + 2007-12-07 02:21:45 384,512 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\iedkcs32.dll
    + 2007-12-07 02:21:46 6,066,176 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\ieframe.dll
    + 2007-12-07 02:21:46 44,544 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\iernonce.dll
    + 2007-12-07 02:21:46 267,776 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\iertutil.dll
    + 2007-12-06 11:00:58 13,824 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\ieudinit.exe
    + 2007-12-06 11:01:25 625,664 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\iexplore.exe
    + 2007-12-07 02:21:47 27,648 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\jsproxy.dll
    + 2007-12-07 02:21:47 459,264 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\msfeeds.dll
    + 2007-12-07 02:21:47 52,224 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\msfeedsbs.dll
    + 2007-12-08 15:51:48 3,592,192 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\mshtml.dll
    + 2007-12-07 02:21:47 478,208 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\mshtmled.dll
    + 2007-12-07 02:21:48 193,024 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\msrating.dll
    + 2007-12-07 02:21:48 671,232 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\mstime.dll
    + 2007-12-07 02:21:48 102,912 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\occache.dll
    + 2008-01-11 05:53:32 44,544 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\pngfilt.dll
    + 2007-03-06 01:22:39 213,216 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\spuninst\spuninst.exe
    + 2007-03-06 01:23:51 371,424 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\spuninst\updspapi.dll
    + 2007-12-07 02:21:48 105,984 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\url.dll
    + 2007-12-07 02:21:48 1,159,680 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\urlmon.dll
    + 2007-12-07 02:21:48 233,472 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\webcheck.dll
    + 2007-12-07 02:21:48 824,832 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\wininet.dll
    - 2008-04-05 06:27:16 29,926 ----a-r C:\WINDOWS\Installer\{508CE775-4BA4-4748-82DF-FE28DA9F03B0}\MsblIco.Exe
    + 2008-04-10 01:26:19 29,926 ----a-r C:\WINDOWS\Installer\{508CE775-4BA4-4748-82DF-FE28DA9F03B0}\MsblIco.Exe
    - 2007-12-07 02:21:45 124,928 ----a-w C:\WINDOWS\system32\advpack.dll
    + 2008-03-01 13:06:20 124,928 ----a-w C:\WINDOWS\system32\advpack.dll
    - 2007-12-07 02:21:45 124,928 -c----w C:\WINDOWS\system32\dllcache\advpack.dll
    + 2008-03-01 13:06:20 124,928 -c----w C:\WINDOWS\system32\dllcache\advpack.dll
    - 2006-06-26 17:37:10 148,480 -c----w C:\WINDOWS\system32\dllcache\dnsapi.dll
    + 2008-02-20 05:32:43 148,992 -c----w C:\WINDOWS\system32\dllcache\dnsapi.dll
    + 2008-02-20 05:32:43 45,568 -c----w C:\WINDOWS\system32\dllcache\dnsrslvr.dll
    - 2007-12-19 23:01:06 347,136 -c----w C:\WINDOWS\system32\dllcache\dxtmsft.dll
    + 2008-03-01 13:06:21 347,136 -c----w C:\WINDOWS\system32\dllcache\dxtmsft.dll
    - 2007-12-07 02:21:45 214,528 -c----w C:\WINDOWS\system32\dllcache\dxtrans.dll
    + 2008-03-01 13:06:21 214,528 -c----w C:\WINDOWS\system32\dllcache\dxtrans.dll
    - 2007-12-07 02:21:45 133,120 -c----w C:\WINDOWS\system32\dllcache\extmgr.dll
    + 2008-03-01 13:06:21 133,120 -c----w C:\WINDOWS\system32\dllcache\extmgr.dll
    - 2007-06-19 13:31:19 282,112 -c----w C:\WINDOWS\system32\dllcache\gdi32.dll
    + 2008-02-20 06:51:05 282,624 -c----w C:\WINDOWS\system32\dllcache\gdi32.dll
    - 2007-12-07 02:21:45 63,488 -c----w C:\WINDOWS\system32\dllcache\icardie.dll
    + 2008-03-01 13:06:21 63,488 -c----w C:\WINDOWS\system32\dllcache\icardie.dll
    - 2007-12-06 11:00:57 70,656 -c----w C:\WINDOWS\system32\dllcache\ie4uinit.exe
    + 2008-02-29 08:55:23 70,656 -c----w C:\WINDOWS\system32\dllcache\ie4uinit.exe
    - 2007-12-07 02:21:45 153,088 -c----w C:\WINDOWS\system32\dllcache\ieakeng.dll
    + 2008-03-01 13:06:21 153,088 -c----w C:\WINDOWS\system32\dllcache\ieakeng.dll
    - 2007-12-07 02:21:45 230,400 -c----w C:\WINDOWS\system32\dllcache\ieaksie.dll
    + 2008-03-01 13:06:21 230,400 -c----w C:\WINDOWS\system32\dllcache\ieaksie.dll
    - 2007-12-06 04:59:51 161,792 -c----w C:\WINDOWS\system32\dllcache\ieakui.dll
    + 2008-02-15 05:44:25 161,792 -c----w C:\WINDOWS\system32\dllcache\ieakui.dll
    - 2007-12-07 02:21:45 383,488 -c----w C:\WINDOWS\system32\dllcache\ieapfltr.dll
    + 2008-03-01 13:06:22 383,488 -c----w C:\WINDOWS\system32\dllcache\ieapfltr.dll
    - 2007-12-07 02:21:45 384,512 -c----w C:\WINDOWS\system32\dllcache\iedkcs32.dll
    + 2008-03-01 13:06:22 384,512 -c----w C:\WINDOWS\system32\dllcache\iedkcs32.dll
    - 2007-12-07 02:21:46 6,066,176 -c----w C:\WINDOWS\system32\dllcache\ieframe.dll
    + 2008-03-01 13:06:24 6,066,176 -c----w C:\WINDOWS\system32\dllcache\ieframe.dll
    - 2007-12-07 02:21:46 44,544 -c----w C:\WINDOWS\system32\dllcache\iernonce.dll
    + 2008-03-01 13:06:24 44,544 -c----w C:\WINDOWS\system32\dllcache\iernonce.dll
    - 2007-12-07 02:21:46 267,776 -c----w C:\WINDOWS\system32\dllcache\iertutil.dll
    + 2008-03-01 13:06:25 267,776 -c----w C:\WINDOWS\system32\dllcache\iertutil.dll
    - 2007-12-06 11:00:58 13,824 -c----w C:\WINDOWS\system32\dllcache\ieudinit.exe
    + 2008-02-22 10:00:51 13,824 -c----w C:\WINDOWS\system32\dllcache\ieudinit.exe
    - 2007-12-06 11:01:25 625,664 -c----w C:\WINDOWS\system32\dllcache\iexplore.exe
    + 2008-02-29 08:55:46 625,664 -c----w C:\WINDOWS\system32\dllcache\iexplore.exe
    - 2007-12-07 02:21:47 27,648 -c----w C:\WINDOWS\system32\dllcache\jsproxy.dll
    + 2008-03-01 13:06:25 27,648 -c----w C:\WINDOWS\system32\dllcache\jsproxy.dll
    - 2007-12-07 02:21:47 459,264 -c----w C:\WINDOWS\system32\dllcache\msfeeds.dll
    + 2008-03-01 13:06:26 459,264 -c----w C:\WINDOWS\system32\dllcache\msfeeds.dll
    - 2007-12-07 02:21:47 52,224 -c----w C:\WINDOWS\system32\dllcache\msfeedsbs.dll
    + 2008-03-01 13:06:26 52,224 -c----w C:\WINDOWS\system32\dllcache\msfeedsbs.dll
    - 2007-12-08 15:51:48 3,592,192 -c----w C:\WINDOWS\system32\dllcache\mshtml.dll
    + 2008-03-01 22:36:30 3,591,680 -c----w C:\WINDOWS\system32\dllcache\mshtml.dll
    - 2007-12-07 02:21:47 478,208 -c----w C:\WINDOWS\system32\dllcache\mshtmled.dll
    + 2008-03-01 13:06:28 478,208 -c----w C:\WINDOWS\system32\dllcache\mshtmled.dll
    - 2007-12-07 02:21:48 193,024 -c----w C:\WINDOWS\system32\dllcache\msrating.dll
    + 2008-03-01 13:06:28 193,024 -c----w C:\WINDOWS\system32\dllcache\msrating.dll
    - 2007-12-07 02:21:48 671,232 -c----w C:\WINDOWS\system32\dllcache\mstime.dll
    + 2008-03-01 13:06:29 671,232 -c----w C:\WINDOWS\system32\dllcache\mstime.dll
    - 2007-12-07 02:21:48 102,912 -c----w C:\WINDOWS\system32\dllcache\occache.dll
    + 2008-03-01 13:06:29 102,912 -c----w C:\WINDOWS\system32\dllcache\occache.dll
    - 2008-01-11 05:53:32 44,544 -c----w C:\WINDOWS\system32\dllcache\pngfilt.dll
    + 2008-03-01 13:06:29 44,544 -c----w C:\WINDOWS\system32\dllcache\pngfilt.dll
    - 2007-12-07 02:21:48 105,984 -c----w C:\WINDOWS\system32\dllcache\url.dll
    + 2008-03-01 13:06:29 105,984 -c----w C:\WINDOWS\system32\dllcache\url.dll
    - 2007-12-07 02:21:48 1,159,680 -c----w C:\WINDOWS\system32\dllcache\urlmon.dll
    + 2008-03-01 13:06:30 1,159,680 -c----w C:\WINDOWS\system32\dllcache\urlmon.dll
    - 2007-12-07 02:21:48 233,472 -c----w C:\WINDOWS\system32\dllcache\webcheck.dll
    + 2008-03-01 13:06:30 233,472 -c----w C:\WINDOWS\system32\dllcache\webcheck.dll
    - 2007-03-08 13:47:48 1,843,584 -c----w C:\WINDOWS\system32\dllcache\win32k.sys
    + 2008-03-19 09:47:00 1,845,248 -c----w C:\WINDOWS\system32\dllcache\win32k.sys
    - 2007-12-07 02:21:48 824,832 -c----w C:\WINDOWS\system32\dllcache\wininet.dll
    + 2008-03-01 13:06:31 826,368 -c----w C:\WINDOWS\system32\dllcache\wininet.dll
    - 2006-06-26 17:37:10 148,480 ----a-w C:\WINDOWS\system32\dnsapi.dll
    + 2008-02-20 05:32:43 148,992 ----a-w C:\WINDOWS\system32\dnsapi.dll
    - 2007-12-19 23:01:06 347,136 ----a-w C:\WINDOWS\system32\dxtmsft.dll
    + 2008-03-01 13:06:21 347,136 ----a-w C:\WINDOWS\system32\dxtmsft.dll
    - 2007-12-07 02:21:45 214,528 ----a-w C:\WINDOWS\system32\dxtrans.dll
    + 2008-03-01 13:06:21 214,528 ----a-w C:\WINDOWS\system32\dxtrans.dll
    - 2007-12-07 02:21:45 133,120 ----a-w C:\WINDOWS\system32\extmgr.dll
    + 2008-03-01 13:06:21 133,120 ----a-w C:\WINDOWS\system32\extmgr.dll
    - 2008-04-07 23:38:21 154,768 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT
    + 2008-04-10 00:30:55 154,768 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT
    - 2007-12-07 02:21:45 63,488 ----a-w C:\WINDOWS\system32\icardie.dll
    + 2008-03-01 13:06:21 63,488 ----a-w C:\WINDOWS\system32\icardie.dll
    - 2007-12-06 11:00:57 70,656 ----a-w C:\WINDOWS\system32\ie4uinit.exe
    + 2008-02-29 08:55:23 70,656 ----a-w C:\WINDOWS\system32\ie4uinit.exe
    - 2007-12-07 02:21:45 153,088 ----a-w C:\WINDOWS\system32\ieakeng.dll
    + 2008-03-01 13:06:21 153,088 ----a-w C:\WINDOWS\system32\ieakeng.dll
    - 2007-12-07 02:21:45 230,400 ----a-w C:\WINDOWS\system32\ieaksie.dll
    + 2008-03-01 13:06:21 230,400 ----a-w C:\WINDOWS\system32\ieaksie.dll
    - 2007-12-06 04:59:51 161,792 ----a-w C:\WINDOWS\system32\ieakui.dll
    + 2008-02-15 05:44:25 161,792 ----a-w C:\WINDOWS\system32\ieakui.dll
    - 2007-12-07 02:21:45 383,488 ----a-w C:\WINDOWS\system32\ieapfltr.dll
    + 2008-03-01 13:06:22 383,488 ----a-w C:\WINDOWS\system32\ieapfltr.dll
    - 2007-12-07 02:21:45 384,512 ----a-w C:\WINDOWS\system32\iedkcs32.dll
    + 2008-03-01 13:06:22 384,512 ----a-w C:\WINDOWS\system32\iedkcs32.dll
    - 2007-12-07 02:21:46 6,066,176 ----a-w C:\WINDOWS\system32\ieframe.dll
    + 2008-03-01 13:06:24 6,066,176 ----a-w C:\WINDOWS\system32\ieframe.dll
    - 2007-12-07 02:21:46 44,544 ----a-w C:\WINDOWS\system32\iernonce.dll
    + 2008-03-01 13:06:24 44,544 ----a-w C:\WINDOWS\system32\iernonce.dll
    - 2007-12-07 02:21:46 267,776 ----a-w C:\WINDOWS\system32\iertutil.dll
    + 2008-03-01 13:06:25 267,776 ----a-w C:\WINDOWS\system32\iertutil.dll
    - 2007-12-06 11:00:58 13,824 ----a-w C:\WINDOWS\system32\ieudinit.exe
    + 2008-02-22 10:00:51 13,824 ----a-w C:\WINDOWS\system32\ieudinit.exe
    - 2007-12-07 02:21:47 27,648 ----a-w C:\WINDOWS\system32\jsproxy.dll
    + 2008-03-01 13:06:25 27,648 ----a-w C:\WINDOWS\system32\jsproxy.dll
    - 2008-03-05 13:30:56 19,148,408 ----a-w C:\WINDOWS\system32\MRT.exe
    + 2008-04-06 05:56:20 19,836,024 ----a-w C:\WINDOWS\system32\MRT.exe
    - 2007-12-07 02:21:47 459,264 ----a-w C:\WINDOWS\system32\msfeeds.dll
    + 2008-03-01 13:06:26 459,264 ----a-w C:\WINDOWS\system32\msfeeds.dll
    - 2007-12-07 02:21:47 52,224 ----a-w C:\WINDOWS\system32\msfeedsbs.dll
    + 2008-03-01 13:06:26 52,224 ----a-w C:\WINDOWS\system32\msfeedsbs.dll
    - 2007-12-08 15:51:48 3,592,192 ----a-w C:\WINDOWS\system32\mshtml.dll
    + 2008-03-01 22:36:30 3,591,680 ----a-w C:\WINDOWS\system32\mshtml.dll
    - 2007-12-07 02:21:47 478,208 ----a-w C:\WINDOWS\system32\mshtmled.dll
    + 2008-03-01 13:06:28 478,208 ----a-w C:\WINDOWS\system32\mshtmled.dll
    - 2007-12-07 02:21:48 193,024 ----a-w C:\WINDOWS\system32\msrating.dll
    + 2008-03-01 13:06:28 193,024 ----a-w C:\WINDOWS\system32\msrating.dll
    - 2007-12-07 02:21:48 671,232 ----a-w C:\WINDOWS\system32\mstime.dll
    + 2008-03-01 13:06:29 671,232 ----a-w C:\WINDOWS\system32\mstime.dll
    - 2007-12-07 02:21:48 102,912 ----a-w C:\WINDOWS\system32\occache.dll
    + 2008-03-01 13:06:29 102,912 ----a-w C:\WINDOWS\system32\occache.dll
    - 2008-01-11 05:53:32 44,544 ----a-w C:\WINDOWS\system32\pngfilt.dll
    + 2008-03-01 13:06:29 44,544 ----a-w C:\WINDOWS\system32\pngfilt.dll
    - 2007-12-07 02:21:48 105,984 ----a-w C:\WINDOWS\system32\url.dll
    + 2008-03-01 13:06:29 105,984 ----a-w C:\WINDOWS\system32\url.dll
    - 2007-12-07 02:21:48 1,159,680 ----a-w C:\WINDOWS\system32\urlmon.dll
    + 2008-03-01 13:06:30 1,159,680 ----a-w C:\WINDOWS\system32\urlmon.dll
    - 2007-12-07 02:21:48 233,472 ----a-w C:\WINDOWS\system32\webcheck.dll
    + 2008-03-01 13:06:30 233,472 ----a-w C:\WINDOWS\system32\webcheck.dll
    .
    -- Snapshot reset to current date --
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D5E5C1E6-78DB-49F0-A137-8D594F342FD6}]
    2008-03-17 06:33 577816 --a------ C:\Program Files\Me.dium\Me.dium IE Add-on\MediumIEAddOn.dll

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:56 15360]
    "Yahoo! Pager "= "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [2007-08-30 17:43 4670704]
    "MsnMsgr "= "C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SoundMan "= "SOUNDMAN.EXE" [2006-01-11 15:08 577536 C:\WINDOWS\SOUNDMAN.EXE]
    "IgfxTray "= "C:\WINDOWS\System32\igfxtray.exe" [2005-06-21 17:48 155648]
    "HotKeysCmds "= "C:\WINDOWS\System32\hkcmd.exe" [2005-06-21 17:44 126976]
    "RemoteControl "= "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" [2004-11-02 20:24 32768]
    "NeroFilterCheck "= "C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648]
    "BluetoothAuthenticationAgent "= "bthprops.cpl" [2004-08-04 02:56 110592 C:\WINDOWS\system32\bthprops.cpl]
    "CameraFixer "= "C:\WINDOWS\CameraFixer.exe" [2006-10-09 17:32 20480]
    "tsnpstd3 "= "C:\WINDOWS\tsnpstd3.exe" [ ]
    "snp325 "= "C:\WINDOWS\vsnp325.exe" [2006-10-10 14:11 827392]
    "AVG7_CC "= "C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-04-06 00:40 579072]
    "Windows Defender "= "C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20 866584]
    "!AVG Anti-Spyware "= "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 05:25 6731312]
    "SunJavaUpdateSched "= "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "AVG7_Run "= "C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-04-06 00:40 219136]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2005-10-09 01:16:54 610365]
    ZDWLan Utility.lnk - C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe [2008-04-05 21:00:17 475136]

    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
    "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} "= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 12:55 77824]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
    C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 12:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe "=
    "C:\\Program Files\\PoivY.com\\PoivY\\PoivY.exe "=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe "=
    "C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe "=
    "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe "=
    "C:\\Program Files\\Grisoft\\AVG7\\avginet.exe "=
    "C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe "=
    "C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe "=
    "C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe "=
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe "=

    R3 m4301a;Linksys Wireless-B USB Network Adapter v4.0 Driver;C:\WINDOWS\system32\DRIVERS\m4301A.sys [2005-03-09 07:11]
    R3 SNP325;USB PC Camera (SNPSTD325);C:\WINDOWS\system32\DRIVERS\snp325.sys [2006-09-27 12:28]
    S3 ZD1211BU(ZyDAS);ZyDAS ZD1211B IEEE 802.11 b+g Wireless LAN Driver (USB)(ZyDAS);C:\WINDOWS\system32\DRIVERS\zd1211Bu.sys [2005-08-17 14:43]

    *Newly Created Service* - USNJSVC
    *Newly Created Service* - WLSETUPSVC
    .
    Contents of the 'Scheduled Tasks' folder
    "2008-04-10 01:22:53 C:\WINDOWS\Tasks\MP Scheduled Scan.job "
    - C:\Program Files\Windows Defender\MpCmdRun.exe
    "2008-04-10 00:36:08 C:\WINDOWS\Tasks\User_Feed_Synchronization-{54DB8B2F-312A-4218-961B-499CAD9E55B2}.job "
    - C:\WINDOWS\system32\msfeedssync.exe
    .
    **************************************************************************

    catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-04-09 22:59:04
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2008-04-09 22:59:41
    ComboFix-quarantined-files.txt 2008-04-10 02:59:32
    ComboFix2.txt 2008-04-09 04:50:13
    Pre-Run: 68,010,151,936 bytes free
    Post-Run: 67,996,098,560 bytes free
    .
    2008-04-09 20:58:20 --- E O F ---
     
    Naj,
    #7
  9. 2008/04/09
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Looks good. Lets see what an online scan reveals. Please do an online scan with Kaspersky WebScanner

    Click Scan Now and accept the agreement. You will be promted to install an ActiveX component from Kaspersky, Click Yes.
    • The program will launch and then begin downloading the latest definition files:
    • Once the files have been downloaded click on NEXT
    • Now click on Scan Settings
    • In the scan settings make that the following are selected:
      • Scan using the following Anti-Virus database:
      • Extended (if available otherwise Standard)
      • Scan Options:
      • Scan Archives
        Scan Mail Bases
    • Click OK
    • Now under select a target to scan:
      • Select My Computer
    • This will program will start and scan your system.
    • The scan will take a while so be patient and let it run.
    • Once the scan is complete it will display if your system has been infected.
      • Now click on the Save as Text button:
    • Save the file to your desktop.

    Post the Kaspersky log and one more fresh HijackThis log.
     
    noahdfear,
    #8
  10. 2008/04/09
    Naj

    Naj Inactive Thread Starter

    Joined:
    2008/04/08
    Messages:
    45
    Likes Received:
    0
    -------------------------------------------------------------------------------
    KASPERSKY ONLINE SCANNER REPORT
    Thursday, April 10, 2008 12:24:54 AM
    Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
    Kaspersky Online Scanner version: 5.0.98.0
    Kaspersky Anti-Virus database last update: 9/04/2008
    Kaspersky Anti-Virus database records: 692913
    -------------------------------------------------------------------------------

    Scan Settings:
    Scan using the following antivirus database: extended
    Scan Archives: true
    Scan Mail Bases: true

    Scan Target - My Computer:
    A:\
    C:\
    D:\
    E:\

    Scan Statistics:
    Total number of scanned objects: 39969
    Number of viruses found: 1
    Number of infected objects: 7
    Number of suspicious objects: 0
    Duration of the scan process: 00:47:17

    Infected Object Name / Virus Name / Last Action
    C:\Documents and Settings\All Users\Application Data\avg7\Log\emc.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Support\MPLog-04062008-104819.log Object is locked skipped
    C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
    C:\Documents and Settings\N A J O\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\N A J O\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\N A J O\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\N A J O\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{C2707B23-1AA8-40AF-9974-E8E48CDED60D} Object is locked skipped
    C:\Documents and Settings\N A J O\Local Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\N A J O\Local Settings\Temp\~DF2792.tmp Object is locked skipped
    C:\Documents and Settings\N A J O\Local Settings\Temp\~DF7A9D.tmp Object is locked skipped
    C:\Documents and Settings\N A J O\Local Settings\Temp\~DF7AAA.tmp Object is locked skipped
    C:\Documents and Settings\N A J O\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
    C:\Documents and Settings\N A J O\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\N A J O\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\N A J O\ntuser.dat.LOG Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
    C:\Program Files\Common Files\WindowsLiveInstaller\Logs\2008-04-09_21-25_858.log Object is locked skipped
    C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
    C:\System Volume Information\_restore{4110AFD0-D90E-4C3C-8424-7828504F044B}\RP30\A0005598.exe/data.rar/is151942.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.lvo skipped
    C:\System Volume Information\_restore{4110AFD0-D90E-4C3C-8424-7828504F044B}\RP30\A0005598.exe/data.rar Infected: not-a-virus:AdWare.Win32.Virtumonde.lvo skipped
    C:\System Volume Information\_restore{4110AFD0-D90E-4C3C-8424-7828504F044B}\RP30\A0005598.exe RarSFX: infected - 2 skipped
    C:\System Volume Information\_restore{4110AFD0-D90E-4C3C-8424-7828504F044B}\RP30\A0005689.exe/data.rar/is151942.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.lvo skipped
    C:\System Volume Information\_restore{4110AFD0-D90E-4C3C-8424-7828504F044B}\RP30\A0005689.exe/data.rar Infected: not-a-virus:AdWare.Win32.Virtumonde.lvo skipped
    C:\System Volume Information\_restore{4110AFD0-D90E-4C3C-8424-7828504F044B}\RP30\A0005689.exe RarSFX: infected - 2 skipped
    C:\System Volume Information\_restore{4110AFD0-D90E-4C3C-8424-7828504F044B}\RP30\A0005690.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.lvo skipped
    C:\System Volume Information\_restore{4110AFD0-D90E-4C3C-8424-7828504F044B}\RP35\A0005746.exe Object is locked skipped
    C:\System Volume Information\_restore{4110AFD0-D90E-4C3C-8424-7828504F044B}\RP35\A0005757.exe Object is locked skipped
    C:\System Volume Information\_restore{4110AFD0-D90E-4C3C-8424-7828504F044B}\RP37\A0005762.exe Object is locked skipped
    C:\System Volume Information\_restore{4110AFD0-D90E-4C3C-8424-7828504F044B}\RP37\A0005772.exe Object is locked skipped
    C:\System Volume Information\_restore{4110AFD0-D90E-4C3C-8424-7828504F044B}\RP37\A0005783.exe Object is locked skipped
    C:\System Volume Information\_restore{4110AFD0-D90E-4C3C-8424-7828504F044B}\RP37\A0005789.exe Object is locked skipped
    C:\System Volume Information\_restore{4110AFD0-D90E-4C3C-8424-7828504F044B}\RP38\A0005798.exe Object is locked skipped
    C:\System Volume Information\_restore{4110AFD0-D90E-4C3C-8424-7828504F044B}\RP38\A0005808.dll Object is locked skipped
    C:\System Volume Information\_restore{4110AFD0-D90E-4C3C-8424-7828504F044B}\RP38\A0005809.exe Object is locked skipped
    C:\System Volume Information\_restore{4110AFD0-D90E-4C3C-8424-7828504F044B}\RP38\A0005810.exe Object is locked skipped
    C:\System Volume Information\_restore{4110AFD0-D90E-4C3C-8424-7828504F044B}\RP38\A0005811.exe Object is locked skipped
    C:\System Volume Information\_restore{4110AFD0-D90E-4C3C-8424-7828504F044B}\RP38\A0005812.exe Object is locked skipped
    C:\System Volume Information\_restore{4110AFD0-D90E-4C3C-8424-7828504F044B}\RP38\A0005813.exe Object is locked skipped
    C:\System Volume Information\_restore{4110AFD0-D90E-4C3C-8424-7828504F044B}\RP38\A0005815.exe Object is locked skipped
    C:\System Volume Information\_restore{4110AFD0-D90E-4C3C-8424-7828504F044B}\RP38\A0005816.dll Object is locked skipped
    C:\System Volume Information\_restore{4110AFD0-D90E-4C3C-8424-7828504F044B}\RP38\A0005819.dll Object is locked skipped
    C:\System Volume Information\_restore{4110AFD0-D90E-4C3C-8424-7828504F044B}\RP38\A0005820.dll Object is locked skipped
    C:\System Volume Information\_restore{4110AFD0-D90E-4C3C-8424-7828504F044B}\RP38\A0005821.dll Object is locked skipped
    C:\System Volume Information\_restore{4110AFD0-D90E-4C3C-8424-7828504F044B}\RP39\A0005944.exe Object is locked skipped
    C:\System Volume Information\_restore{4110AFD0-D90E-4C3C-8424-7828504F044B}\RP42\A0005978.exe Object is locked skipped
    C:\System Volume Information\_restore{4110AFD0-D90E-4C3C-8424-7828504F044B}\RP51\A0007871.dll Object is locked skipped
    C:\System Volume Information\_restore{4110AFD0-D90E-4C3C-8424-7828504F044B}\RP58\change.log Object is locked skipped
    C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
    C:\WINDOWS\SchedLgU.Txt Object is locked skipped
    C:\WINDOWS\SoftwareDistribution\EventCache\{D45CD21B-61F5-4485-AE7A-C99955655FE3}.bin Object is locked skipped
    C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
    C:\WINDOWS\Sti_Trace.log Object is locked skipped
    C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
    C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
    C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\default Object is locked skipped
    C:\WINDOWS\system32\config\default.LOG Object is locked skipped
    C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
    C:\WINDOWS\system32\config\SAM Object is locked skipped
    C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\SECURITY Object is locked skipped
    C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
    C:\WINDOWS\system32\config\software Object is locked skipped
    C:\WINDOWS\system32\config\software.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\system Object is locked skipped
    C:\WINDOWS\system32\config\system.LOG Object is locked skipped
    C:\WINDOWS\system32\h323log.txt Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
    C:\WINDOWS\wiadebug.log Object is locked skipped
    C:\WINDOWS\wiaservc.log Object is locked skipped
    C:\WINDOWS\WindowsUpdate.log Object is locked skipped

    Scan process completed.
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 12:26:42 AM, on 4/10/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16640)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\WINDOWS\System32\igfxtray.exe
    C:\WINDOWS\System32\hkcmd.exe
    C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
    C:\WINDOWS\CameraFixer.exe
    C:\WINDOWS\vsnp325.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
    C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
    C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe
    C:\Program Files\Windows Live\installer\WLSetupSvc.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\WINDOWS\system32\DllHost.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.ca/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://ca.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://ca.search.yahoo.com
    R3 - URLSearchHook: Yahoo! ¤u¨Ã£¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Me.dium IE Add-on - {D5E5C1E6-78DB-49F0-A137-8D594F342FD6} - "C:\Program Files\Me.dium\Me.dium IE Add-on\MediumIEAddOn.dll" (file missing)
    O3 - Toolbar: Yahoo! ¤u¨Ã£¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe "
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
    O4 - HKLM\..\Run: [CameraFixer] C:\WINDOWS\CameraFixer.exe
    O4 - HKLM\..\Run: [tsnpstd3] C:\WINDOWS\tsnpstd3.exe
    O4 - HKLM\..\Run: [snp325] C:\WINDOWS\vsnp325.exe
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe "
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
    O4 - Global Startup: Bluetooth.lnk = ?
    O4 - Global Startup: ZDWLan Utility.lnk = C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe
    O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: Me.dium - {47F8FF58-8C1E-4584-92CD-CE8B1FE1AF44} - "C:\Program Files\Me.dium\Me.dium IE Add-on\MediumIEAddOn.dll" (file missing)
    O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O15 - Trusted Zone: http://www.atribune.org
    O15 - Trusted Zone: http://deckard.geekstogo.com
    O15 - Trusted Zone: http://www.java.com
    O15 - Trusted Zone: http://by108w.bay108.mail.live.com
    O15 - Trusted Zone: http://www.trendsecure.com
    O15 - Trusted Zone: http://www.windowsbbs.com
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/us/kavwebscan_unicode.cab
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1207359593092
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1207360033748
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://sdlc-esd.sun.com/ESD39/JSCDL...-jc.cab&File=jinstall-6u5-windows-i586-jc.cab
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (file missing)
    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe

    --
    End of file - 8689 bytes
     
    Naj,
    #9
  11. 2008/04/09
    Naj

    Naj Inactive Thread Starter

    Joined:
    2008/04/08
    Messages:
    45
    Likes Received:
    0
    Ist good to have Me.dium...or it doesnt matter?
     
    Naj,
    #10
  12. 2008/04/10
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Looks good. Infected item are in system restore. Lets take care of that. Click Start>Run and type ComboFix /u then hit Enter to uninstall ComboFix and remove the files it has quarantined. This action will also reset the System Restore points, removing the infected files there as well. The C:\Deckard's folder will also be removed. You can delete any logs that were created/saved too.

    Note - Combofix makes some changes when run to prevent autorun/autoplay of ALL CDs, floppies and USB devices, to assist with malware removal & increase security. If this is an issue or makes it difficult for you to use those devices, please ask how to reset it.


    I don't see a problem with Me.dium, just wanted to make sure that you installed it. Everything seem to be OK now?
     
    noahdfear,
    #11
  13. 2008/04/10
    Naj

    Naj Inactive Thread Starter

    Joined:
    2008/04/08
    Messages:
    45
    Likes Received:
    0
    when i typed ComboFix /u in run box windows give me this messege...
    Windows cannot find`ComboFix`.make sure you typed the name correctly ,and try again.To search for a file ,click the start button ,and then click search.

    what if i go ahead delete them directly from my computer by select all and click delete?

    yeah it gives me problem while connecting my wireless which is USB device..
    so what to do?
     
    Naj,
    #12
  14. 2008/04/10
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Assuming ComboFix.exe is still on the Desktop, double click to run it. At the disclaimer screen, where prompted 'Are you sure you want to run this', select No. If ComboFix.exe is still present after it closes, delete it manually, then verify that the C:\qoobox and C:\ComboFix folders are gone.

    Download ATF Cleaner by Atribune and save it to your Desktop.
    • Double click ATF-Cleaner.exe to run the program.
    • Check the boxes to the left of:

      • Windows Temp
      • Current User Temp
      • All Users Temp
      • Temporary Internet Files
      • Prefetch
      • Java Cache
      • Recycle bin

    • The rest are optional - if you want it to remove everything check "Select All ".
    • Finally, click Empty Selected. When you get the "Done Cleaning" message, click OK.
    Reboot


    If you're satisfied that the computer is working properly, clear the System Restore points. They are infected.

    Clear past system restore points and create a new one.
    Right click My Computer and select Properties. On the System Restore tab, check the box to turn System Restore off. Click Apply. Now, uncheck the box and click Apply. Click OK, then OK to close the System Properties dialog.

    Verify a new restore point was created.
    Click Start>All Programs>Accessories>System Tools>System Restore
    Select 'Restore my computer to an earlier time', then click next.
    You should have a newly created System Checkpoint available. If so, click Cancel. If not, click Back and select 'Create a restore point' then click Next. Give the restore point a name and click next.


    I'll send you a PM with instructions for enabling autorun.
     
    noahdfear,
    #13
  15. 2008/04/10
    Naj

    Naj Inactive Thread Starter

    Joined:
    2008/04/08
    Messages:
    45
    Likes Received:
    0
    Thanks alot man now i feel like its my computer ;)
    thank you verymuch...
     
    Naj,
    #14
  16. 2008/04/11
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    noahdfear,
    #15

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...