Solved Alternate Data Stream Attatched To C:\Windows Folder

[Resolved] Alternate Data Stream Attatched To C:\Windows Folder

Thanks in advance! I believe I am following everything in your faq, EXCEPT when I went to dl DDS, there were two options: 1 file with an extension of .pif, & one with an extension of .scr. I apologize, I will not run either an .scr or a .pif file unless someone confirms that those really are the extension & the DDS server has not been hijacked.

A slightly different version of this post was originally posted on the Maximum PC site; the only reply was someone offering to try to contact AMD; they failed in their attempt just as I did.
http://www.maximumpc.com/forums/viewtopic.php?p=970522#970522
I have posted there that I have posted here per your faq.

Here's the situation:

The other night Spy Bot Found (& other programs confirmed) an ads attached to the C:\Windows folder. It's named BAD62133E0206B3B
The MD5 Hash is D41D8CD98F00B204E9800998ECF8427E which per Google is a hash for an empty file. This one is 24k. I was able to view the file contents with Adsspy, it's All computer code, no text.

The other XP SP3 pc in my network does NOT have the ads (or the Catalyst driver/control center mentioned below). I have scanned with Pavark, Reg Run Partizan, Adaware, & Avast; none of which notify me of this ads. Originally Spybot, Adsspy, Highjack this & Rootaliser could all see it, but are not able to state if it is malicious or not. Highjack this & Spybot no longer see the ads; adsspy & rootaliser do. I've also been able to save the ads as a separate .bin file & no scanner sees it as a virus.

It's date stamp is identical to a recent install of the Catalyst 9.5 update for a Radeon 3450 card, & while I don't know the exact time of the Catalyst install, it's at minimum within an hour of the ADS time stamp; I'm starting to assume it's likely the same time.

I dl'd the Catalyst update directly from AMD's site & scanned it for virus. I did turn off Reg Run's protection during the install so the driver could modify registry keys & not cause the install to fail.

I would love to ask AMD if the ADS tagged along with the Catalyst driver & if it's necessary, but every attempt to register on AMD's site errors out on both FF & Opera. If I fill out AMD's email form, it sends me a bounce that I need to register before they will accept an email from me. Then no matter what I try, the registration form will not accept any password I've attempted.

My Question is: does anyone know if Catalyst comes with this ADS & if the ADS is necessary? I have several programs that state they can remove the ADS, but they all say to make sure it's malicious before removal or removal could hose my system. In general, how can I find out if an ads is malicious, necessary or neither of the above?


The only sign of any potential problem on this system is from about a month ago, logging into Pay Pal started causing browser crashes on all 3 browsers unless cookies are first deleted, but that precedes this by several weeks. There are NO other signs of virus. I scan often & am a pretty safe surfer.

Thanks for any suggestions........

 

Thank you for the assurance. Here's the logs. As an fyi, I could not get the scr to run even with all security disabled. Also as an fyi, Reg Run saw dds.pif as a trojan/virus, but I ran it anyway.

Thanks in advance!

One other bit of info: the log below shows the time I installed the ATI driver. I went to check the ADS to to see if the time stamp was identical. Unfortunately, the written to/changed date time stamp has changed from 5/30 to 6/9, probably from when i was running all the scans on the ads.


DDS (Ver_09-05-14.01) - NTFSx86
Run by Geff at 0:39:32.76 on Thu 06/11/2009
Internet Explorer: 7.0.5730.13
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3070.2462 [GMT -7:00]

AV: avast! antivirus 4.8.1335 [VPS 090610-0] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Realtek\Diagnostics Utility\8169Diag.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe
C:\PROGRA~1\Greatis\REGRUN~1\WatchDog.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\PhraseExpress\phrase.exe
C:\Program Files\Secunia\PSI\psi.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Documents and Settings\Geff\Desktop\dds.pif

============== Pseudo HJT Report ===============

uStart Page = about:blank
uSearch Page = hxxp://www.google.com/hws/sb/dell-usuk/en/side.html?channel=us-smb
uSearch Bar = hxxp://www.google.com/hws/sb/dell-usuk/en/side.html?channel=us-smb
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/hws/sb/dell-usuk/en/side.html?channel=us-smb
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [AnyDVD] c:\program files\slysoft\anydvd\AnyDVDtray.exe
uRun: [Regrun2] c:\progra~1\greatis\regrun~1\WatchDog.exe
uRun: [EPSON Stylus C120 Series] c:\windows\system32\spool\drivers\w32x86\3\e_faticca.exe /fu "c:\windows\temp\E_S90.tmp" /EF "HKCU "
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [Alcmtr] ALCMTR.EXE
mRun: [8169Diag] c:\program files\realtek\diagnostics utility\8169Diag.exe /hw
mRun: [ATICCC] "c:\program files\ati technologies\ati.ace\CLIStart.exe "
mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe
mRun: [RegRun WinBait] c:\windows\winbait.exe
mRun: [@RegRunOnSecure] c:\progra~1\greatis\regrun~1\OnSecure.exe
mRun: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
mRun: [Avast] "c:\program files\alwil software\avast4\ashDisp.exe "
mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
mRun: [ATIModeChange] Ati2mdxx.exe
mRun: [StartCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun
StartupFolder: c:\docume~1\geff\startm~1\programs\startup\secuni~1.lnk - c:\program files\secunia\psi\psi.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\logite~1.lnk - c:\program files\logitech\setpoint\SetPoint.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\phrase~1.lnk - c:\program files\phraseexpress\phrase.exe
uPolicies-explorer: NoActiveDesktop = 01000000
uPolicies-explorer: NoSMMyDocs = 01000000
uPolicies-explorer: NoSMMyPictures = 01000000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
Trusted Zone: microsoft.com\office
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/C/0/C/C0CBBA88-A6F2-48D9-9B0E-1719D1177202/LegitCheckControl.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1233033940796
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {C7DB51B4-BCF7-4923-8874-7F1A0DC92277} - hxxp://office.microsoft.com/officeupdate/content/opuc4.cab
DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {DE22A7AB-A739-4C58-AD52-21F9CD6306B7} - hxxp://download.microsoft.com/download/7/E/6/7E6A8567-DFE4-4624-87C3-163549BE2704/clearadj.cab
Notify: AtiExtEvent - Ati2evxx.dll
SEH: ShellObj Class: {f552dde6-2090-4bf4-b924-6141e87789a5} - c:\progra~1\greatis\regrun~1\RRShell.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll
SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\wifd1f~1\MpShHook.dll

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-6-9 64160]
R0 Partizan;Partizan;c:\windows\system32\drivers\Partizan.sys [2009-1-27 34760]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-2-5 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-2-5 20560]
R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast4\ashServ.exe [2009-2-5 155160]
R2 LANPkt;Realtek LANPkt Protocol Driver;c:\windows\system32\drivers\LANPkt.sys [2008-12-5 8960]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-3-9 1005904]
R2 ppsio2;PPDevice;c:\windows\system32\drivers\ppsio2.sys [2009-2-9 23200]
R3 AtiHdmiService;ATI Function Driver for HDMI Service;c:\windows\system32\drivers\AtiHdmi.sys [2008-12-5 84992]
R3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast4\ashMaiSv.exe [2009-2-5 254040]
R3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast4\ashWebSv.exe [2009-2-5 352920]
R3 Diag69xp;Diag69xp;c:\windows\system32\drivers\diag69xp.sys [2008-12-5 11264]
R3 RegGuard;RegGuard;c:\windows\system32\drivers\regguard.sys [2009-1-27 29584]
S2 FlingService;Fling File Transfer;c:\program files\nch software\fling\fling.exe [2009-2-9 536580]
S3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [2008-12-10 7808]
S3 RTLVLAN;Realtek VLAN Intermediate Driver;c:\windows\system32\drivers\RTLVLAN.SYS [2008-12-5 16640]
S3 spupdsvc;Windows Service Pack Installer update service;c:\windows\system32\spupdsvc.exe [2008-4-25 26144]
S3 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592]

============== File Associations ===============

txtfile= "c:\program files\jgsoft\editpadlite\EditPadLite.exe" "%1 "

=============== Created Last 30 ================

2009-06-10 04:34 <DIR> --d----- C:\a
2009-06-09 20:46 15,688 a------- c:\windows\system32\lsdelete.exe
2009-06-09 20:22 64,160 a------- c:\windows\system32\drivers\Lbd.sys
2009-06-09 20:18 <DIR> -cd-h--- c:\docume~1\alluse~1\applic~1\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
2009-06-09 20:18 <DIR> --d----- c:\program files\Lavasoft
2009-06-07 00:52 <DIR> --d----- c:\program files\Safer Networking
2009-06-04 01:18 <DIR> --d----- c:\program files\FirstCap
2009-06-03 18:47 <DIR> --d----- c:\program files\Agent
2009-05-31 18:10 <DIR> --d----- C:\DVDFab_Temp
2009-05-30 04:22 593,920 -------- c:\windows\system32\ati2sgag.exe
2009-05-30 04:21 <DIR> --d----- c:\program files\ATI Technologies
2009-05-30 04:21 <DIR> --d----- C:\ATI
2009-05-30 04:03 <DIR> --d----- c:\windows\system32\wbem\Repository
2009-05-26 14:56 104,384 a------- c:\windows\system32\drivers\AnyDVD.sys
2009-05-25 05:01 89,256 a------- c:\windows\system32\ElbyCDIO.dll
2009-05-21 00:19 <DIR> --d----- c:\program files\Trader's Little Helper
2009-05-12 21:48 367 a------- c:\documents and settings\geff\cvdm.dat
2009-05-12 21:48 <DIR> --d----- c:\program files\CV Download Manager

==================== Find3M ====================

2009-06-10 22:07 29,584 a------- c:\windows\system32\drivers\regguard.sys
2009-05-25 00:24 350,208 -------- c:\windows\system32\mssph.dll
2009-05-12 15:12 26,144 a------- c:\windows\system32\spupdsvc.exe
2009-05-07 08:32 345,600 a------- c:\windows\system32\localspl.dll
2009-04-28 21:56 827,392 a------- c:\windows\system32\wininet.dll
2009-04-28 21:55 78,336 a------- c:\windows\system32\ieencode.dll
2009-04-28 20:30 3,643,904 a------- c:\windows\system32\drivers\ati2mtag.sys
2009-04-28 19:18 442,368 a------- c:\windows\system32\ATIDEMGX.dll
2009-04-28 19:17 335,872 a------- c:\windows\system32\ati2dvag.dll
2009-04-28 19:07 204,800 a------- c:\windows\system32\atipdlxx.dll
2009-04-28 19:06 155,648 a------- c:\windows\system32\Oemdspif.dll
2009-04-28 19:06 26,112 a------- c:\windows\system32\Ati2mdxx.exe
2009-04-28 19:06 43,520 a------- c:\windows\system32\ati2edxx.dll
2009-04-28 19:06 155,648 a------- c:\windows\system32\ati2evxx.dll
2009-04-28 19:04 602,112 a------- c:\windows\system32\ati2evxx.exe
2009-04-28 19:03 53,248 a------- c:\windows\system32\ATIDDC.DLL
2009-04-28 19:00 311,296 a------- c:\windows\system32\atiiiexx.dll
2009-04-28 18:56 2,997,536 a------- c:\windows\system32\ati3duag.dll
2009-04-28 18:45 11,603,968 a------- c:\windows\system32\atioglxx.dll
2009-04-28 18:42 2,687,872 a------- c:\windows\system32\ativvaxx.dll
2009-04-28 18:26 49,664 a------- c:\windows\system32\atimpc32.dll
2009-04-28 18:26 49,664 a------- c:\windows\system32\amdpcom32.dll
2009-04-28 18:22 479,232 a------- c:\windows\system32\atikvmag.dll
2009-04-28 18:20 45,056 a------- c:\windows\system32\aticalrt.dll
2009-04-28 18:20 45,056 a------- c:\windows\system32\aticalcl.dll
2009-04-28 18:20 135,168 a------- c:\windows\system32\atiadlxx.dll
2009-04-28 18:19 17,408 a------- c:\windows\system32\atitvo32.dll
2009-04-28 18:19 53,248 a------- c:\windows\system32\drivers\ati2erec.dll
2009-04-28 18:18 3,280,896 a------- c:\windows\system32\aticaldd.dll
2009-04-28 18:17 303,104 a------- c:\windows\system32\atiok3x2.dll
2009-04-28 18:13 630,784 a------- c:\windows\system32\ati2cqag.dll
2009-04-17 05:26 1,847,168 a------- c:\windows\system32\win32k.sys
2009-04-15 13:24 90,112 a------- c:\windows\system32\dpl100.dll
2009-04-15 13:24 823,296 a------- c:\windows\system32\divx_xx0c.dll
2009-04-15 13:24 823,296 a------- c:\windows\system32\divx_xx07.dll
2009-04-15 13:24 815,104 a------- c:\windows\system32\divx_xx0a.dll
2009-04-15 13:24 802,816 a------- c:\windows\system32\divx_xx11.dll
2009-04-15 13:24 684,032 a------- c:\windows\system32\DivX.dll
2009-04-15 07:51 585,216 a------- c:\windows\system32\rpcrt4.dll
2009-04-01 12:59 188,348 a------- c:\windows\system32\atiicdxx.dat
2009-03-16 18:42 524,288 a------- c:\windows\opuc.dll
2009-01-27 01:09 87,608 a------- c:\docume~1\geff\applic~1\inst.exe
2009-01-27 01:09 47,360 a------- c:\docume~1\geff\applic~1\pcouffin.sys
2001-08-22 14:15 245,760 a------- c:\windows\inf\i386\viceo.dll
2001-08-22 14:13 32,768 a------- c:\windows\inf\i386\Pmicro.dll
2001-08-22 14:13 61,440 a------- c:\windows\inf\i386\gl.dll
2001-08-03 19:29 13,824 a------- c:\windows\inf\i386\Usbscan.sys
2001-07-10 10:59 15,716 a------- c:\windows\inf\i386\Pmxscan.sys

============= FINISH: 0:40:10.51 ===============


2nd log to follow.

 

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-05-14.01)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume2
Install Date: 1/26/2009 9:01:47 PM
System Uptime: 6/10/2009 10:05:38 PM (2 hours ago)

Motherboard: Dell Inc. | | 0J584C
Processor: Intel(R) Core(TM)2 Quad CPU Q6600 @ 2.40GHz | Socket 775 | 2394/266mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 233 GiB total, 188.18 GiB free.
D: is CDROM ()

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP91: 3/12/2009 5:49:02 PM - System Checkpoint
RP92: 3/13/2009 8:32:00 PM - System Checkpoint
RP93: 3/14/2009 3:11:37 PM - Software Distribution Service 3.0
RP94: 3/15/2009 10:48:26 PM - System Checkpoint
RP95: 3/16/2009 9:43:13 AM - Software Distribution Service 3.0
RP96: 3/17/2009 12:31:58 PM - System Checkpoint
RP97: 3/18/2009 2:31:23 PM - System Checkpoint
RP98: 3/19/2009 2:11:56 PM - Software Distribution Service 3.0
RP99: 3/20/2009 3:28:26 PM - System Checkpoint
RP100: 3/20/2009 10:42:57 PM - Installed Adobe Reader 9.1.
RP101: 3/20/2009 11:01:07 PM - Installed Adobe Reader 9.1.
RP102: 3/20/2009 11:02:34 PM - Installed Adobe Reader 9.1.
RP103: 3/21/2009 4:52:27 AM - Restore Operation
RP104: 3/22/2009 11:03:40 AM - System Checkpoint
RP105: 3/23/2009 2:54:59 PM - Software Distribution Service 3.0
RP106: 3/24/2009 10:20:57 PM - System Checkpoint
RP107: 3/25/2009 4:36:34 AM - Removed Adobe Reader 9.
RP108: 3/25/2009 4:37:21 AM - Installed Adobe Reader 9.1.
RP109: 3/25/2009 4:40:00 AM - Installed Adobe Reader 9.1.
RP110: 3/25/2009 4:42:43 AM - Removed Acrobat.com
RP111: 3/25/2009 5:01:19 AM - Installed Adobe Reader 9.1.
RP112: 3/26/2009 2:41:34 AM - Software Distribution Service 3.0
RP113: 3/26/2009 2:43:46 AM - Software Distribution Service 3.0
RP114: 3/26/2009 2:45:42 PM - Software Distribution Service 3.0
RP115: 3/27/2009 4:18:14 AM - Installed Windows XP WgaNotify.
RP116: 3/27/2009 9:10:28 PM - Installed Java(TM) 6 Update 13
RP117: 3/28/2009 10:51:03 PM - System Checkpoint
RP118: 3/29/2009 1:36:45 AM - RegRun Virus Scan
RP119: 3/30/2009 2:02:38 AM - System Checkpoint
RP120: 3/30/2009 10:14:03 PM - Software Distribution Service 3.0
RP121: 4/1/2009 10:44:46 AM - System Checkpoint
RP122: 4/2/2009 11:44:13 PM - Software Distribution Service 3.0
RP123: 4/4/2009 6:42:00 AM - System Checkpoint
RP124: 4/5/2009 2:53:43 PM - System Checkpoint
RP125: 4/6/2009 11:49:06 AM - Software Distribution Service 3.0
RP126: 4/7/2009 11:57:23 AM - System Checkpoint
RP127: 4/8/2009 1:18:48 PM - System Checkpoint
RP128: 4/9/2009 3:49:39 PM - System Checkpoint
RP129: 4/10/2009 4:13:04 PM - System Checkpoint
RP130: 4/11/2009 11:01:13 PM - System Checkpoint
RP131: 4/12/2009 11:41:59 PM - System Checkpoint
RP132: 4/13/2009 2:35:33 PM - Software Distribution Service 3.0
RP133: 4/14/2009 12:59:31 PM - Software Distribution Service 3.0
RP134: 4/15/2009 5:06:52 PM - System Checkpoint
RP135: 4/16/2009 6:14:28 PM - System Checkpoint
RP136: 4/17/2009 6:16:29 PM - System Checkpoint
RP137: 4/19/2009 2:15:06 AM - System Checkpoint
RP138: 4/20/2009 2:34:38 AM - System Checkpoint
RP139: 4/21/2009 2:35:50 PM - System Checkpoint
RP140: 4/22/2009 1:42:22 AM - Software Distribution Service 3.0
RP141: 4/22/2009 1:51:01 AM - RegRun Virus Scan
RP142: 4/23/2009 2:35:12 AM - System Checkpoint
RP143: 4/23/2009 8:37:09 PM - Software Distribution Service 3.0
RP144: 4/24/2009 8:58:49 PM - System Checkpoint
RP145: 4/25/2009 9:33:08 PM - System Checkpoint
RP146: 4/26/2009 10:34:12 PM - System Checkpoint
RP147: 4/27/2009 7:24:16 PM - Software Distribution Service 3.0
RP148: 4/28/2009 7:26:08 PM - System Checkpoint
RP149: 4/29/2009 8:31:18 PM - System Checkpoint
RP150: 5/1/2009 3:49:27 AM - System Checkpoint
RP151: 5/1/2009 1:13:13 PM - Software Distribution Service 3.0
RP152: 5/2/2009 10:35:32 PM - System Checkpoint
RP153: 5/4/2009 1:24:24 PM - System Checkpoint
RP154: 5/4/2009 4:23:36 PM - Software Distribution Service 3.0
RP155: 5/5/2009 5:21:26 PM - System Checkpoint
RP156: 5/6/2009 6:35:51 PM - System Checkpoint
RP157: 5/7/2009 9:08:54 AM - Software Distribution Service 3.0
RP158: 5/8/2009 9:20:32 AM - System Checkpoint
RP159: 5/9/2009 2:14:14 PM - System Checkpoint
RP160: 5/10/2009 2:25:36 PM - System Checkpoint
RP161: 5/11/2009 12:59:24 PM - Software Distribution Service 3.0
RP162: 5/12/2009 2:01:27 PM - System Checkpoint
RP163: 5/12/2009 4:21:58 PM - Software Distribution Service 3.0
RP164: 5/13/2009 7:37:39 PM - System Checkpoint
RP165: 5/15/2009 1:33:10 AM - Software Distribution Service 3.0
RP166: 5/16/2009 2:01:33 AM - System Checkpoint
RP167: 5/17/2009 11:05:15 AM - System Checkpoint
RP168: 5/18/2009 5:28:21 PM - Software Distribution Service 3.0
RP169: 5/19/2009 8:45:22 PM - System Checkpoint
RP170: 5/20/2009 9:54:06 PM - System Checkpoint
RP171: 5/21/2009 7:31:31 PM - Software Distribution Service 3.0
RP172: 5/23/2009 2:00:13 PM - System Checkpoint
RP173: 5/24/2009 3:25:51 PM - System Checkpoint
RP174: 5/25/2009 7:26:41 AM - Software Distribution Service 3.0
RP175: 5/26/2009 9:23:47 AM - System Checkpoint
RP176: 5/27/2009 10:18:57 AM - System Checkpoint
RP177: 5/28/2009 11:01:49 AM - Software Distribution Service 3.0
RP178: 5/30/2009 3:36:51 AM - Restore Operation
RP179: 5/30/2009 3:43:20 AM - Software Distribution Service 3.0
RP180: 5/30/2009 3:46:42 AM - Restore Operation
RP181: 5/30/2009 3:53:18 AM - Software Distribution Service 3.0
RP182: 5/30/2009 3:59:14 AM - Restore Operation
RP183: 5/30/2009 4:10:05 AM - Removed ATI Catalyst Control Center
RP184: 5/30/2009 4:22:20 AM - Installed ATI Catalyst Control Center
RP185: 5/30/2009 4:42:56 AM - Removed Browser Address Error Redirector.
RP186: 5/31/2009 5:34:20 AM - System Checkpoint
RP187: 6/1/2009 6:03:45 AM - System Checkpoint
RP188: 6/1/2009 7:41:42 AM - Software Distribution Service 3.0
RP189: 6/2/2009 6:34:34 PM - System Checkpoint
RP190: 6/3/2009 9:01:48 PM - System Checkpoint
RP191: 6/4/2009 3:16:37 PM - Software Distribution Service 3.0
RP192: 6/5/2009 3:31:18 PM - System Checkpoint
RP193: 6/6/2009 5:07:14 PM - System Checkpoint
RP194: 6/8/2009 1:15:36 AM - System Checkpoint
RP195: 6/8/2009 10:23:12 AM - Software Distribution Service 3.0
RP196: 6/8/2009 2:35:44 PM - Installed Enable advisory 971778
RP197: 6/9/2009 4:15:01 PM - Software Distribution Service 3.0

==== Installed Programs ======================

AAC Decoder
Acrobat.com
Ad-Aware
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 9.1.1
AnyDVD
ArcSoft PhotoImpression 6
ArcSoft Print Creations
ATI - Software Uninstall Utility
ATI Catalyst Control Center
ATI Display Driver
AutoUpdate
avast! Antivirus
AviSynth 2.5
Catalyst Control Center - Branding
Catalyst Control Center Core Implementation
Catalyst Control Center Graphics Full Existing
Catalyst Control Center Graphics Full New
Catalyst Control Center Graphics Light
Catalyst Control Center Graphics Previews Common
Catalyst Control Center HydraVision Full
ccc-core-preinstall
ccc-core-static
ccc-utility
CCC Help English
CDDRV_Installer
CDEdit version 1.14
ClearType Tuning Control Panel Applet
CoffeeCup Free HTML Editor
Concert Vault Download Manager
ConvertXtoDVD 3 english manual
ConvertXtoDVD 3.6.4.158
Critical Update for Windows Media Player 11 (KB959772)
CyberView Image 4.5.4
Dell Driver Reset Tool
Dell Support Center (Support Software)
Diagnostics Utility
Digital Camera Enhancer 1.3
Directory Snoop 5.04 (Licensed Version)
DivX Codec
DivX Converter
DivX Player
DivX Plus DirectShow Filters
DivX Version Checker
DivX Web Player
DVD and CD Cover Print
DVD Identifier
DVD Shrink 3.2
DVD slideshow GUI 0.9.1.0
DVDFab (Platinum/Gold/HD Decrypter) (Option: Mobile/Blu-ray/Mov
DVDFab 6.0.0.5 Beta (May 12, 2009)
DVDFab Gold 2.9.6.9
DVDFab Platinum 4.1.2.0
EPSON C120 User's Guide
EPSON Printer Software
Exact Audio Copy 0.99pb4
FileAlyzer
FirstCap 3.0
Fling File Transfer
Forté Agent
GrabIt 1.7.2 Beta 4 (build 997)
H.264 Decoder
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB915800-v4)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB953955)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
IrfanView (remove only)
Java(TM) 6 Update 13
JGsoft EditPad Pro 4.5.5
Just Great Software EditPad Lite 6.4.5
KhalInstallWrapper
Kremlin 2.21
Logitech Registration
Logitech SetPoint
Logitech Updater
MasterSplitter Program
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
Microsoft National Language Support Downlevel APIs
Microsoft Office 2000 SR-1 Disc 2
Microsoft Office 2000 SR-1 Premium
Microsoft Tool Web Package:WntIpcfg.exe
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
MKV Splitter
MSXML 6.0 Parser (KB927977)
Multi Virus Cleaner 2008
NCH Toolbox
Nero 6 Ultra Edition
Nero Digital
Nero Media Player
NeroMIX
NeroVision Express Content
NetLab for Win95/NT
Netscape Communicator 4.79
Opera 9.64
PhraseExpress
PowerDVD
PrimaScan 2400U
QuickPar 0.9
Realtek High Definition Audio Driver
RegRun Security Suite Gold
SearchAssist
Secunia PSI
Security Update for Windows Internet Explorer 7 (KB938127-v2)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 7 (KB969897)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Search 4 - KB963093
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953838)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB970238)
Sonic CinePlayer Decoder Pack
Spelling Dictionaries Support For Adobe Reader 9
Spybot - Search & Destroy
Switch Sound File Converter
Trader's Little Helper 2.4.1
Tweak UI
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows XP (KB898461)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951618-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
VC80CRTRedist - 8.0.50727.762
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
VLC media player 0.9.9
WebFldrs XP
WinAVI Video Converter
Windows Defender
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 7
Windows Media Format 11 runtime
Windows Media Player 11
Windows Presentation Foundation
Windows Search 4.0
WinRAR archiver
XML Paper Specification Shared Components Pack 1.0
Xvid 1.1.3 final uninstall

==== Event Viewer Messages From Past Week ========

6/8/2009 10:08:01 AM, error: MRxSmb [8003] - The master browser has received a server announcement from the computer GEFF that believes that it is the master browser for the domain on transport NetBT_Tcpip_{08674920-CBC9-42C6-B19B. The master browser is stopping or an election is being forced.
6/8/2009 10:02:46 AM, error: Service Control Manager [7001] - The Remote Access Connection Manager service depends on the Telephony service which failed to start because of the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.

==== End Of File ===========================

 

Broni, thank you again very much for your help. The 4 logs are below. A couple comments that may help.......

1. The trojan that Malwarebytes said it found was another ads attached to a folder I created called C:\a. I use that folder for dvd rips.

2. Both ads (C:\a & C:\Windows) are still on the machine per foldalyser. The program that first found the ads on Windows (ADS Spy) can NOT see the ads on C:\a.

3. Don't know if this means anything, but soon after installing Malwarebytes Reg Run came up & said that something had modified the run key to enable Dell Online support (DSCA.exe) which i previously disabled, & at the same time that something had tried to disable ATI2MDXX.exe, which relates to the recently installed Catalyst driver. I chose to roll back those changes.

4. On reboot after running malwarebytes, Reg Run flagged "file missing" on jyeq.sys that GMER also states is missing. I assume it's something to do with Malwarebytes?

5. Haven't mentioned this before, the pc in question is my newest. It's on a home network with an older XP home SP3 machine & a Win 98 SE machine. The 98 machine has shown no issues, the other XP machine shares the Pay Pal crashing issue I mentioned earlier, but no other noticeable issues.

EDIT: 6. I just took a quick look at the 2nd XP box with Spybot's Foldalyzer. It appears that EVERY folder on that machine has 2 ADS attached. I HOPE there's a good explanation.......

Logs are in next 4 posts.

 

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 06/11/2009 at 10:13 PM

Application Version : 4.26.1004

Core Rules Database Version : 3936
Trace Rules Database Version: 1879

Scan type : Complete Scan
Total Scan Time : 01:22:21

Memory items scanned : 231
Memory threats detected : 0
Registry items scanned : 5209
Registry threats detected : 0
File items scanned : 87858
File threats detected : 0

 

Malwarebytes' Anti-Malware 1.37
Database version: 2265
Windows 5.1.2600 Service Pack 3

6/11/2009 10:58:37 PM
mbam-log-2009-06-11 (22-58-37).txt

Scan type: Full Scan (C:\|)
Objects scanned: 194237
Time elapsed: 20 minute(s), 7 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\a (Trojan.Agent) -> Delete on reboot.

 

GMER 1.0.15.14972 - http://www.gmer.net
Rootkit scan 2009-06-12 00:43:50
Windows 5.1.2600 Service Pack 3


---- System - GMER 1.0.15 ----

SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwClose [0xAC2196B8]
SSDT \??\C:\WINDOWS\system32\Drivers\regguard.sys (Registry Guard - registry keys protection driver for Windows NT/2000/XP/2003/Vista/Greatis Software) ZwCreateKey [0xBA3E9800]
SSDT \??\C:\WINDOWS\system32\Drivers\regguard.sys (Registry Guard - registry keys protection driver for Windows NT/2000/XP/2003/Vista/Greatis Software) ZwDeleteKey [0xBA3E9A00]
SSDT \??\C:\WINDOWS\system32\Drivers\regguard.sys (Registry Guard - registry keys protection driver for Windows NT/2000/XP/2003/Vista/Greatis Software) ZwDeleteValueKey [0xBA3E9BE0]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDuplicateObject [0xAC21914C]
SSDT \??\C:\WINDOWS\system32\Drivers\regguard.sys (Registry Guard - registry keys protection driver for Windows NT/2000/XP/2003/Vista/Greatis Software) ZwOpenKey [0xBA3E9900]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenProcess [0xAC21908C]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenThread [0xAC2190F0]
SSDT \??\C:\WINDOWS\system32\Drivers\regguard.sys (Registry Guard - registry keys protection driver for Windows NT/2000/XP/2003/Vista/Greatis Software) ZwQueryValueKey [0xBA3E9CC0]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwRestoreKey [0xAC21972E]
SSDT \??\C:\WINDOWS\system32\Drivers\regguard.sys (Registry Guard - registry keys protection driver for Windows NT/2000/XP/2003/Vista/Greatis Software) ZwSetValueKey [0xBA3E9AF0]

---- Kernel code sections - GMER 1.0.15 ----

? jyeq.sys The system cannot find the file specified. !

---- User code sections - GMER 1.0.15 ----

.text C:\WINDOWS\system32\SearchIndexer.exe[1236] kernel32.dll!WriteFile 7C810E27 7 Bytes JMP 00585C0C C:\WINDOWS\system32\MSSRCH.DLL (mssrch.dll/Microsoft Corporation)

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\WINDOWS\system32\services.exe[804] @ C:\WINDOWS\system32\services.exe [ADVAPI32.dll!CreateProcessAsUserW] 00380002
IAT C:\WINDOWS\system32\services.exe[804] @ C:\WINDOWS\system32\services.exe [KERNEL32.dll!CreateProcessW] 00380000

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Ip aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

Device \Driver\atapi \Device\Ide\IdePort0 AnyDVD.sys (AnyDVD Filter Driver/SlySoft, Inc.)
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 AnyDVD.sys (AnyDVD Filter Driver/SlySoft, Inc.)
Device \Driver\atapi \Device\Ide\IdePort1 AnyDVD.sys (AnyDVD Filter Driver/SlySoft, Inc.)
Device \Driver\atapi \Device\Ide\IdePort2 AnyDVD.sys (AnyDVD Filter Driver/SlySoft, Inc.)
Device \Driver\atapi \Device\Ide\IdePort3 AnyDVD.sys (AnyDVD Filter Driver/SlySoft, Inc.)
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-e AnyDVD.sys (AnyDVD Filter Driver/SlySoft, Inc.)

AttachedDevice \Driver\Tcpip \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\RawIp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

Device \FileSystem\Fastfat \Fat A8BDED20

AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software)

---- Threads - GMER 1.0.15 ----

Thread System [4:112] B9E86096

---- EOF - GMER 1.0.15 ----

 

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:50:17 AM, on 6/12/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16850)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\NCH Software\Fling\fling.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Realtek\Diagnostics Utility\8169Diag.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe
C:\PROGRA~1\Greatis\REGRUN~1\WatchDog.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\PhraseExpress\phrase.exe
C:\Program Files\Secunia\PSI\psi.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\aa\HiJackThis.exe
C:\WINDOWS\system32\wscntfy.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [8169Diag] C:\Program Files\Realtek\Diagnostics Utility\8169Diag.exe /hw
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe "
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RegRun WinBait] C:\WINDOWS\winbait.exe
O4 - HKLM\..\Run: [@RegRunOnSecure] C:\PROGRA~1\Greatis\REGRUN~1\OnSecure.exe
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Avast] "C:\Program Files\Alwil Software\Avast4\ashDisp.exe "
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe "
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKLM\..\RunOnce: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe
O4 - HKCU\..\Run: [Regrun2] C:\PROGRA~1\Greatis\REGRUN~1\WatchDog.exe
O4 - HKCU\..\Run: [EPSON Stylus C120 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICCA.EXE /FU "C:\WINDOWS\TEMP\E_S90.tmp" /EF "HKCU "
O4 - Startup: Secunia PSI.lnk = C:\Program Files\Secunia\PSI\psi.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: PhraseExpress.lnk = C:\Program Files\PhraseExpress\phrase.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1233033940796
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Fling File Transfer (FlingService) - NCH Software - C:\Program Files\NCH Software\Fling\fling.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe

--
End of file - 6457 bytes

 

Here's new logs. I had some difficulty turning off Reg Run. I disabled watch dog, but it still asked my permission before allowing Combofix to run 2 scripts. I don't know how to turn that part off. One other comment: All folders on this machine also now have 1 ads that vary in size from 244k, 256k , 284k & have the attribute "security ", I'm wondering if this has to do with patch Tuesday? The original 24 k ads on the Windows folder appears to be gone. Foldalyzer is seeing the "security" ADS's, Ad Spy is not.

One other comment: Combofix stated it installed a recovery console that I would start seeing on every boot. On reboot, it did NOT come up.

Logs to follow.

 

ComboFix 09-06-12.02 - Geff 06/12/2009 22:05.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3070.2571 [GMT -7:00]
Running from: c:\documents and settings\Geff\Desktop\ComboFix.exe
AV: avast! antivirus 4.8.1335 [VPS 090612-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
ADS - WINDOWS: deleted 24 bytes in 1 streams.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Geff\Application Data\inst.exe
c:\windows\IE4 Error Log.txt

.
((((((((((((((((((((((((( Files Created from 2009-05-13 to 2009-06-13 )))))))))))))))))))))))))))))))
.

2009-06-12 05:20 . 2009-06-12 05:20 -------- d-----w- c:\documents and settings\Geff\Application Data\Malwarebytes
2009-06-12 05:20 . 2009-05-26 20:20 40160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-12 05:20 . 2009-06-12 05:20 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-06-12 05:20 . 2009-06-12 05:20 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-06-12 05:20 . 2009-05-26 20:19 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-06-12 03:33 . 2009-06-12 03:50 117760 ----a-w- c:\documents and settings\Geff\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-06-12 03:33 . 2009-06-12 03:33 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-06-12 03:33 . 2009-06-12 03:33 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-06-12 03:33 . 2009-06-12 03:33 -------- d-----w- c:\documents and settings\Geff\Application Data\SUPERAntiSpyware.com
2009-06-12 03:32 . 2009-06-12 03:32 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-06-12 03:28 . 2009-06-12 07:51 -------- d-----w- C:\aa
2009-06-10 11:34 . 2009-06-12 06:06 -------- d-----w- C:\a
2009-06-10 03:46 . 2009-06-10 03:22 15688 ----a-w- c:\windows\system32\lsdelete.exe
2009-06-10 03:18 . 2009-06-10 03:18 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
2009-06-10 03:18 . 2009-03-12 08:17 2902048 -c--a-w- c:\documents and settings\All Users\Application Data\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}\Ad-AwareAE.exe
2009-06-10 03:18 . 2009-06-10 03:22 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
2009-06-10 03:18 . 2009-06-10 03:18 -------- d-----w- c:\program files\Lavasoft
2009-06-07 07:52 . 2009-06-07 07:52 -------- d-----w- c:\program files\Safer Networking
2009-06-04 08:18 . 2009-06-04 08:19 -------- d-----w- c:\program files\FirstCap
2009-06-04 01:47 . 2009-06-04 01:47 -------- d-----w- c:\program files\Agent
2009-06-01 01:10 . 2009-06-01 01:10 -------- d-----w- C:\DVDFab_Temp
2009-05-30 11:28 . 2009-05-30 11:28 -------- d-----w- c:\documents and settings\All Users\Application Data\ATI
2009-05-30 11:22 . 2009-04-29 04:05 593920 ------w- c:\windows\system32\ati2sgag.exe
2009-05-30 11:21 . 2009-05-30 11:22 -------- d-----w- c:\program files\ATI Technologies
2009-05-30 11:21 . 2009-05-30 11:21 -------- d-----w- C:\ATI
2009-05-30 11:03 . 2009-05-30 11:03 -------- d-----w- c:\windows\system32\wbem\Repository
2009-05-30 11:03 . 2009-05-30 11:03 -------- d-----w- c:\windows\Sun
2009-05-30 11:02 . 2009-05-30 11:02 -------- d-----w- c:\documents and settings\Administrator\Application Data\RegRun
2009-05-26 21:56 . 2009-05-26 21:56 104384 ----a-w- c:\windows\system32\drivers\AnyDVD.sys
2009-05-25 12:01 . 2009-05-25 12:01 89256 ----a-w- c:\windows\system32\ElbyCDIO.dll
2009-05-21 07:19 . 2009-05-30 11:03 -------- d-----w- c:\program files\Trader's Little Helper
2009-05-19 00:38 . 2009-05-19 00:38 -------- d-----w- c:\documents and settings\Geff\Application Data\NCH Swift Sound

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-13 04:51 . 2009-01-27 09:22 35747 ----a-w- c:\windows\nsreg.dat
2009-06-13 04:37 . 2009-01-27 08:32 29584 ----a-w- c:\windows\system32\drivers\regguard.sys
2009-06-11 11:00 . 2009-01-27 09:51 -------- d-----w- c:\documents and settings\Geff\Application Data\GrabIt
2009-06-09 23:25 . 2009-02-10 16:01 -------- d-----w- c:\program files\Windows Desktop Search
2009-06-09 23:18 . 2009-03-21 06:26 -------- d-----w- c:\documents and settings\Geff\Application Data\OfficeUpdate12
2009-06-02 07:32 . 2009-01-27 08:09 -------- d-----w- c:\documents and settings\Geff\Application Data\Vso
2009-06-01 07:47 . 2009-03-15 18:37 -------- d-----w- c:\documents and settings\Geff\Application Data\dvdcss
2009-06-01 05:10 . 2009-01-27 07:49 -------- d-----w- c:\program files\DVDCoverPrint
2009-05-31 07:49 . 2009-01-27 18:33 -------- d-----w- c:\documents and settings\All Users\Application Data\DVD Shrink
2009-05-30 11:28 . 2009-01-27 05:01 -------- d-----w- c:\documents and settings\Geff\Application Data\ATI
2009-05-30 11:22 . 2008-12-05 23:56 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-05-30 11:10 . 2008-12-06 00:04 -------- d-----w- c:\documents and settings\Administrator\Application Data\ATI
2009-05-30 11:02 . 2009-02-11 14:37 -------- d-----w- c:\documents and settings\All Users\Application Data\NCH Swift Sound
2009-05-30 11:02 . 2009-01-27 09:48 -------- d-----w- c:\program files\GrabIt
2009-05-30 11:02 . 2009-05-01 12:02 -------- d-----w- c:\program files\DVDFab 6
2009-05-30 11:02 . 2009-05-13 04:48 -------- d-----w- c:\program files\CV Download Manager
2009-05-30 11:02 . 2009-05-12 23:49 -------- d-----w- c:\documents and settings\Administrator\Application Data\OfficeUpdate12
2009-05-30 11:02 . 2009-01-27 18:53 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-05-30 11:02 . 2009-01-27 18:53 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-05-25 07:24 . 2008-05-27 06:18 350208 ------w- c:\windows\system32\mssph.dll
2009-05-19 00:38 . 2009-02-09 07:11 -------- d-----w- c:\program files\NCH Software
2009-05-19 00:38 . 2009-02-11 14:37 -------- d-----w- c:\program files\NCH Swift Sound
2009-05-15 10:42 . 2009-05-13 04:48 367 ----a-w- c:\documents and settings\Geff\cvdm.dat
2009-05-13 08:32 . 2009-01-27 07:46 -------- d-----w- c:\documents and settings\All Users\Application Data\Ahead
2009-05-12 22:12 . 2008-04-25 21:38 26144 ----a-w- c:\windows\system32\spupdsvc.exe
2009-05-07 15:32 . 2008-04-25 16:16 345600 ----a-w- c:\windows\system32\localspl.dll
2009-05-03 10:47 . 2009-05-03 10:47 -------- d-----w- c:\documents and settings\Geff\Application Data\DVDFab
2009-04-29 04:56 . 2008-04-25 16:16 827392 ----a-w- c:\windows\system32\wininet.dll
2009-04-29 04:55 . 2008-04-25 16:16 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-04-29 03:30 . 2008-12-06 01:43 3643904 ----a-w- c:\windows\system32\drivers\ati2mtag.sys
2009-04-29 02:18 . 2008-12-06 01:43 442368 ----a-w- c:\windows\system32\ATIDEMGX.dll
2009-04-29 02:17 . 2008-12-06 01:43 335872 ----a-w- c:\windows\system32\ati2dvag.dll
2009-04-29 02:07 . 2008-12-06 01:43 204800 ----a-w- c:\windows\system32\atipdlxx.dll
2009-04-29 02:06 . 2008-12-06 01:43 155648 ----a-w- c:\windows\system32\Oemdspif.dll
2009-04-29 02:06 . 2008-12-06 01:43 26112 ----a-w- c:\windows\system32\Ati2mdxx.exe
2009-04-29 02:06 . 2008-12-06 01:43 43520 ----a-w- c:\windows\system32\ati2edxx.dll
2009-04-29 02:06 . 2008-12-06 01:43 155648 ----a-w- c:\windows\system32\ati2evxx.dll
2009-04-29 02:04 . 2008-12-06 01:43 602112 ----a-w- c:\windows\system32\ati2evxx.exe
2009-04-29 02:03 . 2008-12-06 01:43 53248 ----a-w- c:\windows\system32\ATIDDC.DLL
2009-04-29 02:00 . 2008-12-06 01:43 311296 ----a-w- c:\windows\system32\atiiiexx.dll
2009-04-29 01:56 . 2008-12-06 01:43 2997536 ----a-w- c:\windows\system32\ati3duag.dll
2009-04-29 01:45 . 2009-04-29 01:45 11603968 ----a-w- c:\windows\system32\atioglxx.dll
2009-04-29 01:42 . 2008-12-06 01:43 2687872 ----a-w- c:\windows\system32\ativvaxx.dll
2009-04-29 01:26 . 2009-04-29 01:26 49664 ----a-w- c:\windows\system32\atimpc32.dll
2009-04-29 01:26 . 2008-12-06 01:43 49664 ----a-w- c:\windows\system32\amdpcom32.dll
2009-04-29 01:22 . 2008-12-06 01:43 479232 ----a-w- c:\windows\system32\atikvmag.dll
2009-04-29 01:20 . 2009-04-29 01:20 45056 ----a-w- c:\windows\system32\aticalrt.dll
2009-04-29 01:20 . 2009-04-29 01:20 45056 ----a-w- c:\windows\system32\aticalcl.dll
2009-04-29 01:20 . 2008-12-06 01:43 135168 ----a-w- c:\windows\system32\atiadlxx.dll
2009-04-29 01:19 . 2008-12-06 01:43 17408 ----a-w- c:\windows\system32\atitvo32.dll
2009-04-29 01:19 . 2008-12-06 01:43 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll
2009-04-29 01:18 . 2009-04-29 01:18 3280896 ----a-w- c:\windows\system32\aticaldd.dll
2009-04-29 01:17 . 2008-12-06 01:43 303104 ----a-w- c:\windows\system32\atiok3x2.dll
2009-04-29 01:13 . 2008-12-06 01:43 630784 ----a-w- c:\windows\system32\ati2cqag.dll
2009-04-22 09:10 . 2008-12-06 00:03 -------- d-----w- c:\documents and settings\All Users\Application Data\Dell
2009-04-18 05:51 . 2009-01-27 19:56 -------- d-----w- c:\program files\DivX
2009-04-18 05:51 . 2009-04-18 05:51 -------- d-----w- c:\program files\Common Files\DivX Shared
2009-04-18 02:47 . 2009-02-01 11:18 -------- d-----w- c:\program files\CDEdit 1.14
2009-04-17 12:26 . 2008-04-25 16:16 1847168 ----a-w- c:\windows\system32\win32k.sys
2009-04-15 20:24 . 2009-04-15 20:24 90112 ----a-w- c:\windows\system32\dpl100.dll
2009-04-15 20:24 . 2009-04-15 20:24 823296 ----a-w- c:\windows\system32\divx_xx0c.dll
2009-04-15 20:24 . 2009-04-15 20:24 823296 ----a-w- c:\windows\system32\divx_xx07.dll
2009-04-15 20:24 . 2009-04-15 20:24 815104 ----a-w- c:\windows\system32\divx_xx0a.dll
2009-04-15 20:24 . 2009-04-15 20:24 802816 ----a-w- c:\windows\system32\divx_xx11.dll
2009-04-15 20:24 . 2009-04-15 20:24 684032 ----a-w- c:\windows\system32\DivX.dll
2009-04-15 14:51 . 2008-04-25 16:16 585216 ----a-w- c:\windows\system32\rpcrt4.dll
2009-04-15 11:43 . 2009-04-15 11:43 -------- d-----w- c:\program files\MasterSplitter
2009-04-14 20:52 . 2009-02-06 13:44 -------- d-----w- c:\program files\Snapshot Viewer
2009-04-14 05:10 . 2009-05-12 23:49 264704 ------w- c:\documents and settings\Administrator\Application Data\OfficeUpdate12\oudetect.dll
2009-04-14 05:10 . 2009-04-14 20:50 264704 ------w- c:\documents and settings\Geff\Application Data\OfficeUpdate12\oudetect.dll
2009-04-01 19:59 . 2008-12-06 01:43 188348 ----a-w- c:\windows\system32\atiicdxx.dat
2009-03-28 04:10 . 2009-03-28 04:10 152576 ----a-w- c:\documents and settings\Geff\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-03-24 11:03 . 2008-12-10 14:17 7808 ----a-w- c:\windows\system32\drivers\psi_mf.sys
2009-03-17 01:42 . 2009-03-17 01:42 524288 ----a-w- c:\windows\opuc.dll
2009-04-15 20:24 . 2009-04-15 20:24 1044480 ----a-w- c:\program files\opera\program\plugins\libdivx.dll
2009-04-15 20:24 . 2009-04-15 20:24 200704 ----a-w- c:\program files\opera\program\plugins\ssldivx.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe "= "c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"AnyDVD "= "c:\program files\SlySoft\AnyDVD\AnyDVDtray.exe" [2009-05-29 2931648]
"Regrun2 "= "c:\progra~1\Greatis\REGRUN~1\WatchDog.exe" [2008-12-23 383712]
"EPSON Stylus C120 Series "= "c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATICCA.EXE" [2007-03-12 182272]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"KernelFaultCheck "= "c:\windows\system32\dumprep 0 -k" [X]
"8169Diag "= "c:\program files\Realtek\Diagnostics Utility\8169Diag.exe" [2008-02-26 909312]
"NeroFilterCheck "= "c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"RegRun WinBait "= "c:\windows\winbait.exe" [2008-12-23 20192]
"@RegRunOnSecure "= "c:\progra~1\Greatis\REGRUN~1\OnSecure.exe" [2008-12-23 61664]
"Avast "= "c:\program files\Alwil Software\Avast4\ashDisp.exe" [2008-11-26 81000]
"StartCCC "= "c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-04-29 61440]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-28 35696]
"RTHDCPL "= "RTHDCPL.EXE" - c:\windows\RTHDCPL.EXE [2008-01-31 16860672]
"Alcmtr "= "ALCMTR.EXE" - c:\windows\ALCMTR.EXE [2008-01-31 69632]
"Kernel and Hardware Abstraction Layer "= "KHALMNPR.EXE" - c:\windows\KHALMNPR.Exe [2008-02-29 76304]
"ATIModeChange "= "Ati2mdxx.exe" - c:\windows\system32\Ati2mdxx.exe [2009-04-29 26112]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Malwarebytes' Anti-Malware "= "c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2009-05-26 414480]
"Malwarebytes Anti-Malware (reboot) "= "c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-05-26 1283344]

c:\documents and settings\Geff\Start Menu\Programs\Startup\
Secunia PSI.lnk - c:\program files\Secunia\PSI\psi.exe [2009-3-24 748840]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2009-2-10 805392]
PhraseExpress.lnk - c:\program files\PhraseExpress\phrase.exe [2009-1-27 568832]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMMyDocs "= 01000000
"NoSMMyPictures "= 01000000

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{F552DDE6-2090-4bf4-B924-6141E87789A5} "= "c:\progra~1\Greatis\REGRUN~1\RRShell.dll" [2008-10-20 335943]
"{56F9679E-7826-4C84-81F3-532071A8BCC5} "= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} "= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs "=1 (0x1)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0Partizan\0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@= "Service "

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=" "

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@= "Service "

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WZCSVC "=2 (0x2)
"Fax "=2 (0x2)
"TapiSrv "=3 (0x3)
"RemoteRegistry "=2 (0x2)
"RDSessMgr "=3 (0x3)
"mnmsrvc "=3 (0x3)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ISUSPM "= "c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
"Registry "= "c:\program files\Greatis\RegRunSuite\lsoon.exe" -1 30 "c:\program files\Greatis\RegRunSuite\rescue.exe" /a "c:\backreg\rstore.ini "

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe "
"dscactivate "= "c:\program files\Dell Support Center\gs_agent\custom\dsca.exe "
"SunJavaUpdateSched "= "c:\program files\Java\jre6\bin\jusched.exe "
"PDVDDXSrv "= "c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe "

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall "= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe "=
"c:\\WINDOWS\\system32\\sessmgr.exe "=
"c:\\Program Files\\Ahead\\Nero ShowTime\\ShowTime.exe "=
"c:\\Program Files\\WS_FTP\\WS_FTP95.exe "=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [6/9/2009 8:22 PM 64160]
R0 Partizan;Partizan;c:\windows\system32\drivers\Partizan.sys [1/27/2009 1:31 AM 34760]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2/5/2009 12:05 AM 114768]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [5/26/2009 10:05 AM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/26/2009 10:05 AM 72944]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2/5/2009 12:05 AM 20560]
R2 FlingService;Fling File Transfer;c:\program files\NCH Software\Fling\fling.exe [2/9/2009 12:11 AM 536580]
R2 ppsio2;PPDevice;c:\windows\system32\drivers\ppsio2.sys [2/9/2009 2:27 AM 23200]
R3 AtiHdmiService;ATI Function Driver for HDMI Service;c:\windows\system32\drivers\AtiHdmi.sys [12/5/2008 6:43 PM 84992]
R3 RegGuard;RegGuard;c:\windows\system32\drivers\regguard.sys [1/27/2009 1:32 AM 29584]
S2 LANPkt;Realtek LANPkt Protocol Driver;c:\windows\system32\drivers\LANPkt.sys [12/5/2008 4:56 PM 8960]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [3/9/2009 12:06 PM 1005904]
S3 Diag69xp;Diag69xp;c:\windows\system32\drivers\diag69xp.sys [12/5/2008 4:56 PM 11264]
S3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [12/10/2008 7:17 AM 7808]
S3 RTLVLAN;Realtek VLAN Intermediate Driver;c:\windows\system32\drivers\RTLVLAN.SYS [12/5/2008 4:56 PM 16640]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [5/26/2009 10:05 AM 7408]
S3 spupdsvc;Windows Service Pack Installer update service;c:\windows\system32\spupdsvc.exe [4/25/2008 2:38 PM 26144]
S3 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 8:19 PM 13592]
.
Contents of the 'Scheduled Tasks' folder

2009-06-10 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-09 03:22]

2009-06-12 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-04 03:20]
.
- - - - ORPHANS REMOVED - - - -

ShellIconOverlayIdentifiers-{02696AD5-FF96-454b-9E00-81DA8B79B678} - c:\program files\NCH Software\Fling\fldll.dll
HKLM-Run-ATICCC - c:\program files\ATI Technologies\ATI.ACE\CLIStart.exe


.
------- Supplementary Scan -------
.
uStart Page = about:blank
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
Trusted Zone: microsoft.com\office
.
.
------- File Associations -------
.
txtfile= "c:\program files\JGsoft\EditPadLite\EditPadLite.exe" "%1 "
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-12 22:06
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(756)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(3948)
c:\program files\SlySoft\AnyDVD\ADvdDiscHlp.dll
c:\program files\Logitech\SetPoint\lgscroll.dll
.
Completion time: 2009-06-13 22:08
ComboFix-quarantined-files.txt 2009-06-13 05:08

Pre-Run: 205,636,059,136 bytes free
Post-Run: 205,638,680,576 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT= "Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS= "Microsoft Windows XP Professional" /noexecute=optin /fastdetect

265 --- E O F --- 2009-06-12 09:02

 

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:13:32 PM, on 6/12/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16850)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\NCH Software\Fling\fling.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\PhraseExpress\phrase.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\CF21604.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\regedit.exe
C:\aa\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [8169Diag] C:\Program Files\Realtek\Diagnostics Utility\8169Diag.exe /hw
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe "
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RegRun WinBait] C:\WINDOWS\winbait.exe
O4 - HKLM\..\Run: [@RegRunOnSecure] C:\PROGRA~1\Greatis\REGRUN~1\OnSecure.exe
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Avast] "C:\Program Files\Alwil Software\Avast4\ashDisp.exe "
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe "
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKLM\..\RunOnce: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe
O4 - HKCU\..\Run: [Regrun2] C:\PROGRA~1\Greatis\REGRUN~1\WatchDog.exe
O4 - HKCU\..\Run: [EPSON Stylus C120 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICCA.EXE /FU "C:\WINDOWS\TEMP\E_S90.tmp" /EF "HKCU "
O4 - Startup: Secunia PSI.lnk = C:\Program Files\Secunia\PSI\psi.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: PhraseExpress.lnk = C:\Program Files\PhraseExpress\phrase.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1233033940796
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Fling File Transfer (FlingService) - NCH Software - C:\Program Files\NCH Software\Fling\fling.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe

--
End of file - 6285 bytes

 

I see now that combo fix deleted the Windows ads. Thank you!

Questions:
1. Any idea just what I had? Any potential information theft consequences?
2. Any idea how i got it so I don't repeat the behavior?
3. Which of the programs you've had me run (if any) should i run on the other xp pc?

FYI, my security is
Hardware firewall in router
Windows firewall (xp)
Conseal Signal 9 Firewall (Win 98)
Avast Free
Reg Run Gold
PSI
Spybot immunization
I also have numerous spyware & av available for 1 time scans
No script add on on Forefox

 

Thank you again! From your link, that appears to just be a games password stealer? I'm not a gamer; am i likely to be in any danger from id theft or other password theft?

Will follow other suggestions; would you suggest also running any of these security programs on my other xp machine, or should i just look for inst.exe?

 

Will follow highjack this suggestion & post. I manually stopped Dell Support center from running with Greatis Reg Run (wonderful program, been using it for many years). I am wondering from the logs if i only partially disabled, though.

 

After removing combofix, a reference came 2x up on reboot to a missing "catchme.sys" file. A quick Google seems to show that some feel it's a trojan keylogger & some believe it's part of combofix?

Since i had a game password trojan, & it appeared at the same time that I downloaded the Catalyst driver./system from AMD's site i am suspecting that the official Catalyst release on AMD's server had the trojan come along with it. Teach me to shut off security during install (though i did scan the .exe before installing).

Anyone who dl'd Catalyst 9.5 on or near 5/29/09 may want to check your pc with a fine tooth comb. Avast did NOT catch the infection. full file name is "9-5_xp32_dd_ccc_wdm_enu.exe "