Solved Many Problems

Kurmo · 2009/05/28

[Resolved] Many Problems

Greetings!

Recently I discovered my younger siblings penchant for pornography, on MY computer. As a result, a host of nasty problems have erupted. As I am a dunce with all this technical stuff (gamer here) I will show you the system specs of my computer that I can find.

Windows XP Home Edition
Version 2002
Service Pack 3

Intel Core 2 Duo CPU
E6750 @ 2.66 GHz
2.67 GHz , 2.00 GB RAM

Alright lets start listing off problems.

1) Upon starting my computer, I get the typical XP loading screen, however, sometimes the login screen does not appear, and I am stuck with a black screen and a mouse arrow.

2)Once I log in, there is a 50/50 chance my computer will simply freeze. Also, whenever I log in, a popup at the bottom left corner tells me that "userinit.exe" is corrupt and I must use the chkdsk function (which does not help). Every time i use any sort of .exe, the same mesage appears "firefox.exe" etc. Here is an example of said bubble.
http://img16.imageshack.us/img16/6519/errorbubble.png

3)When I play ANY game which consumes the whole screen (an FPS shooter for example) I have roughly 30-45 minutes of playtime before I receive an error message saying "Services and Controller App must close ". It then initiates a system shutdown on a 1 minute timer.

4) Whenever I try to install an anti virus program such as Norton, i get an error message saying that there is another installation in progress, which there is not.

5)The start-up freeze sees to only be resolved if i bring up the task manager and end the process "CCapp.exe ", which is associated with Norton/Symantec.

6)Any form of instant message service simply freezes upon start-up.

7)Random freezes/computer restarts.

Any ideas? Or should I save myself the trouble and take this thing to the local computer shop now?

Oh, and I don't have my original Windows XP install CD, woooooo
===========================================================

DDS (Ver_09-05-14.01) - NTFSx86
Run by Kurtis at 16:01:37.26 on Thu 05/28/2009
Internet Explorer: 7.0.5730.11 BrowserJavaVersion: 1.6.0_11
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2047.1617 [GMT -4:00]

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDClock.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDCountdown.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDMedia.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDPop3.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\MsiExec.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Documents and Settings\Kurtis\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com
mStart Page = hxxp://www.google.com
uInternet Settings,ProxyOverride = *.local
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.1.1309.3572\swg.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: {B7D3E479-CC68-42B5-A338-938ECE35F419} - No File
uRun: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "c:\program files\common files\ahead\lib\NMBgMonitor.exe "
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [ISUSPM] "c:\program files\common files\installshield\updateservice\ISUSPM.exe" -scheduler
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [NeroFilterCheck] c:\program files\common files\ahead\lib\NeroCheck.exe
mRun: [RemoteControl] "c:\program files\cyberlink\powerdvd\PDVDServ.exe "
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe "
mRun: [IntelliPoint] "c:\program files\microsoft intellipoint\point32.exe "
mRun: [Launch LCDMon] "c:\program files\logitech\gamepanel software\lcd manager\LCDMon.exe "
mRun: [Launch LGDCore] "c:\program files\logitech\gamepanel software\g-series software\LGDCore.exe" /SHOWHIDE
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe "
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe "
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe "
mRunOnce: [ ] c:\windows\system32\cmd.exe /c del /q c:\windows\system32\rdssrv.exe c:\windows\system32\rdshost.dll c:\windows\system32\hdfkt.dll
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\nkbmon~1.lnk - c:\program files\nikon\pictureproject\NkbMonitor.exe
uPolicies-explorer: ForceClassicControlPanel = 1 (0x1)
IE: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZRfox000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/5/b/0/5b0d4654-aa20-495c-b89f-c1c34c691085/LegitCheckControl.cab
DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://gfx2.hotmail.com/mail/w3/resources/MSNPUpld.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} - hxxps://secure.logmein.com/activex/RACtrl.cab
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\kurtis\applic~1\mozilla\firefox\profiles\82d3a1hr.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-divx&p=
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-divx&p=
FF - plugin: c:\program files\google\google updater\2.4.1536.6592\npCIDetect13.dll

============= SERVICES / DRIVERS ===============

R2 ccEvtMgr;Symantec Event Manager;c:\program files\common files\symantec shared\ccSvcHst.exe [2006-9-3 105632]
R2 ccSetMgr;Symantec Settings Manager;c:\program files\common files\symantec shared\ccSvcHst.exe [2006-9-3 105632]
R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [2008-1-15 45848]
R2 sx2jilklzlz.sys;sx2jilklzlz.sys;c:\windows\system32\drivers\sx2jilklzlz.sys [2006-2-28 79872]
R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Controller;c:\windows\system32\drivers\atl01_xp.sys [2007-12-6 38656]
S2 6hicm2misz2.sys;6hicm2misz2.sys;\??\c:\windows\system32\drivers\6hicm2misz2.sys --> c:\windows\system32\drivers\6hicm2misz2.sys [?]
S2 LMIInfo;LogMeIn Kernel Information Provider;\??\c:\program files\logmein\x86\rainfo.sys --> c:\program files\logmein\x86\RaInfo.sys [?]
S3 COH_Mon;COH_Mon;\??\c:\windows\system32\drivers\coh_mon.sys --> c:\windows\system32\drivers\COH_Mon.sys [?]
S3 EraserUtilDrv10621;EraserUtilDrv10621;\??\c:\program files\common files\symantec shared\eengine\eraserutildrv10621.sys --> c:\program files\common files\symantec shared\eengine\EraserUtilDrv10621.sys [?]
S3 NAVENG;NAVENG;c:\progra~1\common~1\symant~1\virusd~1\20060823.066\NAVENG.SYS [2008-11-26 79240]
S3 NAVEX15;NAVEX15;c:\progra~1\common~1\symant~1\virusd~1\20060823.066\NAVEX15.SYS [2008-11-26 828872]
S3 Symantec Core LC;Symantec Core LC;c:\progra~1\common~1\symant~1\ccpd-lc\symlcsvc.exe [2007-12-7 1251720]
S4 LMIRfsClientNP;LMIRfsClientNP; [x]

=============== Created Last 30 ================

2009-05-28 15:37 <DIR> --d----- c:\program files\common files\Windows Live
2009-05-28 14:58 <DIR> a-dshr-- C:\cmdcons
2009-05-28 14:57 161,792 a------- c:\windows\SWREG.exe
2009-05-28 14:57 154,624 a------- c:\windows\PEV.exe
2009-05-28 14:57 98,816 a------- c:\windows\sed.exe
2009-05-28 14:57 <DIR> --ds---- C:\3rt5whg18
2009-05-19 20:03 <DIR> --d----- c:\program files\RADVideo
2009-05-19 15:08 15,104 ac------ c:\windows\system32\dllcache\usbscan.sys
2009-05-19 15:08 15,104 a------- c:\windows\system32\drivers\usbscan.sys
2009-05-19 15:08 5,632 a------- c:\windows\system32\ptpusb.dll
2009-05-19 15:08 159,232 a------- c:\windows\system32\ptpusd.dll
2009-05-06 18:52 <DIR> --d----- c:\program files\Perfect World Entertainment
2009-05-06 18:51 258,352 a------- c:\windows\system32\unicows.dll
2009-05-06 17:38 <DIR> --d----- c:\docume~1\kurtis\applic~1\GetRightToGo

==================== Find3M ====================

2009-05-28 16:00 79,872 a------- c:\windows\system32\drivers\sx2jilklzlz.sys
2009-05-27 21:58 138,512 a------- c:\windows\system32\drivers\PnkBstrK.sys
2009-05-27 21:58 201,440 a------- c:\windows\system32\PnkBstrB.exe
2009-03-16 22:35 165,803 a------- c:\windows\Video Cleaner Uninstaller.exe
2008-11-18 01:21 19,144 a------- c:\docume~1\alluse~1\applic~1\anuxo.sys
2008-11-18 01:21 17,397 a------- c:\program files\common files\ycinurafi.pif
2008-11-18 01:21 15,195 a------- c:\docume~1\kurtis\applic~1\ohadixax.bat
2008-11-18 01:21 15,046 a------- c:\docume~1\alluse~1\applic~1\iqygagobik.scr
2008-11-18 01:21 14,740 a------- c:\docume~1\kurtis\applic~1\hepises.sys
2008-11-18 01:21 11,644 a------- c:\program files\common files\ogiwekewi.pif
2008-11-18 01:21 10,582 a------- c:\docume~1\kurtis\applic~1\gabonus.vbs
2008-09-09 07:20 24 a------- c:\documents and settings\kurtis\jagex_runescape_preferences.dat
2006-06-23 02:48 32,768 a----r-- c:\windows\inf\UpdateUSB.exe
2008-11-20 17:56 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008112020081121\index.dat

============= FINISH: 16:01:53.04 ===============

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-05-14.01)

Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume1
Install Date: 12/6/2007 1:39:58 PM
System Uptime: 5/28/2009 3:58:57 PM (1 hours ago)

Motherboard: ASUSTeK Computer INC. | | P5K SE
Processor: Intel(R) Core(TM)2 Duo CPU E6750 @ 2.66GHz | LGA775 | 2669/333mhz

==== Disk Partitions =========================

A: is Removable
C: is FIXED (NTFS) - 233 GiB total, 208.692 GiB free.
D: is CDROM ()

==== Disabled Device Manager Items =============

Class GUID: {4D36E96B-E325-11CE-BFC1-08002BE10318}
Description: Standard 101/102-Key or Microsoft Natural PS/2 Keyboard
Device ID: ACPI\PNP0303\4&1400782C&0
Manufacturer: (Standard keyboards)
Name: Standard 101/102-Key or Microsoft Natural PS/2 Keyboard
PNP Device ID: ACPI\PNP0303\4&1400782C&0
Service: i8042prt

==== System Restore Points ===================

RP327: 3/16/2009 10:51:57 PM - Installed STOIK Video Converter 2
RP328: 5/27/2009 7:51:59 PM - System Checkpoint
RP329: 5/27/2009 9:00:08 PM - Removed Nero 7 Essentials

==== Installed Programs ======================

Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)
Adobe Flash Player 10 Plugin
Adobe Flash Player ActiveX
Adobe Reader 8.1.2
Adobe Reader 8.1.2 Security Update 1 (KB403742)
Adobe Shockwave Player
AppCore
Apple Mobile Device Support
Apple Software Update
Attansic L1 Gigabit Ethernet Driver
AutoUpdate
AV
BlackBerry Desktop Software 4.7
Bonjour
ccCommon
Compatibility Pack for the 2007 Office system
DivX Player
DivX Web Player
Google Updater
High Definition Audio Driver Package - KB888111
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB952287)
Image Resizer Powertoy for Windows XP
iTunes
Java(TM) 6 Update 11
Java(TM) 6 Update 2
Java(TM) 6 Update 3
LightScribe 1.4.136.1
LimeWire 4.18.2
LiveUpdate 3.1 (Symantec Corporation)
Logitech GamePanel Software 2.00
LogMeIn
Microsoft .NET Framework 2.0
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft IntelliPoint 5.4
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft Windows Journal Viewer
Mozilla Firefox (3.0.10)
MSXML 4.0 SP2 (KB954430)
MSXML4 Parser
Nero 7 Essentials
Norton AntiVirus (Symantec Corporation)
Norton AntiVirus Parent MSI
Norton AntiVirus SYMLT MSI
Norton Protection Center
NVIDIA Drivers
OpenOffice.org 2.3
PictureProject
PowerDVD
QuickTime
Realtek High Definition Audio Driver
Roxio Media Manager
Safari
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 9 (KB936782)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Symantec
Symantec Real Time Storage Protection Component
SymNet
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
Ventrilo Client
WebFldrs XP
Windows Internet Explorer 7
Windows Live Messenger
Windows Media Format 11 runtime
Windows Media Player 11
Windows XP Service Pack 3
WinRAR archiver
Wolfenstein - Enemy Territory
Xfire (remove only)
Zune Desktop Theme

==== Event Viewer Messages From Past Week ========

5/28/2009 2:59:19 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the PEVSystemStart service to connect.
5/28/2009 12:04:21 AM, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service NMIndexingService with arguments " " in order to run the server: {C6A811AB-F8FF-45A4-93E5-FC5CCB650BE7}
5/27/2009 9:17:03 PM, error: Service Control Manager [7034] - The iPod Service service terminated unexpectedly. It has done this 1 time(s).
5/27/2009 9:17:00 PM, error: Service Control Manager [7034] - The Application Layer Gateway Service service terminated unexpectedly. It has done this 1 time(s).
5/27/2009 8:58:54 PM, error: Service Control Manager [7034] - The Windows Installer service terminated unexpectedly. It has done this 4 time(s).
5/27/2009 8:55:55 PM, error: Service Control Manager [7034] - The Windows Installer service terminated unexpectedly. It has done this 3 time(s).
5/27/2009 8:55:37 PM, error: Service Control Manager [7034] - The Windows Installer service terminated unexpectedly. It has done this 2 time(s).
5/27/2009 8:21:08 PM, error: Service Control Manager [7023] - The Application Management service terminated with the following error: The specified module could not be found.
5/27/2009 10:25:23 PM, error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Symantec Settings Manager service, but this action failed with the following error: An instance of the service is already running.
5/27/2009 10:25:19 PM, error: Service Control Manager [7034] - The Symantec Lic NetConnect service service terminated unexpectedly. It has done this 1 time(s).
5/27/2009 10:25:19 PM, error: Service Control Manager [7031] - The Symantec Settings Manager service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 100 milliseconds: Restart the service.
5/27/2009 10:25:19 PM, error: Service Control Manager [7031] - The Symantec Event Manager service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 200 milliseconds: Restart the service.
5/27/2009 10:25:19 PM, error: Service Control Manager [7031] - The Symantec AppCore Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 100 milliseconds: Restart the service.
5/27/2009 10:25:19 PM, error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
5/27/2009 10:25:19 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Beep
5/27/2009 10:22:44 PM, error: Service Control Manager [7000] - The LogMeIn Kernel Information Provider service failed to start due to the following error: The system cannot find the path specified.
5/27/2009 10:19:57 PM, error: Service Control Manager [7034] - The Windows Installer service terminated unexpectedly. It has done this 1 time(s).

==== End Of File ===========================

COMBOFIX OUTPUT:

ComboFix 09-05-26.05 - Kurtis 05/28/2009 16:12.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2047.1540 [GMT -4:00]
Running from: c:\documents and settings\Kurtis\Desktop\3rt5whg18.exe
.

((((((((((((((((((((((((( Files Created from 2009-04-28 to 2009-05-28 )))))))))))))))))))))))))))))))
.

2009-05-28 19:37 . 2009-05-28 19:37 -------- d-----w c:\program files\Common Files\Windows Live
2009-05-28 01:31 . 2009-05-28 01:31 -------- d-----w c:\documents and settings\All Users\Application Data\NVIDIA
2009-05-20 00:03 . 2009-05-20 00:03 -------- d-----w c:\program files\RADVideo
2009-05-19 19:08 . 2008-04-13 17:45 15104 -c--a-w c:\windows\system32\dllcache\usbscan.sys
2009-05-19 19:08 . 2008-04-13 17:45 15104 ----a-w c:\windows\system32\drivers\usbscan.sys
2009-05-19 19:08 . 2001-08-18 02:36 5632 ----a-w c:\windows\system32\ptpusb.dll
2009-05-19 19:08 . 2008-04-13 23:12 159232 ----a-w c:\windows\system32\ptpusd.dll
2009-05-06 22:52 . 2009-05-06 23:59 -------- d-----w c:\program files\Perfect World Entertainment
2009-05-06 22:51 . 2005-05-10 22:54 258352 ----a-w c:\windows\system32\unicows.dll
2009-05-06 21:38 . 2009-05-06 22:49 -------- d-----w c:\documents and settings\Kurtis\Application Data\GetRightToGo

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-28 20:00 . 2006-02-28 12:00 79872 ----a-w c:\windows\system32\drivers\sx2jilklzlz.sys
2009-05-28 01:58 . 2008-02-29 12:20 138512 ----a-w c:\windows\system32\drivers\PnkBstrK.sys
2009-05-28 01:58 . 2008-02-29 12:20 201440 ----a-w c:\windows\system32\PnkBstrB.exe
2009-05-28 01:07 . 2007-12-07 15:03 -------- d-----w c:\documents and settings\All Users\Application Data\Symantec
2009-05-28 01:00 . 2007-12-06 19:46 -------- d--h--w c:\program files\InstallShield Installation Information
2009-05-28 01:00 . 2009-03-17 02:51 -------- d-----w c:\documents and settings\Kurtis\Application Data\InstallShield
2009-05-28 00:44 . 2008-11-27 03:45 -------- d-----w c:\program files\Norton AntiVirus
2009-05-28 00:23 . 2007-12-07 15:01 -------- d-----w c:\program files\Common Files\Symantec Shared
2009-05-27 23:59 . 2008-12-22 01:22 -------- d-----w c:\program files\Common Files\Roxio Shared
2009-05-27 23:59 . 2008-12-22 01:22 -------- d-----w c:\documents and settings\All Users\Application Data\Roxio
2009-05-27 23:58 . 2008-11-27 03:44 -------- d-----w c:\program files\Symantec
2009-05-27 23:55 . 2008-12-22 01:26 -------- d-----w c:\documents and settings\Kurtis\Application Data\Research In Motion
2009-05-27 23:55 . 2008-12-22 01:18 -------- d-----w c:\program files\Common Files\Research In Motion
2009-05-27 23:55 . 2008-12-22 01:18 -------- d-----w c:\program files\Research In Motion
2009-05-27 23:53 . 2008-11-05 04:50 -------- d-----w c:\program files\Google
2009-05-27 23:52 . 2008-01-08 21:26 -------- d-----w c:\program files\DivX
2009-05-27 23:49 . 2008-12-22 01:26 256 ----a-w c:\windows\system32\pool.bin
2009-05-27 21:24 . 2008-11-05 04:50 -------- d-----w c:\documents and settings\All Users\Application Data\Google Updater
2009-05-19 23:33 . 2009-01-12 12:36 -------- d-----w c:\documents and settings\Kurtis\Application Data\U3
2009-05-19 22:53 . 2008-02-11 03:27 -------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-05-01 04:37 . 2007-12-07 14:44 -------- d-----w c:\program files\Common Files\Adobe
2009-03-30 21:13 . 2007-12-25 18:46 -------- d-----w c:\program files\LimeWire
2009-03-17 02:35 . 2009-03-17 02:35 165803 ----a-w c:\windows\Video Cleaner Uninstaller.exe
2008-11-18 05:21 . 2008-11-18 05:21 17397 ----a-w c:\program files\Common Files\ycinurafi.pif
2008-11-18 05:21 . 2008-11-18 05:21 11644 ----a-w c:\program files\Common Files\ogiwekewi.pif
.

((((((((((((((((((((((((((((( SnapShot@2009-05-28_19.09.19 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-05-28 20:00 . 2009-05-28 20:00 16384 c:\windows\Temp\Perflib_Perfdata_c30.dat
+ 2009-05-28 19:59 . 2009-05-28 19:59 16384 c:\windows\Temp\Perflib_Perfdata_5a0.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} "= "c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-12-23 143360]
"ctfmon.exe "= "c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"ISUSPM "= "c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2007-08-30 205480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck "= "c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"RemoteControl "= "c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2003-11-01 32768]
"SunJavaUpdateSched "= "c:\program files\Java\jre6\bin\jusched.exe" [2009-01-01 136600]
"IntelliPoint "= "c:\program files\Microsoft IntelliPoint\point32.exe" [2005-06-10 217088]
"Launch LCDMon "= "c:\program files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe" [2007-07-17 1687824]
"Launch LGDCore "= "c:\program files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" [2007-07-18 2094352]
"NvCplDaemon "= "c:\windows\system32\NvCpl.dll" [2006-08-11 7630848]
"NvMediaCenter "= "c:\windows\system32\NvMcTray.dll" [2006-08-11 86016]
"ccApp "= "c:\program files\Common Files\Symantec Shared\ccApp.exe" [2006-09-03 84640]
"QuickTime Task "= "c:\program files\QuickTime\qttask.exe" [2008-11-04 413696]
"iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]
"RTHDCPL "= "RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-03-21 16126464]
"nwiz "= "nwiz.exe" - c:\windows\system32\nwiz.exe [2006-08-11 1519616]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
NkbMonitor.exe.lnk - c:\program files\Nikon\PictureProject\NkbMonitor.exe [2008-12-27 118784]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel "= 1 (0x1)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\6hicm2misz2.sys]
@= "\??\c:\windows\system32\drivers\6hicm2misz2.sys "

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sx2jilklzlz.sys]
@= "\??\c:\windows\system32\drivers\sx2jilklzlz.sys "

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify "=dword:00000001
"UpdatesDisableNotify "=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring "=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring "=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"c:\\Program Files\\Xfire\\xfire.exe "=
"c:\\Program Files\\Wolfenstein - Enemy Territory\\ET.exe "=
"c:\\Program Files\\LimeWire\\LimeWire.exe "=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe "=
"c:\\Program Files\\iTunes\\iTunes.exe "=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe "=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP "= 3724:TCP:Blizzard Downloader: 3724

R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [1/15/2008 12:27 AM 45848]
R2 sx2jilklzlz.sys;sx2jilklzlz.sys;c:\windows\system32\drivers\sx2jilklzlz.sys [2/28/2006 8:00 AM 79872]
R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Controller;c:\windows\system32\drivers\atl01_xp.sys [12/6/2007 3:48 PM 38656]
S2 6hicm2misz2.sys;6hicm2misz2.sys;\??\c:\windows\system32\drivers\6hicm2misz2.sys --> c:\windows\system32\drivers\6hicm2misz2.sys [?]
S2 LMIInfo;LogMeIn Kernel Information Provider;\??\c:\program files\LogMeIn\x86\RaInfo.sys --> c:\program files\LogMeIn\x86\RaInfo.sys [?]
S3 COH_Mon;COH_Mon;\??\c:\windows\system32\Drivers\COH_Mon.sys --> c:\windows\system32\Drivers\COH_Mon.sys [?]
S3 EraserUtilDrv10621;EraserUtilDrv10621;\??\c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrv10621.sys --> c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrv10621.sys [?]
S4 LMIRfsClientNP;LMIRfsClientNP; [x]
.
Contents of the 'Scheduled Tasks' folder

2009-05-07 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]

2009-05-28 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-11-05 23:48]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com
mStart Page = hxxp://www.google.com
uInternet Settings,ProxyOverride = *.local
IE: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZRfox000
FF - ProfilePath - c:\documents and settings\Kurtis\Application Data\Mozilla\Firefox\Profiles\82d3a1hr.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-divx&p=
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-divx&p=
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-28 16:13
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1343024091-287218729-725345543-1004\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3144)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\windows\system32\LMIRfsClientNP.dll
c:\program files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\MSVCR80.dll
.
Completion time: 2009-05-28 16:15
ComboFix-quarantined-files.txt 2009-05-28 20:15
ComboFix2.txt 2009-05-28 19:10

Pre-Run: 224,095,145,984 bytes free
Post-Run: 224,085,319,680 bytes free

160 --- E O F --- 2008-12-18 08:00

broni · 2009/05/28

There is definitely some infection present, but before we proceed, I need to find out what's the situation with Norton.
I see some Norton's traces running, but...
...was it ever installed in full, paid for, is it current, etc...
Give me some info, please.

Kurmo · 2009/05/28

Installed but never paid for. I don't ever recall registering it. I tried to uninstall it entirely yesterday, but it will not let me. The uninstall bar gets to the end and then everything freezes up.

When I try to install a newer version of Norton, it tells me that another installation is already in progress

broni · 2009/05/28

Very good, because the best Norton approach is just not to have it

Make sure, Windows firewall is on, so the computer is protected from the outside world.

Download, and run Norton Removal Tool: http://service1.symantec.com/Support/tsgeninfo.nsf/docid/2005033108162039

Let me know, if it worked.

Kurmo · 2009/05/28

Alright, Norton is now gone and the startup freezing problem has been solved, however I am still getting these error bubbles on the corner of my screen

broni · 2009/05/28

We just started

Get one of these:

- Avast! free antivirus: http://www.avast.com/eng/download-avast-home.html
- Avira free antivirus: http://www.free-av.com/en/download/index.html

- free PC Tools Firewall Plus: http://www.pctools.com/firewall/

- free Comodo Internet Security (firewall + AV): http://www.personalfirewall.comodo.com/
NOTE. During installation, Comodo will also allow you to install AV only, or firewall only, if you prefer to combine one Comodo product with some other product.

If you decide to install Avast, or Avira, make sure, Windows firewall is turned on, or use PC Tools Firewall Plus.
If you decide to install Comodo, make sure, Windows firewall is turned off.

IMPORTANT! Make sure, you use only ONE antivirus, and ONE firewall.

After installation, update AV program, and run full scan.

When done....see my next reply.

broni · 2009/05/28

Print these instructions out.

NOTE. If any of the programs listed below refuse to run, try renaming executive file to something else; for instance, rename hijackthis.exe to scanner.exe

***VERY IMPORTANT! Make sure, you update Superantispyware, and Malwarebytes before running the scans.***

STEP 1. Download SUPERAntiSpyware Free for Home Users:
http://www.superantispyware.com/

* Double-click SUPERAntiSpyware.exe and use the default settings for installation.
* An icon will be created on your desktop. Double-click that icon to launch the program.
* If asked to update the program definitions, click "Yes ". If not, update the definitions before scanning by selecting "Check for Updates ". (If you encounter any problems while downloading the updates, manually download and unzip them from here: http://www.superantispyware.com/definitions.html.)
* Close SUPERAntiSpyware.

PHYSICALLY DISCONNECT FROM THE INTERNET

Restart computer in Safe Mode.
To enter Safe Mode, restart computer, and keep tapping F8 key, until menu appears; select Safe Mode; you'll see "Safe Mode" in all four corners of your screen

* Open SUPERAntiSpyware.
* Under Configuration and Preferences, click the Preferences button.
* Under General and Startup tab, make sure, Start SUPERAntiSpyware when Windows starts option is UN-checked.
* Click the Scanning Control tab.
* Under Scanner Options make sure the following are checked (leave all others unchecked):
- Close browsers before scanning.
- Scan for tracking cookies.
- Terminate memory threats before quarantining.
* Click the Close button to leave the control center screen.
* Back on the main screen, under Scan for Harmful Software click Scan your computer.
* On the left, make sure you check C:\Fixed Drive.
* On the right, under Complete Scan, choose Perform Complete Scan.
* Click Next to start the scan. Please be patient while it scans your computer.
* After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click OK.
* Make sure everything has a checkmark next to it and click Next.
* A notification will appear that Quarantine and Removal is Complete. Click OK and then click the Finish button to return to the main menu.
* If asked if you want to reboot, click Yes.
* To retrieve the removal information after reboot, launch SUPERAntispyware again.
- Click Preferences, then click the Statistics/Logs tab.
- Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
- If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
- Please copy and paste the Scan Log results in your next reply.
* Click Close to exit the program.
Post SUPERAntiSpyware log.
NOTE: Tracking cookies may be omitted from the log.

RECONNECT TO THE INTERNET

RESTART COMPUTER!

STEP 2. Download Malwarebytes' Anti-Malware: http://www.malwarebytes.org/mbam.php to your desktop.
(Malwarebytes is free to use as a manual scanner. Payment is only required if you wish to have it run and update automatically which is not necessary for our purposes)

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.

The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

RESTART COMPUTER!

STEP 3. Download GMER: http://www.gmer.net/files.php, by clicking on Download EXE button.
Alternative downloads:
- http://majorgeeks.com/GMER_d5198.html
- http://www.softpedia.com/get/Interne...ers/GMER.shtml
Double click on downloaded .exe file, select Rootkit tab and click the Scan button.
When scan is completed, click Save button, and save the results as gmer.log
Warning ! Please, do not select the "Show all" checkbox during the scan.
Post the log to your next reply.

RESTART COMPUTER

STEP 4. Download HijackThis:
http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download
by clicking on Download HijackThis Installer
Install, and run it.
Post HijackThis log.
Do NOT attempt to "fix" anything!

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

Kurmo · 2009/05/28

Currently performing a full system scan, and I am going to bed, I shall keep you posted. Although I may have to leave for the weekend >.<

broni · 2009/05/28

Not a problem. Take your time

Kurmo · 2009/05/31

Here's the superantispyware log, loaded with p0rn -.-. More logs will be posted as i work my way through the steps

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 05/31/2009 at 08:10 PM

Application Version : 4.26.1004

Core Rules Database Version : 3917
Trace Rules Database Version: 1861

Scan type : Complete Scan
Total Scan Time : 00:50:46

Memory items scanned : 206
Memory threats detected : 0
Registry items scanned : 6078
Registry threats detected : 11
File items scanned : 38813
File threats detected : 71

Adware.Zango/ShoppingReport
HKU\S-1-5-21-1343024091-287218729-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{C5428486-50A0-4A02-9D20-520B59A9F9B3}

Adware.Tracking Cookie
C:\Documents and Settings\Kurtis\Cookies\kurtis@ads.madisonavenue[1].txt
C:\Documents and Settings\Kurtis\Cookies\kurtis@www.pornrater[2].txt
C:\Documents and Settings\Kurtis\Cookies\kurtis@bs.serving-sys[1].txt
C:\Documents and Settings\Kurtis\Cookies\kurtis@statcounter[1].txt
C:\Documents and Settings\Kurtis\Cookies\kurtis@www.porndad[1].txt
C:\Documents and Settings\Kurtis\Cookies\kurtis@ads.infinisource[2].txt
C:\Documents and Settings\Kurtis\Cookies\kurtis@perf.overture[1].txt
C:\Documents and Settings\Kurtis\Cookies\kurtis@www.crosscuntry[3].txt
C:\Documents and Settings\Kurtis\Cookies\kurtis@ads.crakmedia[1].txt
C:\Documents and Settings\Kurtis\Cookies\kurtis@adultadworld[1].txt
C:\Documents and Settings\Kurtis\Cookies\kurtis@zedo[1].txt
C:\Documents and Settings\Kurtis\Cookies\kurtis@fastclick[2].txt
C:\Documents and Settings\Kurtis\Cookies\kurtis@www.humornsex[1].txt
C:\Documents and Settings\Kurtis\Cookies\kurtis@ads.adgoto[1].txt
C:\Documents and Settings\Kurtis\Cookies\kurtis@apmebf[1].txt
C:\Documents and Settings\Kurtis\Cookies\kurtis@humornsex[1].txt
C:\Documents and Settings\Kurtis\Cookies\kurtis@www.burstnet[1].txt
C:\Documents and Settings\Kurtis\Cookies\kurtis@www.humornsex[2].txt
C:\Documents and Settings\Kurtis\Cookies\kurtis@ad.yieldmanager[1].txt
C:\Documents and Settings\Kurtis\Cookies\kurtis@adbrite[2].txt
C:\Documents and Settings\Kurtis\Cookies\kurtis@2o7[2].txt
C:\Documents and Settings\Kurtis\Cookies\kurtis@tacoda[2].txt
C:\Documents and Settings\Kurtis\Cookies\kurtis@www.youngpornmovies[2].txt
C:\Documents and Settings\Kurtis\Cookies\kurtis@www.crosscuntry[2].txt
C:\Documents and Settings\Kurtis\Cookies\kurtis@adultfriendfinder[2].txt
C:\Documents and Settings\Kurtis\Cookies\kurtis@networldmedia[2].txt
C:\Documents and Settings\Kurtis\Cookies\kurtis@ads.networldmedia[2].txt
C:\Documents and Settings\Kurtis\Cookies\kurtis@chitika[1].txt
C:\Documents and Settings\Kurtis\Cookies\kurtis@ad2.doublepimp[1].txt
C:\Documents and Settings\Kurtis\Cookies\kurtis@insightexpressai[2].txt
C:\Documents and Settings\Kurtis\Cookies\kurtis@youngpornmovies[2].txt
C:\Documents and Settings\Kurtis\Cookies\kurtis@collective-media[1].txt
C:\Documents and Settings\Kurtis\Cookies\kurtis@ads.networldmedia[3].txt
C:\Documents and Settings\Kurtis\Cookies\kurtis@weownthetraffic[2].txt
C:\Documents and Settings\Kurtis\Cookies\kurtis@casalemedia[2].txt
C:\Documents and Settings\Kurtis\Cookies\kurtis@adserv01[1].txt
C:\Documents and Settings\Kurtis\Cookies\kurtis@ads.humornsex[2].txt
C:\Documents and Settings\Kurtis\Cookies\kurtis@crosscuntry[1].txt
C:\Documents and Settings\Kurtis\Cookies\kurtis@vitamine.networldmedia[1].txt
C:\Documents and Settings\Kurtis\Cookies\kurtis@advertising[2].txt
C:\Documents and Settings\Kurtis\Cookies\kurtis@doubleclick[2].txt
C:\Documents and Settings\Kurtis\Cookies\kurtis@porn365[1].txt
C:\Documents and Settings\Kurtis\Cookies\kurtis@atdmt[1].txt
C:\Documents and Settings\Kurtis\Cookies\kurtis@media6degrees[2].txt
C:\Documents and Settings\Kurtis\Cookies\kurtis@burstnet[1].txt
C:\Documents and Settings\Kurtis\Cookies\kurtis@serving-sys[2].txt
C:\Documents and Settings\Kurtis\Cookies\kurtis@bluestreak[2].txt
C:\Documents and Settings\Kurtis\Cookies\kurtis@www.porn365[1].txt
C:\Documents and Settings\Kurtis\Cookies\kurtis@tribalfusion[1].txt
.advertising.com [ C:\Documents and Settings\Kurtis\Application Data\MozillaControl\profiles\MozillaControl\q5r9o55n.slt\cookies.txt ]
.advertising.com [ C:\Documents and Settings\Kurtis\Application Data\MozillaControl\profiles\MozillaControl\q5r9o55n.slt\cookies.txt ]
.advertising.com [ C:\Documents and Settings\Kurtis\Application Data\MozillaControl\profiles\MozillaControl\q5r9o55n.slt\cookies.txt ]
.advertising.com [ C:\Documents and Settings\Kurtis\Application Data\MozillaControl\profiles\MozillaControl\q5r9o55n.slt\cookies.txt ]
.doubleclick.net [ C:\Documents and Settings\Kurtis\Application Data\MozillaControl\profiles\MozillaControl\q5r9o55n.slt\cookies.txt ]
media.adrevolver.com [ C:\Documents and Settings\Kurtis\Application Data\MozillaControl\profiles\MozillaControl\q5r9o55n.slt\cookies.txt ]

Adware.MyWebSearch/FunWebProducts
HKCR\Interface\{2E9937FC-CF2F-4F56-AF54-5A6A3DD375CC}
HKCR\Interface\{2E9937FC-CF2F-4F56-AF54-5A6A3DD375CC}\ProxyStubClsid
HKCR\Interface\{2E9937FC-CF2F-4F56-AF54-5A6A3DD375CC}\ProxyStubClsid32
HKCR\Interface\{2E9937FC-CF2F-4F56-AF54-5A6A3DD375CC}\TypeLib
HKCR\Interface\{2E9937FC-CF2F-4F56-AF54-5A6A3DD375CC}\TypeLib#Version
HKCR\Interface\{741DE825-A6F0-4497-9AA6-8023CF9B0FFF}
HKCR\Interface\{741DE825-A6F0-4497-9AA6-8023CF9B0FFF}\ProxyStubClsid
HKCR\Interface\{741DE825-A6F0-4497-9AA6-8023CF9B0FFF}\ProxyStubClsid32
HKCR\Interface\{741DE825-A6F0-4497-9AA6-8023CF9B0FFF}\TypeLib
HKCR\Interface\{741DE825-A6F0-4497-9AA6-8023CF9B0FFF}\TypeLib#Version

Rogue.AntiVirusPro2009
C:\Program Files\AntivirusPro2009\AntivirusPro2009.cfg
C:\Program Files\AntivirusPro2009\data\daily.cvd
C:\Program Files\AntivirusPro2009\data
C:\Program Files\AntivirusPro2009\htmlayout.dll
C:\Program Files\AntivirusPro2009\Microsoft.VC80.CRT\Microsoft.VC80.CRT.manifest
C:\Program Files\AntivirusPro2009\Microsoft.VC80.CRT\msvcm80.dll
C:\Program Files\AntivirusPro2009\Microsoft.VC80.CRT\msvcp80.dll
C:\Program Files\AntivirusPro2009\Microsoft.VC80.CRT\msvcr80.dll
C:\Program Files\AntivirusPro2009\Microsoft.VC80.CRT
C:\Program Files\AntivirusPro2009\pthreadVC2.dll
C:\Program Files\AntivirusPro2009
C:\Documents and Settings\Kurtis\Start Menu\Programs\AntivirusPro2009\AntivirusPro2009.lnk
C:\Documents and Settings\Kurtis\Start Menu\Programs\AntivirusPro2009\Uninstall.lnk
C:\Documents and Settings\Kurtis\Start Menu\Programs\AntivirusPro2009
C:\Documents and Settings\Kurtis\Application Data\Microsoft\Internet Explorer\Quick Launch\AntivirusPro2009.lnk

Adware.180solutions/Seekmo/Zango
C:\QOOBOX\QUARANTINE\C\PROGRAM FILES\MOZILLA FIREFOX\PLUGINS\NPCLNTAX_ZANGOSA.DLL.VIR

Kurmo · 2009/05/31

Step 2:

Malwarebytes' Anti-Malware 1.37
Database version: 2204
Windows 5.1.2600 Service Pack 3

5/31/2009 8:38:27 PM
mbam-log-2009-05-31 (20-38-27).txt

Scan type: Full Scan (C:\|)
Objects scanned: 124841
Time elapsed: 14 minute(s), 17 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 4
Registry Values Infected: 6
Registry Data Items Infected: 5
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\Interface\{2e9937fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{741de825-a6f0-4497-9aa6-8023cf9b0fff} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{b7d3e479-cc68-42b5-a338-938ece35f419} (Adware.SoftMate) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{b7d3e479-cc68-42b5-a338-938ece35f419} (Adware.SoftMate) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\{c5428486-50a0-4a02-9d20-520b59a9f9b2} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\{c5428486-50a0-4a02-9d20-520b59a9f9b3} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\MenuExt\&Search\ (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\Extensions\Zango@Zango.com (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ForceClassicControlPanel (Hijack.ControlPanelStyle) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
c:\system volume information\_restore{f059d46a-4a08-4273-bac2-3433b8700884}\RP332\A0082817.dll (Rogue.AntivirusPro2009) -> Quarantined and deleted successfully.

Kurmo · 2009/05/31

step 3:

GMER 1.0.15.14972 - http://www.gmer.net
Rootkit scan 2009-05-31 20:58:39
Windows 5.1.2600 Service Pack 3

---- System - GMER 1.0.15 ----

SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwClose [0xB689B6B8]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateKey [0xB689B574]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDeleteValueKey [0xB689BA52]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDuplicateObject [0xB689B14C]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenKey [0xB689B64E]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenProcess [0xB689B08C]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenThread [0xB689B0F0]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwQueryValueKey [0xB689B76E]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwRestoreKey [0xB689B72E]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwSetValueKey [0xB689B8AE]

---- Kernel code sections - GMER 1.0.15 ----

? dujyblwd.sys The system cannot find the file specified. !

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\WINDOWS\system32\services.exe[732] @ C:\WINDOWS\system32\services.exe [ADVAPI32.dll!CreateProcessAsUserW] 00380002
IAT C:\WINDOWS\system32\services.exe[732] @ C:\WINDOWS\system32\services.exe [KERNEL32.dll!CreateProcessW] 00380000

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Ip aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\RawIp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\ControlSet002\Services\TDSSserv.sys@start 1
Reg HKLM\SYSTEM\ControlSet002\Services\TDSSserv.sys@type 1
Reg HKLM\SYSTEM\ControlSet002\Services\TDSSserv.sys@imagepath \systemroot\system32\drivers\TDSSmxst.sys
Reg HKLM\SYSTEM\ControlSet002\Services\TDSSserv.sys@group file system
Reg HKLM\SYSTEM\ControlSet002\Services\TDSSserv.sys\modules
Reg HKLM\SYSTEM\ControlSet002\Services\TDSSserv.sys\modules@TDSSserv \systemroot\system32\drivers\TDSSmxst.sys
Reg HKLM\SYSTEM\ControlSet002\Services\TDSSserv.sys\modules@TDSSl \systemroot\system32\TDSSoitu.dll
Reg HKLM\SYSTEM\ControlSet002\Services\TDSSserv.sys\modules@tdssservers \systemroot\system32\TDSSmtve.dat
Reg HKLM\SYSTEM\ControlSet002\Services\TDSSserv.sys\modules@tdssmain \systemroot\system32\TDSSarxx.dll
Reg HKLM\SYSTEM\ControlSet002\Services\TDSSserv.sys\modules@tdsslog \systemroot\system32\TDSSvoqm.dll
Reg HKLM\SYSTEM\ControlSet002\Services\TDSSserv.sys\modules@tdssadw \systemroot\system32\TDSSnvuo.dll
Reg HKLM\SYSTEM\ControlSet002\Services\TDSSserv.sys\modules@tdssinit \systemroot\system32\TDSSdxcp.dll
Reg HKLM\SYSTEM\ControlSet002\Services\TDSSserv.sys\modules@tdssurls \systemroot\system32\TDSSnmxh.log
Reg HKLM\SYSTEM\ControlSet002\Services\TDSSserv.sys\modules@tdsspanels \systemroot\system32\TDSSsahw.dll
Reg HKLM\SYSTEM\ControlSet002\Services\TDSSserv.sys\modules@tdsserrors \systemroot\system32\TDSSxhyf.log
Reg HKLM\SYSTEM\ControlSet002\Services\TDSSserv.sys\modules@TDSSproc \systemroot\system32\TDSSkkao.log
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update@NextDetectionTime 2009-06-01 00:42:02
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Detect@LastSuccessTime 2009-01-06 11:01:39
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Download@LastSuccessTime 2008-12-18 02:30:00

---- EOF - GMER 1.0.15 ----

Kurmo · 2009/05/31

STEP 4:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:00:19 PM, on 5/31/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe
C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDClock.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDCountdown.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDMedia.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDPop3.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe "
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe "
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe "
O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe "
O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" /SHOWHIDE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe "
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe "
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w3/resources/MSNPUpld.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/RACtrl.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Unknown owner - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe (file missing)

--
End of file - 8026 bytes

Kurmo · 2009/05/31

Alright that's everything, work your magic

broni · 2009/05/31

Please download ComboFix from [color= "Red"]Here[/color] or [color= "#FF0000"]Here[/color] to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

Please, never rename Combofix unless instructed.

Close any open browsers.

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results ".

Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

Close any open browsers.

WARNING: Combofix will disconnect your machine from the Internet as soon as it starts

Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.

If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

Double click on combofix.exe & follow the prompts.

When finished, it will produce a report for you.

Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

Make sure, you re-enable your security programs, when you're done with Combofix.

Kurmo · 2009/05/31

ComboFix 09-05-31.02 - Kurtis 05/31/2009 21:34.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2047.1506 [GMT -4:00]
Running from: c:\documents and settings\Kurtis\Desktop\ComboFix.exe
AV: avast! antivirus 4.8.1335 [VPS 090531-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\NkNEFPlugin.dll

.
((((((((((((((((((((((((( Files Created from 2009-05-01 to 2009-06-01 )))))))))))))))))))))))))))))))
.

2009-06-01 00:59 . 2009-06-01 00:59 -------- d-----w- c:\program files\Trend Micro
2009-06-01 00:43 . 2009-06-01 00:43 -------- d-----w- c:\windows\LastGood
2009-06-01 00:22 . 2009-06-01 00:22 -------- d-----w- c:\documents and settings\Kurtis\Application Data\Malwarebytes
2009-06-01 00:18 . 2009-05-26 17:20 40160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-01 00:18 . 2009-06-01 00:22 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-06-01 00:18 . 2009-06-01 00:18 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-06-01 00:18 . 2009-05-26 17:19 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-05-31 23:10 . 2009-05-31 23:10 -------- d-sh--w- C:\found.001
2009-05-31 23:06 . 2009-06-01 00:13 117760 ----a-w- c:\documents and settings\Kurtis\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-05-31 23:05 . 2009-05-31 23:05 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-05-31 23:04 . 2009-05-31 23:04 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-05-31 23:04 . 2009-05-31 23:04 -------- d-----w- c:\documents and settings\Kurtis\Application Data\SUPERAntiSpyware.com
2009-05-29 02:43 . 2009-02-05 20:06 51376 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2009-05-29 02:43 . 2009-02-05 20:06 23152 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2009-05-29 02:43 . 2009-02-05 20:05 26944 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2009-05-29 02:43 . 2009-02-05 20:07 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2009-05-29 02:43 . 2009-02-05 20:07 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-05-29 02:43 . 2009-02-05 20:04 97480 ----a-w- c:\windows\system32\AvastSS.scr
2009-05-29 02:43 . 2009-02-05 20:08 93296 ----a-w- c:\windows\system32\drivers\aswmon.sys
2009-05-29 02:43 . 2009-02-05 20:08 94032 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2009-05-29 02:42 . 2009-02-05 20:11 1256296 ----a-w- c:\windows\system32\aswBoot.exe
2009-05-29 02:42 . 2009-05-29 02:42 -------- d-----w- c:\program files\Alwil Software
2009-05-29 02:26 . 2009-05-29 02:26 -------- d-----w- c:\documents and settings\All Users\Application Data\NortonInstaller
2009-05-28 20:18 . 2009-05-28 20:18 -------- d-----w- c:\program files\Common Files\Windows Live
2009-05-28 01:31 . 2009-05-28 01:31 -------- d-----w- c:\documents and settings\All Users\Application Data\NVIDIA
2009-05-20 00:03 . 2009-05-20 00:03 -------- d-----w- c:\program files\RADVideo
2009-05-19 19:08 . 2008-04-13 17:45 15104 -c--a-w- c:\windows\system32\dllcache\usbscan.sys
2009-05-19 19:08 . 2008-04-13 17:45 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys
2009-05-19 19:08 . 2001-08-18 02:36 5632 ----a-w- c:\windows\system32\ptpusb.dll
2009-05-19 19:08 . 2008-04-13 23:12 159232 ----a-w- c:\windows\system32\ptpusd.dll
2009-05-06 22:52 . 2009-05-06 23:59 -------- d-----w- c:\program files\Perfect World Entertainment
2009-05-06 22:51 . 2005-05-10 22:54 258352 ----a-w- c:\windows\system32\unicows.dll
2009-05-06 21:38 . 2009-05-06 22:49 -------- d-----w- c:\documents and settings\Kurtis\Application Data\GetRightToGo

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-01 00:41 . 2007-12-06 19:37 26096 ----a-w- c:\documents and settings\Kurtis\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-31 23:03 . 2008-12-08 04:45 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-05-31 22:58 . 2008-11-05 04:50 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater
2009-05-31 22:57 . 2007-12-06 02:15 2145386496 --sha-w- c:\windows\DUMP5f46.tmp
2009-05-29 02:27 . 2007-12-07 15:01 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-05-29 02:27 . 2007-12-07 15:03 -------- d-----w- c:\documents and settings\All Users\Application Data\Symantec
2009-05-28 23:38 . 2008-02-29 12:20 138512 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2009-05-28 23:37 . 2008-02-29 12:20 201440 ----a-w- c:\windows\system32\PnkBstrB.exe
2009-05-28 01:00 . 2007-12-06 19:46 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-05-28 01:00 . 2009-03-17 02:51 -------- d-----w- c:\documents and settings\Kurtis\Application Data\InstallShield
2009-05-27 23:59 . 2008-12-22 01:22 -------- d-----w- c:\program files\Common Files\Roxio Shared
2009-05-27 23:59 . 2008-12-22 01:22 -------- d-----w- c:\documents and settings\All Users\Application Data\Roxio
2009-05-27 23:55 . 2008-12-22 01:26 -------- d-----w- c:\documents and settings\Kurtis\Application Data\Research In Motion
2009-05-27 23:53 . 2008-11-05 04:50 -------- d-----w- c:\program files\Google
2009-05-27 23:52 . 2008-01-08 21:26 -------- d-----w- c:\program files\DivX
2009-05-27 23:49 . 2008-12-22 01:26 256 ----a-w- c:\windows\system32\pool.bin
2009-05-19 23:33 . 2009-01-12 12:36 -------- d-----w- c:\documents and settings\Kurtis\Application Data\U3
2009-05-19 22:53 . 2008-02-11 03:27 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-05-01 04:37 . 2007-12-07 14:44 -------- d-----w- c:\program files\Common Files\Adobe
2009-03-17 02:35 . 2009-03-17 02:35 165803 ----a-w- c:\windows\Video Cleaner Uninstaller.exe
2008-11-18 05:21 . 2008-11-18 05:21 17397 ----a-w- c:\program files\Common Files\ycinurafi.pif
2008-11-18 05:21 . 2008-11-18 05:21 11644 ----a-w- c:\program files\Common Files\ogiwekewi.pif
.

((((((((((((((((((((((((((((( SnapShot@2009-05-28_19.09.19 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-06-01 00:41 . 2009-06-01 00:41 16384 c:\windows\Temp\Perflib_Perfdata_57c.dat
+ 2009-06-01 00:41 . 2009-06-01 00:41 16384 c:\windows\Temp\Perflib_Perfdata_41c.dat
+ 2009-05-31 23:04 . 2009-05-31 23:04 65024 c:\windows\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF15.exe
+ 2009-05-31 23:04 . 2009-05-31 23:04 18944 c:\windows\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF13.exe
+ 2007-12-06 02:19 . 2009-06-01 00:12 134872 c:\windows\system32\FNTCACHE.DAT
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} "= "c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-12-23 143360]
"ctfmon.exe "= "c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"ISUSPM "= "c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2007-08-30 205480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck "= "c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"RemoteControl "= "c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2003-11-01 32768]
"SunJavaUpdateSched "= "c:\program files\Java\jre6\bin\jusched.exe" [2009-01-01 136600]
"IntelliPoint "= "c:\program files\Microsoft IntelliPoint\point32.exe" [2005-06-10 217088]
"Launch LCDMon "= "c:\program files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe" [2007-07-17 1687824]
"Launch LGDCore "= "c:\program files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" [2007-07-18 2094352]
"NvCplDaemon "= "c:\windows\system32\NvCpl.dll" [2006-08-11 7630848]
"NvMediaCenter "= "c:\windows\system32\NvMcTray.dll" [2006-08-11 86016]
"QuickTime Task "= "c:\program files\QuickTime\qttask.exe" [2008-11-04 413696]
"iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]
"avast! "= "c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"RTHDCPL "= "RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-03-21 16126464]
"nwiz "= "nwiz.exe" - c:\windows\system32\nwiz.exe [2006-08-11 1519616]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
NkbMonitor.exe.lnk - c:\program files\Nikon\PictureProject\NkbMonitor.exe [2008-12-27 118784]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} "= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 16:05 356352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\6hicm2misz2.sys]
@= "\??\c:\windows\system32\drivers\6hicm2misz2.sys "

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sx2jilklzlz.sys]
@= "\??\c:\windows\system32\drivers\sx2jilklzlz.sys "

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring "=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring "=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall "= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"c:\\Program Files\\Xfire\\xfire.exe "=
"c:\\Program Files\\Wolfenstein - Enemy Territory\\ET.exe "=
"c:\\Program Files\\LimeWire\\LimeWire.exe "=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe "=
"c:\\Program Files\\iTunes\\iTunes.exe "=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe "=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP "= 3724:TCP:Blizzard Downloader: 3724

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [5/28/2009 10:43 PM 114768]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [5/26/2009 10:05 AM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/26/2009 10:05 AM 72944]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [5/28/2009 10:43 PM 20560]
R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [1/15/2008 12:27 AM 45848]
R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Controller;c:\windows\system32\drivers\atl01_xp.sys [12/6/2007 3:48 PM 38656]
S2 6hicm2misz2.sys;6hicm2misz2.sys;\??\c:\windows\system32\drivers\6hicm2misz2.sys --> c:\windows\system32\drivers\6hicm2misz2.sys [?]
S2 LMIInfo;LogMeIn Kernel Information Provider;\??\c:\program files\LogMeIn\x86\RaInfo.sys --> c:\program files\LogMeIn\x86\RaInfo.sys [?]
S3 EraserUtilDrv10621;EraserUtilDrv10621;\??\c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrv10621.sys --> c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrv10621.sys [?]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [5/26/2009 10:05 AM 7408]
S4 LMIRfsClientNP;LMIRfsClientNP; [x]

--- Other Services/Drivers In Memory ---

*Deregistered* - aujasnkj
.
Contents of the 'Scheduled Tasks' folder

2009-05-07 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]

2009-06-01 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-11-05 23:48]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com
mStart Page = hxxp://www.google.com
uInternet Settings,ProxyOverride = *.local
IE: &Search
FF - ProfilePath - c:\documents and settings\Kurtis\Application Data\Mozilla\Firefox\Profiles\82d3a1hr.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-divx&p=
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-divx&p=
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-31 21:35
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1343024091-287218729-725345543-1004\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(688)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
.
Completion time: 2009-06-01 21:37
ComboFix-quarantined-files.txt 2009-06-01 01:37
ComboFix2.txt 2009-05-28 20:15
ComboFix3.txt 2009-05-28 19:10

Pre-Run: 227,699,478,528 bytes free
Post-Run: 227,776,765,952 bytes free

190 --- E O F --- 2008-12-18 08:00

Kurmo · 2009/05/31

I posted the hijack log before i posted this, should i run hijack again?

broni · 2009/05/31

This time, I'll need fresh HJT log ran after Combofix fix....

1. Please open Notepad

Click Start , then Run

Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

File::
c:\program files\Common Files\ycinurafi.pif
c:\program files\Common Files\ogiwekewi.pif
c:\windows\system32\drivers\6hicm2misz2.sys
c:\windows\system32\drivers\sx2jilklzlz.sys

Folder::

Driver::
6hicm2misz2.sys

Registry::
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\6hicm2 misz2.sys]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sx2jil klzlz.sys]
Click to expand...

3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

Combofix.txt

A new HijackThis log.

Kurmo · 2009/05/31

COMBOFIX

ComboFix 09-05-31.02 - Kurtis 05/31/2009 22:54.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2047.1506 [GMT -4:00]
Running from: c:\documents and settings\Kurtis\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Kurtis\Desktop\CFScript.txt
AV: avast! antivirus 4.8.1335 [VPS 090531-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

FILE ::
"c:\program files\Common Files\ogiwekewi.pif "
"c:\program files\Common Files\ycinurafi.pif "
"c:\windows\system32\drivers\6hicm2misz2.sys "
"c:\windows\system32\drivers\sx2jilklzlz.sys "
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Common Files\ogiwekewi.pif
c:\program files\Common Files\ycinurafi.pif

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_6HICM2MISZ2.SYS
-------\Service_6hicm2misz2.sys

((((((((((((((((((((((((( Files Created from 2009-05-01 to 2009-06-01 )))))))))))))))))))))))))))))))
.

2009-06-01 00:59 . 2009-06-01 00:59 -------- d-----w- c:\program files\Trend Micro
2009-06-01 00:22 . 2009-06-01 00:22 -------- d-----w- c:\documents and settings\Kurtis\Application Data\Malwarebytes
2009-06-01 00:18 . 2009-05-26 17:20 40160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-01 00:18 . 2009-06-01 00:22 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-06-01 00:18 . 2009-06-01 00:18 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-06-01 00:18 . 2009-05-26 17:19 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-05-31 23:10 . 2009-05-31 23:10 -------- d-sh--w- C:\found.001
2009-05-31 23:06 . 2009-06-01 00:13 117760 ----a-w- c:\documents and settings\Kurtis\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-05-31 23:05 . 2009-05-31 23:05 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-05-31 23:04 . 2009-05-31 23:04 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-05-31 23:04 . 2009-05-31 23:04 -------- d-----w- c:\documents and settings\Kurtis\Application Data\SUPERAntiSpyware.com
2009-05-29 02:43 . 2009-02-05 20:06 51376 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2009-05-29 02:43 . 2009-02-05 20:06 23152 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2009-05-29 02:43 . 2009-02-05 20:05 26944 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2009-05-29 02:43 . 2009-02-05 20:07 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2009-05-29 02:43 . 2009-02-05 20:07 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-05-29 02:43 . 2009-02-05 20:04 97480 ----a-w- c:\windows\system32\AvastSS.scr
2009-05-29 02:43 . 2009-02-05 20:08 93296 ----a-w- c:\windows\system32\drivers\aswmon.sys
2009-05-29 02:43 . 2009-02-05 20:08 94032 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2009-05-29 02:42 . 2009-02-05 20:11 1256296 ----a-w- c:\windows\system32\aswBoot.exe
2009-05-29 02:42 . 2009-05-29 02:42 -------- d-----w- c:\program files\Alwil Software
2009-05-29 02:26 . 2009-05-29 02:26 -------- d-----w- c:\documents and settings\All Users\Application Data\NortonInstaller
2009-05-28 20:18 . 2009-05-28 20:18 -------- d-----w- c:\program files\Common Files\Windows Live
2009-05-28 01:31 . 2009-05-28 01:31 -------- d-----w- c:\documents and settings\All Users\Application Data\NVIDIA
2009-05-20 00:03 . 2009-05-20 00:03 -------- d-----w- c:\program files\RADVideo
2009-05-19 19:08 . 2008-04-13 17:45 15104 -c--a-w- c:\windows\system32\dllcache\usbscan.sys
2009-05-19 19:08 . 2008-04-13 17:45 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys
2009-05-19 19:08 . 2001-08-18 02:36 5632 ----a-w- c:\windows\system32\ptpusb.dll
2009-05-19 19:08 . 2008-04-13 23:12 159232 ----a-w- c:\windows\system32\ptpusd.dll
2009-05-06 22:52 . 2009-05-06 23:59 -------- d-----w- c:\program files\Perfect World Entertainment
2009-05-06 22:51 . 2005-05-10 22:54 258352 ----a-w- c:\windows\system32\unicows.dll
2009-05-06 21:38 . 2009-05-06 22:49 -------- d-----w- c:\documents and settings\Kurtis\Application Data\GetRightToGo

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-01 02:09 . 2008-02-29 12:20 138512 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2009-06-01 02:09 . 2008-02-29 12:20 201440 ----a-w- c:\windows\system32\PnkBstrB.exe
2009-06-01 00:41 . 2007-12-06 19:37 26096 ----a-w- c:\documents and settings\Kurtis\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-31 23:03 . 2008-12-08 04:45 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-05-31 22:58 . 2008-11-05 04:50 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater
2009-05-31 22:57 . 2007-12-06 02:15 2145386496 --sha-w- c:\windows\DUMP5f46.tmp
2009-05-29 02:27 . 2007-12-07 15:01 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-05-29 02:27 . 2007-12-07 15:03 -------- d-----w- c:\documents and settings\All Users\Application Data\Symantec
2009-05-28 01:00 . 2007-12-06 19:46 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-05-28 01:00 . 2009-03-17 02:51 -------- d-----w- c:\documents and settings\Kurtis\Application Data\InstallShield
2009-05-27 23:59 . 2008-12-22 01:22 -------- d-----w- c:\program files\Common Files\Roxio Shared
2009-05-27 23:59 . 2008-12-22 01:22 -------- d-----w- c:\documents and settings\All Users\Application Data\Roxio
2009-05-27 23:55 . 2008-12-22 01:26 -------- d-----w- c:\documents and settings\Kurtis\Application Data\Research In Motion
2009-05-27 23:53 . 2008-11-05 04:50 -------- d-----w- c:\program files\Google
2009-05-27 23:52 . 2008-01-08 21:26 -------- d-----w- c:\program files\DivX
2009-05-27 23:49 . 2008-12-22 01:26 256 ----a-w- c:\windows\system32\pool.bin
2009-05-19 23:33 . 2009-01-12 12:36 -------- d-----w- c:\documents and settings\Kurtis\Application Data\U3
2009-05-19 22:53 . 2008-02-11 03:27 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-05-01 04:37 . 2007-12-07 14:44 -------- d-----w- c:\program files\Common Files\Adobe
2009-03-17 02:35 . 2009-03-17 02:35 165803 ----a-w- c:\windows\Video Cleaner Uninstaller.exe
.

((((((((((((((((((((((((((((( SnapShot@2009-05-28_19.09.19 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-06-01 00:41 . 2009-06-01 00:41 16384 c:\windows\Temp\Perflib_Perfdata_57c.dat
+ 2009-06-01 02:57 . 2009-06-01 02:57 16384 c:\windows\Temp\Perflib_Perfdata_1b0.dat
+ 2009-05-31 23:04 . 2009-05-31 23:04 65024 c:\windows\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF15.exe
+ 2009-05-31 23:04 . 2009-05-31 23:04 18944 c:\windows\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF13.exe
+ 2007-12-06 02:19 . 2009-06-01 00:12 134872 c:\windows\system32\FNTCACHE.DAT
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} "= "c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-12-23 143360]
"ctfmon.exe "= "c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"ISUSPM "= "c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2007-08-30 205480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck "= "c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"RemoteControl "= "c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2003-11-01 32768]
"SunJavaUpdateSched "= "c:\program files\Java\jre6\bin\jusched.exe" [2009-01-01 136600]
"IntelliPoint "= "c:\program files\Microsoft IntelliPoint\point32.exe" [2005-06-10 217088]
"Launch LCDMon "= "c:\program files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe" [2007-07-17 1687824]
"Launch LGDCore "= "c:\program files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" [2007-07-18 2094352]
"NvCplDaemon "= "c:\windows\system32\NvCpl.dll" [2006-08-11 7630848]
"NvMediaCenter "= "c:\windows\system32\NvMcTray.dll" [2006-08-11 86016]
"QuickTime Task "= "c:\program files\QuickTime\qttask.exe" [2008-11-04 413696]
"iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]
"avast! "= "c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"RTHDCPL "= "RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-03-21 16126464]
"nwiz "= "nwiz.exe" - c:\windows\system32\nwiz.exe [2006-08-11 1519616]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
NkbMonitor.exe.lnk - c:\program files\Nikon\PictureProject\NkbMonitor.exe [2008-12-27 118784]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} "= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 16:05 356352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sx2jilklzlz.sys]
@= "\??\c:\windows\system32\drivers\sx2jilklzlz.sys "

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring "=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring "=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"c:\\Program Files\\Xfire\\xfire.exe "=
"c:\\Program Files\\Wolfenstein - Enemy Territory\\ET.exe "=
"c:\\Program Files\\LimeWire\\LimeWire.exe "=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe "=
"c:\\Program Files\\iTunes\\iTunes.exe "=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe "=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP "= 3724:TCP:Blizzard Downloader: 3724

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [5/28/2009 10:43 PM 114768]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [5/26/2009 10:05 AM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/26/2009 10:05 AM 72944]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [5/28/2009 10:43 PM 20560]
R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [1/15/2008 12:27 AM 45848]
R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Controller;c:\windows\system32\drivers\atl01_xp.sys [12/6/2007 3:48 PM 38656]
S2 LMIInfo;LogMeIn Kernel Information Provider;\??\c:\program files\LogMeIn\x86\RaInfo.sys --> c:\program files\LogMeIn\x86\RaInfo.sys [?]
S3 EraserUtilDrv10621;EraserUtilDrv10621;\??\c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrv10621.sys --> c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrv10621.sys [?]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [5/26/2009 10:05 AM 7408]
S4 LMIRfsClientNP;LMIRfsClientNP; [x]
.
Contents of the 'Scheduled Tasks' folder

2009-05-07 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]

2009-06-01 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-11-05 23:48]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com
mStart Page = hxxp://www.google.com
uInternet Settings,ProxyOverride = *.local
IE: &Search
FF - ProfilePath - c:\documents and settings\Kurtis\Application Data\Mozilla\Firefox\Profiles\82d3a1hr.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-divx&p=
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-divx&p=
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-31 22:57
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1343024091-287218729-725345543-1004\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(688)
c:\program files\SUPERAntiSpyware\SASWINLO.dll

- - - - - - - > 'explorer.exe'(4080)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\program files\Malwarebytes' Anti-Malware\mbamext.dll
c:\program files\SUPERAntiSpyware\SASCTXMN.DLL
c:\program files\WinRAR\rarext.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\PnkBstrA.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\windows\system32\rundll32.exe
c:\program files\Logitech\GamePanel Software\LCD Manager\Applets\LCDClock.exe
c:\program files\Logitech\GamePanel Software\LCD Manager\Applets\LCDCountdown.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2009-06-01 23:00 - machine was rebooted
ComboFix-quarantined-files.txt 2009-06-01 03:00
ComboFix2.txt 2009-06-01 01:37
ComboFix3.txt 2009-05-28 20:15
ComboFix4.txt 2009-05-28 19:10

Pre-Run: 227,800,965,120 bytes free
Post-Run: 227,714,932,736 bytes free

218 --- E O F --- 2008-12-18 08:00

HIJACK THIS

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:01:09 PM, on 5/31/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe
C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDClock.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDCountdown.exe
C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe "
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe "
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe "
O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe "
O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" /SHOWHIDE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe "
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe "
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w3/resources/MSNPUpld.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/RACtrl.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Unknown owner - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe (file missing)

--
End of file - 7849 bytes

broni · 2009/05/31

1. Please open Notepad

Click Start , then Run

Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

File::
c:\windows\system32\drivers\sx2jilklzlz.sys

Folder::

Driver::
sx2jilklzlz.sys

Registry::
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sx2jil klzlz.sys]
Click to expand...

3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

Combofix.txt

A new HijackThis log.

Log in or Sign up

Solved Many Problems

Kurmo Inactive Thread Starter

broni Moderator Malware Analyst

Kurmo Inactive Thread Starter

broni Moderator Malware Analyst

Kurmo Inactive Thread Starter

broni Moderator Malware Analyst

broni Moderator Malware Analyst

Kurmo Inactive Thread Starter

broni Moderator Malware Analyst

Kurmo Inactive Thread Starter

Kurmo Inactive Thread Starter

Kurmo Inactive Thread Starter

Kurmo Inactive Thread Starter

Kurmo Inactive Thread Starter

broni Moderator Malware Analyst

Kurmo Inactive Thread Starter

Kurmo Inactive Thread Starter

broni Moderator Malware Analyst

Kurmo Inactive Thread Starter

broni Moderator Malware Analyst

Share This Page

Log in or Sign up

Solved Many Problems

Kurmo Inactive Thread Starter

broni Moderator Malware Analyst

Kurmo Inactive Thread Starter

broni Moderator Malware Analyst

Kurmo Inactive Thread Starter

broni Moderator Malware Analyst

broni Moderator Malware Analyst

Kurmo Inactive Thread Starter

broni Moderator Malware Analyst

Kurmo Inactive Thread Starter

Kurmo Inactive Thread Starter

Kurmo Inactive Thread Starter

Kurmo Inactive Thread Starter

Kurmo Inactive Thread Starter

broni Moderator Malware Analyst

Kurmo Inactive Thread Starter

Kurmo Inactive Thread Starter

broni Moderator Malware Analyst

Kurmo Inactive Thread Starter

broni Moderator Malware Analyst

Share This Page

Useful Searches