Solved Trojan horse Agent AVTB HJT log

[Resolved] Trojan horse Agent AVTB HJT log

Okay Windows BBS experts, here is the problem I’m having:
I gave my parents (78 & 74) a custom PC for Christmas in 07.
They have Charter cable high speed internet in Wisconsin. It seems the F Secure Security Suite was corrupted or had some problem. Rodents have chewed up the cable / phone wiring in the box down the street and their phone and internet have been intermittent.
I am not sure but I think during an update or something the connection was opened and their Charter security suite was compromised.
They appear to have been infected with a Trojan Virus called Trojan Downloader AVTB.
I downloaded AVG, Spybot, Ad-Aware and Hijackthis at work and installed them via a flash drive.
I uninstalled the corrupted Charter Security Suite and installed AVG 8.5 and ran a scan. It found many tracking cookies and this Trojan.
I removed them using AVG. I ran Spybot and ad-aware removing the usual "problemsâ€
I am posting the Hijack this log as I know getting rid of this Trojan can not be this easy.
My father has had a stroke and is pretty far progressed in Parkinson’s disease and gets his news and stock updates via the internet. He can read online at his own pace and has become quite an internet browser. He wants his machine back.
You guys (noahdfear) helped me clean the first machine I gave them about 8 yeas years ago, a surplus Zenith with a 100mz processor, over clocked to 150!
Anyway here is the log. What next?
Thanks in advance,
Dan Johnson

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:04:17 PM, on 5/25/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\S3trayp.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.channel3000.com/index.html
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://yahoo.com/
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [S3Trayp] S3trayp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe "
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe "
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: F-Secure ORSP Client (FSORSPClient) - Unknown owner - C:\Program Files\Charter High-Speed Security Suite\ORSP Client\fsorsp.exe (file missing)
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

--
End of file - 5037 bytes

 

Sorry Arie, hope this helps:

DDS (Ver_09-05-14.01) - NTFSx86
Run by Custom PC at 22:30:35.26 on Mon 05/25/2009
Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 1.6.0_13
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.894.310 [GMT -5:00]

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\S3trayp.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
svchost.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Custom PC\My Documents\old docs\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.channel3000.com/index.html
uInternet Connection Wizard,ShellNext = hxxp://yahoo.com/
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: AVG Security Toolbar: {a057a204-bacc-4d26-9990-79a187e2698e} - c:\progra~1\avg\avg8\AVGTOO~1.DLL
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: AVG Security Toolbar: {a057a204-bacc-4d26-9990-79a187e2698e} - c:\progra~1\avg\avg8\AVGTOO~1.DLL
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [SkyTel] SkyTel.EXE
mRun: [Alcmtr] ALCMTR.EXE
mRun: [VTTimer] VTTimer.exe
mRun: [S3Trayp] S3trayp.exe
mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe "
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe "
mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
mRun: [Ad-Watch] c:\program files\lavasoft\ad-aware\AAWTray.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_04-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxps://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
Notify: avgrsstarter - avgrsstx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\custom~1\applic~1\mozilla\firefox\profiles\pq9bhiri.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.channel3000.com/index.html
FF - component: c:\program files\avg\avg8\firefox\components\avgssff.dll
FF - component: c:\program files\avg\avg8\toolbarff\components\vmAVGConnector.dll

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true
============= SERVICES / DRIVERS ===============

R0 fsbts;fsbts;c:\windows\system32\drivers\fsbts.sys [2009-1-16 33408]
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-5-25 64160]
R0 xfilt;VIA SATA IDE Hot-plug Driver;c:\windows\system32\drivers\xfilt.sys [2007-12-6 11264]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-5-25 325896]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-5-25 27784]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-5-25 108552]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-5-25 298776]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-3-9 953168]
R3 S3GIGP;S3GIGP;c:\windows\system32\drivers\S3gIGPm.sys [2007-12-6 634880]
S3 FSORSPClient;F-Secure ORSP Client; "c:\program files\charter high-speed security suite\orsp client\fsorsp.exe" --> c:\program files\charter high-speed security suite\orsp client\fsorsp.exe [?]
S3 FXDrv32;FXDrv32;\??\d:\fxdrv32.sys --> d:\FXDrv32.sys [?]

=============== Created Last 30 ================

2009-05-25 22:00 <DIR> --d----- c:\program files\Trend Micro
2009-05-25 21:28 15,688 a------- c:\windows\system32\lsdelete.exe
2009-05-25 21:20 64,160 a------- c:\windows\system32\drivers\Lbd.sys
2009-05-25 21:17 <DIR> -cd-h--- c:\docume~1\alluse~1\applic~1\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
2009-05-25 21:16 <DIR> --d----- c:\program files\Lavasoft
2009-05-25 20:43 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
2009-05-25 20:43 <DIR> --d----- c:\program files\Spybot - Search & Destroy
2009-05-25 11:58 <DIR> --d-h--- C:\$AVG8.VAULT$
2009-05-25 11:52 108,552 a------- c:\windows\system32\drivers\avgtdix.sys
2009-05-25 11:52 11,952 a------- c:\windows\system32\avgrsstx.dll
2009-05-25 11:52 325,896 a------- c:\windows\system32\drivers\avgldx86.sys
2009-05-25 11:52 <DIR> --d----- c:\windows\system32\drivers\Avg
2009-05-25 11:52 <DIR> --d----- c:\docume~1\custom~1\applic~1\AVGTOOLBAR
2009-05-25 11:51 <DIR> --d----- c:\program files\AVG
2009-05-25 11:51 <DIR> --d----- c:\docume~1\alluse~1\applic~1\avg8
2009-05-23 16:27 <DIR> --d----- c:\windows\system32\drivers\Avg(2)
2009-05-23 16:27 <DIR> --d----- c:\docume~1\alluse~1\applic~1\avg8(2)
2009-05-07 12:34 32 a--s---- c:\windows\system32\2499847018.dat

==================== Find3M ====================

2009-03-18 13:58 22,960 a------- c:\docume~1\custom~1\applic~1\GDIPFONTCACHEV1.DAT
2009-03-09 05:19 410,984 a------- c:\windows\system32\deploytk.dll
2009-03-06 09:22 284,160 a------- c:\windows\system32\pdh.dll

============= FINISH: 22:31:13.20
===============

Here is the other:


UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-05-14.01)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 12/6/2007 7:38:58 AM
System Uptime: 5/25/2009 10:01:36 PM (0 hours ago)

Motherboard: Foxconn | | P4M900-8237A
Processor: Intel(R) Celeron(R) D CPU 3.20GHz | Socket 775 | 3193/133mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 149 GiB total, 139.498 GiB free.
D: is CDROM ()
E: is Removable
F: is Removable
G: is Removable
H: is Removable

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP321: 2/24/2009 10:14:59 PM - Software Distribution Service 3.0
RP322: 2/26/2009 5:18:46 PM - System Checkpoint
RP323: 2/27/2009 6:48:11 PM - System Checkpoint
RP324: 2/28/2009 6:59:54 PM - System Checkpoint
RP325: 3/1/2009 7:05:12 PM - System Checkpoint
RP326: 3/2/2009 7:16:08 PM - System Checkpoint
RP327: 3/3/2009 7:57:35 PM - System Checkpoint
RP328: 3/4/2009 10:56:02 PM - System Checkpoint
RP329: 3/6/2009 6:43:20 PM - System Checkpoint
RP330: 3/6/2009 8:56:22 PM - Removed Java(TM) 6 Update 5
RP331: 3/6/2009 8:57:05 PM - Removed Java(TM) 6 Update 7
RP332: 3/7/2009 10:51:56 PM - System Checkpoint
RP333: 3/9/2009 10:37:26 AM - System Checkpoint
RP334: 3/10/2009 5:37:27 PM - System Checkpoint
RP335: 3/10/2009 10:28:15 PM - Software Distribution Service 3.0
RP336: 3/12/2009 2:06:07 PM - System Checkpoint
RP337: 3/15/2009 9:36:40 PM - System Checkpoint
RP338: 3/15/2009 10:27:17 PM - Software Distribution Service 3.0
RP339: 3/16/2009 10:29:15 PM - System Checkpoint
RP340: 3/17/2009 10:43:56 PM - System Checkpoint
RP341: 3/19/2009 9:42:18 PM - System Checkpoint
RP342: 3/20/2009 9:47:03 PM - System Checkpoint
RP343: 3/21/2009 10:45:42 PM - System Checkpoint
RP344: 3/22/2009 10:50:03 PM - System Checkpoint
RP345: 3/24/2009 9:23:25 PM - System Checkpoint
RP346: 3/25/2009 10:01:46 PM - System Checkpoint
RP347: 3/26/2009 10:19:40 PM - System Checkpoint
RP348: 3/27/2009 10:58:10 PM - System Checkpoint
RP349: 3/28/2009 10:58:18 PM - System Checkpoint
RP350: 3/30/2009 6:40:58 PM - System Checkpoint
RP351: 3/31/2009 6:56:28 PM - System Checkpoint
RP352: 4/1/2009 10:14:06 PM - System Checkpoint
RP353: 4/3/2009 11:08:18 PM - System Checkpoint
RP354: 4/5/2009 10:01:35 PM - System Checkpoint
RP355: 4/7/2009 12:36:44 PM - System Checkpoint
RP356: 4/8/2009 8:27:57 PM - System Checkpoint
RP357: 4/9/2009 9:05:18 PM - System Checkpoint
RP358: 4/9/2009 11:00:07 PM - Software Distribution Service 3.0
RP359: 4/10/2009 3:53:00 PM - Installed Windows XP WgaNotify.
RP360: 4/11/2009 10:11:54 PM - System Checkpoint
RP361: 4/13/2009 6:44:43 PM - System Checkpoint
RP362: 4/15/2009 6:51:32 PM - System Checkpoint
RP363: 4/15/2009 11:06:11 PM - Software Distribution Service 3.0
RP364: 4/17/2009 3:53:27 PM - System Checkpoint
RP365: 4/18/2009 6:29:54 PM - System Checkpoint
RP366: 4/19/2009 9:46:27 PM - System Checkpoint
RP367: 4/20/2009 10:12:58 PM - System Checkpoint
RP368: 4/21/2009 10:34:30 PM - System Checkpoint
RP369: 4/22/2009 8:19:53 PM - Installed Java(TM) 6 Update 13
RP370: 4/22/2009 8:20:35 PM - Installed Java Runtime Environment
RP371: 4/23/2009 9:01:10 PM - System Checkpoint
RP372: 4/24/2009 9:13:55 PM - System Checkpoint
RP373: 4/25/2009 11:00:50 PM - System Checkpoint
RP374: 4/27/2009 3:07:01 PM - System Checkpoint
RP375: 4/28/2009 6:56:50 PM - System Checkpoint
RP376: 4/29/2009 10:28:38 PM - System Checkpoint
RP377: 5/1/2009 9:43:09 PM - System Checkpoint
RP378: 5/2/2009 9:55:14 PM - System Checkpoint
RP379: 5/3/2009 10:40:17 PM - System Checkpoint
RP380: 5/4/2009 10:56:41 PM - System Checkpoint
RP381: 5/5/2009 11:01:12 PM - System Checkpoint
RP382: 5/7/2009 1:00:27 PM - System Checkpoint
RP383: 5/8/2009 1:02:17 PM - System Checkpoint
RP384: 5/9/2009 1:21:35 PM - System Checkpoint
RP385: 5/12/2009 11:30:53 PM - Software Distribution Service 3.0
RP386: 5/14/2009 10:31:35 PM - System Checkpoint
RP387: 5/17/2009 3:19:15 PM - System Checkpoint
RP388: 5/18/2009 9:46:42 PM - System Checkpoint
RP389: 5/19/2009 10:04:45 PM - System Checkpoint
RP390: 5/21/2009 10:12:43 AM - System Checkpoint
RP391: 5/22/2009 12:20:52 PM - System Checkpoint
RP392: 5/23/2009 2:44:18 PM - psc 8.02 build 106 Installation
RP393: 5/23/2009 3:55:00 PM - psc 8.02 build 106 Installation
RP394: 5/23/2009 5:07:48 PM - Restore Operation
RP395: 5/23/2009 9:13:37 PM - Software Distribution Service 3.0
RP396: 5/25/2009 11:51:54 AM - Installed AVG Free 8.5

==== Installed Programs ======================

Ad-Aware
Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 8.1.2
Adobe Reader 8.1.2 Security Update 1 (KB403742)
Apple Software Update
AVG Free 8.5
Critical Update for Windows Media Player 11 (KB959772)
High Definition Audio Driver Package - KB888111
HijackThis 2.0.2
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB952287)
J2SE Runtime Environment 5.0 Update 4
Java(TM) 6 Update 13
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Office XP Professional with FrontPage
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Mozilla Firefox (3.0.10)
Nero Suite
Platform
Politikens Engelsk-dansk dansk-engelsk ordbog
PowerDVD
QuickTime
REALTEK GbE & FE Ethernet PCI NIC Driver
Realtek High Definition Audio Driver
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player 10 (KB936782)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB938464-v2)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956390)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958215)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960714)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB963027)
Spelling Dictionaries Support For Adobe Reader 8
Spybot - Search & Destroy
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
VIA Platform Device Manager
VIA/S3G Display Driver 6.14.10.0078
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
WebFldrs XP
Windows Genuine Advantage Notifications (KB905474)
Windows Media Format 11 runtime
Windows Media Player 11
Windows XP Service Pack 3

==== Event Viewer Messages From Past Week ========

5/23/2009 5:20:06 PM, error: W32Time [17] - Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 15 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751)
5/23/2009 4:46:08 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD AvgLdx86 AvgMfx86 AvgTdiX Fips intelppm IPSec MRxSmb NetBIOS NetBT RasAcd Rdbss Tcpip WS2IFSL
5/23/2009 4:46:08 PM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD Networking Support Environment service which failed to start because of the following error: A device attached to the system is not functioning.
5/23/2009 4:46:08 PM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.
5/23/2009 4:46:08 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
5/23/2009 4:46:08 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.
5/23/2009 4:40:25 PM, error: SideBySide [59] - Generate Activation Context failed for C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe. Reference error message: The operation completed successfully. .
5/23/2009 4:40:17 PM, error: SideBySide [59] - Generate Activation Context failed for C:\PROGRA~1\AVG\AVG8\avgtray.exe. Reference error message: The operation completed successfully. .
5/23/2009 4:40:14 PM, error: SideBySide [59] - Generate Activation Context failed for C:\WINDOWS\system32\avgrsstx.dll. Reference error message: The operation completed successfully. .
5/23/2009 4:40:14 PM, error: Dhcp [1002] - The IP address lease 75.128.244.132 for the Network Card with network address 00016C08AB10 has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message).
5/23/2009 4:27:34 PM, error: SideBySide [59] - Generate Activation Context failed for C:\Program Files\AVG\AVG8\avgui.exe. Reference error message: The operation completed successfully. .
5/23/2009 4:27:30 PM, error: SideBySide [59] - Generate Activation Context failed for C:\Program Files\AVG\AVG8\avgfrw.exe. Reference error message: The operation completed successfully. .
5/23/2009 4:27:16 PM, error: SideBySide [59] - Resolve Partial Assembly failed for Microsoft.VC80.CRT. Reference error message: The referenced assembly is not installed on your system. .
5/23/2009 4:27:16 PM, error: SideBySide [59] - Generate Activation Context failed for C:\Program Files\AVG\AVG8\avgssie.dll. Reference error message: The operation completed successfully. .
5/23/2009 4:27:16 PM, error: SideBySide [59] - Generate Activation Context failed for C:\Program Files\AVG\AVG8\avgpp.dll. Reference error message: The operation completed successfully. .
5/23/2009 4:27:16 PM, error: SideBySide [32] - Dependent Assembly Microsoft.VC80.CRT could not be found and Last Error was The referenced assembly is not installed on your system.
5/23/2009 4:27:07 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service MSIServer with arguments " " in order to run the server: {000C101C-0000-0000-C000-000000000046}
5/23/2009 3:25:20 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Fips intelppm
5/23/2009 3:24:08 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments " " in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
5/23/2009 2:49:13 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the F-Secure Management Agent service to connect.
5/23/2009 2:45:29 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the FSGKHS service to connect.
5/23/2009 2:11:46 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the FSMA service to connect.
5/18/2009 9:16:46 PM, error: Dhcp [1001] - Your computer was not assigned an address from the network (by the DHCP Server) for the Network Card with network address 00016C08AB10. The following error occurred: The semaphore timeout period has expired. . Your computer will continue to try and obtain an address on its own from the network address (DHCP) server.

==== End Of File ===========================

Thanks for the quick reply and the help,
Dan

 

Thanks Broni, I will be at their house tomorrow and do as instructed.
I will post the results then.
I have been using another machine to download the utilities so far and using a flash drive to transfer to the infected machine.
Do you think the problem can attach to the flash drive? I have been scanning it each time I put it in the known good machine without any detected problems before exploring to it.
Thanks again,
Dan

 

Broni, I have done as instructed with the following exceptions.
I downloaded all 3 utilities at work and brought them to the infected machine via a flash drive after vaccinating it (the flash drive) with the Panda vaccine.
I opened Super spyware and did the update then pulled the cable modem plug, restarted in safe mode.
Then ran the Super spyware program in safe mode. It came back with no problems found:
SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 05/27/2009 at 01:12 PM

Application Version : 4.26.1004

Core Rules Database Version : 3912
Trace Rules Database Version: 1856

Scan type : Complete Scan
Total Scan Time : 00:55:13

Memory items scanned : 224
Memory threats detected : 0
Registry items scanned : 4548
Registry threats detected : 0
File items scanned : 27182
File threats detected : 0

I reconnected the modem, restarted in normal windows and installed malwarebytes and updated it.
Here is the log:
Malwarebytes' Anti-Malware 1.37
Database version: 2186
Windows 5.1.2600 Service Pack 3

5/27/2009 5:32:38 PM
mbam-log-2009-05-27 (17-32-38).txt

Scan type: Full Scan (C:\|)
Objects scanned: 120392
Time elapsed: 30 minute(s), 16 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 12

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
c:\system volume information\_restore{57b076cb-55b5-4ade-86a3-c502dd053abb}\RP391\A0035073.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
c:\system volume information\_restore{57b076cb-55b5-4ade-86a3-c502dd053abb}\RP392\A0035321.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
c:\system volume information\_restore{57b076cb-55b5-4ade-86a3-c502dd053abb}\RP392\A0035720.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
c:\system volume information\_restore{57b076cb-55b5-4ade-86a3-c502dd053abb}\RP392\A0035726.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
c:\system volume information\_restore{57b076cb-55b5-4ade-86a3-c502dd053abb}\RP392\A0036368.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
c:\system volume information\_restore{57b076cb-55b5-4ade-86a3-c502dd053abb}\RP393\A0036613.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
c:\system volume information\_restore{57b076cb-55b5-4ade-86a3-c502dd053abb}\RP393\A0037023.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
c:\system volume information\_restore{57b076cb-55b5-4ade-86a3-c502dd053abb}\RP393\A0037028.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
c:\system volume information\_restore{57b076cb-55b5-4ade-86a3-c502dd053abb}\RP393\A0037032.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\system volume information\_restore{57b076cb-55b5-4ade-86a3-c502dd053abb}\RP394\A0037051.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
c:\system volume information\_restore{57b076cb-55b5-4ade-86a3-c502dd053abb}\RP394\A0038395.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\system volume information\_restore{57b076cb-55b5-4ade-86a3-c502dd053abb}\RP394\A0038396.dll (Trojan.Dropper) -> Quarantined and deleted successfully.

Unfortunately when I restarted the machine before running malwarebytes the AVG Free started and I forgot it was set to scan daily and it happened to be running in the background while Malwarebytes was running and AVG popped up saying it found some problems. I just closed the warning window and exited AVG. After this (about 5 min) Malwarebytes started finding the Trojans and Agents listed above. I removed them all.

When I ran GMER, it started the scan immediately when it opened. The Show All box was not checked. I had trouble seeing the check box though as I have set the desktop and monitor set to as large as it gets (my parents have bad eyes) and some programs have buttons overlapping text and check boxes.
Here is the the log from GMER:
GMER 1.0.15.14972 - http://www.gmer.net
Rootkit scan 2009-05-27 17:43:16
Windows 5.1.2600 Service Pack 3


---- Devices - GMER 1.0.15 ----

AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Tcp Lbd.sys (Boot Driver/Lavasoft AB)
AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Udp Lbd.sys (Boot Driver/Lavasoft AB)
AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\RawIp Lbd.sys (Boot Driver/Lavasoft AB)

---- EOF - GMER 1.0.15 ----


NEXT POST HAS HJT Log

 

Here is the HJT Log now:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:00:33 PM, on 5/27/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\S3trayp.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.channel3000.com/index.html
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://yahoo.com/
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [S3Trayp] S3trayp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe "
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe "
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: F-Secure ORSP Client (FSORSPClient) - Unknown owner - C:\Program Files\Charter High-Speed Security Suite\ORSP Client\fsorsp.exe (file missing)
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

--
End of file - 5031 bytes

I do not believe AVG running caused the Malwarebyts program to miss anything.
I am assuming that I should exit AVG when running these scans right?
Again Thanks for sticking with me on this,
Dan

 

Cool, Okay this time I will download Combofix directly on their machine instead of the flash drive transfer and run as instructed.
Once you declare it clean, do you recommend I remove AVG and put the Charter Security Suite by F-Secure back on? It is free for Charter High Speed customers but it looks like they got what they paid for in the first place.
Also do I need to keep any of the resident shields from SpyBot or Ad-Aware at all. Should I uninstall Malwarebytes and SuperAntispyware?
Please give me your recommendations what to run and how to prevent this in the future.
Thanks,
Dan

 

Thanks broni, checked your website and would like to know what your preference is between Avast! and Avira free programs.
I have been using Avast for years on my home dial-up machines (I live in the woods) and like the way it checks for updates and installs them when it senses a connection to the internet. I assume most are able to do this but as I said AVG wants a time of day to check for updates and when to run scans. Not very friendly if your machine is not on 24/7.
I see noadfear likes Avira AntiVir Personal, just wondering if it is more secure.
Dan

 

I downloaded combofix from the first link in your post.
I closed all resident shields and AVG free and got the usual warning from AVG that I would no longer be protected.
When I ran Combofix it warned that AVG was still running.
I checked in task manager that it was not listed under the applications tab (only combofix was there).
Under the Processes tab it looked like avgwdsvc.exe and a couple other avg files were listed.
I ran it anyway fairly certain AVG was not running.
It then said I needed to download Microsoft Recovery Console in order to remove some serious infections.
I was a little spooked here but did it anyway and the DOS looking screen went to microsoft.com and got the console after I said yes to the license agreement.
It seemed to me that it did its thing and here is the log it generated:

ComboFix 09-05-26.05 - Custom PC 05/28/2009 12:19.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.894.527 [GMT -5:00]
Running from: c:\documents and settings\Custom PC\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.

((((((((((((((((((((((((( Files Created from 2009-04-28 to 2009-05-28 )))))))))))))))))))))))))))))))
.

2009-05-27 21:59 . 2009-05-27 21:59 -------- d-----w c:\documents and settings\Custom PC\Application Data\Malwarebytes
2009-05-27 21:59 . 2009-05-26 18:20 40160 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-27 21:59 . 2009-05-27 21:59 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-05-27 21:59 . 2009-05-27 21:59 -------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-05-27 21:59 . 2009-05-26 18:19 19096 ----a-w c:\windows\system32\drivers\mbam.sys
2009-05-27 17:09 . 2009-05-27 17:14 117760 ----a-w c:\documents and settings\Custom PC\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-05-27 17:09 . 2009-05-27 17:09 -------- d-----w c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-05-27 17:08 . 2009-05-27 17:08 -------- d-----w c:\program files\SUPERAntiSpyware
2009-05-27 17:08 . 2009-05-27 17:08 -------- d-----w c:\documents and settings\Custom PC\Application Data\SUPERAntiSpyware.com
2009-05-27 17:07 . 2009-05-27 17:07 -------- d-----w c:\program files\Common Files\Wise Installation Wizard
2009-05-26 03:00 . 2009-05-26 03:00 -------- d-----w c:\program files\Trend Micro
2009-05-26 02:28 . 2009-05-26 02:19 15688 ----a-w c:\windows\system32\lsdelete.exe
2009-05-26 02:20 . 2009-05-26 02:19 64160 ----a-w c:\windows\system32\drivers\Lbd.sys
2009-05-26 02:20 . 2009-05-26 02:20 -------- dc----w c:\windows\system32\DRVSTORE
2009-05-26 02:17 . 2009-05-26 02:17 -------- dc-h--w c:\documents and settings\All Users\Application Data\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
2009-05-26 02:17 . 2009-03-12 08:17 2902048 -c--a-w c:\documents and settings\All Users\Application Data\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}\Ad-AwareAE.exe
2009-05-26 02:16 . 2009-05-26 02:19 -------- d-----w c:\documents and settings\All Users\Application Data\Lavasoft
2009-05-26 02:16 . 2009-05-26 02:16 -------- d-----w c:\program files\Lavasoft
2009-05-26 01:43 . 2009-05-26 03:03 -------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-05-26 01:43 . 2009-05-26 01:44 -------- d-----w c:\program files\Spybot - Search & Destroy
2009-05-25 16:58 . 2009-05-26 01:39 -------- d--h--w C:\$AVG8.VAULT$
2009-05-25 16:52 . 2009-05-25 16:52 11952 ----a-w c:\windows\system32\avgrsstx.dll
2009-05-25 16:52 . 2009-05-25 16:52 108552 ----a-w c:\windows\system32\drivers\avgtdix.sys
2009-05-25 16:52 . 2009-05-25 16:52 325896 ----a-w c:\windows\system32\drivers\avgldx86.sys
2009-05-25 16:52 . 2009-05-25 16:52 27784 ----a-w c:\windows\system32\drivers\avgmfx86.sys
2009-05-25 16:52 . 2009-05-27 23:25 -------- d-----w c:\windows\system32\drivers\Avg
2009-05-25 16:52 . 2009-05-25 16:52 -------- d-----w c:\documents and settings\Custom PC\Application Data\AVGTOOLBAR
2009-05-25 16:51 . 2009-05-25 16:51 -------- d-----w c:\program files\AVG
2009-05-25 16:51 . 2009-05-25 16:51 -------- d-----w c:\documents and settings\All Users\Application Data\avg8
2009-05-23 21:27 . 2009-05-23 21:27 -------- d-----w c:\windows\system32\drivers\Avg(2)
2009-05-23 21:27 . 2009-05-23 22:10 -------- d-----w c:\documents and settings\All Users\Application Data\avg8(2)
2009-05-07 17:34 . 2009-05-08 02:15 32 --s-a-w c:\windows\system32\2499847018.dat

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-25 16:47 . 2008-02-09 03:17 -------- d-----w c:\program files\Windows Media Connect 2
2009-05-25 16:47 . 2008-12-30 02:39 -------- d-----w c:\program files\QuickTime
2009-05-23 22:33 . 2007-12-27 19:33 -------- d-----w c:\documents and settings\All Users\Application Data\F-Secure
2009-05-23 19:44 . 2007-12-27 19:32 -------- d-----w c:\documents and settings\All Users\Application Data\fssg
2009-04-23 01:20 . 2009-04-23 01:20 57344 ----a-w c:\documents and settings\Custom PC\Application Data\Sun\Java\Deployment\cache\6.0\50\5b902232-26bd6dfb-n\Decora-SSE.dll
2009-04-23 01:20 . 2009-04-23 01:20 24064 ----a-w c:\documents and settings\Custom PC\Application Data\Sun\Java\Deployment\cache\6.0\15\4e09eacf-2350a1f9-n\Decora-D3D.dll
2009-04-23 01:20 . 2009-04-23 01:20 315392 ----a-w c:\documents and settings\Custom PC\Application Data\Sun\Java\Deployment\cache\6.0\62\6baea4fe-71ed852a-n\jogl.dll
2009-04-23 01:20 . 2009-04-23 01:20 20480 ----a-w c:\documents and settings\Custom PC\Application Data\Sun\Java\Deployment\cache\6.0\62\6baea4fe-71ed852a-n\jogl_awt.dll
2009-04-23 01:20 . 2009-04-23 01:20 20480 ----a-w c:\documents and settings\Custom PC\Application Data\Sun\Java\Deployment\cache\6.0\45\4f710eed-22de6433-n\gluegen-rt.dll
2009-04-23 01:20 . 2009-04-23 01:20 114688 ----a-w c:\documents and settings\Custom PC\Application Data\Sun\Java\Deployment\cache\6.0\62\6baea4fe-71ed852a-n\jogl_cg.dll
2009-04-23 01:20 . 2009-04-23 01:20 348160 ----a-w c:\documents and settings\Custom PC\Application Data\Sun\Java\Deployment\cache\6.0\33\258cea61-61d7291c-n\msvcr71.dll
2009-04-23 01:20 . 2009-04-23 01:20 499712 ----a-w c:\documents and settings\Custom PC\Application Data\Sun\Java\Deployment\cache\6.0\33\258cea61-61d7291c-n\msvcp71.dll
2009-04-23 01:20 . 2009-04-23 01:20 499712 ----a-w c:\documents and settings\Custom PC\Application Data\Sun\Java\Deployment\cache\6.0\33\258cea61-61d7291c-n\jmc.dll
2009-04-23 01:20 . 2007-12-07 00:52 -------- d-----w c:\program files\Java
2009-04-23 01:19 . 2009-04-23 01:19 152576 ----a-w c:\documents and settings\Custom PC\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-03-09 10:19 . 2008-12-11 23:48 410984 ----a-w c:\windows\system32\deploytk.dll
2009-03-06 14:22 . 2001-08-23 12:00 284160 ----a-w c:\windows\system32\pdh.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe "= "c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"MSMSGS "= "c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"SpybotSD TeaTimer "= "c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck "= "c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]
"QuickTime Task "= "c:\program files\QuickTime\QTTask.exe" [2007-06-29 286720]
"SunJavaUpdateSched "= "c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"AVG8_TRAY "= "c:\progra~1\AVG\AVG8\avgtray.exe" [2009-05-25 1947928]
"Ad-Watch "= "c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-05-26 516440]
"RTHDCPL "= "RTHDCPL.EXE" - c:\windows\RTHDCPL.EXE [2006-12-19 16062464]
"SkyTel "= "SkyTel.EXE" - c:\windows\SkyTel.exe [2006-05-16 2879488]
"VTTimer "= "VTTimer.exe" - c:\windows\system32\VTTimer.exe [2006-09-21 53248]
"S3Trayp "= "S3trayp.exe" - c:\windows\system32\S3Trayp.exe [2006-10-09 176128]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} "= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 17:05 356352 ----a-w c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-05-25 16:52 11952 ----a-w c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@= "Service "

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe "=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe "=

R0 fsbts;fsbts;c:\windows\system32\drivers\fsbts.sys [1/16/2009 3:35 PM 33408]
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [5/25/2009 9:20 PM 64160]
R0 xfilt;VIA SATA IDE Hot-plug Driver;c:\windows\system32\drivers\xfilt.sys [12/6/2007 8:14 PM 11264]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [5/25/2009 11:52 AM 325896]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [5/25/2009 11:52 AM 108552]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [5/26/2009 10:05 AM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/26/2009 10:05 AM 72944]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [5/25/2009 11:51 AM 298776]
R3 S3GIGP;S3GIGP;c:\windows\system32\drivers\S3gIGPm.sys [12/6/2007 9:36 PM 634880]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [3/9/2009 2:06 PM 953168]
S3 FSORSPClient;F-Secure ORSP Client; "c:\program files\Charter High-Speed Security Suite\ORSP Client\fsorsp.exe" --> c:\program files\Charter High-Speed Security Suite\ORSP Client\fsorsp.exe [?]
S3 FXDrv32;FXDrv32;\??\d:\fxdrv32.sys --> d:\FXDrv32.sys [?]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [5/26/2009 10:05 AM 7408]
.
Contents of the 'Scheduled Tasks' folder

2009-05-26 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-09 02:19]

2009-04-07 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-06-03 19:42]
.
- - - - ORPHANS REMOVED - - - -

SafeBoot-procexp90.Sys


.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.channel3000.com/index.html
uInternet Connection Wizard,ShellNext = hxxp://yahoo.com/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Custom PC\Application Data\Mozilla\Firefox\Profiles\pq9bhiri.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.channel3000.com/index.html
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - component: c:\program files\AVG\AVG8\ToolbarFF\components\vmAVGConnector.dll

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-28 12:21
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(588)
c:\program files\SUPERAntiSpyware\SASWINLO.dll

- - - - - - - > 'explorer.exe'(3100)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2009-05-28 12:22
ComboFix-quarantined-files.txt 2009-05-28 17:22

Pre-Run: 150,100,865,024 bytes free
Post-Run: 150,109,569,024 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT= "Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS= "Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

159 --- E O F --- 2009-05-24 02:14

Hope it worked to your satisfaction.
Here is the new HJT Log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:27:24 PM, on 5/28/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\S3trayp.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.channel3000.com/index.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://yahoo.com/
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [S3Trayp] S3trayp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe "
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe "
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: F-Secure ORSP Client (FSORSPClient) - Unknown owner - C:\Program Files\Charter High-Speed Security Suite\ORSP Client\fsorsp.exe (file missing)
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

--
End of file - 5147 bytes

What do you think?

 

Sorry broni, Since you have not posted and the fact that combofix had a less than smooth run, I decided to do it again. I disabled all the items according to the instructions linked in your earlier post and ran both combofix and HJT in this unhindered mode.
The only thing that was not as expected was that combo fix popped up saying a newer version was available but since it had only been 4 hours I declined any update or internet activity.
Here are the logs:
ComboFix 09-05-26.05 - Custom PC 05/28/2009 16:54.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.894.540 [GMT -5:00]
Running from: c:\documents and settings\Custom PC\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.

((((((((((((((((((((((((( Files Created from 2009-04-28 to 2009-05-28 )))))))))))))))))))))))))))))))
.

2009-05-27 21:59 . 2009-05-27 21:59 -------- d-----w c:\documents and settings\Custom PC\Application Data\Malwarebytes
2009-05-27 21:59 . 2009-05-26 18:20 40160 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-27 21:59 . 2009-05-27 21:59 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-05-27 21:59 . 2009-05-27 21:59 -------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-05-27 21:59 . 2009-05-26 18:19 19096 ----a-w c:\windows\system32\drivers\mbam.sys
2009-05-27 17:09 . 2009-05-27 17:14 117760 ----a-w c:\documents and settings\Custom PC\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-05-27 17:09 . 2009-05-27 17:09 -------- d-----w c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-05-27 17:08 . 2009-05-27 17:08 -------- d-----w c:\program files\SUPERAntiSpyware
2009-05-27 17:08 . 2009-05-27 17:08 -------- d-----w c:\documents and settings\Custom PC\Application Data\SUPERAntiSpyware.com
2009-05-27 17:07 . 2009-05-27 17:07 -------- d-----w c:\program files\Common Files\Wise Installation Wizard
2009-05-26 03:00 . 2009-05-26 03:00 -------- d-----w c:\program files\Trend Micro
2009-05-26 02:28 . 2009-05-26 02:19 15688 ----a-w c:\windows\system32\lsdelete.exe
2009-05-26 02:20 . 2009-05-26 02:19 64160 ----a-w c:\windows\system32\drivers\Lbd.sys
2009-05-26 02:20 . 2009-05-26 02:20 -------- dc----w c:\windows\system32\DRVSTORE
2009-05-26 02:17 . 2009-05-26 02:17 -------- dc-h--w c:\documents and settings\All Users\Application Data\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
2009-05-26 02:17 . 2009-03-12 08:17 2902048 -c--a-w c:\documents and settings\All Users\Application Data\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}\Ad-AwareAE.exe
2009-05-26 02:16 . 2009-05-26 02:19 -------- d-----w c:\documents and settings\All Users\Application Data\Lavasoft
2009-05-26 02:16 . 2009-05-26 02:16 -------- d-----w c:\program files\Lavasoft
2009-05-26 01:43 . 2009-05-26 03:03 -------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-05-26 01:43 . 2009-05-26 01:44 -------- d-----w c:\program files\Spybot - Search & Destroy
2009-05-25 16:58 . 2009-05-26 01:39 -------- d--h--w C:\$AVG8.VAULT$
2009-05-25 16:52 . 2009-05-25 16:52 11952 ----a-w c:\windows\system32\avgrsstx.dll
2009-05-25 16:52 . 2009-05-25 16:52 108552 ----a-w c:\windows\system32\drivers\avgtdix.sys
2009-05-25 16:52 . 2009-05-25 16:52 325896 ----a-w c:\windows\system32\drivers\avgldx86.sys
2009-05-25 16:52 . 2009-05-25 16:52 27784 ----a-w c:\windows\system32\drivers\avgmfx86.sys
2009-05-25 16:52 . 2009-05-28 17:24 -------- d-----w c:\windows\system32\drivers\Avg
2009-05-25 16:52 . 2009-05-25 16:52 -------- d-----w c:\documents and settings\Custom PC\Application Data\AVGTOOLBAR
2009-05-25 16:51 . 2009-05-25 16:51 -------- d-----w c:\program files\AVG
2009-05-25 16:51 . 2009-05-25 16:51 -------- d-----w c:\documents and settings\All Users\Application Data\avg8
2009-05-23 21:27 . 2009-05-23 21:27 -------- d-----w c:\windows\system32\drivers\Avg(2)
2009-05-23 21:27 . 2009-05-23 22:10 -------- d-----w c:\documents and settings\All Users\Application Data\avg8(2)
2009-05-07 17:34 . 2009-05-08 02:15 32 --s-a-w c:\windows\system32\2499847018.dat

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-25 16:47 . 2008-02-09 03:17 -------- d-----w c:\program files\Windows Media Connect 2
2009-05-25 16:47 . 2008-12-30 02:39 -------- d-----w c:\program files\QuickTime
2009-05-23 22:33 . 2007-12-27 19:33 -------- d-----w c:\documents and settings\All Users\Application Data\F-Secure
2009-05-23 19:44 . 2007-12-27 19:32 -------- d-----w c:\documents and settings\All Users\Application Data\fssg
2009-04-23 01:20 . 2009-04-23 01:20 57344 ----a-w c:\documents and settings\Custom PC\Application Data\Sun\Java\Deployment\cache\6.0\50\5b902232-26bd6dfb-n\Decora-SSE.dll
2009-04-23 01:20 . 2009-04-23 01:20 24064 ----a-w c:\documents and settings\Custom PC\Application Data\Sun\Java\Deployment\cache\6.0\15\4e09eacf-2350a1f9-n\Decora-D3D.dll
2009-04-23 01:20 . 2009-04-23 01:20 315392 ----a-w c:\documents and settings\Custom PC\Application Data\Sun\Java\Deployment\cache\6.0\62\6baea4fe-71ed852a-n\jogl.dll
2009-04-23 01:20 . 2009-04-23 01:20 20480 ----a-w c:\documents and settings\Custom PC\Application Data\Sun\Java\Deployment\cache\6.0\62\6baea4fe-71ed852a-n\jogl_awt.dll
2009-04-23 01:20 . 2009-04-23 01:20 20480 ----a-w c:\documents and settings\Custom PC\Application Data\Sun\Java\Deployment\cache\6.0\45\4f710eed-22de6433-n\gluegen-rt.dll
2009-04-23 01:20 . 2009-04-23 01:20 114688 ----a-w c:\documents and settings\Custom PC\Application Data\Sun\Java\Deployment\cache\6.0\62\6baea4fe-71ed852a-n\jogl_cg.dll
2009-04-23 01:20 . 2009-04-23 01:20 348160 ----a-w c:\documents and settings\Custom PC\Application Data\Sun\Java\Deployment\cache\6.0\33\258cea61-61d7291c-n\msvcr71.dll
2009-04-23 01:20 . 2009-04-23 01:20 499712 ----a-w c:\documents and settings\Custom PC\Application Data\Sun\Java\Deployment\cache\6.0\33\258cea61-61d7291c-n\msvcp71.dll
2009-04-23 01:20 . 2009-04-23 01:20 499712 ----a-w c:\documents and settings\Custom PC\Application Data\Sun\Java\Deployment\cache\6.0\33\258cea61-61d7291c-n\jmc.dll
2009-04-23 01:20 . 2007-12-07 00:52 -------- d-----w c:\program files\Java
2009-04-23 01:19 . 2009-04-23 01:19 152576 ----a-w c:\documents and settings\Custom PC\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-03-09 10:19 . 2008-12-11 23:48 410984 ----a-w c:\windows\system32\deploytk.dll
2009-03-06 14:22 . 2001-08-23 12:00 284160 ----a-w c:\windows\system32\pdh.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-05-28_17.21.04 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-05-28 21:41 . 2009-05-28 21:41 16384 c:\windows\Temp\Perflib_Perfdata_74c.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe "= "c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"MSMSGS "= "c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck "= "c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]
"QuickTime Task "= "c:\program files\QuickTime\QTTask.exe" [2007-06-29 286720]
"SunJavaUpdateSched "= "c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"AVG8_TRAY "= "c:\progra~1\AVG\AVG8\avgtray.exe" [2009-05-25 1947928]
"Ad-Watch "= "c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-05-26 516440]
"RTHDCPL "= "RTHDCPL.EXE" - c:\windows\RTHDCPL.EXE [2006-12-19 16062464]
"SkyTel "= "SkyTel.EXE" - c:\windows\SkyTel.exe [2006-05-16 2879488]
"VTTimer "= "VTTimer.exe" - c:\windows\system32\VTTimer.exe [2006-09-21 53248]
"S3Trayp "= "S3trayp.exe" - c:\windows\system32\S3Trayp.exe [2006-10-09 176128]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} "= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 17:05 356352 ----a-w c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-05-25 16:52 11952 ----a-w c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@= "Service "

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"SpybotSD TeaTimer "=c:\program files\Spybot - Search & Destroy\TeaTimer.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe "=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe "=

R0 fsbts;fsbts;c:\windows\system32\drivers\fsbts.sys [1/16/2009 3:35 PM 33408]
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [5/25/2009 9:20 PM 64160]
R0 xfilt;VIA SATA IDE Hot-plug Driver;c:\windows\system32\drivers\xfilt.sys [12/6/2007 8:14 PM 11264]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [5/25/2009 11:52 AM 325896]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [5/25/2009 11:52 AM 108552]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [5/26/2009 10:05 AM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/26/2009 10:05 AM 72944]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [5/25/2009 11:51 AM 298776]
R3 S3GIGP;S3GIGP;c:\windows\system32\drivers\S3gIGPm.sys [12/6/2007 9:36 PM 634880]
S3 FSORSPClient;F-Secure ORSP Client; "c:\program files\Charter High-Speed Security Suite\ORSP Client\fsorsp.exe" --> c:\program files\Charter High-Speed Security Suite\ORSP Client\fsorsp.exe [?]
S3 FXDrv32;FXDrv32;\??\d:\fxdrv32.sys --> d:\FXDrv32.sys [?]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [3/9/2009 2:06 PM 953168]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [5/26/2009 10:05 AM 7408]
.
Contents of the 'Scheduled Tasks' folder

2009-05-26 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-09 02:19]

2009-04-07 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-06-03 19:42]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.channel3000.com/index.html
uInternet Connection Wizard,ShellNext = hxxp://yahoo.com/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Custom PC\Application Data\Mozilla\Firefox\Profiles\pq9bhiri.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.channel3000.com/index.html
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - component: c:\program files\AVG\AVG8\ToolbarFF\components\vmAVGConnector.dll

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-28 16:55
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(584)
c:\program files\SUPERAntiSpyware\SASWINLO.dll

- - - - - - - > 'explorer.exe'(2772)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2009-05-28 16:57
ComboFix-quarantined-files.txt 2009-05-28 21:57
ComboFix2.txt 2009-05-28 17:22

Pre-Run: 150,124,904,448 bytes free
Post-Run: 150,109,343,744 bytes free

156 --- E O F --- 2009-05-24 02:14

And The HJT Log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:58:10 PM, on 5/28/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\S3trayp.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.channel3000.com/index.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://yahoo.com/
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [S3Trayp] S3trayp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe "
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe "
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: F-Secure ORSP Client (FSORSPClient) - Unknown owner - C:\Program Files\Charter High-Speed Security Suite\ORSP Client\fsorsp.exe (file missing)
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

--
End of file - 5051 bytes

Not sure if it worked any better or found something it missed the first time but I feel better about this scan.

Thanks again for the help broni.
I plan to turn them loose with AVG for a while and just update manually every day.
Dan

 

Okay broni, I'm home now but will do in the morning.
I think I am going to install Avast! on their machine. My 12 year old has the same machine ( I built 2 of them). I just finished the AVG 8.5 upgrade and it seems to bog it down so I want to switch. I use Avast om my laptop and with dial-up it silently checks for updates when first connected then updates the database with no input or hassle. AVG has no option for this except to dial on its own at a specified time. Avg has no indication that it is scanning email when using Outlook Express, it claims not to worry but I feel better when I see the blue ball or blue siren spinning in the task bar.
So that brings up the question I have seen on other forums it is hard to completely remove AVG so there are no remnants like the F-Secure parts you see above.
AVG has a removal tool for download that they claim removes all entries.
http://www.avg.com/download-tools
Do you think it will work on the new 8.5 version or do you have a better option.
Thanks,
Dan

 

Wow, didn't see that post so quick.
I know this is not the forum (I've searched the XP forum) but I still have a card reader that is case mounted and plugged into the MB that shows all 4 slots at in the "safe to remove" area of the task bar even when no cards or flash devices are plugged in.
The MB is a foxconn unit:
http://www.foxconnchannel.com/product/Motherboards/detail_overview.aspx?ID=en-us0000243#
I posted this question a couple years ago and got no real solution.
http://www.windowsbbs.com/windows-xp/69996-sata-safely-remove-hardware.html
see post #8.
I don't mean to hijack this thread so PM me if you have any ideas.
Dan

 

No problem, I've been trying to keep up with you on the other threads you are working on.
Dude, you work your butt off!
Dan