1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Solved Google Redirect Hijack

Discussion in 'Malware and Virus Removal Archive' started by jgrendel61, 2008/09/08.

Page 1 of 2
  1. 2008/09/08
    jgrendel61

    jgrendel61 Inactive Thread Starter

    Joined:
    2008/09/08
    Messages:
    12
    Likes Received:
    0
    [Resolved] Google Redirect Hijack

    Soooo... I've acquired a lovely problem. When using google sites (including gmail), clicked links get redirected to spam-looking sites (certainly not what the link was supposed to be). I've run AdAware, Super Anti Spyware, and CA Antivirus. Each found something, but the problem persists. I've got a HJT log and am hoping a kind and knowledgeable member will help me out.

    Thanks!

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 9:55:41 PM, on 9/8/2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16705)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
    C:\Program Files\Canon\CAL\CALMAIN.exe
    C:\Program Files\NETGEAR\WG511SCU\Utility\Gear511.exe
    C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe
    C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe
    C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe
    C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Internet Explorer\Iexplore.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=33568
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O4 - HKLM\..\Run: [AS00_Gear511] C:\Program Files\NETGEAR\WG511SCU\Utility\Gear511.exe -hide
    O4 - HKLM\..\Run: [cctray] "C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe "
    O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe "
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe "
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
    O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Audible Download Manager.lnk = C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {9059F30F-4EB1-4BD2-9FDC-36F43A218F4A} (Microsoft RDP Client Control (redist)) - https://webdesktop.woodardcurran.com/mis/tsweb/,DanaInfo=intranet+msrdp.cab
    O16 - DPF: {BCBC9371-595D-11D4-A96D-00105A1CEF6C} (View22RTE Class) - http://66.242.36.116/view22/View22RTE.cab
    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: CaCCProvSP - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
    O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
    O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: VET Message Service (VETMSGNT) - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe

    --
    End of file - 5693 bytes
     
    jgrendel61,
    #1
  2. 2008/09/09
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi jgrendel61
    Welcome to Windowsbbs.

    Sorry for the wait, Kind of busy here.

    Please do this in the order given.

    Download Malwarebytes' Anti-Malware (MBAM) from here or here and save the file to your desktop.

    Double click mbam-setup.exe to install the application.
    • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
    • If an update is found, it will download and install the latest version.
    • Once the program has loaded, select 'Perform Quick Scan', then click Scan.
    • The scan may take some time to finish,so please be patient.
    • When the scan is complete, click OK, then Show Results to view the results.
    • Make sure that everything is checked, and click Remove Selected.
    • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note below)
    • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
    • Post the entire report in your next reply along with a fresh HijackThis log.

    Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.


    • Download RSIT by random/random and save it to your desktop.
    • Double click RSIT.exe to start the tool and click Continue at the disclaimer.
    • When the scan completes it will open a log named log.txt maximized, and a log named info.txt minimized.
    • Please post the contents of both logs here in your next reply.

    Please post the MBAM log and the RSIT log.txt.

    Thanks
    Geri
     
    Geri,
    #2


  3. to hide this advert.

  4. 2008/09/10
    jgrendel61

    jgrendel61 Inactive Thread Starter

    Joined:
    2008/09/08
    Messages:
    12
    Likes Received:
    0
    Thanks Geri!

    I will probably have to do all that in safe mode, since the machine now hangs almost every time I start up normally. I assume that's OK and will post all logs as soon as I have a chance.

    j
     
    jgrendel61,
    #3
  5. 2008/09/10
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi
    Yes run MBAM in safe mode, then again in normal mode if you can.

    The RSIT log I would really like to see in normal mode if possible, see what happens after running MBAM.

    Thanks
    Geri
     
    Geri,
    #4
  6. 2008/09/10
    jgrendel61

    jgrendel61 Inactive Thread Starter

    Joined:
    2008/09/08
    Messages:
    12
    Likes Received:
    0
    Thanks again Geri. Successfully ran both MBAM and RSIT in normal mode. logs below.

    MBAM LOG:

    Malwarebytes' Anti-Malware 1.28
    Database version: 1137
    Windows 5.1.2600 Service Pack 3

    9/10/2008 7:11:10 PM
    mbam-log-2008-09-10 (19-11-10).txt

    Scan type: Quick Scan
    Objects scanned: 47208
    Time elapsed: 6 minute(s), 45 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 3
    Registry Values Infected: 0
    Registry Data Items Infected: 2
    Folders Infected: 0
    Files Infected: 14

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\tdss (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> Quarantined and deleted successfully.

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispBackgroundPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispScrSavPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    C:\WINDOWS\system32\tdssadw.dll (Trojan.Agent) -> Delete on reboot.
    C:\WINDOWS\system32\tdssl.dll (Trojan.Agent) -> Delete on reboot.
    C:\WINDOWS\system32\tdssserf.dll (Trojan.Agent) -> Delete on reboot.
    C:\WINDOWS\system32\tdssmain.dll (Trojan.Agent) -> Delete on reboot.
    C:\WINDOWS\system32\tdssinit.dll (Trojan.Agent) -> Delete on reboot.
    C:\WINDOWS\system32\tdsslog.dll (Trojan.Agent) -> Delete on reboot.
    C:\WINDOWS\system32\tdssservers.dat (Trojan.Agent) -> Delete on reboot.
    C:\WINDOWS\system32\drivers\tdssserv.sys (Trojan.Agent) -> Delete on reboot.
    C:\Documents and Settings\Molly\Local Settings\Temp\.tt1.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Molly\Local Settings\Temp\.tt2.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Molly\Local Settings\Temp\.tt7.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Molly\Local Settings\Temp\.tt8.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Molly\Local Settings\Temp\.ttD.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Molly\Local Settings\Temp\.ttF.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.


    RSIT LOG

    Logfile of random's system information tool (written by random/random)
    Run by Molly at 2008-09-10 19:17:56
    Microsoft Windows XP Professional Service Pack 3
    System drive C: has 77 GB (81%) free of 95 GB
    Total RAM: 255 MB (37% free)

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 7:18:22 PM, on 9/10/2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16705)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
    C:\Program Files\Canon\CAL\CALMAIN.exe
    C:\Program Files\NETGEAR\WG511SCU\Utility\Gear511.exe
    C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe
    C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe
    C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe
    C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Documents and Settings\Molly\Desktop\RSIT.exe
    C:\Program Files\Trend Micro\HijackThis\Molly.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=33568
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O4 - HKLM\..\Run: [AS00_Gear511] C:\Program Files\NETGEAR\WG511SCU\Utility\Gear511.exe -hide
    O4 - HKLM\..\Run: [cctray] "C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe "
    O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe "
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe "
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
    O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Audible Download Manager.lnk = C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {9059F30F-4EB1-4BD2-9FDC-36F43A218F4A} (Microsoft RDP Client Control (redist)) - https://webdesktop.woodardcurran.com/mis/tsweb/,DanaInfo=intranet+msrdp.cab
    O16 - DPF: {BCBC9371-595D-11D4-A96D-00105A1CEF6C} (View22RTE Class) - http://66.242.36.116/view22/View22RTE.cab
    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: CaCCProvSP - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
    O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
    O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: VET Message Service (VETMSGNT) - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe

    --
    End of file - 5767 bytes

    Scheduled tasks folder

    C:\WINDOWS\tasks\AppleSoftwareUpdate.job

    Registry dump

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
    Adobe PDF Reader Link Helper - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2006-12-18 59032]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
    SSVHelper Class - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll [2008-06-10 509328]

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    "AS00_Gear511 "=C:\Program Files\NETGEAR\WG511SCU\Utility\Gear511.exe [2006-01-20 1122412]
    "cctray "=C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe [2008-09-10 181488]
    "CAVRID "=C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe [2008-09-10 234736]
    "SunJavaUpdateSched "=C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe [2008-06-10 144784]
    "iTunesHelper "=C:\Program Files\iTunes\iTunesHelper.exe [2008-03-30 267048]
    "QuickTime Task "=C:\Program Files\QuickTime\qttask.exe [2008-05-27 413696]

    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    "MSMSGS "=C:\Program Files\Messenger\msmsgs.exe [2008-04-13 1695232]
    "ctfmon.exe "=C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360]
    "updateMgr "=C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe [2006-03-30 313472]
    "SUPERAntiSpyware "=C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [2008-09-04 1576176]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup
    Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    Audible Download Manager.lnk - C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe
    Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon]
    C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL [2008-09-01 352256]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
    C:\WINDOWS\system32\WgaLogon.dll [2007-04-10 236928]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
    WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} "=C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2008-05-13 77824]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TDSSserv.sys]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\aawservice]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\TDSSserv.sys]

    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
    "NoDispScrSavPage "=0

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
    "dontdisplaylastusername "=0
    "legalnoticecaption "=
    "legalnoticetext "=
    "shutdownwithoutlogon "=1
    "undockwithoutlogon "=1
    "NoDispScrSavPage "=0

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
    "%windir%\system32\sessmgr.exe "= "%windir%\system32\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019 "
    "C:\Program Files\DAP\DAP.exe "= "C:\Program Files\DAP\DAP.exe:*:Enabled:Download Accelerator Plus (DAP) "
    "%windir%\Network Diagnostic\xpnetdiag.exe "= "%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000 "
    "C:\Program Files\Internet Explorer\iexplore.exe "= "C:\Program Files\Internet Explorer\iexplore.exe:*:Enabled:Internet Explorer "
    "C:\Program Files\iTunes\iTunes.exe "= "C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes "
    "C:\Program Files\BitTornado\btdownloadgui.exe "= "C:\Program Files\BitTornado\btdownloadgui.exe:*:Enabled:btdownloadgui "
    "C:\WINDOWS\system32\a.exe "= "C:\WINDOWS\system32\a.exe:*:Disabled:a "
    "C:\Documents and Settings\Molly\Local Settings\Temp\.tt7C.tmp "= "C:\Documents and Settings\Molly\Local Settings\Temp\.tt7C.tmp:*:Enabled:enable "
    "C:\WINDOWS\system32\sysrest32.exe "= "C:\WINDOWS\system32\sysrest32.exe:*:Enabled:enable "

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
    "%windir%\system32\sessmgr.exe "= "%windir%\system32\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019 "
    "%windir%\Network Diagnostic\xpnetdiag.exe "= "%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000 "

    List of files/folders created in the last three months

    2008-09-10 19:17:56 ----D---- C:\rsit
    2008-09-10 18:59:30 ----D---- C:\Documents and Settings\Molly\Application Data\Malwarebytes
    2008-09-10 18:59:21 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
    2008-09-10 18:59:21 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-09-10 18:58:25 ----D---- C:\Program Files\Common Files\Download Manager
    2008-09-08 21:55:18 ----D---- C:\Program Files\Trend Micro
    2008-09-08 20:51:37 ----D---- C:\!KillBox
    2008-09-08 19:51:08 ----A---- C:\WINDOWS\system32\wmpns.dll
    2008-09-08 19:50:32 ----D---- C:\WINDOWS\Prefetch
    2008-09-08 19:47:30 ----HDC---- C:\WINDOWS\$NtUninstallKB952954$
    2008-09-08 19:47:22 ----HDC---- C:\WINDOWS\$NtUninstallKB952287$
    2008-09-08 19:47:15 ----HDC---- C:\WINDOWS\$NtUninstallKB951748$
    2008-09-08 19:47:07 ----HDC---- C:\WINDOWS\$NtUninstallKB951698$
    2008-09-08 19:47:00 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2$
    2008-09-08 19:46:53 ----HDC---- C:\WINDOWS\$NtUninstallKB951376$
    2008-09-08 19:46:43 ----HDC---- C:\WINDOWS\$NtUninstallKB951066$
    2008-09-08 19:46:35 ----HDC---- C:\WINDOWS\$NtUninstallKB950974$
    2008-09-08 19:46:28 ----HDC---- C:\WINDOWS\$NtUninstallKB950762$
    2008-09-08 19:46:16 ----HDC---- C:\WINDOWS\$NtUninstallKB946648$
    2008-09-08 19:40:04 ----D---- C:\WINDOWS\system32\scripting
    2008-09-08 19:40:03 ----D---- C:\WINDOWS\l2schemas
    2008-09-08 19:40:02 ----D---- C:\WINDOWS\system32\en
    2008-09-08 19:40:02 ----D---- C:\WINDOWS\system32\bits
    2008-09-08 19:37:02 ----D---- C:\WINDOWS\ServicePackFiles
    2008-09-08 19:32:36 ----D---- C:\WINDOWS\system32\ReinstallBackups
    2008-09-08 19:28:14 ----HDC---- C:\WINDOWS\$NtServicePackUninstall$
    2008-09-04 20:48:55 ----A---- C:\WINDOWS\system32\windows_update.exe
    2008-09-04 19:57:36 ----A---- C:\WINDOWS\system32\a.exe
    2008-09-03 21:57:50 ----N---- C:\WINDOWS\system32\wmphoto.dll
    2008-09-03 21:57:46 ----N---- C:\WINDOWS\system32\wlanapi.dll
    2008-09-03 21:57:43 ----N---- C:\WINDOWS\system32\windowscodecsext.dll
    2008-09-03 21:57:43 ----N---- C:\WINDOWS\system32\windowscodecs.dll
    2008-09-03 21:57:28 ----N---- C:\WINDOWS\system32\tspkg.dll
    2008-09-03 21:57:28 ----N---- C:\WINDOWS\system32\tsgqec.dll
    2008-09-03 21:57:14 ----N---- C:\WINDOWS\system32\spupdwxp.exe
    2008-09-03 21:57:12 ----A---- C:\WINDOWS\system32\spdwnwxp.exe
    2008-09-03 21:57:09 ----N---- C:\WINDOWS\system32\slserv.exe
    2008-09-03 21:57:09 ----N---- C:\WINDOWS\system32\slrundll.exe
    2008-09-03 21:57:09 ----N---- C:\WINDOWS\system32\slgen.dll
    2008-09-03 21:57:09 ----N---- C:\WINDOWS\system32\slextspk.dll
    2008-09-03 21:57:09 ----N---- C:\WINDOWS\slrundll.exe
    2008-09-03 21:57:08 ----N---- C:\WINDOWS\system32\slcoinst.dll
    2008-09-03 21:57:04 ----N---- C:\WINDOWS\system32\setupn.exe
    2008-09-03 21:56:59 ----N---- C:\WINDOWS\system32\s3gnb.dll
    2008-09-03 21:56:57 ----N---- C:\WINDOWS\system32\rhttpaa.dll
    2008-09-03 21:56:54 ----N---- C:\WINDOWS\system32\rasqec.dll
    2008-09-03 21:56:52 ----N---- C:\WINDOWS\system32\qutil.dll
    2008-09-03 21:56:51 ----N---- C:\WINDOWS\system32\qcliprov.dll
    2008-09-03 21:56:51 ----N---- C:\WINDOWS\system32\qagentrt.dll
    2008-09-03 21:56:51 ----N---- C:\WINDOWS\system32\qagent.dll
    2008-09-03 21:56:48 ----N---- C:\WINDOWS\system32\photometadatahandler.dll
    2008-09-03 21:56:43 ----N---- C:\WINDOWS\system32\onex.dll
    2008-09-03 21:56:27 ----N---- C:\WINDOWS\system32\napstat.exe
    2008-09-03 21:56:27 ----N---- C:\WINDOWS\system32\napmontr.dll
    2008-09-03 21:56:26 ----N---- C:\WINDOWS\system32\napipsec.dll
    2008-09-03 21:56:26 ----N---- C:\WINDOWS\system32\mtxparhd.dll
    2008-09-03 21:56:24 ----N---- C:\WINDOWS\system32\msxml6r.dll
    2008-09-03 21:56:24 ----N---- C:\WINDOWS\system32\msxml6.dll
    2008-09-03 21:56:21 ----N---- C:\WINDOWS\system32\msshavmsg.dll
    2008-09-03 21:56:21 ----N---- C:\WINDOWS\system32\mssha.dll
    2008-09-03 21:55:55 ----N---- C:\WINDOWS\system32\mmcperf.exe
    2008-09-03 21:55:55 ----N---- C:\WINDOWS\system32\mmcfxcommon.dll
    2008-09-03 21:55:55 ----N---- C:\WINDOWS\system32\mmcex.dll
    2008-09-03 21:55:54 ----N---- C:\WINDOWS\system32\microsoft.managementconsole.dll
    2008-09-03 21:55:51 ----N---- C:\WINDOWS\system32\mdmxsdk.dll
    2008-09-03 21:55:35 ----N---- C:\WINDOWS\system32\l2gpstore.dll
    2008-09-03 21:55:34 ----N---- C:\WINDOWS\system32\kmsvc.dll
    2008-09-03 21:55:33 ----N---- C:\WINDOWS\system32\kbdpash.dll
    2008-09-03 21:55:32 ----N---- C:\WINDOWS\system32\kbdnepr.dll
    2008-09-03 21:55:32 ----N---- C:\WINDOWS\system32\kbdiultn.dll
    2008-09-03 21:55:31 ----N---- C:\WINDOWS\system32\kbdbhc.dll
    2008-09-03 21:55:15 ----N---- C:\WINDOWS\system32\smtpapi.dll
    2008-09-03 21:55:14 ----N---- C:\WINDOWS\system32\rwnh.dll
    2008-09-03 21:55:08 ----N---- C:\WINDOWS\system32\comsdupd.exe
    2008-09-03 21:55:00 ----N---- C:\WINDOWS\system32\hsfcisp2.dll
    2008-09-03 21:54:57 ----N---- C:\WINDOWS\system32\hccoin.dll
    2008-09-03 21:54:48 ----N---- C:\WINDOWS\system32\faxpatch.exe
    2008-09-03 21:54:48 ----A---- C:\WINDOWS\003066_.tmp
    2008-09-03 21:54:44 ----N---- C:\WINDOWS\system32\eapsvc.dll
    2008-09-03 21:54:44 ----N---- C:\WINDOWS\system32\eapqec.dll
    2008-09-03 21:54:44 ----N---- C:\WINDOWS\system32\eappprxy.dll
    2008-09-03 21:54:44 ----N---- C:\WINDOWS\system32\eapphost.dll
    2008-09-03 21:54:44 ----N---- C:\WINDOWS\system32\eappgnui.dll
    2008-09-03 21:54:44 ----N---- C:\WINDOWS\system32\eappcfg.dll
    2008-09-03 21:54:44 ----N---- C:\WINDOWS\system32\eapp3hst.dll
    2008-09-03 21:54:44 ----N---- C:\WINDOWS\system32\eapolqec.dll
    2008-09-03 21:54:38 ----N---- C:\WINDOWS\system32\dot3ui.dll
    2008-09-03 21:54:38 ----N---- C:\WINDOWS\system32\dot3svc.dll
    2008-09-03 21:54:38 ----N---- C:\WINDOWS\system32\dot3msm.dll
    2008-09-03 21:54:38 ----N---- C:\WINDOWS\system32\dot3gpclnt.dll
    2008-09-03 21:54:38 ----N---- C:\WINDOWS\system32\dot3dlg.dll
    2008-09-03 21:54:38 ----N---- C:\WINDOWS\system32\dot3cfg.dll
    2008-09-03 21:54:38 ----N---- C:\WINDOWS\system32\dot3api.dll
    2008-09-03 21:54:35 ----N---- C:\WINDOWS\system32\dimsroam.dll
    2008-09-03 21:54:35 ----N---- C:\WINDOWS\system32\dimsntfy.dll
    2008-09-03 21:54:34 ----N---- C:\WINDOWS\system32\dhcpqec.dll
    2008-09-03 21:54:28 ----N---- C:\WINDOWS\system32\credssp.dll
    2008-09-03 21:54:17 ----N---- C:\WINDOWS\system32\bitsprx4.dll
    2008-09-03 21:54:16 ----N---- C:\WINDOWS\system32\azroles.dll
    2008-09-03 21:54:14 ----N---- C:\WINDOWS\system32\ativvaxx.dll
    2008-09-03 21:54:14 ----N---- C:\WINDOWS\system32\ativtmxx.dll
    2008-09-03 21:54:13 ----N---- C:\WINDOWS\system32\ati3duag.dll
    2008-09-03 21:54:12 ----N---- C:\WINDOWS\system32\ati3d1ag.dll
    2008-09-03 21:54:12 ----N---- C:\WINDOWS\system32\ati2dvag.dll
    2008-09-03 21:54:12 ----N---- C:\WINDOWS\system32\ati2dvaa.dll
    2008-09-03 21:54:12 ----N---- C:\WINDOWS\system32\ati2cqag.dll
    2008-09-03 21:53:59 ----N---- C:\WINDOWS\system32\aaclient.dll
    2008-08-31 21:39:53 ----SHD---- C:\WINDOWS\CSC
    2008-08-19 17:37:33 ----A---- C:\WINDOWS\ntbtlog.txt
    2008-08-19 17:30:00 ----D---- C:\Documents and Settings\All Users\Application Data\Lavasoft
    2008-08-19 15:36:26 ----D---- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
    2008-08-19 15:35:50 ----D---- C:\Program Files\SUPERAntiSpyware
    2008-08-19 15:35:50 ----D---- C:\Documents and Settings\Molly\Application Data\SUPERAntiSpyware.com
    2008-08-19 10:47:18 ----D---- C:\Movies
    2008-08-19 10:46:46 ----D---- C:\Documents and Settings\Molly\Application Data\.BitTornado
    2008-08-17 08:45:16 ----D---- C:\Program Files\Sun
    2008-08-17 08:44:17 ----A---- C:\WINDOWS\system32\javaws.exe
    2008-08-17 08:44:17 ----A---- C:\WINDOWS\system32\javaw.exe
    2008-08-17 08:44:16 ----A---- C:\WINDOWS\system32\java.exe
    2008-08-13 22:48:42 ----HDC---- C:\WINDOWS\$NtUninstallKB952954_0$
    2008-08-13 22:48:25 ----HDC---- C:\WINDOWS\$NtUninstallKB946648_0$
    2008-08-13 22:48:10 ----HDC---- C:\WINDOWS\$NtUninstallKB953839$
    2008-08-13 22:47:47 ----HDC---- C:\WINDOWS\$NtUninstallKB950974_0$
    2008-08-13 22:45:29 ----HDC---- C:\WINDOWS\$NtUninstallKB951072-v2$
    2008-08-13 22:45:02 ----HDC---- C:\WINDOWS\$NtUninstallKB952287_0$
    2008-08-13 22:43:25 ----HDC---- C:\WINDOWS\$NtUninstallKB951066_0$
    2008-08-11 18:09:52 ----D---- C:\Program Files\Microsoft Silverlight
    2008-07-16 17:53:55 ----HDC---- C:\WINDOWS\$NtUninstallKB951748_0$
    2008-07-12 18:57:34 ----D---- C:\Program Files\QuickTime
    2008-06-20 22:39:26 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2_0$
    2008-06-12 22:48:13 ----HDC---- C:\WINDOWS\$NtUninstallKB951698_0$
    2008-06-11 19:00:14 ----HDC---- C:\WINDOWS\$NtUninstallKB950762_0$
    2008-06-11 18:59:56 ----HDC---- C:\WINDOWS\$NtUninstallKB950760$
    2008-06-11 18:58:56 ----HDC---- C:\WINDOWS\$NtUninstallKB951376_0$

    List of drivers

    R1 P3;Intel PentiumIII Processor Driver; C:\WINDOWS\system32\DRIVERS\p3.sys [2008-04-13 42752]
    R1 SASDIFSV;SASDIFSV; \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS []
    R1 SASKUTIL;SASKUTIL; \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys []
    R1 VETEFILE;VET File Scan Engine; C:\WINDOWS\system32\drivers\VETEFILE.sys [2008-06-04 880560]
    R1 VETFDDNT;VET Floppy Boot Sector Monitor; C:\WINDOWS\system32\drivers\VETFDDNT.sys [2008-09-10 21488]
    R1 VET-FILT;VET File System Filter; C:\WINDOWS\system32\drivers\VET-FILT.sys [2008-09-10 26352]
    R1 VETMONNT;VET File Monitor; C:\WINDOWS\system32\drivers\VETMONNT.sys [2008-09-10 32240]
    R1 VET-REC;VET File System Recognizer; C:\WINDOWS\system32\drivers\VET-REC.sys [2008-09-10 21104]
    R2 AegisP;AEGIS Protocol (IEEE 802.1x) v3.2.0.3; C:\WINDOWS\system32\DRIVERS\AegisP.sys [2006-11-08 17801]
    R3 ac97intc;Intel(r) 82801 Audio Driver Install Service (WDM); C:\WINDOWS\system32\drivers\ac97intc.sys [2001-08-17 96256]
    R3 AWINDIS5;AWINDIS5 Protocol Driver; \??\C:\WINDOWS\system32\AWINDIS5.SYS []
    R3 CmBatt;Microsoft ACPI Control Method Battery Driver; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2008-04-13 13952]
    R3 EL90XBC;3Com EtherLink XL 90XB/C Adapter Driver; C:\WINDOWS\system32\DRIVERS\el90xbc5.sys [2001-08-17 66591]
    R3 GEARAspiWDM;GEARAspiWDM; C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys [2008-01-29 16168]
    R3 NETGEAR_WG511_SERVICE;NETGEAR WG511T Wireless Adapter Service; C:\WINDOWS\system32\DRIVERS\wg511nd5.sys [2005-07-25 449888]
    R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2004-08-03 1897408]
    R3 SASENUM;SASENUM; \??\C:\Program Files\SUPERAntiSpyware\SASENUM.SYS []
    R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
    R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
    R3 VETEBOOT;VET Boot Scan Engine; C:\WINDOWS\system32\drivers\VETEBOOT.sys [2008-06-04 108368]
    S1 kbdhid;Keyboard HID Driver; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-13 14592]
    S3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
    S3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-17 12160]
    S3 usbscan;USB Scanner Driver; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
    S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
    S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
    S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]

    List of services

    R2 aawservice;Lavasoft Ad-Aware Service; C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe [2008-08-19 611664]
    R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-02-18 110592]
    R2 CAISafe;CAISafe; C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe [2008-01-31 144696]
    R2 CCALib8;Canon Camera Access Library 8; C:\Program Files\Canon\CAL\CALMAIN.exe [2007-01-31 96370]
    R2 VETMSGNT;VET Message Service; C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe [2008-09-10 255216]
    R3 CaCCProvSP;CaCCProvSP; C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe [2008-09-10 214256]
    R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2008-03-30 504104]
    S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800]
    S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
    S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-18 913408]
    S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-13 14336]

    -----------------EOF-----------------
     
    jgrendel61,
    #5
  7. 2008/09/10
    jgrendel61

    jgrendel61 Inactive Thread Starter

    Joined:
    2008/09/08
    Messages:
    12
    Likes Received:
    0
    ... and more...

    RSIT INFO:

    info.txt logfile of random's system information tool 2008-09-10 19:18:27

    Uninstall list

    -->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
    Ad-Aware-->MsiExec.exe /I{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}
    Adobe Flash Player 9 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\FlashUtil9b.exe -uninstallDelete
    Adobe Flash Player Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
    Adobe Reader 7.0.9-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A70900000002}
    Apple Mobile Device Support-->MsiExec.exe /I{44734179-8A79-4DEE-BB08-73037F065543}
    Apple Software Update-->MsiExec.exe /I{02DFF6B1-1654-411C-8D7B-FD6052EF016F}
    Audible Download Manager-->C:\Program Files\Audible\Bin\AudibleDM_iTunesSetup.exe /Uninstall
    CA Anti-Virus--> "C:\Program Files\CA\CA Internet Security Suite\caunst.exe" /u /product=av
    CA Anti-Virus-->C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\unvet32.exe
    Canon Camera Access Library--> "C:\Program Files\Common Files\Canon\UIW\1.3.0.0\Uninst.exe" "C:\Program Files\Canon\CAL\Uninst.ini "
    Canon Camera Support Core Library--> "C:\Program Files\Common Files\Canon\UIW\1.3.0.0\Uninst.exe" "C:\Program Files\Canon\CSCLIB\Uninst.ini "
    Canon G.726 WMP-Decoder--> "C:\Program Files\Common Files\Canon\UIW\1.3.0.0\Uninst.exe" "C:\Program Files\Canon\G726Decoder\G726DecUnInstall.ini "
    Canon MovieEdit Task for ZoomBrowser EX--> "C:\Program Files\Common Files\Canon\UIW\1.3.0.0\Uninst.exe" "C:\Program Files\Canon\ZoomBrowser EX\Program\MVWUninst.ini "
    Canon RAW Image Task for ZoomBrowser EX--> "C:\Program Files\Common Files\Canon\UIW\1.3.0.0\Uninst.exe" "C:\Program Files\Canon\RAW Image Task\Uninst.ini "
    Canon Utilities CameraWindow DC_DV 5 for ZoomBrowser EX--> "C:\Program Files\Common Files\Canon\UIW\1.3.0.0\Uninst.exe" "C:\Program Files\Canon\CameraWindow\CameraWindowDVC\Uninst.ini "
    Canon Utilities CameraWindow DC_DV 6 for ZoomBrowser EX--> "C:\Program Files\Common Files\Canon\UIW\1.3.0.0\Uninst.exe" "C:\Program Files\Canon\CameraWindow\CameraWindowDVC6\Uninst.ini "
    Canon Utilities CameraWindow DC--> "C:\Program Files\Common Files\Canon\UIW\1.3.0.0\Uninst.exe" "C:\Program Files\Canon\CameraWindow\CameraWindowDC\Uninst.ini "
    Canon Utilities CameraWindow--> "C:\Program Files\Common Files\Canon\UIW\1.3.0.0\Uninst.exe" "C:\Program Files\Canon\CameraWindow\CameraWindowLauncher\Uninst.ini "
    Canon Utilities EOS Utility--> "C:\Program Files\Common Files\Canon\UIW\1.3.0.0\Uninst.exe" "C:\Program Files\Canon\EOS Utility\Uninst.ini "
    Canon Utilities MyCamera DC--> "C:\Program Files\Common Files\Canon\UIW\1.3.0.0\Uninst.exe" "C:\Program Files\Canon\CameraWindow\MyCameraDC\Uninst.ini "
    Canon Utilities MyCamera--> "C:\Program Files\Common Files\Canon\UIW\1.3.0.0\Uninst.exe" "C:\Program Files\Canon\CameraWindow\MyCamera\Uninst.ini "
    Canon Utilities PhotoStitch--> "C:\Program Files\Common Files\Canon\UIW\1.3.0.0\Uninst.exe" "C:\Program Files\Canon\PhotoStitch\Uninst.ini "
    Canon Utilities RemoteCapture DC--> "C:\Program Files\Common Files\Canon\UIW\1.3.0.0\Uninst.exe" "C:\Program Files\Canon\CameraWindow\RemoteCaptureDC\Uninst.ini "
    Canon Utilities RemoteCapture Task for ZoomBrowser EX--> "C:\Program Files\Common Files\Canon\UIW\1.3.0.0\Uninst.exe" "C:\Program Files\Canon\CameraWindow\RemoteCaptureTask DC\Uninst.ini "
    Canon Utilities ZoomBrowser EX--> "C:\Program Files\Common Files\Canon\UIW\1.3.0.0\Uninst.exe" "C:\Program Files\Canon\ZoomBrowser EX\Program\Uninst.ini "
    Canon ZoomBrowser EX Memory Card Utility--> "C:\Program Files\Common Files\Canon\UIW\1.3.0.0\Uninst.exe" "C:\Program Files\Canon\ZoomBrowser EX MCU\Uninst.ini "
    Citrix Presentation Server Client - Web Only-->MsiExec.exe /X{23E8D2D6-F7C8-4A35-816C-6C914EE0A601}
    DivX Content Uploader-->C:\Program Files\DivX\DivXContentUploaderUninstall.exe /CUPLOADER
    DivX Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
    Download Accelerator Plus (DAP)-->C:\PROGRA~1\DAP\DAPREMOVE.EXE
    Google SketchUp-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{E1423608-F529-40A1-93CA-C7F396F30DF0}\setup.exe" -l0x9
    HijackThis 2.0.2--> "C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
    Hotfix for Windows Internet Explorer 7 (KB947864)--> "C:\WINDOWS\ie7updates\KB947864-IE7\spuninst\spuninst.exe "
    Hotfix for Windows Media Format 11 SDK (KB929399)--> "C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe "
    Hotfix for Windows Media Player 11 (KB939683)--> "C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe "
    Hotfix for Windows XP (KB952287)--> "C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe "
    IKEA HomePlanner Kitchen-->MsiExec.exe /I{E215F522-2FD6-46F4-9507-747E14D71598}
    iTunes-->MsiExec.exe /I{585776BC-4BD6-4BD2-A19A-1D6CB44A403B}
    Java(TM) 6 Update 2-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160020}
    Java(TM) 6 Update 3-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160030}
    Java(TM) 6 Update 5-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050}
    Java(TM) 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
    K-Lite Codec Pack 2.80 Full--> "C:\Program Files\K-Lite Codec Pack\unins000.exe "
    KODAK Gallery Upload Software-->MsiExec.exe /I{B7F98125-4955-41E3-8A71-4CE11CE9C198}
    Malwarebytes' Anti-Malware--> "C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe "
    Microsoft .NET Framework 2.0 Service Pack 1-->MsiExec.exe /I{B508B3F1-A24A-32C0-B310-85786919EF28}
    Microsoft Compression Client Pack 1.0 for Windows XP--> "C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe "
    Microsoft Internationalized Domain Names Mitigation APIs--> "C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe "
    Microsoft National Language Support Downlevel APIs--> "C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe "
    Microsoft Office PowerPoint Viewer 2003-->MsiExec.exe /X{90AF0409-6000-11D3-8CFE-0150048383C9}
    Microsoft Office XP Small Business-->MsiExec.exe /I{91130409-6000-11D3-8CFE-0050048383C9}
    Microsoft Silverlight-->MsiExec.exe /I{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
    Microsoft User-Mode Driver Framework Feature Pack 1.0--> "C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe "
    Move Networks Player for Internet Explorer--> "C:\Documents and Settings\Molly\Application Data\Move Networks\ie_bin\unins000.exe "
    Mozilla Firefox (3.0.1)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
    NETGEAR 108 Mbps Wireless PC Card WG511T-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C9D20484-D3CC-4CD2-B1ED-B72A9CEFD45D}\Setup.exe" -l0x9
    OpenOffice.org Installer 1.0-->MsiExec.exe /X{0D499481-22C6-4B25-8AC2-6D3F6C885FB9}
    QuickTime-->MsiExec.exe /I{08CA9554-B5FE-4313-938F-D4A417B81175}
    Real Alternative 1.7.5--> "C:\Program Files\Real Alternative\unins000.exe "
    Security Update for Windows Internet Explorer 7 (KB928090)--> "C:\WINDOWS\ie7updates\KB928090-IE7\spuninst\spuninst.exe "
    Security Update for Windows Internet Explorer 7 (KB931768)--> "C:\WINDOWS\ie7updates\KB931768-IE7\spuninst\spuninst.exe "
    Security Update for Windows Internet Explorer 7 (KB933566)--> "C:\WINDOWS\ie7updates\KB933566-IE7\spuninst\spuninst.exe "
    Security Update for Windows Internet Explorer 7 (KB937143)--> "C:\WINDOWS\ie7updates\KB937143-IE7\spuninst\spuninst.exe "
    Security Update for Windows Internet Explorer 7 (KB938127)--> "C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\spuninst.exe "
    Security Update for Windows Internet Explorer 7 (KB939653)--> "C:\WINDOWS\ie7updates\KB939653-IE7\spuninst\spuninst.exe "
    Security Update for Windows Internet Explorer 7 (KB942615)--> "C:\WINDOWS\ie7updates\KB942615-IE7\spuninst\spuninst.exe "
    Security Update for Windows Internet Explorer 7 (KB944533)--> "C:\WINDOWS\ie7updates\KB944533-IE7\spuninst\spuninst.exe "
    Security Update for Windows Internet Explorer 7 (KB950759)--> "C:\WINDOWS\ie7updates\KB950759-IE7\spuninst\spuninst.exe "
    Security Update for Windows Internet Explorer 7 (KB953838)--> "C:\WINDOWS\ie7updates\KB953838-IE7\spuninst\spuninst.exe "
    Security Update for Windows Media Player 11 (KB936782)--> "C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe "
    Security Update for Windows Media Player 9 (KB917734)--> "C:\WINDOWS\$NtUninstallKB917734_WMP9$\spuninst\spuninst.exe "
    Security Update for Windows XP (KB923789)-->C:\WINDOWS\system32\MacroMed\Flash\genuinst.exe C:\WINDOWS\system32\MacroMed\Flash\KB923789.inf
    Security Update for Windows XP (KB941569)--> "C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe "
    Security Update for Windows XP (KB946648)--> "C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe "
    Security Update for Windows XP (KB950760)--> "C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe "
    Security Update for Windows XP (KB950762)--> "C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe "
    Security Update for Windows XP (KB950974)--> "C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe "
    Security Update for Windows XP (KB951066)--> "C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe "
    Security Update for Windows XP (KB951376)--> "C:\WINDOWS\$NtUninstallKB951376$\spuninst\spuninst.exe "
    Security Update for Windows XP (KB951376-v2)--> "C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe "
    Security Update for Windows XP (KB951698)--> "C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe "
    Security Update for Windows XP (KB951748)--> "C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe "
    Security Update for Windows XP (KB952954)--> "C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe "
    Security Update for Windows XP (KB953839)--> "C:\WINDOWS\$NtUninstallKB953839$\spuninst\spuninst.exe "
    SUPERAntiSpyware Free Edition-->MsiExec.exe /X{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}
    Update for Windows XP (KB951072-v2)--> "C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe "
    Windows Media Format 11 runtime--> "C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
    Windows Media Format 11 runtime--> "C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe "
    Windows Media Player 11--> "C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
    Windows Media Player 11--> "C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe "
    Windows XP Service Pack 3--> "C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe "
    WinRAR archiver-->C:\Program Files\WinRAR\uninstall.exe

    Security center information

    AV: CA Anti-Virus

    Environment variables

    "ComSpec "=%SystemRoot%\system32\cmd.exe
    "Path "=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\QuickTime\QTSystem\
    "windir "=%SystemRoot%
    "FP_NO_HOST_CHECK "=NO
    "OS "=Windows_NT
    "PROCESSOR_ARCHITECTURE "=x86
    "PROCESSOR_LEVEL "=6
    "PROCESSOR_IDENTIFIER "=x86 Family 6 Model 11 Stepping 1, GenuineIntel
    "PROCESSOR_REVISION "=0b01
    "NUMBER_OF_PROCESSORS "=1
    "PATHEXT "=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
    "TEMP "=%SystemRoot%\TEMP
    "TMP "=%SystemRoot%\TEMP
    "CLASSPATH "=.;C:\Program Files\Java\jre1.6.0_05\lib\ext\QTJava.zip
    "QTJAVA "=C:\Program Files\Java\jre1.6.0_05\lib\ext\QTJava.zip

    -----------------EOF-----------------


    HIJACKTHIS LOG:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 7:23:13 PM, on 9/10/2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16705)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
    C:\Program Files\Canon\CAL\CALMAIN.exe
    C:\Program Files\NETGEAR\WG511SCU\Utility\Gear511.exe
    C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe
    C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe
    C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe
    C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=33568
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O4 - HKLM\..\Run: [AS00_Gear511] C:\Program Files\NETGEAR\WG511SCU\Utility\Gear511.exe -hide
    O4 - HKLM\..\Run: [cctray] "C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe "
    O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe "
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe "
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
    O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Audible Download Manager.lnk = C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {9059F30F-4EB1-4BD2-9FDC-36F43A218F4A} (Microsoft RDP Client Control (redist)) - https://webdesktop.woodardcurran.com/mis/tsweb/,DanaInfo=intranet+msrdp.cab
    O16 - DPF: {BCBC9371-595D-11D4-A96D-00105A1CEF6C} (View22RTE Class) - http://66.242.36.116/view22/View22RTE.cab
    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: CaCCProvSP - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
    O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
    O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: VET Message Service (VETMSGNT) - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe

    --
    End of file - 5678 bytes


    Thanks again!
     
    jgrendel61,
    #6
  8. 2008/09/10
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi
    Ok now this please.

    Download ComboFix from Here to your Desktop.

    It's best to disable realtime protection applications as they sometimes interfere with the tool.
    Check this link for any applicable programs you may have.
    • Close all open programs and windows
    • Double click combofix.exe and follow the prompts.
    • Vista users right click Combofix.exe and select Run As Administrator.
    • When finished, it shall produce a log for you. Post the Combofix log
    Note: Do not mouseclick combofix's window while its running. That may cause it to stall

    Note - ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.

    Note - Combofix makes some changes when run to prevent autorun/autoplay of ALL CDs, floppies and USB devices, to assist with malware removal & increase security. If this is an issue or makes it difficult for you to use those devices, please ask how to reset it.

    Please post the Combofix log.

    Thanks
    Geri
     
    Geri,
    #7
  9. 2008/09/11
    jgrendel61

    jgrendel61 Inactive Thread Starter

    Joined:
    2008/09/08
    Messages:
    12
    Likes Received:
    0
    Combofix Log:

    ComboFix 08-09-10.04 - Molly 2008-09-11 21:33:39.1 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.101 [GMT -4:00]
    Running from: C:\Documents and Settings\Molly\Desktop\ComboFix.exe
    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\WINDOWS\system32\a.exe
    C:\WINDOWS\system32\windows_update.exe

    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    -------\Legacy_TDSSSERV
    -------\Service_TDSSserv


    ((((((((((((((((((((((((( Files Created from 2008-08-12 to 2008-09-12 )))))))))))))))))))))))))))))))
    .

    2008-09-10 19:17 . 2008-09-10 19:18 <DIR> d-------- C:\rsit
    2008-09-10 18:59 . 2008-09-10 18:59 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-09-10 18:59 . 2008-09-10 18:59 <DIR> d-------- C:\Documents and Settings\Molly\Application Data\Malwarebytes
    2008-09-10 18:59 . 2008-09-10 18:59 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-09-10 18:59 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
    2008-09-10 18:59 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
    2008-09-10 18:58 . 2008-09-10 18:58 <DIR> d-------- C:\Program Files\Common Files\Download Manager
    2008-09-08 21:55 . 2008-09-08 21:55 <DIR> d-------- C:\Program Files\Trend Micro
    2008-09-08 20:51 . 2008-09-08 20:51 <DIR> d-------- C:\!KillBox
    2008-09-08 19:51 . 2004-08-04 08:00 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
    2008-09-08 19:40 . 2008-09-08 19:40 <DIR> d-------- C:\WINDOWS\system32\scripting
    2008-09-08 19:40 . 2008-09-08 19:40 <DIR> d-------- C:\WINDOWS\system32\en
    2008-09-08 19:40 . 2008-09-08 19:40 <DIR> d-------- C:\WINDOWS\system32\bits
    2008-09-08 19:40 . 2008-09-08 19:40 <DIR> d-------- C:\WINDOWS\l2schemas
    2008-09-08 19:37 . 2008-09-08 19:40 <DIR> d-------- C:\WINDOWS\ServicePackFiles
    2008-09-03 21:56 . 2008-04-13 20:12 1,737,856 --------- C:\WINDOWS\system32\mtxparhd.dll
    2008-09-03 21:55 . 2004-08-03 22:41 1,041,536 --------- C:\WINDOWS\system32\drivers\hsfdpsp2.sys
    2008-09-03 21:54 . 2008-04-13 20:11 1,888,992 --------- C:\WINDOWS\system32\ati3duag.dll
    2008-09-03 21:53 . 2008-04-13 20:11 136,192 --------- C:\WINDOWS\system32\aaclient.dll
    2008-08-19 17:30 . 2008-08-19 17:30 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
    2008-08-19 15:36 . 2008-08-19 15:36 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
    2008-08-19 15:35 . 2008-09-04 21:18 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
    2008-08-19 15:35 . 2008-08-19 15:35 <DIR> d-------- C:\Documents and Settings\Molly\Application Data\SUPERAntiSpyware.com
    2008-08-19 10:47 . 2008-08-19 10:51 <DIR> d-------- C:\Movies
    2008-08-19 10:46 . 2008-08-19 10:46 <DIR> d-------- C:\Documents and Settings\Molly\Application Data\.BitTornado
    2008-08-17 08:45 . 2008-08-17 08:45 <DIR> d-------- C:\Program Files\Sun
    2008-08-13 18:20 . 2008-04-11 15:04 691,712 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-09-10 21:49 32,240 ----a-w C:\WINDOWS\system32\drivers\vetmonnt.sys
    2008-09-10 21:49 26,352 ----a-w C:\WINDOWS\system32\drivers\vet-filt.sys
    2008-09-10 21:49 21,488 ----a-w C:\WINDOWS\system32\drivers\vetfddnt.sys
    2008-09-10 21:49 21,104 ----a-w C:\WINDOWS\system32\drivers\vet-rec.sys
    2008-09-06 14:55 --------- d-----w C:\Program Files\Common Files\InstallShield
    2008-09-06 14:49 --------- d-----w C:\Program Files\DAP
    2008-08-19 21:31 --------- d-----w C:\Program Files\Lavasoft
    2008-08-19 21:27 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
    2008-08-19 14:36 --------- d-----w C:\Documents and Settings\Molly\Application Data\AdobeUM
    2008-08-17 12:44 --------- d-----w C:\Program Files\Java
    2008-08-15 01:17 --------- d-----w C:\Documents and Settings\Molly\Application Data\ZoomBrowser EX
    2008-08-11 22:09 --------- d-----w C:\Program Files\Microsoft Silverlight
    2008-07-22 00:53 --------- d-----w C:\Documents and Settings\Molly\Application Data\CameraWindowDC
    2008-07-12 22:58 --------- d-----w C:\Program Files\QuickTime
    2007-03-27 00:12 61,248 ----a-w C:\Documents and Settings\Molly\Application Data\GDIPFONTCACHEV1.DAT
    2007-11-09 21:10 30,288 ----a-w C:\Program Files\mozilla firefox\plugins\cgpcfg.dll
    2007-11-09 21:10 79,440 ----a-w C:\Program Files\mozilla firefox\plugins\CgpCore.dll
    2007-11-09 21:10 75,344 ----a-w C:\Program Files\mozilla firefox\plugins\confmgr.dll
    2007-11-09 21:10 140,880 ----a-w C:\Program Files\mozilla firefox\plugins\ctxmui.dll
    2007-11-09 21:10 42,576 ----a-w C:\Program Files\mozilla firefox\plugins\icafile.dll
    2007-11-09 21:10 50,768 ----a-w C:\Program Files\mozilla firefox\plugins\icalogon.dll
    2007-11-09 21:10 34,384 ----a-w C:\Program Files\mozilla firefox\plugins\logging.dll
    2007-11-09 21:11 685,648 ----a-w C:\Program Files\mozilla firefox\plugins\sslsdk_b.dll
    2007-11-09 21:11 30,288 ----a-w C:\Program Files\mozilla firefox\plugins\TcpPServ.dll
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "MSMSGS "= "C:\Program Files\Messenger\msmsgs.exe" [2008-04-13 1695232]
    "ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 15360]
    "updateMgr "= "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]
    "SUPERAntiSpyware "= "C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-09-04 1576176]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "AS00_Gear511 "= "C:\Program Files\NETGEAR\WG511SCU\Utility\Gear511.exe" [2006-01-20 1122412]
    "cctray "= "C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe" [2008-09-10 181488]
    "CAVRID "= "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe" [2008-09-10 234736]
    "SunJavaUpdateSched "= "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
    "iTunesHelper "= "C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 267048]
    "QuickTime Task "= "C:\Program Files\QuickTime\qttask.exe" [2008-05-27 413696]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 29696]
    Audible Download Manager.lnk - C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe [2007-11-16 1697112]
    Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]

    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} "= "C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
    2008-09-01 15:51 352256 C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ComputerAssociatesAntiVirus]
    "DisableMonitoring "=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe "=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe "=
    "C:\\Program Files\\iTunes\\iTunes.exe "=

    R3 AWINDIS5;AWINDIS5 Protocol Driver;C:\WINDOWS\system32\AWINDIS5.SYS [2002-04-11 16194]
    R3 NETGEAR_WG511_SERVICE;NETGEAR WG511T Wireless Adapter Service;C:\WINDOWS\system32\DRIVERS\wg511nd5.sys [2005-07-25 449888]
    .
    Contents of the 'Scheduled Tasks' folder
    .
    .
    ------- Supplementary Scan -------
    .
    FireFox -: Profile - C:\Documents and Settings\Molly\Application Data\Mozilla\Firefox\Profiles\a0wq3tbs.default\
    FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://en-us.start.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:en-US:eek:fficial
    FF -: plugin - C:\Documents and Settings\Molly\Application Data\Mozilla\Firefox\Profiles\a0wq3tbs.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp07076007.dll
    FF -: plugin - C:\Program Files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll
    FF -: plugin - C:\Program Files\DivX\DivX Content Uploader\npUpload.dll
    FF -: plugin - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
    FF -: plugin - c:\Program Files\Microsoft Silverlight\2.0.30523.8\npctrl.dll
    FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\npicaN.dll
    .

    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-09-11 21:38:16
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    ------------------------ Other Running Processes ------------------------
    .
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\isafe.exe
    C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\vetmsg.exe
    C:\Program Files\Canon\CAL\CALMAIN.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
    C:\Program Files\iPod\bin\iPodService.exe
    .
    **************************************************************************
    .
    Completion time: 2008-09-11 21:42:58 - machine was rebooted
    ComboFix-quarantined-files.txt 2008-09-12 01:42:47

    Pre-Run: 80,928,690,176 bytes free
    Post-Run: 81,503,805,440 bytes free

    148 --- E O F --- 2008-09-11 22:36:35
     
    jgrendel61,
    #8
  10. 2008/09/11
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi
    Ok please do this.

    Highlight and copy the contents of the code box below and paste it into a blank Notepad, then save it to your desktop as;

    Filename: CFScript.txt
    Save As Type: All Files (*.*)

    Close all other windows and programs. Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button.
    Click here to see how to use CFScript.txt
    Combofix should run and may reboot the computer when it's done. A log will open when it's complete. Post the contents of that log and another fresh HijackThis log.

    Please do not click on the ComboFix window while it is running a scan. This can cause it to stall.

    Code:
    File::
C:\Documents and Settings\Molly\Local Settings\Temp\.tt7C.tmp
C:\WINDOWS\system32\sysrest32.exe
    Now please post a new RSIT log.txt and the combofix log.

    Thanks
    Geri
     
    Geri,
    #9
  11. 2008/09/12
    jgrendel61

    jgrendel61 Inactive Thread Starter

    Joined:
    2008/09/08
    Messages:
    12
    Likes Received:
    0
    New combofix log:

    ComboFix 08-09-10.04 - Molly 2008-09-12 17:18:02.2 - NTFSx86
    Running from: C:\Documents and Settings\Molly\Desktop\ComboFix.exe
    Command switches used :: C:\Documents and Settings\Molly\Desktop\CFScript.txt
    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    ((((((((((((((((((((((((( Files Created from 2008-08-12 to 2008-09-12 )))))))))))))))))))))))))))))))
    .

    2008-09-10 19:17 . 2008-09-10 19:18 <DIR> d-------- C:\rsit
    2008-09-10 18:59 . 2008-09-10 18:59 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-09-10 18:59 . 2008-09-10 18:59 <DIR> d-------- C:\Documents and Settings\Molly\Application Data\Malwarebytes
    2008-09-10 18:59 . 2008-09-10 18:59 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-09-10 18:59 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
    2008-09-10 18:59 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
    2008-09-10 18:58 . 2008-09-10 18:58 <DIR> d-------- C:\Program Files\Common Files\Download Manager
    2008-09-08 21:55 . 2008-09-08 21:55 <DIR> d-------- C:\Program Files\Trend Micro
    2008-09-08 20:51 . 2008-09-08 20:51 <DIR> d-------- C:\!KillBox
    2008-09-08 19:51 . 2004-08-04 08:00 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
    2008-09-08 19:40 . 2008-09-08 19:40 <DIR> d-------- C:\WINDOWS\system32\scripting
    2008-09-08 19:40 . 2008-09-08 19:40 <DIR> d-------- C:\WINDOWS\system32\en
    2008-09-08 19:40 . 2008-09-08 19:40 <DIR> d-------- C:\WINDOWS\system32\bits
    2008-09-08 19:40 . 2008-09-08 19:40 <DIR> d-------- C:\WINDOWS\l2schemas
    2008-09-08 19:37 . 2008-09-08 19:40 <DIR> d-------- C:\WINDOWS\ServicePackFiles
    2008-09-03 21:56 . 2008-04-13 20:12 1,737,856 --------- C:\WINDOWS\system32\mtxparhd.dll
    2008-09-03 21:55 . 2004-08-03 22:41 1,041,536 --------- C:\WINDOWS\system32\drivers\hsfdpsp2.sys
    2008-09-03 21:54 . 2008-04-13 20:11 1,888,992 --------- C:\WINDOWS\system32\ati3duag.dll
    2008-09-03 21:53 . 2008-04-13 20:11 136,192 --------- C:\WINDOWS\system32\aaclient.dll
    2008-08-19 17:30 . 2008-08-19 17:30 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
    2008-08-19 15:36 . 2008-08-19 15:36 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
    2008-08-19 15:35 . 2008-09-04 21:18 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
    2008-08-19 15:35 . 2008-08-19 15:35 <DIR> d-------- C:\Documents and Settings\Molly\Application Data\SUPERAntiSpyware.com
    2008-08-19 10:47 . 2008-08-19 10:51 <DIR> d-------- C:\Movies
    2008-08-19 10:46 . 2008-08-19 10:46 <DIR> d-------- C:\Documents and Settings\Molly\Application Data\.BitTornado
    2008-08-17 08:45 . 2008-08-17 08:45 <DIR> d-------- C:\Program Files\Sun
    2008-08-13 18:20 . 2008-04-11 15:04 691,712 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-09-10 21:49 32,240 ----a-w C:\WINDOWS\system32\drivers\vetmonnt.sys
    2008-09-10 21:49 26,352 ----a-w C:\WINDOWS\system32\drivers\vet-filt.sys
    2008-09-10 21:49 21,488 ----a-w C:\WINDOWS\system32\drivers\vetfddnt.sys
    2008-09-10 21:49 21,104 ----a-w C:\WINDOWS\system32\drivers\vet-rec.sys
    2008-09-06 14:55 --------- d-----w C:\Program Files\Common Files\InstallShield
    2008-09-06 14:49 --------- d-----w C:\Program Files\DAP
    2008-08-19 21:31 --------- d-----w C:\Program Files\Lavasoft
    2008-08-19 21:27 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
    2008-08-19 14:36 --------- d-----w C:\Documents and Settings\Molly\Application Data\AdobeUM
    2008-08-17 12:44 --------- d-----w C:\Program Files\Java
    2008-08-15 01:17 --------- d-----w C:\Documents and Settings\Molly\Application Data\ZoomBrowser EX
    2008-08-11 22:09 --------- d-----w C:\Program Files\Microsoft Silverlight
    2008-07-22 00:53 --------- d-----w C:\Documents and Settings\Molly\Application Data\CameraWindowDC
    2008-07-12 22:58 --------- d-----w C:\Program Files\QuickTime
    2007-03-27 00:12 61,248 ----a-w C:\Documents and Settings\Molly\Application Data\GDIPFONTCACHEV1.DAT
    2007-11-09 21:10 30,288 ----a-w C:\Program Files\mozilla firefox\plugins\cgpcfg.dll
    2007-11-09 21:10 79,440 ----a-w C:\Program Files\mozilla firefox\plugins\CgpCore.dll
    2007-11-09 21:10 75,344 ----a-w C:\Program Files\mozilla firefox\plugins\confmgr.dll
    2007-11-09 21:10 140,880 ----a-w C:\Program Files\mozilla firefox\plugins\ctxmui.dll
    2007-11-09 21:10 42,576 ----a-w C:\Program Files\mozilla firefox\plugins\icafile.dll
    2007-11-09 21:10 50,768 ----a-w C:\Program Files\mozilla firefox\plugins\icalogon.dll
    2007-11-09 21:10 34,384 ----a-w C:\Program Files\mozilla firefox\plugins\logging.dll
    2007-11-09 21:11 685,648 ----a-w C:\Program Files\mozilla firefox\plugins\sslsdk_b.dll
    2007-11-09 21:11 30,288 ----a-w C:\Program Files\mozilla firefox\plugins\TcpPServ.dll
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "MSMSGS "= "C:\Program Files\Messenger\msmsgs.exe" [2008-04-13 1695232]
    "ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 15360]
    "updateMgr "= "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]
    "SUPERAntiSpyware "= "C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-09-04 1576176]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "AS00_Gear511 "= "C:\Program Files\NETGEAR\WG511SCU\Utility\Gear511.exe" [2006-01-20 1122412]
    "cctray "= "C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe" [2008-09-10 181488]
    "CAVRID "= "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe" [2008-09-10 234736]
    "SunJavaUpdateSched "= "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
    "iTunesHelper "= "C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 267048]
    "QuickTime Task "= "C:\Program Files\QuickTime\qttask.exe" [2008-05-27 413696]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 29696]
    Audible Download Manager.lnk - C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe [2007-11-16 1697112]
    Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]

    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} "= "C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
    2008-09-01 15:51 352256 C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ComputerAssociatesAntiVirus]
    "DisableMonitoring "=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe "=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe "=
    "C:\\Program Files\\iTunes\\iTunes.exe "=

    R3 AWINDIS5;AWINDIS5 Protocol Driver;C:\WINDOWS\system32\AWINDIS5.SYS [2002-04-11 16194]
    R3 NETGEAR_WG511_SERVICE;NETGEAR WG511T Wireless Adapter Service;C:\WINDOWS\system32\DRIVERS\wg511nd5.sys [2005-07-25 449888]
    .
    Contents of the 'Scheduled Tasks' folder
    .

    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-09-12 17:20:27
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2008-09-12 17:23:01
    ComboFix-quarantined-files.txt 2008-09-12 21:22:53
    ComboFix2.txt 2008-09-12 01:42:59

    Pre-Run: 81,489,022,976 bytes free
    Post-Run: 81,477,603,328 bytes free

    115 --- E O F --- 2008-09-11 22:36:35
     
    jgrendel61,
    #10
  12. 2008/09/12
    jgrendel61

    jgrendel61 Inactive Thread Starter

    Joined:
    2008/09/08
    Messages:
    12
    Likes Received:
    0
    RSIT log:

    Logfile of random's system information tool (written by random/random)
    Run by Molly at 2008-09-12 17:36:14
    Microsoft Windows XP Professional Service Pack 3
    System drive C: has 78 GB (81%) free of 95 GB
    Total RAM: 255 MB (42% free)

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 5:36:20 PM, on 9/12/2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16705)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
    C:\Program Files\Canon\CAL\CALMAIN.exe
    C:\Program Files\NETGEAR\WG511SCU\Utility\Gear511.exe
    C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe
    C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe
    C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe
    C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\explorer.exe
    C:\Documents and Settings\Molly\Desktop\RSIT.exe
    C:\Program Files\Trend Micro\HijackThis\Molly.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=33568
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O4 - HKLM\..\Run: [AS00_Gear511] C:\Program Files\NETGEAR\WG511SCU\Utility\Gear511.exe -hide
    O4 - HKLM\..\Run: [cctray] "C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe "
    O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe "
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe "
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
    O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Audible Download Manager.lnk = C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {9059F30F-4EB1-4BD2-9FDC-36F43A218F4A} (Microsoft RDP Client Control (redist)) - https://webdesktop.woodardcurran.com/mis/tsweb/,DanaInfo=intranet+msrdp.cab
    O16 - DPF: {BCBC9371-595D-11D4-A96D-00105A1CEF6C} (View22RTE Class) - http://66.242.36.116/view22/View22RTE.cab
    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: CaCCProvSP - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
    O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
    O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: VET Message Service (VETMSGNT) - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe

    --
    End of file - 5383 bytes

    Scheduled tasks folder

    C:\WINDOWS\tasks\AppleSoftwareUpdate.job

    Registry dump

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
    Adobe PDF Reader Link Helper - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2006-12-18 59032]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
    SSVHelper Class - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll [2008-06-10 509328]

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    "AS00_Gear511 "=C:\Program Files\NETGEAR\WG511SCU\Utility\Gear511.exe [2006-01-20 1122412]
    "cctray "=C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe [2008-09-10 181488]
    "CAVRID "=C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe [2008-09-10 234736]
    "SunJavaUpdateSched "=C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe [2008-06-10 144784]
    "iTunesHelper "=C:\Program Files\iTunes\iTunesHelper.exe [2008-03-30 267048]
    "QuickTime Task "=C:\Program Files\QuickTime\qttask.exe [2008-05-27 413696]

    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    "MSMSGS "=C:\Program Files\Messenger\msmsgs.exe [2008-04-13 1695232]
    "ctfmon.exe "=C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360]
    "updateMgr "=C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe [2006-03-30 313472]
    "SUPERAntiSpyware "=C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [2008-09-04 1576176]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup
    Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    Audible Download Manager.lnk - C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe
    Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon]
    C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL [2008-09-01 352256]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
    C:\WINDOWS\system32\WgaLogon.dll [2007-04-10 236928]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
    WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} "=C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2008-05-13 77824]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\aawservice]

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
    "dontdisplaylastusername "=0
    "legalnoticecaption "=
    "legalnoticetext "=
    "shutdownwithoutlogon "=1
    "undockwithoutlogon "=1

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
    "%windir%\system32\sessmgr.exe "= "%windir%\system32\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019 "
    "%windir%\Network Diagnostic\xpnetdiag.exe "= "%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000 "
    "C:\Program Files\iTunes\iTunes.exe "= "C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes "

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
    "%windir%\system32\sessmgr.exe "= "%windir%\system32\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019 "
    "%windir%\Network Diagnostic\xpnetdiag.exe "= "%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000 "

    List of files/folders created in the last three months

    2008-09-12 17:23:06 ----D---- C:\WINDOWS\temp
    2008-09-12 17:23:02 ----A---- C:\ComboFix.txt
    2008-09-11 21:33:20 ----D---- C:\WINDOWS\erdnt
    2008-09-11 21:32:23 ----D---- C:\QooBox
    2008-09-11 21:32:21 ----A---- C:\WINDOWS\zip.exe
    2008-09-11 21:32:21 ----A---- C:\WINDOWS\VFind.exe
    2008-09-11 21:32:21 ----A---- C:\WINDOWS\swxcacls.exe
    2008-09-11 21:32:21 ----A---- C:\WINDOWS\swsc.exe
    2008-09-11 21:32:21 ----A---- C:\WINDOWS\swreg.exe
    2008-09-11 21:32:21 ----A---- C:\WINDOWS\sed.exe
    2008-09-11 21:32:21 ----A---- C:\WINDOWS\Nircmd.exe
    2008-09-11 21:32:21 ----A---- C:\WINDOWS\grep.exe
    2008-09-11 21:32:21 ----A---- C:\WINDOWS\fdsv.exe
    2008-09-11 18:31:12 ----HDC---- C:\WINDOWS\$NtUninstallKB951978$
    2008-09-11 18:29:41 ----HDC---- C:\WINDOWS\$NtUninstallKB938464$
    2008-09-11 18:26:32 ----HDC---- C:\WINDOWS\$NtUninstallKB954154_WM11$
    2008-09-10 19:17:56 ----D---- C:\rsit
    2008-09-10 18:59:30 ----D---- C:\Documents and Settings\Molly\Application Data\Malwarebytes
    2008-09-10 18:59:21 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
    2008-09-10 18:59:21 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-09-10 18:58:25 ----D---- C:\Program Files\Common Files\Download Manager
    2008-09-08 21:55:18 ----D---- C:\Program Files\Trend Micro
    2008-09-08 20:51:37 ----D---- C:\!KillBox
    2008-09-08 19:51:08 ----A---- C:\WINDOWS\system32\wmpns.dll
    2008-09-08 19:50:32 ----D---- C:\WINDOWS\Prefetch
    2008-09-08 19:47:30 ----HDC---- C:\WINDOWS\$NtUninstallKB952954$
    2008-09-08 19:47:22 ----HDC---- C:\WINDOWS\$NtUninstallKB952287$
    2008-09-08 19:47:15 ----HDC---- C:\WINDOWS\$NtUninstallKB951748$
    2008-09-08 19:47:07 ----HDC---- C:\WINDOWS\$NtUninstallKB951698$
    2008-09-08 19:47:00 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2$
    2008-09-08 19:46:53 ----HDC---- C:\WINDOWS\$NtUninstallKB951376$
    2008-09-08 19:46:43 ----HDC---- C:\WINDOWS\$NtUninstallKB951066$
    2008-09-08 19:46:35 ----HDC---- C:\WINDOWS\$NtUninstallKB950974$
    2008-09-08 19:46:28 ----HDC---- C:\WINDOWS\$NtUninstallKB950762$
    2008-09-08 19:46:16 ----HDC---- C:\WINDOWS\$NtUninstallKB946648$
    2008-09-08 19:40:04 ----D---- C:\WINDOWS\system32\scripting
    2008-09-08 19:40:03 ----D---- C:\WINDOWS\l2schemas
    2008-09-08 19:40:02 ----D---- C:\WINDOWS\system32\en
    2008-09-08 19:40:02 ----D---- C:\WINDOWS\system32\bits
    2008-09-08 19:37:02 ----D---- C:\WINDOWS\ServicePackFiles
    2008-09-08 19:32:36 ----D---- C:\WINDOWS\system32\ReinstallBackups
    2008-09-08 19:28:14 ----HDC---- C:\WINDOWS\$NtServicePackUninstall$
    2008-09-03 21:57:50 ----N---- C:\WINDOWS\system32\wmphoto.dll
    2008-09-03 21:57:46 ----N---- C:\WINDOWS\system32\wlanapi.dll
    2008-09-03 21:57:43 ----N---- C:\WINDOWS\system32\windowscodecsext.dll
    2008-09-03 21:57:43 ----N---- C:\WINDOWS\system32\windowscodecs.dll
    2008-09-03 21:57:28 ----N---- C:\WINDOWS\system32\tspkg.dll
    2008-09-03 21:57:28 ----N---- C:\WINDOWS\system32\tsgqec.dll
    2008-09-03 21:57:14 ----N---- C:\WINDOWS\system32\spupdwxp.exe
    2008-09-03 21:57:12 ----A---- C:\WINDOWS\system32\spdwnwxp.exe
    2008-09-03 21:57:09 ----N---- C:\WINDOWS\system32\slserv.exe
    2008-09-03 21:57:09 ----N---- C:\WINDOWS\system32\slrundll.exe
    2008-09-03 21:57:09 ----N---- C:\WINDOWS\system32\slgen.dll
    2008-09-03 21:57:09 ----N---- C:\WINDOWS\system32\slextspk.dll
    2008-09-03 21:57:09 ----N---- C:\WINDOWS\slrundll.exe
    2008-09-03 21:57:08 ----N---- C:\WINDOWS\system32\slcoinst.dll
    2008-09-03 21:57:04 ----N---- C:\WINDOWS\system32\setupn.exe
    2008-09-03 21:56:59 ----N---- C:\WINDOWS\system32\s3gnb.dll
    2008-09-03 21:56:57 ----N---- C:\WINDOWS\system32\rhttpaa.dll
    2008-09-03 21:56:54 ----N---- C:\WINDOWS\system32\rasqec.dll
    2008-09-03 21:56:52 ----N---- C:\WINDOWS\system32\qutil.dll
    2008-09-03 21:56:51 ----N---- C:\WINDOWS\system32\qcliprov.dll
    2008-09-03 21:56:51 ----N---- C:\WINDOWS\system32\qagentrt.dll
    2008-09-03 21:56:51 ----N---- C:\WINDOWS\system32\qagent.dll
    2008-09-03 21:56:48 ----N---- C:\WINDOWS\system32\photometadatahandler.dll
    2008-09-03 21:56:43 ----N---- C:\WINDOWS\system32\onex.dll
    2008-09-03 21:56:27 ----N---- C:\WINDOWS\system32\napstat.exe
    2008-09-03 21:56:27 ----N---- C:\WINDOWS\system32\napmontr.dll
    2008-09-03 21:56:26 ----N---- C:\WINDOWS\system32\napipsec.dll
    2008-09-03 21:56:26 ----N---- C:\WINDOWS\system32\mtxparhd.dll
    2008-09-03 21:56:24 ----N---- C:\WINDOWS\system32\msxml6r.dll
    2008-09-03 21:56:24 ----N---- C:\WINDOWS\system32\msxml6.dll
    2008-09-03 21:56:21 ----N---- C:\WINDOWS\system32\msshavmsg.dll
    2008-09-03 21:56:21 ----N---- C:\WINDOWS\system32\mssha.dll
    2008-09-03 21:55:55 ----N---- C:\WINDOWS\system32\mmcperf.exe
    2008-09-03 21:55:55 ----N---- C:\WINDOWS\system32\mmcfxcommon.dll
    2008-09-03 21:55:55 ----N---- C:\WINDOWS\system32\mmcex.dll
    2008-09-03 21:55:54 ----N---- C:\WINDOWS\system32\microsoft.managementconsole.dll
    2008-09-03 21:55:51 ----N---- C:\WINDOWS\system32\mdmxsdk.dll
    2008-09-03 21:55:35 ----N---- C:\WINDOWS\system32\l2gpstore.dll
    2008-09-03 21:55:34 ----N---- C:\WINDOWS\system32\kmsvc.dll
    2008-09-03 21:55:33 ----N---- C:\WINDOWS\system32\kbdpash.dll
    2008-09-03 21:55:32 ----N---- C:\WINDOWS\system32\kbdnepr.dll
    2008-09-03 21:55:32 ----N---- C:\WINDOWS\system32\kbdiultn.dll
    2008-09-03 21:55:31 ----N---- C:\WINDOWS\system32\kbdbhc.dll
    2008-09-03 21:55:15 ----N---- C:\WINDOWS\system32\smtpapi.dll
    2008-09-03 21:55:14 ----N---- C:\WINDOWS\system32\rwnh.dll
    2008-09-03 21:55:08 ----N---- C:\WINDOWS\system32\comsdupd.exe
    2008-09-03 21:55:00 ----N---- C:\WINDOWS\system32\hsfcisp2.dll
    2008-09-03 21:54:57 ----N---- C:\WINDOWS\system32\hccoin.dll
    2008-09-03 21:54:48 ----N---- C:\WINDOWS\system32\faxpatch.exe
    2008-09-03 21:54:48 ----A---- C:\WINDOWS\003066_.tmp
    2008-09-03 21:54:44 ----N---- C:\WINDOWS\system32\eapsvc.dll
    2008-09-03 21:54:44 ----N---- C:\WINDOWS\system32\eapqec.dll
    2008-09-03 21:54:44 ----N---- C:\WINDOWS\system32\eappprxy.dll
    2008-09-03 21:54:44 ----N---- C:\WINDOWS\system32\eapphost.dll
    2008-09-03 21:54:44 ----N---- C:\WINDOWS\system32\eappgnui.dll
    2008-09-03 21:54:44 ----N---- C:\WINDOWS\system32\eappcfg.dll
    2008-09-03 21:54:44 ----N---- C:\WINDOWS\system32\eapp3hst.dll
    2008-09-03 21:54:44 ----N---- C:\WINDOWS\system32\eapolqec.dll
    2008-09-03 21:54:38 ----N---- C:\WINDOWS\system32\dot3ui.dll
    2008-09-03 21:54:38 ----N---- C:\WINDOWS\system32\dot3svc.dll
    2008-09-03 21:54:38 ----N---- C:\WINDOWS\system32\dot3msm.dll
    2008-09-03 21:54:38 ----N---- C:\WINDOWS\system32\dot3gpclnt.dll
    2008-09-03 21:54:38 ----N---- C:\WINDOWS\system32\dot3dlg.dll
    2008-09-03 21:54:38 ----N---- C:\WINDOWS\system32\dot3cfg.dll
    2008-09-03 21:54:38 ----N---- C:\WINDOWS\system32\dot3api.dll
    2008-09-03 21:54:35 ----N---- C:\WINDOWS\system32\dimsroam.dll
    2008-09-03 21:54:35 ----N---- C:\WINDOWS\system32\dimsntfy.dll
    2008-09-03 21:54:34 ----N---- C:\WINDOWS\system32\dhcpqec.dll
    2008-09-03 21:54:28 ----N---- C:\WINDOWS\system32\credssp.dll
    2008-09-03 21:54:17 ----N---- C:\WINDOWS\system32\bitsprx4.dll
    2008-09-03 21:54:16 ----N---- C:\WINDOWS\system32\azroles.dll
    2008-09-03 21:54:14 ----N---- C:\WINDOWS\system32\ativvaxx.dll
    2008-09-03 21:54:14 ----N---- C:\WINDOWS\system32\ativtmxx.dll
    2008-09-03 21:54:13 ----N---- C:\WINDOWS\system32\ati3duag.dll
    2008-09-03 21:54:12 ----N---- C:\WINDOWS\system32\ati3d1ag.dll
    2008-09-03 21:54:12 ----N---- C:\WINDOWS\system32\ati2dvag.dll
    2008-09-03 21:54:12 ----N---- C:\WINDOWS\system32\ati2dvaa.dll
    2008-09-03 21:54:12 ----N---- C:\WINDOWS\system32\ati2cqag.dll
    2008-09-03 21:53:59 ----N---- C:\WINDOWS\system32\aaclient.dll
    2008-08-31 21:39:53 ----SHD---- C:\WINDOWS\CSC
    2008-08-19 17:37:33 ----A---- C:\WINDOWS\ntbtlog.txt
    2008-08-19 17:30:00 ----D---- C:\Documents and Settings\All Users\Application Data\Lavasoft
    2008-08-19 15:36:26 ----D---- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
    2008-08-19 15:35:50 ----D---- C:\Program Files\SUPERAntiSpyware
    2008-08-19 15:35:50 ----D---- C:\Documents and Settings\Molly\Application Data\SUPERAntiSpyware.com
    2008-08-19 10:47:18 ----D---- C:\Movies
    2008-08-19 10:46:46 ----D---- C:\Documents and Settings\Molly\Application Data\.BitTornado
    2008-08-17 08:45:16 ----D---- C:\Program Files\Sun
    2008-08-17 08:44:17 ----A---- C:\WINDOWS\system32\javaws.exe
    2008-08-17 08:44:17 ----A---- C:\WINDOWS\system32\javaw.exe
    2008-08-17 08:44:16 ----A---- C:\WINDOWS\system32\java.exe
    2008-08-13 22:48:42 ----HDC---- C:\WINDOWS\$NtUninstallKB952954_0$
    2008-08-13 22:48:25 ----HDC---- C:\WINDOWS\$NtUninstallKB946648_0$
    2008-08-13 22:48:10 ----HDC---- C:\WINDOWS\$NtUninstallKB953839$
    2008-08-13 22:47:47 ----HDC---- C:\WINDOWS\$NtUninstallKB950974_0$
    2008-08-13 22:45:29 ----HDC---- C:\WINDOWS\$NtUninstallKB951072-v2$
    2008-08-13 22:45:02 ----HDC---- C:\WINDOWS\$NtUninstallKB952287_0$
    2008-08-13 22:43:25 ----HDC---- C:\WINDOWS\$NtUninstallKB951066_0$
    2008-08-11 18:09:52 ----D---- C:\Program Files\Microsoft Silverlight
    2008-07-16 17:53:55 ----HDC---- C:\WINDOWS\$NtUninstallKB951748_0$
    2008-07-12 18:57:34 ----D---- C:\Program Files\QuickTime
    2008-06-20 22:39:26 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2_0$

    List of drivers

    R1 P3;Intel PentiumIII Processor Driver; C:\WINDOWS\system32\DRIVERS\p3.sys [2008-04-13 42752]
    R1 SASDIFSV;SASDIFSV; \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS []
    R1 SASKUTIL;SASKUTIL; \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys []
    R1 VETEFILE;VET File Scan Engine; C:\WINDOWS\system32\drivers\VETEFILE.sys [2008-06-04 880560]
    R1 VETFDDNT;VET Floppy Boot Sector Monitor; C:\WINDOWS\system32\drivers\VETFDDNT.sys [2008-09-10 21488]
    R1 VET-FILT;VET File System Filter; C:\WINDOWS\system32\drivers\VET-FILT.sys [2008-09-10 26352]
    R1 VETMONNT;VET File Monitor; C:\WINDOWS\system32\drivers\VETMONNT.sys [2008-09-10 32240]
    R1 VET-REC;VET File System Recognizer; C:\WINDOWS\system32\drivers\VET-REC.sys [2008-09-10 21104]
    R2 AegisP;AEGIS Protocol (IEEE 802.1x) v3.2.0.3; C:\WINDOWS\system32\DRIVERS\AegisP.sys [2006-11-08 17801]
    R3 ac97intc;Intel(r) 82801 Audio Driver Install Service (WDM); C:\WINDOWS\system32\drivers\ac97intc.sys [2001-08-17 96256]
    R3 AWINDIS5;AWINDIS5 Protocol Driver; \??\C:\WINDOWS\system32\AWINDIS5.SYS []
    R3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
    R3 CmBatt;Microsoft ACPI Control Method Battery Driver; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2008-04-13 13952]
    R3 EL90XBC;3Com EtherLink XL 90XB/C Adapter Driver; C:\WINDOWS\system32\DRIVERS\el90xbc5.sys [2001-08-17 66591]
    R3 GEARAspiWDM;GEARAspiWDM; C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys [2008-01-29 16168]
    R3 NETGEAR_WG511_SERVICE;NETGEAR WG511T Wireless Adapter Service; C:\WINDOWS\system32\DRIVERS\wg511nd5.sys [2005-07-25 449888]
    R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2004-08-03 1897408]
    R3 SASENUM;SASENUM; \??\C:\Program Files\SUPERAntiSpyware\SASENUM.SYS []
    R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
    R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
    R3 VETEBOOT;VET Boot Scan Engine; C:\WINDOWS\system32\drivers\VETEBOOT.sys [2008-06-04 108368]
    S1 kbdhid;Keyboard HID Driver; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-13 14592]
    S3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
    S3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-17 12160]
    S3 usbscan;USB Scanner Driver; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
    S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
    S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
    S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]

    List of services

    R2 aawservice;Lavasoft Ad-Aware Service; C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe [2008-08-19 611664]
    R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-02-18 110592]
    R2 CAISafe;CAISafe; C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe [2008-01-31 144696]
    R2 CCALib8;Canon Camera Access Library 8; C:\Program Files\Canon\CAL\CALMAIN.exe [2007-01-31 96370]
    R2 VETMSGNT;VET Message Service; C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe [2008-09-10 255216]
    R3 CaCCProvSP;CaCCProvSP; C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe [2008-09-10 214256]
    R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2008-03-30 504104]
    S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800]
    S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
    S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-18 913408]
    S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-13 14336]

    -----------------EOF-----------------
     
    jgrendel61,
    #11
  13. 2008/09/12
    jgrendel61

    jgrendel61 Inactive Thread Starter

    Joined:
    2008/09/08
    Messages:
    12
    Likes Received:
    0
    Aaaaand the HJT log:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 5:38:12 PM, on 9/12/2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16705)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
    C:\Program Files\Canon\CAL\CALMAIN.exe
    C:\Program Files\NETGEAR\WG511SCU\Utility\Gear511.exe
    C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe
    C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe
    C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe
    C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=33568
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O4 - HKLM\..\Run: [AS00_Gear511] C:\Program Files\NETGEAR\WG511SCU\Utility\Gear511.exe -hide
    O4 - HKLM\..\Run: [cctray] "C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe "
    O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe "
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe "
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
    O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Audible Download Manager.lnk = C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {9059F30F-4EB1-4BD2-9FDC-36F43A218F4A} (Microsoft RDP Client Control (redist)) - https://webdesktop.woodardcurran.com/mis/tsweb/,DanaInfo=intranet+msrdp.cab
    O16 - DPF: {BCBC9371-595D-11D4-A96D-00105A1CEF6C} (View22RTE Class) - http://66.242.36.116/view22/View22RTE.cab
    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: CaCCProvSP - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
    O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
    O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: VET Message Service (VETMSGNT) - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe

    --
    End of file - 5338 bytes



    Thank you Geri!!!
     
    jgrendel61,
    #12
  14. 2008/09/13
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi
    Ok now lets get a on line scan.

    Download ATF Cleaner by Atribune and save it to your Desktop.
    This is a good tool to get rid of the temporary garbage you pick up while surfing the net.
    Double click ATF-Cleaner.exe to run the program.
    Check the boxes to the left of:

    Windows Temp
    Current User Temp
    All Users Temp
    Cookies
    Temporary Internet Files
    Prefetch
    Java Cache
    Recycle bin

    The rest are optional - if you want it to remove everything check "Select All ".
    Finally, click Empty Selected. When you get the "Done Cleaning" message, click OK.


    Now this.

    Please do an online scan with Kaspersky WebScanner

    Click on "Accept" If your pop "“up blocker blocks any windows from opening.

    Click Run on the window that opens.
    Windows Vista users you must open the web browser using the Run as Administrator command.
    • The program will launch and then begin downloading the latest definition files:
    • Under Scan on the left side.Click on My Computer
    • This will start the program and scan your system.
    • Click the "Scan Report" On the left side.
    • The scan will take a while so be patient and let it run.
    • Once the scan is complete it will display if your system has been infected.
      • Click the Save Report As button, and in the Browse dialog box, type a name for the scan report file that you want to create and select its type Text file. Click OK to save the file.:
    • Save the text file to your desktop.
    • Copy and paste that information in your next post.

    Please post the Kaspersky results.

    Thanks
    Geri
     
    Geri,
    #13
  15. 2008/09/13
    jgrendel61

    jgrendel61 Inactive Thread Starter

    Joined:
    2008/09/08
    Messages:
    12
    Likes Received:
    0
    Thank you Geri. I really appreciate your help.

    --------------------------------------------------------------------------------
    KASPERSKY ONLINE SCANNER 7 REPORT
    Saturday, September 13, 2008
    Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600)
    Kaspersky Online Scanner 7 version: 7.0.25.0
    Program database last update: Saturday, September 13, 2008 19:07:41
    Records in database: 1221756
    --------------------------------------------------------------------------------

    Scan settings:
    Scan using the following database: extended
    Scan archives: yes
    Scan mail databases: yes

    Scan area - My Computer:
    C:\
    D:\

    Scan statistics:
    Files scanned: 39201
    Threat name: 2
    Infected objects: 24
    Suspicious objects: 0
    Duration of the scan: 01:19:21


    File name / Threat name / Threats count
    C:\Documents and Settings\Molly\Local Settings\Application Data\Mozilla\Firefox\Profiles\a0wq3tbs.default\Cache\33AA34DEd01 Infected: Trojan-Downloader.JS.Agent.cnn 1
    C:\QooBox\Quarantine\C\WINDOWS\system32\a.exe.vir Infected: Trojan-Downloader.Win32.Small.acxh 1
    C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\6MK0DEXV\acCA61IVFS.htm Infected: Trojan-Downloader.JS.Agent.cnn 1
    C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\6MK0DEXV\acCAN0MA25.htm Infected: Trojan-Downloader.JS.Agent.cnn 1
    C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\6MK0DEXV\acCAT8KO61.htm Infected: Trojan-Downloader.JS.Agent.cnn 1
    C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\6MK0DEXV\ac[10].htm Infected: Trojan-Downloader.JS.Agent.cnn 1
    C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\6MK0DEXV\ac[11].htm Infected: Trojan-Downloader.JS.Agent.cnn 1
    C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\6MK0DEXV\ac[1].htm Infected: Trojan-Downloader.JS.Agent.cnn 1
    C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\6MK0DEXV\ac[2].htm Infected: Trojan-Downloader.JS.Agent.cnn 1
    C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\6MK0DEXV\ac[3].htm Infected: Trojan-Downloader.JS.Agent.cnn 1
    C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\6MK0DEXV\ac[4].htm Infected: Trojan-Downloader.JS.Agent.cnn 1
    C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\6MK0DEXV\ac[5].htm Infected: Trojan-Downloader.JS.Agent.cnn 1
    C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\6MK0DEXV\ac[6].htm Infected: Trojan-Downloader.JS.Agent.cnn 1
    C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\6MK0DEXV\ac[7].htm Infected: Trojan-Downloader.JS.Agent.cnn 1
    C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\6MK0DEXV\ac[8].htm Infected: Trojan-Downloader.JS.Agent.cnn 1
    C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\6MK0DEXV\ac[9].htm Infected: Trojan-Downloader.JS.Agent.cnn 1
    C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\KUYBC7WO\ac[1].htm Infected: Trojan-Downloader.JS.Agent.cnn 1
    C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\KUYBC7WO\ac[2].htm Infected: Trojan-Downloader.JS.Agent.cnn 1
    C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\KUYBC7WO\ac[3].htm Infected: Trojan-Downloader.JS.Agent.cnn 1
    C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\OMBLANX7\ac[1].htm Infected: Trojan-Downloader.JS.Agent.cnn 1
    C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\OMBLANX7\ac[2].htm Infected: Trojan-Downloader.JS.Agent.cnn 1
    C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\YT3VTFVB\ac[1].htm Infected: Trojan-Downloader.JS.Agent.cnn 1
    C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\YT3VTFVB\ac[2].htm Infected: Trojan-Downloader.JS.Agent.cnn 1
    C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\YT3VTFVB\ac[3].htm Infected: Trojan-Downloader.JS.Agent.cnn 1

    The selected area was scanned.
     
    jgrendel61,
    #14
  16. 2008/09/13
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi
    OK please do this.

    Highlight and copy the contents of the code box below and paste it into a blank Notepad, then save it to your desktop as;

    Filename: CFScript.txt
    Save As Type: All Files (*.*)

    Close all other windows and programs. Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button.
    Click here to see how to use CFScript.txt
    Combofix should run and may reboot the computer when it's done. A log will open when it's complete. Post the contents of that log and another fresh HijackThis log.

    Please do not click on the ComboFix window while it is running a scan. This can cause it to stall.

    Code:
    Folder::
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\6MK0DEXV
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\KUYBC7WO
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\OMBLANX7
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\YT3VTFVB
    Please post the Combofix log.

    Thanks
    Geri
     
    Geri,
    #15
  17. 2008/09/13
    jgrendel61

    jgrendel61 Inactive Thread Starter

    Joined:
    2008/09/08
    Messages:
    12
    Likes Received:
    0
    Combofix:

    ComboFix 08-09-10.04 - Molly 2008-09-13 22:33:27.3 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.114 [GMT -4:00]
    Running from: C:\Documents and Settings\Molly\Desktop\ComboFix.exe
    Command switches used :: C:\Documents and Settings\Molly\Desktop\CFScript.txt
    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\6MK0DEXV\ac[1].htm
    C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\6MK0DEXV\ac[10].htm
    C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\6MK0DEXV\ac[11].htm
    C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\6MK0DEXV\ac[2].htm
    C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\6MK0DEXV\ac[3].htm
    C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\6MK0DEXV\ac[4].htm
    C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\6MK0DEXV\ac[5].htm
    C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\6MK0DEXV\ac[6].htm
    C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\6MK0DEXV\ac[7].htm
    C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\6MK0DEXV\ac[8].htm
    C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\6MK0DEXV\ac[9].htm
    C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\6MK0DEXV\acCA61IVFS.htm
    C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\6MK0DEXV\acCAN0MA25.htm
    C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\6MK0DEXV\acCAT8KO61.htm
    C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\6MK0DEXV\background_gradient[1]
    C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\6MK0DEXV\desktop.ini
    C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\6MK0DEXV\httpErrorPagesScripts[2]
    C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\KUYBC7WO\ac[1].htm
    C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\KUYBC7WO\ac[2].htm
    C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\KUYBC7WO\ac[3].htm
    C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\KUYBC7WO\desktop.ini
    C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\KUYBC7WO\http_404[1]
    C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\KUYBC7WO\info_48[1]
    C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\OMBLANX7\ac[1].htm
    C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\OMBLANX7\ac[2].htm
    C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\OMBLANX7\desktop.ini
    C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\OMBLANX7\down[1]
    C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\OMBLANX7\errorPageStrings[1]
    C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\YT3VTFVB\ac[1].htm
    C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\YT3VTFVB\ac[2].htm
    C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\YT3VTFVB\ac[3].htm
    C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\YT3VTFVB\bullet[1]
    C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\YT3VTFVB\desktop.ini
    C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\YT3VTFVB\ErrorPageTemplate[1]

    .
    ((((((((((((((((((((((((( Files Created from 2008-08-14 to 2008-09-14 )))))))))))))))))))))))))))))))
    .

    2008-09-10 19:17 . 2008-09-10 19:18 <DIR> d-------- C:\rsit
    2008-09-10 18:59 . 2008-09-10 18:59 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-09-10 18:59 . 2008-09-10 18:59 <DIR> d-------- C:\Documents and Settings\Molly\Application Data\Malwarebytes
    2008-09-10 18:59 . 2008-09-10 18:59 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-09-10 18:59 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
    2008-09-10 18:59 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
    2008-09-10 18:58 . 2008-09-10 18:58 <DIR> d-------- C:\Program Files\Common Files\Download Manager
    2008-09-08 21:55 . 2008-09-08 21:55 <DIR> d-------- C:\Program Files\Trend Micro
    2008-09-08 20:51 . 2008-09-08 20:51 <DIR> d-------- C:\!KillBox
    2008-09-08 19:51 . 2004-08-04 08:00 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
    2008-09-08 19:40 . 2008-09-08 19:40 <DIR> d-------- C:\WINDOWS\system32\scripting
    2008-09-08 19:40 . 2008-09-08 19:40 <DIR> d-------- C:\WINDOWS\system32\en
    2008-09-08 19:40 . 2008-09-08 19:40 <DIR> d-------- C:\WINDOWS\system32\bits
    2008-09-08 19:40 . 2008-09-08 19:40 <DIR> d-------- C:\WINDOWS\l2schemas
    2008-09-08 19:37 . 2008-09-08 19:40 <DIR> d-------- C:\WINDOWS\ServicePackFiles
    2008-09-03 21:56 . 2008-04-13 20:12 1,737,856 --------- C:\WINDOWS\system32\mtxparhd.dll
    2008-09-03 21:55 . 2004-08-03 22:41 1,041,536 --------- C:\WINDOWS\system32\drivers\hsfdpsp2.sys
    2008-09-03 21:54 . 2008-04-13 20:11 1,888,992 --------- C:\WINDOWS\system32\ati3duag.dll
    2008-09-03 21:53 . 2008-04-13 20:11 136,192 --------- C:\WINDOWS\system32\aaclient.dll
    2008-08-19 17:30 . 2008-08-19 17:30 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
    2008-08-19 15:36 . 2008-08-19 15:36 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
    2008-08-19 15:35 . 2008-09-04 21:18 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
    2008-08-19 15:35 . 2008-08-19 15:35 <DIR> d-------- C:\Documents and Settings\Molly\Application Data\SUPERAntiSpyware.com
    2008-08-19 10:47 . 2008-08-19 10:51 <DIR> d-------- C:\Movies
    2008-08-19 10:46 . 2008-08-19 10:46 <DIR> d-------- C:\Documents and Settings\Molly\Application Data\.BitTornado
    2008-08-17 08:45 . 2008-08-17 08:45 <DIR> d-------- C:\Program Files\Sun

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-09-10 21:49 32,240 ----a-w C:\WINDOWS\system32\drivers\vetmonnt.sys
    2008-09-10 21:49 26,352 ----a-w C:\WINDOWS\system32\drivers\vet-filt.sys
    2008-09-10 21:49 21,488 ----a-w C:\WINDOWS\system32\drivers\vetfddnt.sys
    2008-09-10 21:49 21,104 ----a-w C:\WINDOWS\system32\drivers\vet-rec.sys
    2008-09-06 14:55 --------- d-----w C:\Program Files\Common Files\InstallShield
    2008-09-06 14:49 --------- d-----w C:\Program Files\DAP
    2008-08-19 21:31 --------- d-----w C:\Program Files\Lavasoft
    2008-08-19 21:27 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
    2008-08-19 14:36 --------- d-----w C:\Documents and Settings\Molly\Application Data\AdobeUM
    2008-08-17 12:44 --------- d-----w C:\Program Files\Java
    2008-08-15 01:17 --------- d-----w C:\Documents and Settings\Molly\Application Data\ZoomBrowser EX
    2008-08-11 22:09 --------- d-----w C:\Program Files\Microsoft Silverlight
    2008-07-22 00:53 --------- d-----w C:\Documents and Settings\Molly\Application Data\CameraWindowDC
    2007-03-27 00:12 61,248 ----a-w C:\Documents and Settings\Molly\Application Data\GDIPFONTCACHEV1.DAT
    2007-11-09 21:10 30,288 ----a-w C:\Program Files\mozilla firefox\plugins\cgpcfg.dll
    2007-11-09 21:10 79,440 ----a-w C:\Program Files\mozilla firefox\plugins\CgpCore.dll
    2007-11-09 21:10 75,344 ----a-w C:\Program Files\mozilla firefox\plugins\confmgr.dll
    2007-11-09 21:10 140,880 ----a-w C:\Program Files\mozilla firefox\plugins\ctxmui.dll
    2007-11-09 21:10 42,576 ----a-w C:\Program Files\mozilla firefox\plugins\icafile.dll
    2007-11-09 21:10 50,768 ----a-w C:\Program Files\mozilla firefox\plugins\icalogon.dll
    2007-11-09 21:10 34,384 ----a-w C:\Program Files\mozilla firefox\plugins\logging.dll
    2007-11-09 21:11 685,648 ----a-w C:\Program Files\mozilla firefox\plugins\sslsdk_b.dll
    2007-11-09 21:11 30,288 ----a-w C:\Program Files\mozilla firefox\plugins\TcpPServ.dll
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "MSMSGS "= "C:\Program Files\Messenger\msmsgs.exe" [2008-04-13 1695232]
    "ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 15360]
    "updateMgr "= "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]
    "SUPERAntiSpyware "= "C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-09-04 1576176]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "AS00_Gear511 "= "C:\Program Files\NETGEAR\WG511SCU\Utility\Gear511.exe" [2006-01-20 1122412]
    "cctray "= "C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe" [2008-09-10 181488]
    "CAVRID "= "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe" [2008-09-10 234736]
    "SunJavaUpdateSched "= "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
    "iTunesHelper "= "C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 267048]
    "QuickTime Task "= "C:\Program Files\QuickTime\qttask.exe" [2008-05-27 413696]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 29696]
    Audible Download Manager.lnk - C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe [2007-11-16 1697112]
    Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]

    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} "= "C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
    2008-09-01 15:51 352256 C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ComputerAssociatesAntiVirus]
    "DisableMonitoring "=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe "=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe "=
    "C:\\Program Files\\iTunes\\iTunes.exe "=

    R3 AWINDIS5;AWINDIS5 Protocol Driver;C:\WINDOWS\system32\AWINDIS5.SYS [2002-04-11 16194]
    R3 NETGEAR_WG511_SERVICE;NETGEAR WG511T Wireless Adapter Service;C:\WINDOWS\system32\DRIVERS\wg511nd5.sys [2005-07-25 449888]
    .
    Contents of the 'Scheduled Tasks' folder
    .

    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-09-13 22:38:33
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    ------------------------ Other Running Processes ------------------------
    .
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\isafe.exe
    C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\vetmsg.exe
    C:\Program Files\Canon\CAL\CALMAIN.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
    C:\Program Files\iPod\bin\iPodService.exe
    .
    **************************************************************************
    .
    Completion time: 2008-09-13 22:43:22 - machine was rebooted
    ComboFix-quarantined-files.txt 2008-09-14 02:43:15
    ComboFix2.txt 2008-09-12 21:23:02
    ComboFix3.txt 2008-09-12 01:42:59

    Pre-Run: 80,766,717,952 bytes free
    Post-Run: 80,892,235,776 bytes free

    165 --- E O F --- 2008-09-11 22:36:35




    And HJT:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 10:43:53 PM, on 9/13/2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16705)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
    C:\Program Files\Canon\CAL\CALMAIN.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\NETGEAR\WG511SCU\Utility\Gear511.exe
    C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe
    C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe
    C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe
    C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\explorer.exe
    C:\WINDOWS\system32\notepad.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=33568
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O4 - HKLM\..\Run: [AS00_Gear511] C:\Program Files\NETGEAR\WG511SCU\Utility\Gear511.exe -hide
    O4 - HKLM\..\Run: [cctray] "C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe "
    O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe "
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe "
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
    O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Audible Download Manager.lnk = C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {9059F30F-4EB1-4BD2-9FDC-36F43A218F4A} (Microsoft RDP Client Control (redist)) - https://webdesktop.woodardcurran.com/mis/tsweb/,DanaInfo=intranet+msrdp.cab
    O16 - DPF: {BCBC9371-595D-11D4-A96D-00105A1CEF6C} (View22RTE Class) - http://66.242.36.116/view22/View22RTE.cab
    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: CaCCProvSP - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
    O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
    O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: VET Message Service (VETMSGNT) - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe

    --
    End of file - 5501 bytes
     
    jgrendel61,
    #16
  18. 2008/09/13
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi

    OK please clear your Firefox cache.
    Here is how.

    Open Firefox
    Click on Tools
    Click on Clear Private Data
    Make sure there is a check in the Cache box
    Click on Clear Private Data Now.
    OK any prompts.


    Now Click Start>Run in the run box copy and paste or type ComboFix /u then hit Enter to uninstall ComboFix and remove the files/folders it created. This action will also reset the System Restore points, removing any infected files there as well.

    Delete RSIT.exe and this folder. C:\rsit

    Now please run ATF Cleaner and then one more Kaspersky scan.

    Please post the Kaspersky results.

    Thanks
    Geri
     
    Geri,
    #17
  19. 2008/09/14
    jgrendel61

    jgrendel61 Inactive Thread Starter

    Joined:
    2008/09/08
    Messages:
    12
    Likes Received:
    0
    --------------------------------------------------------------------------------
    KASPERSKY ONLINE SCANNER 7 REPORT
    Sunday, September 14, 2008
    Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600)
    Kaspersky Online Scanner 7 version: 7.0.25.0
    Program database last update: Sunday, September 14, 2008 14:00:54
    Records in database: 1228031
    --------------------------------------------------------------------------------

    Scan settings:
    Scan using the following database: extended
    Scan archives: yes
    Scan mail databases: yes

    Scan area - My Computer:
    C:\
    D:\

    Scan statistics:
    Files scanned: 38485
    Threat name: 0
    Infected objects: 0
    Suspicious objects: 0
    Duration of the scan: 01:20:10

    No malware has been detected. The scan area is clean.

    The selected area was scanned.
     
    jgrendel61,
    #18
  20. 2008/09/14
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi jgrendel61
    OK perfect. Kaspersky shows you're clean.

    How are things running?

    Geri
     
    Geri,
    #19
  21. 2008/09/14
    jgrendel61

    jgrendel61 Inactive Thread Starter

    Joined:
    2008/09/08
    Messages:
    12
    Likes Received:
    0
    Much better! By that I mean, the machine actually starts up every time, doesn't hang doing routine tasks, and google/gmail are acting normally.

    Thank you so much for all your help. I'm really glad I found this site, and that you were kind enough to spend your time helping me out. You offer a great free service here, and I'll definitely spread the word!

    Best,

    j
     
    jgrendel61,
    #20
Page 1 of 2

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...