1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Solved Another tojan

Discussion in 'Malware and Virus Removal Archive' started by lokilokii, 2008/08/29.

  1. 2008/08/29
    lokilokii

    lokilokii Inactive Thread Starter

    Joined:
    2008/08/29
    Messages:
    8
    Likes Received:
    0
    [Resolved] Another tojan

    Hey guys, just a description on whats been happening

    Background was changed too "install antivirus 2008 xp "
    Desktop properties were disabled.
    Computer will not boot up while connected to the internet.
    Bogged down internet speeds
    Browser hijacked.
    Hotmail accounts and paypal accounts hacked.
    New "antivirus" icons on desktop and in program files.

    Ive used "unhack me" to remove some of the rookits so i can now change the background :D, And AVG detected 8 threats and apparently deleted them but im still suffering the same affects.

    Anyway heres my hijack this log

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 1:02:22 PM, on 8/30/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\system32\CTsvcCDA.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\MsPMSPSv.exe
    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
    C:\PROGRA~1\AVG\AVG8\avgemc.exe
    C:\Program Files\Ideazon\Zboard Software\Driver\ZboardTray.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\WINDOWS\system32\Rundll32.exe
    C:\WINDOWS\system32\CTHELPER.EXE
    C:\PROGRA~1\AVG\AVG8\avgtray.exe
    C:\Program Files\Ideazon\Zboard Software\Driver\Zboard.exe
    C:\Program Files\DNA\btdna.exe
    C:\Program Files\NETGEAR\WG111v3\WG111v3.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
    O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
    O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe "
    O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe "
    O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S
    O4 - HKLM\..\Policies\Explorer\Run: [ZboardTray] "C:\Program Files\Ideazon\Zboard Software\Driver\ZboardTray.exe" /autolaunch
    O4 - Global Startup: NETGEAR WG111v3 Smart Wizard.lnk = C:\Program Files\NETGEAR\WG111v3\WG111v3.exe
    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
    O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
    O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-SG/a-UNO1/GAME_UNO1.cab
    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1198218324001
    O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
    O16 - DPF: {BD8667B7-38D8-4C77-B580-18C3E146372C} (Creative Toolbox Plug-in) - http://kiw.imgag.com/imgag/cp/install/crusher-kiwen.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
    O20 - AppInit_DLLs: avgrsstx.dll
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
    O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe

    --
    End of file - 5370 bytes


    Just a side note, this forum account will probably be hacked along with the email i signed up with so i may be posting under another name next time.

    Thanks for anyhelp!
     
    lokilokii,
    #1
  2. 2008/08/29
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Welcome to WindowsBBS lokilokii :)

    Lets get a better look at what we're dealing with first.

    • Download RSIT by random/random and save it to your desktop.
    • Double click RSIT.exe to start the tool and click Continue at the disclaimer.
    • When the scan completes it will open a log named log.txt maximized, and a log named info.txt minimized.
    • Please post the contents of both logs here in your next reply.
     
    noahdfear,
    #2


  3. to hide this advert.

  4. 2008/08/30
    lokilokii

    lokilokii Inactive Thread Starter

    Joined:
    2008/08/29
    Messages:
    8
    Likes Received:
    0
    hey noahdfear, thanks for the speedy reply heres my log.txt

    ogfile of random's system information tool (written by random/random)
    Run by Owner at 2008-08-30 15:14:07
    Microsoft Windows XP Home Edition Service Pack 2
    System drive C: has 32 GB (42%) free of 76 GB
    Total RAM: 1022 MB (61% free)

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 3:14:09 PM, on 8/30/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Ideazon\Zboard Software\Driver\ZboardTray.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\WINDOWS\system32\Rundll32.exe
    C:\WINDOWS\system32\CTHELPER.EXE
    C:\PROGRA~1\AVG\AVG8\avgtray.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\Program Files\DNA\btdna.exe
    C:\Program Files\NETGEAR\WG111v3\WG111v3.exe
    C:\Program Files\Ideazon\Zboard Software\Driver\Zboard.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\system32\CTsvcCDA.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\MsPMSPSv.exe
    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
    C:\PROGRA~1\AVG\AVG8\avgemc.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Internet Explorer\Iexplore.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Documents and Settings\Owner\Desktop\RSIT.exe
    C:\Program Files\Trend Micro\HijackThis\Owner.exe

    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
    O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
    O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe "
    O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe "
    O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S
    O4 - HKLM\..\Policies\Explorer\Run: [ZboardTray] "C:\Program Files\Ideazon\Zboard Software\Driver\ZboardTray.exe" /autolaunch
    O4 - Global Startup: NETGEAR WG111v3 Smart Wizard.lnk = C:\Program Files\NETGEAR\WG111v3\WG111v3.exe
    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
    O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
    O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-SG/a-UNO1/GAME_UNO1.cab
    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1198218324001
    O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
    O16 - DPF: {BD8667B7-38D8-4C77-B580-18C3E146372C} (Creative Toolbox Plug-in) - http://kiw.imgag.com/imgag/cp/install/crusher-kiwen.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
    O20 - AppInit_DLLs: avgrsstx.dll
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
    O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe

    --
    End of file - 5445 bytes

    Scheduled tasks folder

    C:\WINDOWS\tasks\AppleSoftwareUpdate.job

    Registry dump

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]
    AVG Safe Search - C:\Program Files\AVG\AVG8\avgssie.dll [2008-08-30 455960]

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    "NvCplDaemon "=C:\WINDOWS\system32\NvCpl.dll [2008-05-02 13529088]
    "nwiz "=C:\WINDOWS\system32\nwiz.exe [2008-05-02 1630208]
    "QuickTime Task "=C:\Program Files\QuickTime\QTTask.exe [2008-01-10 385024]
    "iTunesHelper "=C:\Program Files\iTunes\iTunesHelper.exe [2008-01-15 267048]
    "NvMediaCenter "=C:\WINDOWS\system32\NvMcTray.dll [2008-05-02 86016]
    "P17Helper "=Rundll32 P17.dll []
    "CTHelper "=C:\WINDOWS\system32\CTHELPER.EXE [2003-08-28 24576]
    "Jet Detection "=C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe [2001-11-29 28672]
    "AVG8_TRAY "=C:\PROGRA~1\AVG\AVG8\avgtray.exe [2008-08-30 1235736]

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
    "ZboardTray "=C:\Program Files\Ideazon\Zboard Software\Driver\ZboardTray.exe [2005-05-02 380928]

    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    "MsnMsgr "=C:\Program Files\Windows Live\Messenger\msnmsgr.exe [2007-10-18 5724184]
    "BitTorrent DNA "=C:\Program Files\DNA\btdna.exe [2008-08-18 342336]
    "Uniblue RegistryBooster 2 "=C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S []

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup
    NETGEAR WG111v3 Smart Wizard.lnk - C:\Program Files\NETGEAR\WG111v3\WG111v3.exe

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
    "AppInit_DLLS "= "avgrsstx.dll "

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
    WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    "{CA4F0D8D-5F2B-4F16-838A-8D52249EAB21} "= []

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
    "authentication packages "=msv1_0
    C:\WINDOWS\system32\ddabb

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\clbdriver.sys]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\clbdriver.sys]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm.sys]

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
    "dontdisplaylastusername "=0
    "legalnoticecaption "=
    "legalnoticetext "=
    "shutdownwithoutlogon "=1
    "undockwithoutlogon "=1

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
    "C:\Program Files\Windows Live\Messenger\msnmsgr.exe "= "C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger "
    "C:\Program Files\Warcraft III\Warcraft III.exe "= "C:\Program Files\Warcraft III\Warcraft III.exe:*:Enabled:Warcraft III "
    "C:\Program Files\THQ\Company of Heroes\RelicCOH.exe "= "C:\Program Files\THQ\Company of Heroes\RelicCOH.exe:*:Enabled:RelicCOH "
    "C:\Program Files\FrostWire\FrostWire.exe "= "C:\Program Files\FrostWire\FrostWire.exe:*:Enabled:LimeWire "
    "C:\Program Files\World of Warcraft\BackgroundDownloader.exe "= "C:\Program Files\World of Warcraft\BackgroundDownloader.exe:*:Enabled:Blizzard Downloader "
    "C:\Program Files\DNA\btdna.exe "= "C:\Program Files\DNA\btdna.exe:*:Enabled:DNA "
    "C:\Program Files\BitTorrent\bittorrent.exe "= "C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent "
    "C:\Program Files\Maxis\SimCity 3000 Unlimited\Apps\Updater\UPDATER.EXE "= "C:\Program Files\Maxis\SimCity 3000 Unlimited\Apps\Updater\UPDATER.EXE:*:Enabled:SC3UpdaterMFC "
    "C:\Program Files\SEGA\Medieval II Total War\medieval2.exe "= "C:\Program Files\SEGA\Medieval II Total War\medieval2.exe:*:Enabled:Medieval 2: Total War "
    "C:\Documents and Settings\Owner\Desktop\Games\Firefly Studios\Stronghold\Stronghold.exe "= "C:\Documents and Settings\Owner\Desktop\Games\Firefly Studios\Stronghold\Stronghold.exe:*:Enabled:Stronghold "
    "C:\WINDOWS\system32\winver.exe "= "C:\WINDOWS\system32\winver.exe:*:Enabled:winver "
    "C:\Sierra\Counter-Strike\cstrike.exe "= "C:\Sierra\Counter-Strike\cstrike.exe:*:Enabled:CounterStrike Launcher "
    "C:\Program Files\EA GAMES\Battlefield 2\BF2.exe "= "C:\Program Files\EA GAMES\Battlefield 2\BF2.exe:*:Enabled:Battlefield 2 "
    "C:\Program Files\FlightGear\bin\win32\fgfs.exe "= "C:\Program Files\FlightGear\bin\win32\fgfs.exe:*:Enabled:fgfs "
    "C:\Program Files\Microsoft Games\Age of Empires II\EMPIRES2.ICD "= "C:\Program Files\Microsoft Games\Age of Empires II\EMPIRES2.ICD:*:Enabled:Age of Empires II "
    "C:\Program Files\Microsoft Games\Age of Empires II\empires2.exe "= "C:\Program Files\Microsoft Games\Age of Empires II\empires2.exe:*:Enabled:Age of Empires II "
    "C:\WINDOWS\system32\dplaysvr.exe "= "C:\WINDOWS\system32\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper "
    "C:\WINDOWS\system32\a.exe "= "C:\WINDOWS\system32\a.exe:*:Disabled:a "
    "C:\Program Files\AVG\AVG8\avgemc.exe "= "C:\Program Files\AVG\AVG8\avgemc.exe:*:Enabled:avgemc.exe "
    "C:\Program Files\AVG\AVG8\avgupd.exe "= "C:\Program Files\AVG\AVG8\avgupd.exe:*:Enabled:avgupd.exe "

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
    "%windir%\system32\sessmgr.exe "= "%windir%\system32\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019 "
    "C:\Program Files\Windows Live\Messenger\msnmsgr.exe "= "C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger "
    "C:\Program Files\Windows Live\Messenger\livecall.exe "= "C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone) "

    List of files/folders created in the last three months

    2008-08-30 15:08:44 ----D---- C:\rsit
    2008-08-30 13:41:54 ----A---- C:\WINDOWS\system32\avgrsstx.dll
    2008-08-30 13:41:38 ----D---- C:\Program Files\AVG
    2008-08-30 12:18:21 ----D---- C:\WINDOWS\SxsCaPendDel
    2008-08-30 12:01:25 ----D---- C:\RootkitNO
    2008-08-30 11:26:26 ----HD---- C:\$AVG8.VAULT$
    2008-08-30 11:14:22 ----A---- C:\WINDOWS\rootkitno.ini
    2008-08-30 11:13:44 ----D---- C:\Documents and Settings\All Users\Application Data\avg8
    2008-08-30 10:56:55 ----D---- C:\Documents and Settings\Owner\Application Data\Help
    2008-08-30 00:49:39 ----D---- C:\Program Files\UnHackMe
    2008-08-30 00:28:54 ----D---- C:\Documents and Settings\Owner\Application Data\rhc1mlj0e5c1
    2008-08-26 08:23:41 ----D---- C:\Documents and Settings\Owner\Application Data\InstallShield
    2008-08-26 08:15:09 ----D---- C:\Documents and Settings\All Users\Application Data\TEMP
    2008-08-19 19:02:22 ----A---- C:\AILog.txt
    2008-08-19 18:23:45 ----D---- C:\Program Files\Microsoft Games
    2008-08-18 22:34:59 ----D---- C:\Documents and Settings\Owner\Application Data\BitTorrent
    2008-08-18 22:34:35 ----D---- C:\Program Files\DNA
    2008-08-18 22:34:35 ----D---- C:\Program Files\BitTorrent
    2008-08-16 16:48:29 ----N---- C:\WINDOWS\{00000000-00000000-0000000B-00001102-00000002-80661102}.BAK
    2008-08-16 16:46:39 ----N---- C:\WINDOWS\system32\SFCVRT32.DLL
    2008-08-16 16:46:39 ----N---- C:\WINDOWS\system32\CTWFLT32.DLL
    2008-08-16 16:46:39 ----N---- C:\WINDOWS\system32\CTL3D.DLL
    2008-08-16 16:46:39 ----N---- C:\WINDOWS\CTRES.DLL
    2008-08-16 16:46:39 ----N---- C:\WINDOWS\CTCCW.DLL
    2008-08-16 16:46:39 ----N---- C:\WINDOWS\AC3API.INI
    2008-08-16 16:46:03 ----A---- C:\WINDOWS\system32\Emu10kx.ini
    2008-08-16 16:46:03 ----A---- C:\WINDOWS\system32\ctzapxx.ini
    2008-08-16 16:46:03 ----A---- C:\WINDOWS\INRES.DLL
    2008-08-16 16:45:57 ----A---- C:\WINDOWS\system32\SFMS32.DLL
    2008-08-16 16:45:57 ----A---- C:\WINDOWS\system32\sfman32.dll
    2008-08-16 16:45:57 ----A---- C:\WINDOWS\system32\REGPLIB.EXE
    2008-08-16 16:45:57 ----A---- C:\WINDOWS\system32\PIAPROXY.DLL
    2008-08-16 16:45:57 ----A---- C:\WINDOWS\system32\OPENAL32.DLL
    2008-08-16 16:45:57 ----A---- C:\WINDOWS\system32\KILLAPPS.EXE
    2008-08-16 16:45:57 ----A---- C:\WINDOWS\system32\KILL.INI
    2008-08-16 16:45:57 ----A---- C:\WINDOWS\system32\ENSDEF.INI
    2008-08-16 16:45:57 ----A---- C:\WINDOWS\system32\ENSDEF.EXE
    2008-08-16 16:45:57 ----A---- C:\WINDOWS\system32\EAXAC3.DLL
    2008-08-16 16:45:57 ----A---- C:\WINDOWS\READREG.EXE
    2008-08-16 16:45:57 ----A---- C:\WINDOWS\PSCONV.EXE
    2008-08-16 16:45:57 ----A---- C:\WINDOWS\MIDIDEF.EXE
    2008-08-16 16:45:57 ----A---- C:\WINDOWS\DEVREG.DLL
    2008-08-16 16:45:57 ----A---- C:\WINDOWS\CTDCRES.DLL
    2008-08-16 16:45:56 ----A---- C:\WINDOWS\system32\CTSPKHLP.DLL
    2008-08-16 16:45:56 ----A---- C:\WINDOWS\system32\CTSCAL.DLL
    2008-08-16 16:45:56 ----A---- C:\WINDOWS\system32\CTSBLFX.DLL
    2008-08-16 16:45:56 ----A---- C:\WINDOWS\system32\CTOSUSER.DLL
    2008-08-16 16:45:56 ----A---- C:\WINDOWS\system32\CTMMEP.DLL
    2008-08-16 16:45:56 ----A---- C:\WINDOWS\system32\CTHELPER.EXE
    2008-08-16 16:45:56 ----A---- C:\WINDOWS\system32\CTEMUPIA.DLL
    2008-08-16 16:45:53 ----A---- C:\WINDOWS\system32\CTDPROXY.DLL
    2008-08-16 16:45:53 ----A---- C:\WINDOWS\system32\CTDCIFCE.DLL
    2008-08-16 16:45:53 ----A---- C:\WINDOWS\system32\CTDC0001.DLL
    2008-08-16 16:45:52 ----A---- C:\WINDOWS\system32\CTDC0000.DLL
    2008-08-16 16:45:52 ----A---- C:\WINDOWS\system32\CTAUDFX.DLL
    2008-08-16 16:45:52 ----A---- C:\WINDOWS\system32\CTASIO.DLL
    2008-08-16 16:45:52 ----A---- C:\WINDOWS\system32\CTAGENT.DLL
    2008-08-16 16:45:51 ----A---- C:\WINDOWS\system32\COMMONFX.DLL
    2008-08-16 16:45:51 ----A---- C:\WINDOWS\system32\AC3API.DLL
    2008-08-16 16:45:51 ----A---- C:\WINDOWS\system32\a3d.dll
    2008-08-16 16:44:20 ----A---- C:\WINDOWS\system32\CTMERes.DLL
    2008-08-16 16:44:20 ----A---- C:\WINDOWS\system32\CTIntRes.dll
    2008-08-16 16:44:20 ----A---- C:\WINDOWS\system32\CTDrmRes.dll
    2008-08-16 16:44:18 ----N---- C:\WINDOWS\system32\Inetwh32.dll
    2008-08-16 16:44:18 ----D---- C:\Media
    2008-08-16 16:44:17 ----N---- C:\WINDOWS\system32\CTMedEng.dll
    2008-08-16 16:44:17 ----N---- C:\WINDOWS\system32\CTDRMUI.dll
    2008-08-16 16:44:12 ----A---- C:\WINDOWS\system32\CTSVCCTL.EXE
    2008-08-16 16:44:12 ----A---- C:\WINDOWS\system32\CTSVCCDA.EXE
    2008-08-16 16:44:12 ----A---- C:\WINDOWS\system32\CTDetres.dll
    2008-08-16 16:43:53 ----A---- C:\WINDOWS\system32\AHQCpURes.dll
    2008-08-16 11:04:35 ----D---- C:\Documents and Settings\Owner\Application Data\Ideazon
    2008-08-16 11:00:43 ----D---- C:\Program Files\Ideazon
    2008-08-15 18:52:06 ----D---- C:\Documents and Settings\Owner\Application Data\yess
    2008-08-14 18:03:58 ----HDC---- C:\WINDOWS\$NtUninstallKB952954$
    2008-08-14 18:03:53 ----HDC---- C:\WINDOWS\$NtUninstallKB953839$
    2008-08-14 18:03:49 ----HDC---- C:\WINDOWS\$NtUninstallKB950974$
    2008-08-14 18:02:50 ----HDC---- C:\WINDOWS\$NtUninstallKB951072-v2$
    2008-08-14 18:02:44 ----HDC---- C:\WINDOWS\$NtUninstallKB952287$
    2008-08-14 18:02:39 ----HDC---- C:\WINDOWS\$NtUninstallKB951066$
    2008-08-14 18:02:24 ----HDC---- C:\WINDOWS\$NtUninstallKB953838$
    2008-08-11 18:35:04 ----D---- C:\Program Files\BitDefender
    2008-08-07 19:37:56 ----D---- C:\Program Files\A Ruler for Windows
    2008-08-02 16:41:11 ----D---- C:\Documents and Settings\All Users\Application Data\nView_Profiles
    2008-07-31 16:02:02 ----D---- C:\Documents and Settings\Owner\Application Data\flightgear.org
    2008-07-31 16:00:40 ----D---- C:\Program Files\FlightGear
    2008-07-30 19:25:49 ----D---- C:\Program Files\Attack on Pearl Harbor Demo
    2008-07-30 14:08:53 ----D---- C:\Program Files\Elektrogames
    2008-07-26 22:38:36 ----D---- C:\Program Files\PDF2EXE
    2008-07-26 12:39:17 ----N---- C:\WINDOWS\Setup1.exe
    2008-07-26 12:39:16 ----A---- C:\WINDOWS\ST6UNST.EXE
    2008-07-21 13:40:41 ----D---- C:\Program Files\Lionhead Studios
    2008-07-18 17:43:03 ----A---- C:\WINDOWS\system32\37iS1cjp.exe.a_a
    2008-07-18 15:28:23 ----A---- C:\WINDOWS\system32\COCj4Cu6.exe.a_a
    2008-07-17 21:34:15 ----D---- C:\Impressions Games
    2008-07-12 12:44:41 ----D---- C:\Program Files\Windows Live Safety Center
    2008-07-11 20:49:14 ----A---- C:\WINDOWS\eSellerateEngine.dll
    2008-07-11 20:47:23 ----A---- C:\WINDOWS\MSNImport.exe
    2008-07-09 23:42:11 ----HDC---- C:\WINDOWS\$NtUninstallKB951748$
    2008-07-08 00:38:45 ----D---- C:\Program Files\EA GAMES
    2008-06-21 12:11:05 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2$
    2008-06-19 21:38:46 ----D---- C:\Program Files\The Creative Assembly
    2008-06-13 16:09:06 ----A---- C:\WINDOWS\system32\CmdLineExt03.dll
    2008-06-12 21:28:48 ----AT---- C:\WINDOWS\system32\SIntfNT.dll
    2008-06-12 21:28:48 ----AT---- C:\WINDOWS\system32\SIntf32.dll
    2008-06-12 21:28:48 ----AT---- C:\WINDOWS\system32\SIntf16.dll
    2008-06-11 16:11:45 ----HDC---- C:\WINDOWS\$NtUninstallKB951698$
    2008-06-11 16:11:39 ----HDC---- C:\WINDOWS\$NtUninstallKB950762$
    2008-06-11 16:11:26 ----HDC---- C:\WINDOWS\$NtUninstallKB950759$
    2008-06-11 16:11:19 ----HDC---- C:\WINDOWS\$NtUninstallKB950760$
    2008-06-11 16:11:12 ----HDC---- C:\WINDOWS\$NtUninstallKB951376$
    2008-06-08 23:56:52 ----A---- C:\WINDOWS\system32\clbinit.dll
    2008-06-08 23:54:09 ----A---- C:\WINDOWS\system32\winver.bat
    2008-06-08 23:51:48 ----A---- C:\WINDOWS\system32\URQQIGAP.DLL.del
    2008-06-08 20:51:33 ----D---- C:\Documents and Settings\Owner\Application Data\Locktime
    2008-06-08 20:49:47 ----D---- C:\Documents and Settings\All Users\Application Data\Locktime
    2008-06-08 20:35:06 ----D---- C:\Program Files\Traffic Shaper XP Server
    2008-06-08 20:35:06 ----A---- C:\WINDOWS\system32\bcevent.dll
    2008-06-08 12:59:19 ----A---- C:\WINDOWS\system32\TrackerNET.dll
    2008-06-08 12:59:19 ----A---- C:\WINDOWS\system32\libmySQL.dll
    2008-06-08 12:55:10 ----A---- C:\WINDOWS\sierra.ini
    2008-06-08 12:55:08 ----D---- C:\Program Files\Sierra On-Line
    2008-06-08 12:48:32 ----A---- C:\fmod.dll
    2008-06-07 13:15:41 ----D---- C:\OEMSettings
    2008-06-07 13:15:13 ----D---- C:\Program Files\NETGEAR
    2008-06-07 13:14:57 ----D---- C:\WINDOWS\Downloaded Installations
    2008-06-07 12:44:47 ----D---- C:\Netgear
    2008-06-04 18:26:34 ----D---- C:\WINDOWS\BDOSCAN8
    2008-06-04 18:17:28 ----A---- C:\smp.bat
    2008-06-04 17:49:20 ----A---- C:\WINDOWS\system32\wrap_oal.dll
    2008-06-04 17:49:18 ----A---- C:\WINDOWS\system32\Ludap17.ini
    2008-06-04 17:48:19 ----A---- C:\WINDOWS\system32\P17RES.DLL
    2008-06-04 17:48:19 ----A---- C:\WINDOWS\system32\P17CPI.DLL
    2008-06-04 17:48:19 ----A---- C:\WINDOWS\system32\P17.DLL
    2008-06-04 17:48:18 ----A---- C:\WINDOWS\system32\EAX.DLL
    2008-06-04 17:48:09 ----AC---- C:\WINDOWS\P17DEF.EXE
    2008-06-04 17:48:09 ----AC---- C:\WINDOWS\OALInst.exe
    2008-06-04 16:33:22 ----D---- C:\Documents and Settings\Owner\Application Data\Uniblue

    List of drivers

    R1 AvgLdx86;AVG Free AVI Loader Driver x86; C:\WINDOWS\system32\System32\Drivers\avgldx86.sys []
    R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86; C:\WINDOWS\system32\System32\Drivers\avgmfx86.sys []
    R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2004-08-04 36096]
    R1 kbdhid;Keyboard HID Driver; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2004-08-03 14848]
    R2 AegisP;AEGIS Protocol (IEEE 802.1x) v3.4.5.0; C:\WINDOWS\system32\DRIVERS\AegisP.sys [2008-06-07 21035]
    R2 AvgTdiX;AVG Free8 Network Redirector; C:\WINDOWS\system32\System32\Drivers\avgtdix.sys []
    R2 PfModNT;PfModNT; \??\C:\WINDOWS\system32\drivers\PfModNT.sys []
    R3 ctac32k;Creative AC3 Software Decoder; C:\WINDOWS\System32\drivers\ctac32k.sys [2003-08-28 186068]
    R3 ctaud2k;Creative Audio Driver (WDM); C:\WINDOWS\system32\drivers\ctaud2k.sys [2003-09-19 496800]
    R3 ctprxy2k;Creative Proxy Driver; C:\WINDOWS\System32\drivers\ctprxy2k.sys [2003-08-28 6144]
    R3 ctsfm2k;Creative SoundFont Management Device Driver; C:\WINDOWS\System32\drivers\ctsfm2k.sys [2003-08-28 136448]
    R3 emupia;E-mu Plug-in Architecture Driver; C:\WINDOWS\System32\drivers\emupia2k.sys [2003-08-28 145504]
    R3 GEARAspiWDM;GEARAspiWDM; C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys [2006-09-19 15664]
    R3 ha10kx2k;Creative Hardware Abstract Layer Driver; C:\WINDOWS\System32\drivers\ha10kx2k.sys [2003-08-28 823456]
    R3 hidusb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2004-08-04 9600]
    R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2004-08-04 12160]
    R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2008-05-02 6554496]
    R3 OmniUsb;Ideazon USB Zboard Driver; C:\WINDOWS\system32\DRIVERS\OmniUsb.sys [2005-09-22 28800]
    R3 OmniUsbl;Ideazon USBl Zboard Driver; C:\WINDOWS\system32\DRIVERS\OmniUsbl.sys [2005-09-22 9696]
    R3 ossrv;Creative OS Services Driver; C:\WINDOWS\system32\drivers\ctoss2k.sys [2003-08-28 113840]
    R3 RTL8187B;NETGEAR WG111v3 54Mbps Wireless USB 2.0 Adapter Vista Driver; C:\WINDOWS\system32\DRIVERS\wg111v3.sys [2007-04-23 224896]
    R3 SISNIC;SiS PCI Fast Ethernet Adapter Driver; C:\WINDOWS\system32\DRIVERS\sisnic.sys [2004-08-04 32768]
    R3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-04 31616]
    R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-04 26624]
    R3 usbhub;Microsoft USB Standard Hub Driver; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-04 57600]
    R3 usbohci;Microsoft USB Open Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2004-08-04 17024]
    S3 ctdvda2k;Creative DVD-Audio Device Driver; C:\WINDOWS\System32\drivers\ctdvda2k.sys []
    S3 ctljystk;Creative SBLive! Gameport; C:\WINDOWS\system32\DRIVERS\ctljystk.sys [2001-08-17 3712]
    S3 ENTECH;ENTECH; \??\C:\WINDOWS\system32\DRIVERS\ENTECH.SYS []
    S3 hap16v2k;Creative P16V HAL Driver; C:\WINDOWS\System32\drivers\hap16v2k.sys [2003-08-28 135696]
    S3 nm;Network Monitor Driver; C:\WINDOWS\system32\DRIVERS\NMnt.sys [2004-08-04 40320]
    S3 NPF;NetGroup Packet Filter Driver; C:\WINDOWS\system32\drivers\npf.sys [2005-08-03 32512]
    S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys [2007-10-31 30464]
    S3 usbaudio;USB Audio Driver (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2004-08-03 59264]
    S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
    S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
    S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
    S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

    List of services

    R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2007-10-31 110592]
    R2 avg8emc;AVG Free8 E-mail Scanner; C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-08-30 875288]
    R2 avg8wd;AVG Free8 WatchDog; C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-08-30 231704]
    R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2007-07-24 229376]
    R2 Creative Service for CDROM Access;Creative Service for CDROM Access; C:\WINDOWS\system32\CTsvcCDA.exe [1999-12-13 44032]
    R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2008-05-02 159812]
    R2 WMDM PMSP Service;WMDM PMSP Service; C:\WINDOWS\system32\MsPMSPSv.exe [2000-06-26 53520]
    R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2008-01-15 504104]
    S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800]
    S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
    S3 rpcapd;Remote Packet Capture Protocol v.0 (experimental); C:\Program Files\WinPcap\rpcapd.exe [2005-08-03 86016]
    S3 usnjsvc;Messenger Sharing Folders USN Journal Reader service; C:\Program Files\Windows Live\Messenger\usnsvc.exe [2007-10-18 98328]
    S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-18 913408]
    S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-06-08 14336]

    -----------------EOF-----------------


    The first time i ran RSIT, both log and info opened up but my system locked up so after reboot it now no longer generates the info.txt
     
    lokilokii,
    #3
  5. 2008/08/31
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Download ComboFix by sUBs from here, saving the file to your desktop.


    Please disable realtime protection applications as they sometimes interfere with the tool. Check this link for your applicable programs.

    • Close all open programs and windows
    • Double click combofix.exe and follow the prompts.
    • It may reboot your computer and resume running when you logon. Wait for it to complete. When finished, it will open a log for you. Post that log in your next reply.
    Note: Do not mouseclick combofix's window while its running. That may cause it to stall
     
    noahdfear,
    #4
  6. 2008/09/02
    lokilokii

    lokilokii Inactive Thread Starter

    Joined:
    2008/08/29
    Messages:
    8
    Likes Received:
    0
    ComboFix 08-09-01.01 - Owner 2008-09-02 19:51:48.1 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.687 [GMT 10:00]
    Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe
    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\smp.bat
    C:\WINDOWS\msnimport.exe
    C:\WINDOWS\system32\actskn43.ocx
    C:\WINDOWS\system32\bbadd.ini
    C:\WINDOWS\system32\bbadd.ini2
    C:\WINDOWS\system32\cavnfdsj.ini
    C:\WINDOWS\system32\nfabyphu.ini
    C:\WINDOWS\system32\nwtulseh.ini
    C:\WINDOWS\system32\utmgijrb.ini

    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    -------\Legacy_CLBDRIVER
    -------\Legacy_DOMAINSERVICE
    -------\Legacy_fci
    -------\Legacy_TDSSSERV
    -------\Service_TDSSserv


    ((((((((((((((((((((((((( Files Created from 2008-08-02 to 2008-09-02 )))))))))))))))))))))))))))))))
    .

    2008-09-02 11:29 . 2008-09-02 11:29 <DIR> d-------- C:\Program Files\MSXML 4.0
    2008-09-01 10:05 . 2008-09-02 19:55 3,376,640 --a------ C:\WINDOWS\{00000000-00000000-0000000B-00001102-00000002-80661102}.BAK
    2008-08-31 22:34 . 2008-08-31 22:34 <DIR> d-------- C:\Program Files\Red Kawa
    2008-08-31 15:15 . 2008-08-31 15:25 1,116 --a------ C:\WINDOWS\system32\tmp.reg
    2008-08-31 15:02 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
    2008-08-31 15:02 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
    2008-08-31 15:02 . 2008-08-31 00:53 88,576 --a------ C:\WINDOWS\system32\AntiXPVSTFix.exe
    2008-08-31 15:02 . 2008-08-27 15:17 87,040 --a------ C:\WINDOWS\system32\VACFix.exe
    2008-08-31 15:02 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe
    2008-08-31 15:02 . 2008-08-28 22:36 82,432 --a------ C:\WINDOWS\system32\IEDFix.C.exe
    2008-08-31 15:02 . 2008-08-18 12:19 82,432 --a------ C:\WINDOWS\system32\404Fix.exe
    2008-08-31 15:02 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
    2008-08-31 15:02 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
    2008-08-31 15:02 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
    2008-08-31 15:00 . 2008-08-31 15:00 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-08-31 15:00 . 2008-08-31 15:00 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Malwarebytes
    2008-08-31 15:00 . 2008-08-31 15:00 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-08-31 15:00 . 2008-08-17 15:01 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
    2008-08-31 15:00 . 2008-08-17 15:01 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
    2008-08-31 12:42 . 2008-08-31 12:42 <DIR> d-------- C:\Program Files\CCleaner
    2008-08-31 00:27 . 2008-08-31 00:27 <DIR> d-------- C:\Program Files\Lavasoft
    2008-08-31 00:27 . 2008-08-31 00:32 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
    2008-08-30 19:26 . 2008-08-31 14:46 <DIR> d-------- C:\Program Files\Enigma Software Group
    2008-08-30 18:25 . 2008-08-30 18:25 <DIR> d-------- C:\Program Files\Trend Micro
    2008-08-30 15:08 . 2008-08-30 15:08 <DIR> d-------- C:\rsit
    2008-08-30 13:41 . 2008-09-02 19:26 <DIR> d-------- C:\WINDOWS\system32\drivers\Avg
    2008-08-30 13:41 . 2008-08-30 13:41 <DIR> d-------- C:\Program Files\AVG
    2008-08-30 13:41 . 2008-08-30 13:46 97,928 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys
    2008-08-30 13:41 . 2008-08-30 13:41 76,040 --a------ C:\WINDOWS\system32\drivers\avgtdix.sys
    2008-08-30 13:41 . 2008-08-30 13:41 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll
    2008-08-30 12:18 . 2008-08-30 13:17 <DIR> d-------- C:\WINDOWS\SxsCaPendDel
    2008-08-30 12:01 . 2008-08-30 12:01 <DIR> d-------- C:\RootkitNO
    2008-08-30 11:26 . 2008-09-02 11:06 <DIR> d--h----- C:\$AVG8.VAULT$
    2008-08-30 11:14 . 2008-08-30 12:01 134 --a------ C:\WINDOWS\rootkitno.ini
    2008-08-30 11:13 . 2008-08-30 13:41 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg8
    2008-08-30 00:49 . 2008-08-30 12:18 <DIR> d-------- C:\Program Files\UnHackMe
    2008-08-26 08:23 . 2008-08-26 08:23 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\InstallShield
    2008-08-26 08:15 . 2008-08-26 08:15 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\TEMP
    2008-08-19 18:23 . 2008-09-02 11:23 <DIR> d-------- C:\Program Files\Microsoft Games
    2008-08-18 22:34 . 2008-09-02 19:40 <DIR> d-------- C:\Program Files\DNA
    2008-08-18 22:34 . 2008-08-18 22:34 <DIR> d-------- C:\Program Files\BitTorrent
    2008-08-18 22:34 . 2008-08-30 17:47 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\BitTorrent
    2008-08-16 23:11 . 2008-09-02 19:54 17,456 --a------ C:\WINDOWS\system32\BMXStateBkp-{00000000-00000000-0000000B-00001102-00000002-80661102}.rfx
    2008-08-16 23:11 . 2008-09-02 19:54 17,456 --a------ C:\WINDOWS\system32\BMXState-{00000000-00000000-0000000B-00001102-00000002-80661102}.rfx
    2008-08-16 23:11 . 2008-09-02 19:54 288 --a------ C:\WINDOWS\system32\DVCStateBkp-{00000000-00000000-0000000B-00001102-00000002-80661102}.dat
    2008-08-16 23:11 . 2008-09-02 19:54 288 --a------ C:\WINDOWS\system32\DVCState-{00000000-00000000-0000000B-00001102-00000002-80661102}.dat
    2008-08-16 16:48 . 2008-09-02 19:55 3,376,640 --a------ C:\WINDOWS\{00000000-00000000-0000000B-00001102-00000002-80661102}.CDF
    2008-08-16 16:45 . 2000-12-05 11:11 4,174,814 --a------ C:\WINDOWS\system32\CT4MGM.SF2
    2008-08-16 16:44 . 2008-08-16 16:44 <DIR> d-------- C:\Media
    2008-08-16 16:43 . 2001-05-28 13:47 32,768 --a------ C:\WINDOWS\system32\AudioHQU.cpl
    2008-08-16 16:43 . 2003-03-05 14:19 15,840 --------- C:\WINDOWS\system32\drivers\PFMODNT.SYS
    2008-08-16 16:43 . 2001-05-28 13:47 12,288 --a------ C:\WINDOWS\system32\AHQCpURes.dll
    2008-08-16 16:42 . 2001-10-22 11:10 4,398 --a------ C:\WINDOWS\system32\SBLive.ico
    2008-08-16 16:42 . 2001-10-22 11:10 3,126 --a------ C:\WINDOWS\system32\Live.bmp
    2008-08-16 11:04 . 2008-08-16 11:04 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Ideazon
    2008-08-16 11:00 . 2008-08-16 11:00 <DIR> d-------- C:\Program Files\Ideazon
    2008-08-16 11:00 . 2005-05-02 15:41 49,152 --a------ C:\WINDOWS\system32\ZboardConfig.cpl
    2008-08-16 11:00 . 2005-09-22 16:22 28,800 -ra------ C:\WINDOWS\system32\drivers\OmniUsb.sys
    2008-08-16 11:00 . 2005-09-22 16:22 9,696 -ra------ C:\WINDOWS\system32\drivers\OmniUsbl.sys
    2008-08-15 18:52 . 2008-08-15 18:52 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\yess
    2008-08-02 16:41 . 2008-08-02 16:41 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\nView_Profiles

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-09-02 01:29 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-08-30 14:27 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
    2008-08-30 05:33 --------- d-----w C:\Documents and Settings\Owner\Application Data\DNA
    2008-08-29 05:21 --------- d-----w C:\Program Files\World of Warcraft
    2008-08-26 10:10 --------- d-----w C:\Documents and Settings\Owner\Application Data\OpenOffice.org2
    2008-08-26 09:49 --------- d-----w C:\Program Files\Incomplete
    2008-08-26 09:33 --------- d-----w C:\Program Files\FrostWire
    2008-08-25 22:22 --------- d-----w C:\Program Files\Electronic Arts
    2008-08-16 06:48 --------- d-----w C:\Program Files\Creative
    2008-08-11 09:08 81,984 ----a-w C:\WINDOWS\system32\bdod.bin
    2008-08-10 11:48 --------- d-----w C:\Program Files\Warcraft III
    2008-07-31 09:11 --------- d-----w C:\Program Files\FlightGear
    2008-07-31 06:32 --------- d-----w C:\Documents and Settings\Owner\Application Data\flightgear.org
    2008-07-30 10:45 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
    2008-07-30 09:03 --------- d-----w C:\Program Files\Wesnoth
    2008-07-29 03:40 --------- d-----w C:\Program Files\Common Files\InstallShield
    2008-07-26 12:38 --------- d-----w C:\Program Files\PDF2EXE
    2008-07-26 02:39 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE
    2008-07-26 02:39 286,720 ------w C:\WINDOWS\Setup1.exe
    2008-07-21 03:40 --------- d-----w C:\Program Files\Lionhead Studios
    2008-07-19 11:34 --------- d-----w C:\Documents and Settings\Owner\Application Data\SystemRequirementsLab
    2008-07-18 12:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
    2008-07-18 12:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
    2008-07-18 12:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
    2008-07-18 12:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
    2008-07-18 12:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
    2008-07-18 12:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
    2008-07-18 12:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
    2008-07-18 12:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
    2008-07-18 12:07 270,880 ----a-w C:\WINDOWS\system32\mucltui.dll
    2008-07-18 12:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll
    2008-07-17 11:34 --------- d-----w C:\Program Files\Sierra On-Line
    2008-07-13 02:09 --------- d-----w C:\Program Files\Windows Live
    2008-07-12 02:44 --------- d-----w C:\Program Files\Windows Live Safety Center
    2008-07-11 10:49 356,352 ----a-w C:\WINDOWS\eSellerateEngine.dll
    2008-07-07 20:32 253,952 ----a-w C:\WINDOWS\system32\es.dll
    2008-07-07 14:38 --------- d-----w C:\Program Files\EA GAMES
    2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
    2008-06-23 15:38 659,456 ----a-w C:\WINDOWS\system32\wininet.dll
    2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
    2008-06-13 12:00 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll
    2008-06-13 06:04 21,840 ----atw C:\WINDOWS\system32\SIntfNT.dll
    2008-06-13 06:04 17,212 ----atw C:\WINDOWS\system32\SIntf32.dll
    2008-06-13 06:04 12,067 ----atw C:\WINDOWS\system32\SIntf16.dll
    2008-06-11 06:25 1,536 ----a-w C:\WINDOWS\system32\bcevent.dll
    2008-06-08 13:54 14,336 ----a-w C:\WINDOWS\system32\svchost.exe
    2008-06-04 07:49 409,600 ----a-w C:\WINDOWS\system32\wrap_oal.dll
    2007-04-23 04:21 269,824 -c--a-w C:\WINDOWS\inf\WG111v3\Vista64\wg111v3.sys
    2007-04-23 04:11 224,896 -c--a-w C:\WINDOWS\inf\WG111v3\wg111v3.sys
    2006-12-15 01:30 98,304 -c--a-w C:\WINDOWS\inf\WG111v3\UScanM.exe
    2006-12-15 01:30 66,048 -c--a-w C:\WINDOWS\inf\WG111v3\EAPPkt.sys
    2006-12-15 01:30 315,392 -c--a-w C:\WINDOWS\inf\WG111v3\InstallDriver.exe
    2006-12-15 01:30 28,672 -c--a-w C:\WINDOWS\inf\WG111v3\SetDrv.exe
    2006-12-15 01:30 212,992 -c--a-w C:\WINDOWS\inf\WG111v3\CopyWHQLDriver.exe
    2006-12-15 01:30 20,480 -c--a-w C:\WINDOWS\inf\WG111v3\RTWUPath.exe
    2006-12-15 01:30 19,968 -c--a-w C:\WINDOWS\inf\WG111v3\RTWREFU.EXE
    .
    Code:
    <pre>
-c--a-w            28,672 2008-01-16 00:23:45  C:\Program Files\Creative\SBLive\Program\ADGJDet .exe
-c--a-w           267,048 2008-01-22 23:58:59  C:\Program Files\iTunes\iTunesHelper .exe
-c--a-w           132,496 2008-01-17 01:00:33  C:\Program Files\Java\jre1.6.0_03\bin\jusched .exe
-c--a-w           471,040 2008-01-06 01:03:54  C:\Program Files\Winamp Remote\bin\OrbTray .exe
-c--a-w         5,724,184 2008-01-23 01:28:10  C:\Program Files\Windows Live\Messenger\msnmsgr     .exe
-c--a-w            90,112 2008-01-17 01:00:33  C:\WINDOWS\UpdReg .EXE
</pre>

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "MsnMsgr "= "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 10:34 5724184]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "NvCplDaemon "= "C:\WINDOWS\system32\NvCpl.dll" [2008-05-02 22:46 13529088]
    "iTunesHelper "= "C:\Program Files\iTunes\iTunesHelper.exe" [2008-01-15 02:22 267048]
    "NvMediaCenter "= "C:\WINDOWS\system32\NvMcTray.dll" [2008-05-02 22:46 86016]
    "Jet Detection "= "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe" [2001-11-29 01:00 28672]
    "AVG8_TRAY "= "C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-08-30 13:46 1235736]
    "nwiz "= "nwiz.exe" [2008-05-02 22:46 1630208 C:\WINDOWS\system32\nwiz.exe]
    "P17Helper "= "P17.dll" [2005-05-04 09:38 64512 C:\WINDOWS\system32\P17.DLL]
    "CTHelper "= "CTHELPER.EXE" [2003-08-28 18:45 24576 C:\WINDOWS\system32\CTHELPER.EXE]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run]
    "ZboardTray "= "C:\Program Files\Ideazon\Zboard Software\Driver\ZboardTray.exe" [2005-05-02 15:41 380928]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    NETGEAR WG111v3 Smart Wizard.lnk - C:\Program Files\NETGEAR\WG111v3\WG111v3.exe [2007-09-12 15:14:42 1527808]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs "=avgrsstx.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "msacm.ctmp3 "= C:\WINDOWS\system32\ctmp3.acm

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
    SecurityProviders msapsspc.dllschannel.dlldigest.dllmsnsspc.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
    --a------ 2008-01-10 14:27 385024 C:\Program Files\QuickTime\QTTask.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Uniblue RegistryBooster 2]
    C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe [N/A]

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusOverride "=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
    "C:\\Program Files\\Warcraft III\\Warcraft III.exe "=
    "C:\\Program Files\\THQ\\Company of Heroes\\RelicCOH.exe "=
    "C:\\Program Files\\FrostWire\\FrostWire.exe "=
    "C:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe "=
    "C:\\Program Files\\BitTorrent\\bittorrent.exe "=
    "C:\\WINDOWS\\system32\\winver.exe "=
    "C:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe "=
    "C:\\Program Files\\Microsoft Games\\Age of Empires II\\EMPIRES2.ICD "=
    "C:\\Program Files\\Microsoft Games\\Age of Empires II\\empires2.exe "=
    "C:\\WINDOWS\\system32\\dplaysvr.exe "=
    "C:\\Program Files\\AVG\\AVG8\\avgemc.exe "=
    "C:\\Program Files\\AVG\\AVG8\\avgupd.exe "=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "6112:TCP "= 6112:TCP:hehe
    "3724:TCP "= 3724:TCP:Blizzard Downloader: 3724
    "59560:TCP "= 59560:TCP:59560

    R1 AvgLdx86;AVG Free AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-08-30 13:46]
    R2 avg8emc;AVG Free8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-08-30 13:46]
    R2 avg8wd;AVG Free8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-08-30 13:46]
    R2 AvgTdiX;AVG Free8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-08-30 13:41]
    S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys [2005-08-03 07:10]
    S3 RTL8187B;NETGEAR WG111v3 54Mbps Wireless USB 2.0 Adapter Vista Driver;C:\WINDOWS\system32\DRIVERS\wg111v3.sys [2007-04-23 14:11]
    .
    Contents of the 'Scheduled Tasks' folder
    .
    .
    ------- Supplementary Scan -------
    .
    FireFox -: Profile - C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\1ptw362o.default\
    FF -: plugin - C:\Program Files\DivX\DivX Content Uploader\npUpload.dll
    FF -: plugin - C:\Program Files\DNA\plugins\npbtdna.dll
    FF -: plugin - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
    FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\npbittorrent.dll
    .

    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-09-02 19:55:19
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    ------------------------ Other Running Processes ------------------------
    .
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\system32\CTSVCCDA.EXE
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\MsPMSPSv.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\Program Files\AVG\AVG8\avgrsx.exe
    .
    **************************************************************************
    .
    Completion time: 2008-09-02 20:01:00 - machine was rebooted [Owner]
    ComboFix-quarantined-files.txt 2008-09-02 10:00:57

    Pre-Run: 30,448,254,976 bytes free
    Post-Run: 30,888,472,576 bytes free

    255 --- E O F --- 2008-08-14 08:04:01
     
    lokilokii,
    #5
  7. 2008/09/02
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Once again, please disable any realtime protection applications. Highlight and copy the contents of the code box below and paste it into a blank notepad, then save it to your desktop as;

    Filename: CFScript.txt
    Save As Type: All Files (*.*)

    Code:
    RenV::
-c--a-w            28,672 2008-01-16 00:23:45  C:\Program Files\Creative\SBLive\Program\ADGJDet .exe
-c--a-w           267,048 2008-01-22 23:58:59  C:\Program Files\iTunes\iTunesHelper .exe
-c--a-w           132,496 2008-01-17 01:00:33  C:\Program Files\Java\jre1.6.0_03\bin\jusched .exe
-c--a-w           471,040 2008-01-06 01:03:54  C:\Program Files\Winamp Remote\bin\OrbTray .exe
-c--a-w         5,724,184 2008-01-23 01:28:10  C:\Program Files\Windows Live\Messenger\msnmsgr     .exe
-c--a-w            90,112 2008-01-17 01:00:33  C:\WINDOWS\UpdReg .EXE
Registry::
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
 "SecurityProviders "= "msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll "
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\Auth orizedApplications\List]
 "C:\\WINDOWS\\system32\\winver.exe "=-
    Close all other windows and programs. Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button. Combofix should run and may reboot the computer when it's done. A log will open when it's complete. Post the contents of that log.

    Please do not click on the ComboFix window while it is running a scan. This can cause it to stall.

    **NOTE - Allow ComboFix to update if prompted.
     
    noahdfear,
    #6
  8. 2008/09/03
    lokilokii

    lokilokii Inactive Thread Starter

    Joined:
    2008/08/29
    Messages:
    8
    Likes Received:
    0
    Thanks again for the help ;

    ComboFix 08-09-01.04 - Owner 2008-09-03 16:23:01.2 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.647 [GMT 10:00]
    Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe
    Command switches used :: C:\Documents and Settings\Owner\Desktop\CFScript.txt.txt
    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    ((((((((((((((((((((((((( Files Created from 2008-08-03 to 2008-09-03 )))))))))))))))))))))))))))))))
    .

    2008-09-03 16:02 . 2008-09-03 16:10 <DIR> d-------- C:\WINDOWS\system32\CatRoot_bak
    2008-09-02 11:29 . 2008-09-02 11:29 <DIR> d-------- C:\Program Files\MSXML 4.0
    2008-09-01 10:05 . 2008-09-03 16:21 3,376,640 --a------ C:\WINDOWS\{00000000-00000000-0000000B-00001102-00000002-80661102}.BAK
    2008-08-31 22:34 . 2008-08-31 22:34 <DIR> d-------- C:\Program Files\Red Kawa
    2008-08-31 15:15 . 2008-08-31 15:25 1,116 --a------ C:\WINDOWS\system32\tmp.reg
    2008-08-31 15:02 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
    2008-08-31 15:02 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
    2008-08-31 15:02 . 2008-08-31 00:53 88,576 --a------ C:\WINDOWS\system32\AntiXPVSTFix.exe
    2008-08-31 15:02 . 2008-08-27 15:17 87,040 --a------ C:\WINDOWS\system32\VACFix.exe
    2008-08-31 15:02 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe
    2008-08-31 15:02 . 2008-08-28 22:36 82,432 --a------ C:\WINDOWS\system32\IEDFix.C.exe
    2008-08-31 15:02 . 2008-08-18 12:19 82,432 --a------ C:\WINDOWS\system32\404Fix.exe
    2008-08-31 15:02 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
    2008-08-31 15:02 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
    2008-08-31 15:02 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
    2008-08-31 15:00 . 2008-08-31 15:00 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-08-31 15:00 . 2008-08-31 15:00 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Malwarebytes
    2008-08-31 15:00 . 2008-08-31 15:00 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-08-31 15:00 . 2008-08-17 15:01 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
    2008-08-31 15:00 . 2008-08-17 15:01 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
    2008-08-31 12:42 . 2008-08-31 12:42 <DIR> d-------- C:\Program Files\CCleaner
    2008-08-31 00:27 . 2008-08-31 00:27 <DIR> d-------- C:\Program Files\Lavasoft
    2008-08-31 00:27 . 2008-08-31 00:32 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
    2008-08-30 19:26 . 2008-08-31 14:46 <DIR> d-------- C:\Program Files\Enigma Software Group
    2008-08-30 18:25 . 2008-08-30 18:25 <DIR> d-------- C:\Program Files\Trend Micro
    2008-08-30 15:08 . 2008-08-30 15:08 <DIR> d-------- C:\rsit
    2008-08-30 13:41 . 2008-09-03 08:22 <DIR> d-------- C:\WINDOWS\system32\drivers\Avg
    2008-08-30 13:41 . 2008-08-30 13:41 <DIR> d-------- C:\Program Files\AVG
    2008-08-30 13:41 . 2008-08-30 13:46 97,928 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys
    2008-08-30 13:41 . 2008-08-30 13:41 76,040 --a------ C:\WINDOWS\system32\drivers\avgtdix.sys
    2008-08-30 13:41 . 2008-08-30 13:41 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll
    2008-08-30 12:18 . 2008-08-30 13:17 <DIR> d-------- C:\WINDOWS\SxsCaPendDel
    2008-08-30 12:01 . 2008-08-30 12:01 <DIR> d-------- C:\RootkitNO
    2008-08-30 11:26 . 2008-09-02 11:06 <DIR> d--h----- C:\$AVG8.VAULT$
    2008-08-30 11:14 . 2008-08-30 12:01 134 --a------ C:\WINDOWS\rootkitno.ini
    2008-08-30 11:13 . 2008-08-30 13:41 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg8
    2008-08-30 00:49 . 2008-08-30 12:18 <DIR> d-------- C:\Program Files\UnHackMe
    2008-08-26 08:23 . 2008-08-26 08:23 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\InstallShield
    2008-08-26 08:15 . 2008-08-26 08:15 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\TEMP
    2008-08-19 18:23 . 2008-09-02 11:23 <DIR> d-------- C:\Program Files\Microsoft Games
    2008-08-18 22:34 . 2008-09-02 19:40 <DIR> d-------- C:\Program Files\DNA
    2008-08-18 22:34 . 2008-08-18 22:34 <DIR> d-------- C:\Program Files\BitTorrent
    2008-08-18 22:34 . 2008-08-30 17:47 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\BitTorrent
    2008-08-16 23:11 . 2008-09-03 08:38 16,376 --a------ C:\WINDOWS\system32\BMXStateBkp-{00000000-00000000-0000000B-00001102-00000002-80661102}.rfx
    2008-08-16 23:11 . 2008-09-03 08:38 16,376 --a------ C:\WINDOWS\system32\BMXState-{00000000-00000000-0000000B-00001102-00000002-80661102}.rfx
    2008-08-16 23:11 . 2008-09-03 08:38 288 --a------ C:\WINDOWS\system32\DVCStateBkp-{00000000-00000000-0000000B-00001102-00000002-80661102}.dat
    2008-08-16 23:11 . 2008-09-03 08:38 288 --a------ C:\WINDOWS\system32\DVCState-{00000000-00000000-0000000B-00001102-00000002-80661102}.dat
    2008-08-16 16:48 . 2008-09-03 16:21 3,376,640 --a------ C:\WINDOWS\{00000000-00000000-0000000B-00001102-00000002-80661102}.CDF
    2008-08-16 16:45 . 2000-12-05 11:11 4,174,814 --a------ C:\WINDOWS\system32\CT4MGM.SF2
    2008-08-16 16:44 . 2008-08-16 16:44 <DIR> d-------- C:\Media
    2008-08-16 16:43 . 2001-05-28 13:47 32,768 --a------ C:\WINDOWS\system32\AudioHQU.cpl
    2008-08-16 16:43 . 2003-03-05 14:19 15,840 --------- C:\WINDOWS\system32\drivers\PFMODNT.SYS
    2008-08-16 16:43 . 2001-05-28 13:47 12,288 --a------ C:\WINDOWS\system32\AHQCpURes.dll
    2008-08-16 16:42 . 2001-10-22 11:10 4,398 --a------ C:\WINDOWS\system32\SBLive.ico
    2008-08-16 16:42 . 2001-10-22 11:10 3,126 --a------ C:\WINDOWS\system32\Live.bmp
    2008-08-16 11:04 . 2008-08-16 11:04 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Ideazon
    2008-08-16 11:00 . 2008-08-16 11:00 <DIR> d-------- C:\Program Files\Ideazon
    2008-08-16 11:00 . 2005-05-02 15:41 49,152 --a------ C:\WINDOWS\system32\ZboardConfig.cpl
    2008-08-16 11:00 . 2005-09-22 16:22 28,800 -ra------ C:\WINDOWS\system32\drivers\OmniUsb.sys
    2008-08-16 11:00 . 2005-09-22 16:22 9,696 -ra------ C:\WINDOWS\system32\drivers\OmniUsbl.sys
    2008-08-15 18:52 . 2008-08-15 18:52 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\yess

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-09-03 06:23 --------- d-----w C:\Program Files\iTunes
    2008-09-02 01:29 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-08-30 14:27 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
    2008-08-30 05:33 --------- d-----w C:\Documents and Settings\Owner\Application Data\DNA
    2008-08-29 05:21 --------- d-----w C:\Program Files\World of Warcraft
    2008-08-26 10:10 --------- d-----w C:\Documents and Settings\Owner\Application Data\OpenOffice.org2
    2008-08-26 09:49 --------- d-----w C:\Program Files\Incomplete
    2008-08-26 09:33 --------- d-----w C:\Program Files\FrostWire
    2008-08-25 22:22 --------- d-----w C:\Program Files\Electronic Arts
    2008-08-16 06:48 --------- d-----w C:\Program Files\Creative
    2008-08-11 09:08 81,984 ----a-w C:\WINDOWS\system32\bdod.bin
    2008-08-10 11:48 --------- d-----w C:\Program Files\Warcraft III
    2008-08-02 06:41 --------- d-----w C:\Documents and Settings\All Users\Application Data\nView_Profiles
    2008-07-31 09:11 --------- d-----w C:\Program Files\FlightGear
    2008-07-31 06:32 --------- d-----w C:\Documents and Settings\Owner\Application Data\flightgear.org
    2008-07-30 10:45 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
    2008-07-30 09:03 --------- d-----w C:\Program Files\Wesnoth
    2008-07-29 03:40 --------- d-----w C:\Program Files\Common Files\InstallShield
    2008-07-26 12:38 --------- d-----w C:\Program Files\PDF2EXE
    2008-07-26 02:39 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE
    2008-07-26 02:39 286,720 ------w C:\WINDOWS\Setup1.exe
    2008-07-21 03:40 --------- d-----w C:\Program Files\Lionhead Studios
    2008-07-19 11:34 --------- d-----w C:\Documents and Settings\Owner\Application Data\SystemRequirementsLab
    2008-07-18 12:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
    2008-07-18 12:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
    2008-07-18 12:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
    2008-07-18 12:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
    2008-07-18 12:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
    2008-07-18 12:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
    2008-07-18 12:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
    2008-07-18 12:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
    2008-07-18 12:07 270,880 ----a-w C:\WINDOWS\system32\mucltui.dll
    2008-07-18 12:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll
    2008-07-17 11:34 --------- d-----w C:\Program Files\Sierra On-Line
    2008-07-13 02:09 --------- d-----w C:\Program Files\Windows Live
    2008-07-12 02:44 --------- d-----w C:\Program Files\Windows Live Safety Center
    2008-07-11 10:49 356,352 ----a-w C:\WINDOWS\eSellerateEngine.dll
    2008-07-07 20:32 253,952 ----a-w C:\WINDOWS\system32\es.dll
    2008-07-07 14:38 --------- d-----w C:\Program Files\EA GAMES
    2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
    2008-06-23 15:38 659,456 ----a-w C:\WINDOWS\system32\wininet.dll
    2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
    2008-06-13 12:00 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll
    2008-06-13 06:04 21,840 ----atw C:\WINDOWS\system32\SIntfNT.dll
    2008-06-13 06:04 17,212 ----atw C:\WINDOWS\system32\SIntf32.dll
    2008-06-13 06:04 12,067 ----atw C:\WINDOWS\system32\SIntf16.dll
    2008-06-11 06:25 1,536 ----a-w C:\WINDOWS\system32\bcevent.dll
    2008-06-08 13:54 14,336 ----a-w C:\WINDOWS\system32\svchost.exe
    2008-06-04 07:49 409,600 ----a-w C:\WINDOWS\system32\wrap_oal.dll
    2007-04-23 04:21 269,824 -c--a-w C:\WINDOWS\inf\WG111v3\Vista64\wg111v3.sys
    2007-04-23 04:11 224,896 -c--a-w C:\WINDOWS\inf\WG111v3\wg111v3.sys
    2006-12-15 01:30 98,304 -c--a-w C:\WINDOWS\inf\WG111v3\UScanM.exe
    2006-12-15 01:30 66,048 -c--a-w C:\WINDOWS\inf\WG111v3\EAPPkt.sys
    2006-12-15 01:30 315,392 -c--a-w C:\WINDOWS\inf\WG111v3\InstallDriver.exe
    2006-12-15 01:30 28,672 -c--a-w C:\WINDOWS\inf\WG111v3\SetDrv.exe
    2006-12-15 01:30 212,992 -c--a-w C:\WINDOWS\inf\WG111v3\CopyWHQLDriver.exe
    2006-12-15 01:30 20,480 -c--a-w C:\WINDOWS\inf\WG111v3\RTWUPath.exe
    2006-12-15 01:30 19,968 -c--a-w C:\WINDOWS\inf\WG111v3\RTWREFU.EXE
    .

    ((((((((((((((((((((((((((((( snapshot@2008-09-02_20.00.39.98 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2008-09-02 13:32:46 32,768 ----a-r C:\WINDOWS\Installer\{C04E32E0-0416-434D-AFB9-6969D703A9EF}\icon.exe
    - 2003-04-18 06:46:22 1,233,920 ----a-w C:\WINDOWS\system32\msxml4.dll
    + 2007-05-08 05:03:04 1,275,392 ----a-w C:\WINDOWS\system32\msxml4.dll
    + 2008-01-17 01:00:33 90,112 -c--a-w C:\WINDOWS\UpdReg.EXE
    + 2007-05-08 05:06:44 1,275,392 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9848.0_x-ww_1b897e9a\msxml4.dll
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "MsnMsgr "= "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2008-01-23 5724184]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "NvCplDaemon "= "C:\WINDOWS\system32\NvCpl.dll" [2008-05-02 13529088]
    "iTunesHelper "= "C:\Program Files\iTunes\iTunesHelper.exe" [2008-01-23 267048]
    "NvMediaCenter "= "C:\WINDOWS\system32\NvMcTray.dll" [2008-05-02 86016]
    "Jet Detection "= "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe" [2008-01-16 28672]
    "AVG8_TRAY "= "C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-08-30 1235736]
    "nwiz "= "nwiz.exe" [2008-05-02 C:\WINDOWS\system32\nwiz.exe]
    "P17Helper "= "P17.dll" [2005-05-04 C:\WINDOWS\system32\P17.DLL]
    "CTHelper "= "CTHELPER.EXE" [2003-08-28 C:\WINDOWS\system32\CTHELPER.EXE]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run]
    "ZboardTray "= "C:\Program Files\Ideazon\Zboard Software\Driver\ZboardTray.exe" [2005-05-02 380928]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    NETGEAR WG111v3 Smart Wizard.lnk - C:\Program Files\NETGEAR\WG111v3\WG111v3.exe [2007-09-12 1527808]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs "=avgrsstx.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "msacm.ctmp3 "= C:\WINDOWS\system32\ctmp3.acm

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
    SecurityProviders msapsspc.dllschannel.dlldigest.dllmsnsspc.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
    --a------ 2008-01-10 14:27 385024 C:\Program Files\QuickTime\QTTask.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusOverride "=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
    "C:\\Program Files\\Warcraft III\\Warcraft III.exe "=
    "C:\\Program Files\\THQ\\Company of Heroes\\RelicCOH.exe "=
    "C:\\Program Files\\FrostWire\\FrostWire.exe "=
    "C:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe "=
    "C:\\Program Files\\BitTorrent\\bittorrent.exe "=
    "C:\\WINDOWS\\system32\\winver.exe "=
    "C:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe "=
    "C:\\Program Files\\Microsoft Games\\Age of Empires II\\EMPIRES2.ICD "=
    "C:\\Program Files\\Microsoft Games\\Age of Empires II\\empires2.exe "=
    "C:\\WINDOWS\\system32\\dplaysvr.exe "=
    "C:\\Program Files\\AVG\\AVG8\\avgemc.exe "=
    "C:\\Program Files\\AVG\\AVG8\\avgupd.exe "=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "6112:TCP "= 6112:TCP:hehe
    "3724:TCP "= 3724:TCP:Blizzard Downloader: 3724
    "59560:TCP "= 59560:TCP:59560

    R1 AvgLdx86;AVG Free AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-08-30 97928]
    R2 avg8emc;AVG Free8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-08-30 875288]
    R2 avg8wd;AVG Free8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-08-30 231704]
    R2 AvgTdiX;AVG Free8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-08-30 76040]
    S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys [2005-08-03 32512]
    S3 RTL8187B;NETGEAR WG111v3 54Mbps Wireless USB 2.0 Adapter Vista Driver;C:\WINDOWS\system32\DRIVERS\wg111v3.sys [2007-04-23 224896]

    *Newly Created Service* - CATCHME
    .
    Contents of the 'Scheduled Tasks' folder
    .
    - - - - ORPHANS REMOVED - - - -

    MSConfigStartUp-Uniblue RegistryBooster 2 - C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe



    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-09-03 16:24:43
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2008-09-03 16:26:55
    ComboFix-quarantined-files.txt 2008-09-03 06:26:05
    ComboFix2.txt 2008-09-02 10:01:01

    Pre-Run: 30,305,415,168 bytes free
    Post-Run: 30,293,372,928 bytes free

    216 --- E O F --- 2008-09-02 13:32:46
     
    lokilokii,
    #7
  9. 2008/09/03
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Highlight and copy the contents of the code box below to a blank notepad. Save it to the desktop as;

    Filename: fix.reg
    Save as type: All Files (*.*)

    Code:
    REGEDIT4

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
 "SecurityProviders "= "msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll "
    Double click fix.reg and allow it to merge with the registry. Now delete fix.reg


    Download ATF Cleaner by Atribune and save it to your Desktop.
    • Double click ATF-Cleaner.exe to run the program.
    • Check the boxes to the left of:

      • Windows Temp
      • Current User Temp
      • All Users Temp
      • Temporary Internet Files
      • Prefetch
      • Java Cache
      • Recycle bin

    • The rest are optional - if you want it to remove everything check "Select All ".
    • Finally, click Empty Selected. When you get the "Done Cleaning" message, click OK then exit.
    Reboot


    Now, please do an online scan with Kaspersky Online Scanner

    Click Accept, when prompted to download and install the program files and database of malware definitions.
    • Click Run at the Security prompt.
    • The program will then begin downloading and installing and will also update the database.
    • Please be patient as this can take several minutes.
    • Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
    • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
    • Click View scan report at the bottom.
    • Click the Save Report As... button.
    • Click the Save as Text button to save the file to your desktop so that you may post it in your next reply.
    **Note**

    To optimize scanning time and produce a more sensible report for review:
    • Close any open programs.
    • Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.
    Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.


    Post the Kaspersky log and a new RSIT log here.
     
    noahdfear,
    #8
  10. 2008/09/03
    lokilokii

    lokilokii Inactive Thread Starter

    Joined:
    2008/08/29
    Messages:
    8
    Likes Received:
    0
    --------------------------------------------------------------------------------
    KASPERSKY ONLINE SCANNER 7 REPORT
    Wednesday, September 3, 2008
    Operating System: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
    Kaspersky Online Scanner 7 version: 7.0.25.0
    Program database last update: Wednesday, September 03, 2008 06:00:12
    Records in database: 1185493
    --------------------------------------------------------------------------------

    Scan settings:
    Scan using the following database: extended
    Scan archives: yes
    Scan mail databases: yes

    Scan area - My Computer:
    A:\
    C:\
    D:\

    Scan statistics:
    Files scanned: 86464
    Threat name: 3
    Infected objects: 10
    Suspicious objects: 0
    Duration of the scan: 01:17:51


    File name / Threat name / Threats count
    C:\Documents and Settings\Owner\Desktop\New Folder\spywaredetectorb.exe Infected: not-a-virus:FraudTool.Win32.SpywareDetector.b 1
    C:\Documents and Settings\Owner\Desktop\SmitfraudFix.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f 1
    C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\E1PTW4U1\ac[1].htm Infected: Trojan-Downloader.JS.Agent.cnn 1
    C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\GGEZK1JY\ac[1].htm Infected: Trojan-Downloader.JS.Agent.cnn 1
    C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\GGEZK1JY\ac[2].htm Infected: Trojan-Downloader.JS.Agent.cnn 1
    C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\GGEZK1JY\ac[3].htm Infected: Trojan-Downloader.JS.Agent.cnn 1
    C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HTYGYSSL\ac[1].htm Infected: Trojan-Downloader.JS.Agent.cnn 1
    C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HTYGYSSL\ac[2].htm Infected: Trojan-Downloader.JS.Agent.cnn 1
    C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\NSDIOXTJ\ac[1].htm Infected: Trojan-Downloader.JS.Agent.cnn 1
    C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\NSDIOXTJ\ac[2].htm Infected: Trojan-Downloader.JS.Agent.cnn 1

    The selected area was scanned.
     
    lokilokii,
    #9
  11. 2008/09/07
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Highlight and copy the following bolded text, including the quotes.

    "C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5 "

    Click Start>Run and paste the text into the run box, then hit Enter.
    When the Content.IE5 window opens, delete all folders in it.

    Delete the file spywaredetectorb.exe in the New Folder on your desktop, and SmitfraudFix.exe on your desktop.

    Empty your recycle bin.

    • Download RSIT by random/random and save it to your desktop.
    • Double click RSIT.exe to start the tool and click Continue at the disclaimer.
    • When the scan completes it will open a log named log.txt maximized, and a log named info.txt minimized.
    • Please post the contents of both logs here in your next reply.


    Let me know how the computer is behaving now.
     
    noahdfear,
    #10
  12. 2008/09/08
    lokilokii

    lokilokii Inactive Thread Starter

    Joined:
    2008/08/29
    Messages:
    8
    Likes Received:
    0
    Ive tried uninstalling both RTS and hijack and reinstalling after reboot but im still only getting a log file :/

    Logfile of random's system information tool (written by random/random)
    Run by Owner at 2008-09-08 19:33:25
    Microsoft Windows XP Home Edition Service Pack 3
    System drive C: has 28 GB (36%) free of 76 GB
    Total RAM: 1022 MB (69% free)

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 19:33:32, on 9/8/2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Ideazon\Zboard Software\Driver\ZboardTray.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\WINDOWS\system32\Rundll32.exe
    C:\WINDOWS\system32\CTsvcCDA.exe
    C:\WINDOWS\system32\CTHELPER.EXE
    C:\PROGRA~1\AVG\AVG8\avgtray.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\WINDOWS\system32\MsPMSPSv.exe
    C:\Program Files\NETGEAR\WG111v3\WG111v3.exe
    C:\Program Files\Ideazon\Zboard Software\Driver\Zboard.exe
    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
    C:\PROGRA~1\AVG\AVG8\avgemc.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Documents and Settings\Owner\Desktop\RSIT.exe
    C:\Documents and Settings\Owner\Desktop\Owner.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
    O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
    O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe "
    O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKLM\..\Policies\Explorer\Run: [ZboardTray] "C:\Program Files\Ideazon\Zboard Software\Driver\ZboardTray.exe" /autolaunch
    O4 - Global Startup: NETGEAR WG111v3 Smart Wizard.lnk = C:\Program Files\NETGEAR\WG111v3\WG111v3.exe
    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
    O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-SG/a-UNO1/GAME_UNO1.cab
    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1198218324001
    O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
    O16 - DPF: {BD8667B7-38D8-4C77-B580-18C3E146372C} (Creative Toolbox Plug-in) - http://kiw.imgag.com/imgag/cp/install/crusher-kiwen.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
    O20 - AppInit_DLLs: avgrsstx.dll
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
    O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe

    --
    End of file - 6162 bytes

    Scheduled tasks folder

    C:\WINDOWS\tasks\AppleSoftwareUpdate.job

    Registry dump

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]
    AVG Safe Search - C:\Program Files\AVG\AVG8\avgssie.dll [2008-08-30 455960]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    "NvCplDaemon "=C:\WINDOWS\system32\NvCpl.dll [2008-05-02 13529088]
    "nwiz "=C:\WINDOWS\system32\nwiz.exe [2008-05-02 1630208]
    "iTunesHelper "=C:\Program Files\iTunes\iTunesHelper.exe [2008-01-23 267048]
    "NvMediaCenter "=C:\WINDOWS\system32\NvMcTray.dll [2008-05-02 86016]
    "P17Helper "=Rundll32 P17.dll []
    "CTHelper "=C:\WINDOWS\system32\CTHELPER.EXE [2003-08-28 24576]
    "Jet Detection "=C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe [2008-01-16 28672]
    "AVG8_TRAY "=C:\PROGRA~1\AVG\AVG8\avgtray.exe [2008-08-30 1235736]

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
    "ZboardTray "=C:\Program Files\Ideazon\Zboard Software\Driver\ZboardTray.exe [2005-05-02 380928]

    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    "MsnMsgr "=C:\Program Files\Windows Live\Messenger\msnmsgr.exe [2008-01-23 5724184]
    "MSMSGS "=C:\Program Files\Messenger\msmsgs.exe [2008-04-14 1695232]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
    C:\Program Files\QuickTime\QTTask.exe [2008-01-10 385024]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup
    NETGEAR WG111v3 Smart Wizard.lnk - C:\Program Files\NETGEAR\WG111v3\WG111v3.exe

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
    "AppInit_DLLS "= "avgrsstx.dll "

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
    WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
    "SecurityProviders "=msapsspc.dllschannel.dlldigest.dllmsnsspc.dll

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\aawservice]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm.sys]

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
    "dontdisplaylastusername "=0
    "legalnoticecaption "=
    "legalnoticetext "=
    "shutdownwithoutlogon "=1
    "undockwithoutlogon "=1

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
    "C:\Program Files\Warcraft III\Warcraft III.exe "= "C:\Program Files\Warcraft III\Warcraft III.exe:*:Enabled:Warcraft III "
    "C:\Program Files\THQ\Company of Heroes\RelicCOH.exe "= "C:\Program Files\THQ\Company of Heroes\RelicCOH.exe:*:Enabled:RelicCOH "
    "C:\Program Files\FrostWire\FrostWire.exe "= "C:\Program Files\FrostWire\FrostWire.exe:*:Enabled:LimeWire "
    "C:\Program Files\World of Warcraft\BackgroundDownloader.exe "= "C:\Program Files\World of Warcraft\BackgroundDownloader.exe:*:Enabled:Blizzard Downloader "
    "C:\Program Files\BitTorrent\bittorrent.exe "= "C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent "
    "C:\WINDOWS\system32\winver.exe "= "C:\WINDOWS\system32\winver.exe:*:Enabled:winver "
    "C:\Program Files\EA GAMES\Battlefield 2\BF2.exe "= "C:\Program Files\EA GAMES\Battlefield 2\BF2.exe:*:Enabled:Battlefield 2 "
    "C:\Program Files\Microsoft Games\Age of Empires II\EMPIRES2.ICD "= "C:\Program Files\Microsoft Games\Age of Empires II\EMPIRES2.ICD:*:Enabled:Age of Empires II "
    "C:\Program Files\Microsoft Games\Age of Empires II\empires2.exe "= "C:\Program Files\Microsoft Games\Age of Empires II\empires2.exe:*:Enabled:Age of Empires II "
    "C:\WINDOWS\system32\dplaysvr.exe "= "C:\WINDOWS\system32\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper "
    "C:\Program Files\AVG\AVG8\avgemc.exe "= "C:\Program Files\AVG\AVG8\avgemc.exe:*:Enabled:avgemc.exe "
    "C:\Program Files\AVG\AVG8\avgupd.exe "= "C:\Program Files\AVG\AVG8\avgupd.exe:*:Enabled:avgupd.exe "
    "%windir%\Network Diagnostic\xpnetdiag.exe "= "%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000 "
    "%windir%\system32\sessmgr.exe "= "%windir%\system32\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019 "
    "C:\Program Files\Windows Live\Messenger\msnmsgr.exe "= "C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger "
    "C:\Program Files\Windows Live\Messenger\livecall.exe "= "C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone) "

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
    "%windir%\system32\sessmgr.exe "= "%windir%\system32\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019 "
    "%windir%\Network Diagnostic\xpnetdiag.exe "= "%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000 "
    "C:\Program Files\Windows Live\Messenger\msnmsgr.exe "= "C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger "
    "C:\Program Files\Windows Live\Messenger\livecall.exe "= "C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone) "

    List of files/folders created in the last three months

    2008-09-04 18:07:56 ----A---- C:\WINDOWS\{00000000-00000000-0000000B-00001102-00000002-80661102}.BAK
    2008-09-03 18:27:25 ----SHD---- C:\RECYCLER
    2008-09-03 18:02:05 ----HDC---- C:\WINDOWS\$NtUninstallKB946648$
    2008-09-03 18:01:55 ----HDC---- C:\WINDOWS\$NtUninstallKB951978$
    2008-09-03 17:35:09 ----SHD---- C:\Config.Msi
    2008-09-03 17:33:24 ----D---- C:\WINDOWS\Prefetch
    2008-09-03 17:00:01 ----HDC---- C:\WINDOWS\$NtUninstallKB953838$
    2008-09-03 16:59:54 ----HDC---- C:\WINDOWS\$NtUninstallKB952954$
    2008-09-03 16:59:48 ----HDC---- C:\WINDOWS\$NtUninstallKB952287$
    2008-09-03 16:59:41 ----HDC---- C:\WINDOWS\$NtUninstallKB951748$
    2008-09-03 16:59:29 ----HDC---- C:\WINDOWS\$NtUninstallKB951698$
    2008-09-03 16:59:22 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2$
    2008-09-03 16:59:15 ----HDC---- C:\WINDOWS\$NtUninstallKB951376$
    2008-09-03 16:59:07 ----HDC---- C:\WINDOWS\$NtUninstallKB951066$
    2008-09-03 16:59:01 ----HDC---- C:\WINDOWS\$NtUninstallKB950974$
    2008-09-03 16:58:54 ----HDC---- C:\WINDOWS\$NtUninstallKB950762$
    2008-09-03 16:58:45 ----HDC---- C:\WINDOWS\$NtUninstallKB950759$
    2008-09-03 16:55:34 ----D---- C:\Program Files\Messenger
    2008-09-03 16:55:23 ----D---- C:\WINDOWS\system32\en-us
    2008-09-03 16:55:22 ----D---- C:\WINDOWS\system32\scripting
    2008-09-03 16:55:22 ----D---- C:\WINDOWS\system32\en
    2008-09-03 16:55:22 ----D---- C:\WINDOWS\l2schemas
    2008-09-03 16:55:21 ----D---- C:\WINDOWS\system32\bits
    2008-09-03 16:53:52 ----D---- C:\WINDOWS\ServicePackFiles
    2008-09-03 16:51:56 ----D---- C:\WINDOWS\network diagnostic
    2008-09-03 16:47:27 ----HDC---- C:\WINDOWS\$NtServicePackUninstall$
    2008-09-03 16:47:24 ----D---- C:\WINDOWS\EHome
    2008-09-03 16:43:30 ----N---- C:\WINDOWS\system32\xmllite.dll
    2008-09-03 16:43:27 ----N---- C:\WINDOWS\system32\wmphoto.dll
    2008-09-03 16:43:25 ----N---- C:\WINDOWS\system32\wlanapi.dll
    2008-09-03 16:43:24 ----N---- C:\WINDOWS\system32\windowscodecsext.dll
    2008-09-03 16:43:24 ----N---- C:\WINDOWS\system32\windowscodecs.dll
    2008-09-03 16:43:18 ----N---- C:\WINDOWS\system32\tspkg.dll
    2008-09-03 16:43:18 ----N---- C:\WINDOWS\system32\tsgqec.dll
    2008-09-03 16:43:13 ----N---- C:\WINDOWS\system32\spupdwxp.exe
    2008-09-03 16:43:12 ----A---- C:\WINDOWS\system32\spdwnwxp.exe
    2008-09-03 16:43:11 ----N---- C:\WINDOWS\system32\slserv.exe
    2008-09-03 16:43:11 ----N---- C:\WINDOWS\system32\slrundll.exe
    2008-09-03 16:43:11 ----N---- C:\WINDOWS\slrundll.exe
    2008-09-03 16:43:10 ----N---- C:\WINDOWS\system32\slgen.dll
    2008-09-03 16:43:10 ----N---- C:\WINDOWS\system32\slextspk.dll
    2008-09-03 16:43:10 ----N---- C:\WINDOWS\system32\slcoinst.dll
    2008-09-03 16:43:06 ----N---- C:\WINDOWS\system32\setupn.exe
    2008-09-03 16:43:04 ----N---- C:\WINDOWS\system32\s3gnb.dll
    2008-09-03 16:43:03 ----N---- C:\WINDOWS\system32\rhttpaa.dll
    2008-09-03 16:43:01 ----N---- C:\WINDOWS\system32\rasqec.dll
    2008-09-03 16:43:01 ----N---- C:\WINDOWS\system32\qutil.dll
    2008-09-03 16:43:00 ----N---- C:\WINDOWS\system32\qcliprov.dll
    2008-09-03 16:43:00 ----N---- C:\WINDOWS\system32\qagentrt.dll
    2008-09-03 16:43:00 ----N---- C:\WINDOWS\system32\qagent.dll
    2008-09-03 16:42:59 ----N---- C:\WINDOWS\system32\photometadatahandler.dll
    2008-09-03 16:42:57 ----N---- C:\WINDOWS\system32\onex.dll
    2008-09-03 16:42:50 ----N---- C:\WINDOWS\system32\napstat.exe
    2008-09-03 16:42:50 ----N---- C:\WINDOWS\system32\napmontr.dll
    2008-09-03 16:42:50 ----N---- C:\WINDOWS\system32\napipsec.dll
    2008-09-03 16:42:49 ----N---- C:\WINDOWS\system32\mtxparhd.dll
    2008-09-03 16:42:49 ----N---- C:\WINDOWS\system32\msxml6r.dll
    2008-09-03 16:42:49 ----N---- C:\WINDOWS\system32\msxml6.dll
    2008-09-03 16:42:48 ----N---- C:\WINDOWS\system32\msshavmsg.dll
    2008-09-03 16:42:48 ----N---- C:\WINDOWS\system32\mssha.dll
    2008-09-03 16:42:38 ----N---- C:\WINDOWS\system32\mmcperf.exe
    2008-09-03 16:42:38 ----N---- C:\WINDOWS\system32\mmcfxcommon.dll
    2008-09-03 16:42:38 ----N---- C:\WINDOWS\system32\mmcex.dll
    2008-09-03 16:42:38 ----N---- C:\WINDOWS\system32\microsoft.managementconsole.dll
    2008-09-03 16:42:36 ----N---- C:\WINDOWS\system32\mdmxsdk.dll
    2008-09-03 16:42:29 ----N---- C:\WINDOWS\system32\l2gpstore.dll
    2008-09-03 16:42:29 ----N---- C:\WINDOWS\system32\kmsvc.dll
    2008-09-03 16:42:28 ----N---- C:\WINDOWS\system32\kbdpash.dll
    2008-09-03 16:42:28 ----N---- C:\WINDOWS\system32\kbdnepr.dll
    2008-09-03 16:42:28 ----N---- C:\WINDOWS\system32\kbdiultn.dll
    2008-09-03 16:42:28 ----N---- C:\WINDOWS\system32\kbdbhc.dll
    2008-09-03 16:42:21 ----N---- C:\WINDOWS\system32\hsfcisp2.dll
    2008-09-03 16:42:17 ----N---- C:\WINDOWS\system32\faxpatch.exe
    2008-09-03 16:42:17 ----A---- C:\WINDOWS\002780_.tmp
    2008-09-03 16:42:15 ----N---- C:\WINDOWS\system32\eapsvc.dll
    2008-09-03 16:42:15 ----N---- C:\WINDOWS\system32\eapqec.dll
    2008-09-03 16:42:15 ----N---- C:\WINDOWS\system32\eappprxy.dll
    2008-09-03 16:42:15 ----N---- C:\WINDOWS\system32\eapphost.dll
    2008-09-03 16:42:15 ----N---- C:\WINDOWS\system32\eappgnui.dll
    2008-09-03 16:42:15 ----N---- C:\WINDOWS\system32\eappcfg.dll
    2008-09-03 16:42:15 ----N---- C:\WINDOWS\system32\eapp3hst.dll
    2008-09-03 16:42:15 ----N---- C:\WINDOWS\system32\eapolqec.dll
    2008-09-03 16:42:13 ----N---- C:\WINDOWS\system32\dot3ui.dll
    2008-09-03 16:42:13 ----N---- C:\WINDOWS\system32\dot3svc.dll
    2008-09-03 16:42:13 ----N---- C:\WINDOWS\system32\dot3msm.dll
    2008-09-03 16:42:13 ----N---- C:\WINDOWS\system32\dot3gpclnt.dll
    2008-09-03 16:42:13 ----N---- C:\WINDOWS\system32\dot3dlg.dll
    2008-09-03 16:42:13 ----N---- C:\WINDOWS\system32\dot3cfg.dll
    2008-09-03 16:42:13 ----N---- C:\WINDOWS\system32\dot3api.dll
    2008-09-03 16:42:11 ----N---- C:\WINDOWS\system32\dimsroam.dll
    2008-09-03 16:42:11 ----N---- C:\WINDOWS\system32\dimsntfy.dll
    2008-09-03 16:42:10 ----N---- C:\WINDOWS\system32\dhcpqec.dll
    2008-09-03 16:42:07 ----N---- C:\WINDOWS\system32\credssp.dll
    2008-09-03 16:42:03 ----N---- C:\WINDOWS\system32\bitsprx4.dll
    2008-09-03 16:42:03 ----N---- C:\WINDOWS\system32\azroles.dll
    2008-09-03 16:42:02 ----N---- C:\WINDOWS\system32\ativvaxx.dll
    2008-09-03 16:42:02 ----N---- C:\WINDOWS\system32\ativtmxx.dll
    2008-09-03 16:42:02 ----N---- C:\WINDOWS\system32\ati3duag.dll
    2008-09-03 16:42:02 ----N---- C:\WINDOWS\system32\ati3d1ag.dll
    2008-09-03 16:42:01 ----N---- C:\WINDOWS\system32\ati2dvag.dll
    2008-09-03 16:42:01 ----N---- C:\WINDOWS\system32\ati2dvaa.dll
    2008-09-03 16:42:01 ----N---- C:\WINDOWS\system32\ati2cqag.dll
    2008-09-03 16:41:57 ----N---- C:\WINDOWS\system32\aaclient.dll
    2008-09-03 16:26:57 ----D---- C:\WINDOWS\temp
    2008-09-03 16:26:56 ----A---- C:\ComboFix.txt
    2008-09-03 16:22:35 ----D---- C:\ComboFix
    2008-09-02 19:51:37 ----D---- C:\WINDOWS\erdnt
    2008-09-02 19:51:28 ----A---- C:\WINDOWS\zip.exe
    2008-09-02 19:51:28 ----A---- C:\WINDOWS\VFind.exe
    2008-09-02 19:51:28 ----A---- C:\WINDOWS\swxcacls.exe
    2008-09-02 19:51:28 ----A---- C:\WINDOWS\swsc.exe
    2008-09-02 19:51:28 ----A---- C:\WINDOWS\swreg.exe
    2008-09-02 19:51:28 ----A---- C:\WINDOWS\sed.exe
    2008-09-02 19:51:28 ----A---- C:\WINDOWS\Nircmd.exe
    2008-09-02 19:51:28 ----A---- C:\WINDOWS\grep.exe
    2008-09-02 19:51:28 ----A---- C:\WINDOWS\fdsv.exe
    2008-09-02 11:29:25 ----D---- C:\Program Files\MSXML 4.0
    2008-09-01 20:10:19 ----D---- C:\QooBox
    2008-08-31 22:34:20 ----D---- C:\Program Files\Red Kawa
    2008-08-31 15:15:09 ----A---- C:\WINDOWS\system32\tmp.txt
    2008-08-31 15:14:52 ----A---- C:\rapport.txt
    2008-08-31 15:02:06 ----A---- C:\WINDOWS\system32\WS2Fix.exe
    2008-08-31 15:02:06 ----A---- C:\WINDOWS\system32\VCCLSID.exe
    2008-08-31 15:02:06 ----A---- C:\WINDOWS\system32\VACFix.exe
    2008-08-31 15:02:06 ----A---- C:\WINDOWS\system32\SrchSTS.exe
    2008-08-31 15:02:06 ----A---- C:\WINDOWS\system32\Process.exe
    2008-08-31 15:02:06 ----A---- C:\WINDOWS\system32\IEDFix.exe
    2008-08-31 15:02:06 ----A---- C:\WINDOWS\system32\IEDFix.C.exe
    2008-08-31 15:02:06 ----A---- C:\WINDOWS\system32\dumphive.exe
    2008-08-31 15:02:06 ----A---- C:\WINDOWS\system32\AntiXPVSTFix.exe
    2008-08-31 15:02:06 ----A---- C:\WINDOWS\system32\404Fix.exe
    2008-08-31 15:00:45 ----D---- C:\Documents and Settings\Owner\Application Data\Malwarebytes
    2008-08-31 15:00:42 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
    2008-08-31 15:00:42 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-08-31 12:34:34 ----D---- C:\WINDOWS\pss
    2008-08-31 00:27:35 ----D---- C:\Program Files\Lavasoft
    2008-08-31 00:27:35 ----D---- C:\Documents and Settings\All Users\Application Data\Lavasoft
    2008-08-30 19:26:24 ----D---- C:\Program Files\Enigma Software Group
    2008-08-30 15:08:44 ----D---- C:\rsit
    2008-08-30 13:41:54 ----A---- C:\WINDOWS\system32\avgrsstx.dll
    2008-08-30 13:41:38 ----D---- C:\Program Files\AVG
    2008-08-30 12:18:21 ----D---- C:\WINDOWS\SxsCaPendDel
    2008-08-30 12:01:25 ----D---- C:\RootkitNO
    2008-08-30 11:26:26 ----HD---- C:\$AVG8.VAULT$
    2008-08-30 11:14:22 ----A---- C:\WINDOWS\rootkitno.ini
    2008-08-30 11:13:44 ----D---- C:\Documents and Settings\All Users\Application Data\avg8
    2008-08-30 10:56:55 ----D---- C:\Documents and Settings\Owner\Application Data\Help
    2008-08-30 00:49:39 ----D---- C:\Program Files\UnHackMe
    2008-08-26 08:23:41 ----D---- C:\Documents and Settings\Owner\Application Data\InstallShield
    2008-08-26 08:15:09 ----D---- C:\Documents and Settings\All Users\Application Data\TEMP
    2008-08-19 19:02:22 ----A---- C:\AILog.txt
    2008-08-19 18:23:45 ----D---- C:\Program Files\Microsoft Games
    2008-08-18 22:34:59 ----D---- C:\Documents and Settings\Owner\Application Data\BitTorrent
    2008-08-18 22:34:35 ----D---- C:\Program Files\DNA
    2008-08-18 22:34:35 ----D---- C:\Program Files\BitTorrent
    2008-08-16 16:46:39 ----N---- C:\WINDOWS\system32\SFCVRT32.DLL
    2008-08-16 16:46:39 ----N---- C:\WINDOWS\system32\CTWFLT32.DLL
    2008-08-16 16:46:39 ----N---- C:\WINDOWS\system32\CTL3D.DLL
    2008-08-16 16:46:39 ----N---- C:\WINDOWS\CTRES.DLL
    2008-08-16 16:46:39 ----N---- C:\WINDOWS\CTCCW.DLL
    2008-08-16 16:46:39 ----N---- C:\WINDOWS\AC3API.INI
    2008-08-16 16:46:03 ----A---- C:\WINDOWS\system32\Emu10kx.ini
    2008-08-16 16:46:03 ----A---- C:\WINDOWS\system32\ctzapxx.ini
    2008-08-16 16:46:03 ----A---- C:\WINDOWS\INRES.DLL
    2008-08-16 16:45:57 ----A---- C:\WINDOWS\system32\SFMS32.DLL
    2008-08-16 16:45:57 ----A---- C:\WINDOWS\system32\sfman32.dll
    2008-08-16 16:45:57 ----A---- C:\WINDOWS\system32\REGPLIB.EXE
    2008-08-16 16:45:57 ----A---- C:\WINDOWS\system32\PIAPROXY.DLL
    2008-08-16 16:45:57 ----A---- C:\WINDOWS\system32\OPENAL32.DLL
    2008-08-16 16:45:57 ----A---- C:\WINDOWS\system32\KILLAPPS.EXE
    2008-08-16 16:45:57 ----A---- C:\WINDOWS\system32\KILL.INI
    2008-08-16 16:45:57 ----A---- C:\WINDOWS\system32\ENSDEF.INI
    2008-08-16 16:45:57 ----A---- C:\WINDOWS\system32\ENSDEF.EXE
    2008-08-16 16:45:57 ----A---- C:\WINDOWS\system32\EAXAC3.DLL
    2008-08-16 16:45:57 ----A---- C:\WINDOWS\READREG.EXE
    2008-08-16 16:45:57 ----A---- C:\WINDOWS\PSCONV.EXE
    2008-08-16 16:45:57 ----A---- C:\WINDOWS\MIDIDEF.EXE
    2008-08-16 16:45:57 ----A---- C:\WINDOWS\DEVREG.DLL
    2008-08-16 16:45:57 ----A---- C:\WINDOWS\CTDCRES.DLL
    2008-08-16 16:45:56 ----A---- C:\WINDOWS\system32\CTSPKHLP.DLL
    2008-08-16 16:45:56 ----A---- C:\WINDOWS\system32\CTSCAL.DLL
    2008-08-16 16:45:56 ----A---- C:\WINDOWS\system32\CTSBLFX.DLL
    2008-08-16 16:45:56 ----A---- C:\WINDOWS\system32\CTOSUSER.DLL
    2008-08-16 16:45:56 ----A---- C:\WINDOWS\system32\CTMMEP.DLL
    2008-08-16 16:45:56 ----A---- C:\WINDOWS\system32\CTHELPER.EXE
    2008-08-16 16:45:56 ----A---- C:\WINDOWS\system32\CTEMUPIA.DLL
    2008-08-16 16:45:53 ----A---- C:\WINDOWS\system32\CTDPROXY.DLL
    2008-08-16 16:45:53 ----A---- C:\WINDOWS\system32\CTDCIFCE.DLL
    2008-08-16 16:45:53 ----A---- C:\WINDOWS\system32\CTDC0001.DLL
    2008-08-16 16:45:52 ----A---- C:\WINDOWS\system32\CTDC0000.DLL
    2008-08-16 16:45:52 ----A---- C:\WINDOWS\system32\CTAUDFX.DLL
    2008-08-16 16:45:52 ----A---- C:\WINDOWS\system32\CTASIO.DLL
    2008-08-16 16:45:52 ----A---- C:\WINDOWS\system32\CTAGENT.DLL
    2008-08-16 16:45:51 ----A---- C:\WINDOWS\system32\COMMONFX.DLL
    2008-08-16 16:45:51 ----A---- C:\WINDOWS\system32\AC3API.DLL
    2008-08-16 16:45:51 ----A---- C:\WINDOWS\system32\a3d.dll
    2008-08-16 16:44:20 ----A---- C:\WINDOWS\system32\CTMERes.DLL
    2008-08-16 16:44:20 ----A---- C:\WINDOWS\system32\CTIntRes.dll
    2008-08-16 16:44:20 ----A---- C:\WINDOWS\system32\CTDrmRes.dll
    2008-08-16 16:44:18 ----N---- C:\WINDOWS\system32\Inetwh32.dll
    2008-08-16 16:44:18 ----D---- C:\Media
    2008-08-16 16:44:17 ----N---- C:\WINDOWS\system32\CTMedEng.dll
    2008-08-16 16:44:17 ----N---- C:\WINDOWS\system32\CTDRMUI.dll
    2008-08-16 16:44:12 ----A---- C:\WINDOWS\system32\CTSVCCTL.EXE
    2008-08-16 16:44:12 ----A---- C:\WINDOWS\system32\CTSVCCDA.EXE
    2008-08-16 16:44:12 ----A---- C:\WINDOWS\system32\CTDetres.dll
    2008-08-16 16:43:53 ----A---- C:\WINDOWS\system32\AHQCpURes.dll
    2008-08-16 11:04:35 ----D---- C:\Documents and Settings\Owner\Application Data\Ideazon
    2008-08-16 11:00:43 ----D---- C:\Program Files\Ideazon
    2008-08-15 18:52:06 ----D---- C:\Documents and Settings\Owner\Application Data\yess
    2008-08-14 18:03:58 ----HDC---- C:\WINDOWS\$NtUninstallKB952954_0$
    2008-08-14 18:03:53 ----HDC---- C:\WINDOWS\$NtUninstallKB953839$
    2008-08-14 18:03:49 ----HDC---- C:\WINDOWS\$NtUninstallKB950974_0$
    2008-08-14 18:02:50 ----HDC---- C:\WINDOWS\$NtUninstallKB951072-v2$
    2008-08-14 18:02:44 ----HDC---- C:\WINDOWS\$NtUninstallKB952287_0$
    2008-08-14 18:02:39 ----HDC---- C:\WINDOWS\$NtUninstallKB951066_0$
    2008-08-14 18:02:24 ----HDC---- C:\WINDOWS\$NtUninstallKB953838_0$
    2008-08-02 16:41:11 ----D---- C:\Documents and Settings\All Users\Application Data\nView_Profiles
    2008-07-31 16:02:02 ----D---- C:\Documents and Settings\Owner\Application Data\flightgear.org
    2008-07-31 16:00:40 ----D---- C:\Program Files\FlightGear
    2008-07-26 22:38:36 ----D---- C:\Program Files\PDF2EXE
    2008-07-26 12:39:17 ----N---- C:\WINDOWS\Setup1.exe
    2008-07-26 12:39:16 ----A---- C:\WINDOWS\ST6UNST.EXE
    2008-07-21 13:40:41 ----D---- C:\Program Files\Lionhead Studios
    2008-07-17 21:34:15 ----D---- C:\Impressions Games
    2008-07-12 12:44:41 ----D---- C:\Program Files\Windows Live Safety Center
    2008-07-11 20:49:14 ----A---- C:\WINDOWS\eSellerateEngine.dll
    2008-07-09 23:42:11 ----HDC---- C:\WINDOWS\$NtUninstallKB951748_0$
    2008-07-08 00:38:45 ----D---- C:\Program Files\EA GAMES
    2008-06-21 12:11:05 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2_0$
    2008-06-19 21:38:46 ----D---- C:\Program Files\The Creative Assembly
    2008-06-13 16:09:06 ----A---- C:\WINDOWS\system32\CmdLineExt03.dll
    2008-06-12 21:28:48 ----AT---- C:\WINDOWS\system32\SIntfNT.dll
    2008-06-12 21:28:48 ----AT---- C:\WINDOWS\system32\SIntf32.dll
    2008-06-12 21:28:48 ----AT---- C:\WINDOWS\system32\SIntf16.dll
    2008-06-11 16:11:45 ----HDC---- C:\WINDOWS\$NtUninstallKB951698_0$
    2008-06-11 16:11:39 ----HDC---- C:\WINDOWS\$NtUninstallKB950762_0$
    2008-06-11 16:11:26 ----HDC---- C:\WINDOWS\$NtUninstallKB950759_0$
    2008-06-11 16:11:19 ----HDC---- C:\WINDOWS\$NtUninstallKB950760$
    2008-06-11 16:11:12 ----HDC---- C:\WINDOWS\$NtUninstallKB951376_0$

    List of drivers

    R1 AvgLdx86;AVG Free AVI Loader Driver x86; C:\WINDOWS\system32\System32\Drivers\avgldx86.sys []
    R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86; C:\WINDOWS\system32\System32\Drivers\avgmfx86.sys []
    R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 36352]
    R1 kbdhid;Keyboard HID Driver; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
    R2 AegisP;AEGIS Protocol (IEEE 802.1x) v3.4.5.0; C:\WINDOWS\system32\DRIVERS\AegisP.sys [2008-06-07 21035]
    R2 AvgTdiX;AVG Free8 Network Redirector; C:\WINDOWS\system32\System32\Drivers\avgtdix.sys []
    R2 PfModNT;PfModNT; \??\C:\WINDOWS\system32\drivers\PfModNT.sys []
    R3 ctac32k;Creative AC3 Software Decoder; C:\WINDOWS\System32\drivers\ctac32k.sys [2003-08-28 186068]
    R3 ctaud2k;Creative Audio Driver (WDM); C:\WINDOWS\system32\drivers\ctaud2k.sys [2003-09-19 496800]
    R3 ctprxy2k;Creative Proxy Driver; C:\WINDOWS\System32\drivers\ctprxy2k.sys [2003-08-28 6144]
    R3 ctsfm2k;Creative SoundFont Management Device Driver; C:\WINDOWS\System32\drivers\ctsfm2k.sys [2003-08-28 136448]
    R3 emupia;E-mu Plug-in Architecture Driver; C:\WINDOWS\System32\drivers\emupia2k.sys [2003-08-28 145504]
    R3 GEARAspiWDM;GEARAspiWDM; C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys [2006-09-19 15664]
    R3 ha10kx2k;Creative Hardware Abstract Layer Driver; C:\WINDOWS\System32\drivers\ha10kx2k.sys [2003-08-28 823456]
    R3 hidusb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
    R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2004-08-04 12160]
    R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2008-05-02 6554496]
    R3 OmniUsb;Ideazon USB Zboard Driver; C:\WINDOWS\system32\DRIVERS\OmniUsb.sys [2005-09-22 28800]
    R3 OmniUsbl;Ideazon USBl Zboard Driver; C:\WINDOWS\system32\DRIVERS\OmniUsbl.sys [2005-09-22 9696]
    R3 ossrv;Creative OS Services Driver; C:\WINDOWS\system32\drivers\ctoss2k.sys [2003-08-28 113840]
    R3 SISNIC;SiS PCI Fast Ethernet Adapter Driver; C:\WINDOWS\system32\DRIVERS\sisnic.sys [2004-08-04 32768]
    R3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
    R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-14 30208]
    R3 usbhub;Microsoft USB Standard Hub Driver; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-14 59520]
    R3 usbohci;Microsoft USB Open Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-14 17152]
    S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
    S3 ctdvda2k;Creative DVD-Audio Device Driver; C:\WINDOWS\System32\drivers\ctdvda2k.sys []
    S3 ctljystk;Creative SBLive! Gameport; C:\WINDOWS\system32\DRIVERS\ctljystk.sys [2001-08-17 3712]
    S3 ENTECH;ENTECH; \??\C:\WINDOWS\system32\DRIVERS\ENTECH.SYS []
    S3 hap16v2k;Creative P16V HAL Driver; C:\WINDOWS\System32\drivers\hap16v2k.sys [2003-08-28 135696]
    S3 nm;Network Monitor Driver; C:\WINDOWS\system32\DRIVERS\NMnt.sys [2008-04-14 40320]
    S3 NPF;NetGroup Packet Filter Driver; C:\WINDOWS\system32\drivers\npf.sys [2005-08-03 32512]
    S3 RTL8187B;NETGEAR WG111v3 54Mbps Wireless USB 2.0 Adapter Vista Driver; C:\WINDOWS\system32\DRIVERS\wg111v3.sys [2007-04-23 224896]
    S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys [2007-10-31 30464]
    S3 usbaudio;USB Audio Driver (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-14 60032]
    S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
    S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
    S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
    S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

    List of services

    R2 aawservice;Lavasoft Ad-Aware Service; C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe [2008-08-31 611664]
    R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2007-10-31 110592]
    R2 avg8emc;AVG Free8 E-mail Scanner; C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-08-30 875288]
    R2 avg8wd;AVG Free8 WatchDog; C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-08-30 231704]
    R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2007-07-24 229376]
    R2 Creative Service for CDROM Access;Creative Service for CDROM Access; C:\WINDOWS\system32\CTsvcCDA.exe [1999-12-13 44032]
    R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2008-05-02 159812]
    R2 WMDM PMSP Service;WMDM PMSP Service; C:\WINDOWS\system32\MsPMSPSv.exe [2000-06-26 53520]
    R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2008-01-15 504104]
    R3 usnjsvc;Messenger Sharing Folders USN Journal Reader service; C:\Program Files\Windows Live\Messenger\usnsvc.exe [2007-10-18 98328]
    S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800]
    S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
    S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
    S3 rpcapd;Remote Packet Capture Protocol v.0 (experimental); C:\Program Files\WinPcap\rpcapd.exe [2005-08-03 86016]
    S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-18 913408]
    S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]

    -----------------EOF-----------------


    My computer diffidently seems better though, Thank you very much!
     
    lokilokii,
    #11
  13. 2008/09/08
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Please open MBAM and check for updates, then run a complete scan. Fix whatever it finds and post the log here.
     
    noahdfear,
    #12
  14. 2008/09/09
    lokilokii

    lokilokii Inactive Thread Starter

    Joined:
    2008/08/29
    Messages:
    8
    Likes Received:
    0
    Malwarebytes' Anti-Malware 1.27
    Database version: 1131
    Windows 5.1.2600 Service Pack 3

    9/9/2008 11:32:28 PM
    mbam-log-2008-09-09 (23-32-28).txt

    Scan type: Full Scan (C:\|)
    Objects scanned: 124650
    Time elapsed: 1 hour(s), 23 minute(s), 59 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 1
    Folders Infected: 0
    Files Infected: 0

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SecurityProviders (Broken.SecurityProviders) -> Bad: (msapsspc.dllschannel.dlldigest.dllmsnsspc.dll) Good: (msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll) -> Quarantined and deleted successfully.

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    (No malicious items detected)
     
    lokilokii,
    #13
  15. 2008/09/09
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Looks great! Lets get a few things cleaned up.


    Delete the folder C:\rsit and RSIT.exe on your desktop.
    Click Start>Run and type ComboFix /u then hit Enter to uninstall ComboFix and remove the files it has quarantined. This action will also reset the System Restore points, removing any infected files there as well.
    You can delete any other logs that we created/saved too.

    Now, download OTMoveIt2 by OldTimer and save it to your desktop.
    • Double-click OTMoveIt2.exe to run it.
    • Now click CleanUp
    • If prompted to download a file, please allow it.
    • When you receive a message that the file download is complete, click Yes.
    • It should run briefly, then prompt you to reboot.
    • Allow it to reboot and OTMoveIt2.exe should be gone upon logon.


    Next, download ATF Cleaner by Atribune and save it to your Desktop.
    • Double click ATF-Cleaner.exe to run the program.
    • Check the boxes to the left of:

      • Windows Temp
      • Current User Temp
      • All Users Temp
      • Temporary Internet Files
      • Prefetch
      • Java Cache
      • Recycle bin

    • The rest are optional - if you want it to remove everything check "Select All ".
    • Finally, click Empty Selected. When you get the "Done Cleaning" message, click OK then exit.
    Reboot


    How's the computer running now?
     
    noahdfear,
    #14
  16. 2008/09/10
    lokilokii

    lokilokii Inactive Thread Starter

    Joined:
    2008/08/29
    Messages:
    8
    Likes Received:
    0
    It seems pretty good, initially firefox was very sluggish to open up but that seems to have resolved it's self. Thanks again for the help, if i hadn't found this site i would have formatted :(
     
    lokilokii,
    #15
  17. 2008/09/10
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    noahdfear,
    #16

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...