Active missing icons/desktop

garsar · 2009/08/07

[Active] missing icons/desktop

Here are the results of the scan. I was originally on the XP forum for this but after we thought it was solved, on reboot it always goes back to no icons, so it was suggested to come here.

DDS (Ver_09-07-30.01) - NTFSx86
Run by Sarah Legon at 13:58:09.42 on Fri 08/07/2009
Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_05
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.3070.2517 [GMT 2:00]

AV: BitDefender Antivirus *On-access scanning enabled* (Updated) {6C4BB89C-B0ED-4F41-A29C-4373888923BB}

============== Running Processes ===============

C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\MXOALDR.EXE
C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe
C:\Program Files\NovaStor\NovaStor NovaBACKUP\NsCtrl.exe
C:\Program Files\BitDefender\BitDefender 2009\seccenter.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\NovaStor\NovaStor NovaBACKUP\DR\CBP\DCSchdler.exe
C:\Program Files\Hotspot Shield\bin\openvpnas.exe
C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe
C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
C:\Program Files\NovaStor\NovaStor NovaBACKUP\NsService.exe
C:\Program Files\NovaStor\NovaStor NovaBACKUP\DR\Fsloader.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Sarah Legon\My Documents\dds.scr

============== Pseudo HJT Report ===============

uDefault_Page_URL = hxxp://www.euro.dell.com/countries/fr/fra/gen/default.htm
uStart Page = hxxp://www.google.com/
mDefault_Page_URL = hxxp://www.euro.dell.com/countries/fr/fra/gen/default.htm
mStart Page = hxxp://www.euro.dell.com/countries/fr/fra/gen/default.htm
uInternet Connection Wizard,ShellNext = hxxp://www.euro.dell.com/countries/fr/fra/gen/default.htm
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_05\bin\ssv.dll
BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
BHO: Hotspot Shield Class: {f9e4a054-e9b1-4bc3-83a3-76a1ae736170} - c:\program files\hotspot shield\hssie\HssIE.dll
TB: {BA52B914-B692-46c4-B683-905236F6F655} - No File
TB: BitDefender Toolbar: {381ffde8-2394-4f90-b10d-fc6124a40f8c} - c:\program files\bitdefender\bitdefender 2009\IEToolbar.dll
TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
mRun: [IAAnotif] "c:\program files\intel\intel application accelerator\iaanotif.exe "
mRun: [ATIPTA] "c:\program files\ati technologies\ati control panel\atiptaxx.exe "
mRun: [MXO Auto Loader] "c:\windows\MXOALDR.EXE "
mRun: [BDAgent] "c:\program files\bitdefender\bitdefender 2009\bdagent.exe "
mRun: [BitDefender Antiphishing Helper] "c:\program files\bitdefender\bitdefender 2009\IEShow.exe "
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\cordle~1.lnk - c:\program files\cordless usb phone\Cordless DUALphone Suite.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\novaba~1.lnk - c:\program files\novastor\novastor novabackup\NsCtrl.exe
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office10\EXCEL.EXE/3000
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_05\bin\ssv.dll
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1095004391125
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
Handler: x-atng - {7e8717b0-d862-11d5-8c9e-00010304f989} - c:\program files\fidelity investments\fidelity active trader\system\atngprot.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
LSA: Notification Packages = :\WINDOW

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\sarahl~1\applic~1\mozilla\firefox\profiles\4nr8tqiw.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.nytimes.com/
FF - component: c:\program files\mozilla firefox\components\FFComm.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}

============= SERVICES / DRIVERS ===============

R0 dcsnap;dcsnap;c:\windows\system32\drivers\dcsnap.sys [2008-9-1 77472]
R0 ppa;Iomega Parallel Port Filter Driver;c:\windows\system32\drivers\ppa.sys [2004-9-12 17792]
R1 DCDisk;DCDisk;c:\windows\system32\drivers\DCDisk.sys [2008-9-1 155648]
R2 aawservice;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\aawservice.exe [2008-7-7 611664]
R2 HssSrv;Hotspot Shield Helper Service;c:\program files\hotspot shield\hsswpr\hsssrv.exe [2009-2-5 117208]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\mcafee\siteadvisor\McSACore.exe [2009-4-5 210216]
R2 NsService;NovaStor NovaBACKUP Backup/Copy Engine;c:\program files\novastor\novastor novabackup\NsService.exe [2008-6-17 207936]
R2 Real time Backup Loader;Real time Backup Loader;c:\program files\novastor\novastor novabackup\dr\FsLoader.exe [2008-9-1 93248]
R3 bdfm;BDFM;c:\windows\system32\drivers\bdfm.sys [2008-9-18 111112]
R3 HssDrv;Hotspot Shield Helper Miniport;c:\windows\system32\drivers\hssdrv.sys [2009-2-14 31704]
R3 P1120VID;Creative WebCam NX Ultra;c:\windows\system32\drivers\P1120Vid.sys [2006-1-28 1252474]
S1 efbDisk;efbDisk; [x]
S2 Backup Scheduler;Backup Scheduler;c:\program files\novastor\novastor novabackup\dr\cbp\DCSchdlerSRVC.exe [2008-9-1 98304]
S2 DVR2INS;ADS Instant DVD 2.0;c:\windows\system32\drivers\dvr2ins.sys [2006-4-7 34792]
S3 Arrakis3;BitDefender Arrakis Server;c:\program files\common files\bitdefender\bitdefender arrakis server\bin\Arrakis3.exe [2008-7-17 118784]

=============== Created Last 30 ================

2009-08-07 09:54 <DIR> --d-h--- c:\windows\system32\GroupPolicy
2009-08-07 09:39 <DIR> --d----- c:\temp\desktop fix
2009-08-06 21:01 132 a------- C:\httpdwl.dat
2009-08-06 20:54 <DIR> --d----- c:\windows\system32\wbem\Repository
2009-08-06 20:51 <DIR> a-d--r-- C:\PUBDATA
2009-07-28 08:41 2,584 a------- c:\windows\system32\bda29.tmp

==================== Find3M ====================

2009-08-07 13:53 15,872 ----h--- C:\logicinf.bin
2009-08-07 13:22 81,984 a------- c:\windows\system32\bdod.bin
2009-07-21 18:52 9,262 a------- c:\windows\pchealth\helpctr\config\cache\Professional_32_1033.dat
2009-07-18 18:20 3,062,272 a------- c:\windows\system32\dllcache\mshtml.dll
2009-07-18 18:20 1,506,304 a------- c:\windows\system32\dllcache\shdocvw.dll
2009-06-22 13:38 18,432 a------- c:\windows\system32\dllcache\iedw.exe
2009-06-16 16:55 119,808 a------- c:\windows\system32\t2embed.dll
2009-06-16 16:55 82,432 a------- c:\windows\system32\fontsub.dll
2009-06-16 16:55 119,808 -------- c:\windows\system32\dllcache\t2embed.dll
2009-06-16 16:55 82,432 -------- c:\windows\system32\dllcache\fontsub.dll
2009-06-03 21:27 1,290,752 a------- c:\windows\system32\quartz.dll
2009-06-03 21:27 1,290,752 a------- c:\windows\system32\dllcache\quartz.dll
2008-12-10 17:28 90,000 a------- c:\docume~1\sarahl~1\applic~1\GDIPFONTCACHEV1.DAT
2008-09-03 16:33 942,534 a------- c:\documents and settings\all users\gl.zip
2007-08-18 09:26 716,531 a------- c:\documents and settings\all users\garsar1.zip

============= FINISH: 13:59:19.01 ===============

broni · 2009/08/08

Second part of DDS log is missing. Please, post it in your next reply.

When done....

Please download ComboFix from [color= "Red"]Here[/color] or [color= "#FF0000"]Here[/color] to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

Please, never rename Combofix unless instructed.

Close any open browsers.

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results ".

Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

Close any open browsers.

WARNING: Combofix will disconnect your machine from the Internet as soon as it starts

Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.

If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

Double click on combofix.exe & follow the prompts.

When finished, it will produce a report for you.

Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

Make sure, you re-enable your security programs, when you're done with Combofix.

Download HijackThis:
http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download
by clicking on Download HijackThis Installer
Install, and run it.
Post HijackTHis log.
Do NOT attempt to fix anything!

NOTE. If you're using Vista, right click on HijackThis, and click Run as Administrator

garsar · 2009/08/08

Sorry about the missing log. Here it is. The next post will have the Combo and Hijack logs. Thanks for the effort on our behalf.
DDS (Ver_09-07-30.01)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume2
Install Date: 9/11/2004 9:54:01 AM
System Uptime: 8/7/2009 1:51:29 PM (0 hours ago)

Motherboard: Dell Inc. | | 0J3492
Processor: Intel(R) Pentium(R) 4 CPU 3.00GHz | Microprocessor | 2992/800mhz
Processor: Intel(R) Pentium(R) 4 CPU 3.00GHz | Microprocessor | 2992/800mhz

==== Disk Partitions =========================

A: is Removable
C: is FIXED (NTFS) - 74 GiB total, 26.934 GiB free.
D: is CDROM ()
E: is FIXED (NTFS) - 466 GiB total, 277.616 GiB free.
F: is Removable

==== Disabled Device Manager Items =============

Class GUID: {9529B873-1D23-4BDD-960D-D1E3F610B897}
Description: WD External HDD Button & Lights
Device ID: ROOT\UNKNOWN\0000
Manufacturer: Western Digital Technologies
Name: WD External HDD Button & Lights
PNP Device ID: ROOT\UNKNOWN\0000
Service: WD_FireWire_HID

==== System Restore Points ===================

RP668: 5/23/2009 9:18:17 AM - System Checkpoint
RP669: 5/24/2009 10:01:38 AM - System Checkpoint
RP670: 5/26/2009 10:21:10 AM - System Checkpoint
RP671: 5/30/2009 7:00:04 PM - System Checkpoint
RP672: 6/3/2009 9:01:12 PM - System Checkpoint
RP673: 6/6/2009 3:02:50 PM - System Checkpoint
RP674: 6/8/2009 3:59:39 PM - System Checkpoint
RP675: 6/9/2009 9:19:24 PM - System Checkpoint
RP676: 6/12/2009 2:44:43 PM - Software Distribution Service 3.0
RP677: 6/15/2009 11:24:38 AM - System Checkpoint
RP678: 6/21/2009 5:49:59 PM - System Checkpoint
RP679: 6/23/2009 9:23:24 AM - System Checkpoint
RP680: 6/24/2009 9:25:04 AM - System Checkpoint
RP681: 6/28/2009 2:42:36 PM - System Checkpoint
RP682: 6/30/2009 8:01:15 AM - System Checkpoint
RP683: 7/3/2009 11:55:27 AM - System Checkpoint
RP684: 7/5/2009 10:34:22 AM - System Checkpoint
RP685: 7/7/2009 7:42:39 AM - Software Distribution Service 3.0
RP686: 7/8/2009 8:05:24 AM - System Checkpoint
RP687: 7/11/2009 5:21:18 PM - Software Distribution Service 3.0
RP688: 7/12/2009 8:50:18 PM - System Checkpoint
RP689: 7/15/2009 7:11:22 AM - System Checkpoint
RP690: 7/15/2009 12:35:34 PM - Software Distribution Service 3.0
RP691: 7/16/2009 12:56:43 PM - System Checkpoint
RP692: 7/17/2009 1:15:34 PM - System Checkpoint
RP693: 7/21/2009 11:54:08 PM - System Checkpoint
RP694: 7/23/2009 12:38:58 PM - System Checkpoint
RP695: 7/27/2009 9:38:01 PM - System Checkpoint
RP696: 7/29/2009 7:44:11 AM - System Checkpoint
RP697: 7/30/2009 8:50:27 AM - Software Distribution Service 3.0
RP698: 8/3/2009 3:17:29 PM - System Checkpoint
RP699: 8/5/2009 5:48:05 PM - System Checkpoint
RP700: 8/6/2009 1:14:36 PM - Restore Operation
RP701: 8/6/2009 8:50:58 PM - Restore Operation

==== Installed Programs ======================

Active Disk
Ad-Aware
Adobe Acrobat 5.0
Adobe Flash Player 10 Plugin
Adobe Photoshop 6.0
Adobe Reader 7.0.9
ADS Tech Master Installer V3.5
ADS Tech V3.5 Instant DVD+DV CapWiz
Advanced StartUp Manager
Alcatel SpeedTouch USB Software
ATI Control Panel
ATI Display Driver
Audio Converter 4.5 Licensed Version
AutoUpdate
BitDefender Antivirus 2009
Bleu Ciel d'EDF 1.0
Broadcom Advanced Control Suite 2
CloneDVDmobile
Cordless DUALphone Suite
Creative MediaSource
Creative MediaSource 5
Creative PC-CAM Center
Creative Removable Disk Manager
Creative System Information
Creative WebCam Monitor
Creative WebCam NX Ultra Driver (1.01.03.0112)
Creative WebCam NX Ultra User's Guide (English)
Creative ZEN V Series (R2)
Creative Zen Vision M
Critical Update for Windows Media Player 11 (KB959772)
DivX
DVD Decrypter (Remove Only)
DVD Shrink 3.2
DVD43 v4.0.0
DVDx 2.3
EasyCleaner
EasyTools 1.1
Fidelity Active Trader Pro®
File Scavenger 3.1
FxFoto by Triscape
Help and Support Customization
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB909394)
Hotfix for Windows XP (KB926239)
Hotfix for Windows XP (KB952287)
Hotspot Shield 1.12
Huffyuv AVI lossless video codec (Remove Only)
ImgBurn
Intel Application Accelerator
IomegaWare 4.0.2
Java 2 Runtime Environment, SE v1.4.2_03
Java(TM) 6 Update 2
Java(TM) 6 Update 3
Java(TM) 6 Update 5
LimeWire 4.14.8
livebox
Macromedia Flash Player 8
Maxtor OneTouch
McAfee SiteAdvisor
Microsoft .NET Framework 2.0
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Office XP Small Business
Microsoft PowerPoint Viewer 97
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft Windows XP Video Decoder Checkup Utility
Mozilla Firefox (2.0)
Mozilla Thunderbird (2.0.0.22)
Nero 6
Nero Digital
Nero Media Player
NovaBACKUP
Palm Desktop
Picasa 3
PowerDVD 5.1
QuickTime Alternative 1.81
RealPlayer
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Media Encoder (KB954156)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921503)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928090)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB929969)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB933566)
Security Update for Windows XP (KB933729)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
Security Update for Windows XP (KB936021)
Security Update for Windows XP (KB937143)
Security Update for Windows XP (KB937894)
Security Update for Windows XP (KB938127)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB938829)
Security Update for Windows XP (KB939653)
Security Update for Windows XP (KB941202)
Security Update for Windows XP (KB941568)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB941644)
Security Update for Windows XP (KB941693)
Security Update for Windows XP (KB942615)
Security Update for Windows XP (KB943055)
Security Update for Windows XP (KB943460)
Security Update for Windows XP (KB943485)
Security Update for Windows XP (KB944338)
Security Update for Windows XP (KB944533)
Security Update for Windows XP (KB944653)
Security Update for Windows XP (KB945553)
Security Update for Windows XP (KB946026)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB947864)
Security Update for Windows XP (KB948590)
Security Update for Windows XP (KB948881)
Security Update for Windows XP (KB950749)
Security Update for Windows XP (KB950759)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953838)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956390)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958215)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960714)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB963027)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969897)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB972260)
Security Update for Windows XP (KB973346)
Skype 2.5
Triscape FxFoto
Ulead DVD MovieFactory 3 SE
Ulead Straight-to-Disc SDK
Ulead VideoStudio 8.0 SE DVD
Undelete Plus 2.9
Update for Windows XP (KB920872)
Update for Windows XP (KB927891)
Update for Windows XP (KB929338)
Update for Windows XP (KB930916)
Update for Windows XP (KB931836)
Update for Windows XP (KB933360)
Update for Windows XP (KB936357)
Update for Windows XP (KB938828)
Update for Windows XP (KB942763)
Update for Windows XP (KB946627)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
USB Storage Adapter FX (MXO)
WD Backup
WD Diagnostics
WD Firewire HID Driver
WebFldrs XP
Windows Genuine Advantage v1.3.0254.0
Windows Media Encoder 9 Series
Windows Media Format 11 runtime
Windows Media Player 10 Hotfix - KB894476
Windows Media Player 10 Hotfix - KB895316
Windows Media Player 11
Windows Media Player Firefox Plugin
Windows XP Hotfix - KB834707
Windows XP Hotfix - KB867282
Windows XP Hotfix - KB873333
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885250
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB885884
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB887742
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890047
Windows XP Hotfix - KB890175
Windows XP Hotfix - KB891781
WinZip

==== Event Viewer Messages From Past Week ========

8/6/2009 9:13:19 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments " " in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
8/6/2009 9:13:02 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service McAfee SiteAdvisor Service with arguments " " in order to run the server: {5A90F5EE-16B8-4C2A-81B3-FD5329BA477C}
8/6/2009 9:05:06 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments " " in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
8/6/2009 7:02:56 PM, error: iaStor [9] - The device, \Device\Ide\iaStor0, did not respond within the timeout period.
8/6/2009 6:48:25 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service VSSERV with arguments " " in order to run the server: {6DFC0DC7-FDC5-44C2-8B80-5977BA8F8ACC}
8/6/2009 12:04:00 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service wuauserv with arguments " " in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
8/6/2009 11:52:16 AM, information: Windows File Protection [64017] - Windows File Protection file scan completed successfully.
8/6/2009 11:44:10 AM, information: Windows File Protection [64020] - Windows File Protection scan found that the system file c:\windows\system32\oembios.sig has a bad signature. This file was restored to the original version to maintain system stability. The file version of the system file is 0.0.0.1.
8/6/2009 11:44:10 AM, information: Windows File Protection [64020] - Windows File Protection scan found that the system file c:\windows\system32\oembios.dat has a bad signature. This file was restored to the original version to maintain system stability. The file version of the system file is 0.0.0.1.
8/6/2009 11:44:10 AM, information: Windows File Protection [64004] - The protected system file c:\windows\system32\oembios.sig could not be restored to its original, valid version. The file version of the bad file is 0.0.0.1 The specific error code is 0x800b0100 [No signature was present in the subject. ].
8/6/2009 11:44:10 AM, information: Windows File Protection [64004] - The protected system file c:\windows\system32\oembios.dat could not be restored to its original, valid version. The file version of the bad file is 0.0.0.1 The specific error code is 0x800b0100 [No signature was present in the subject. ].
8/6/2009 11:44:09 AM, information: Windows File Protection [64004] - The protected system file c:\windows\system32\oembios.bin could not be restored to its original, valid version. The file version of the bad file is 0.0.0.1 The specific error code is 0x800b0100 [No signature was present in the subject. ].
8/6/2009 11:44:08 AM, information: Windows File Protection [64020] - Windows File Protection scan found that the system file c:\windows\system32\oembios.bin has a bad signature. This file was restored to the original version to maintain system stability. The file version of the system file is 0.0.0.1.
8/6/2009 11:43:44 AM, information: Windows File Protection [64016] - Windows File Protection file scan was started.
8/1/2009 11:28:21 AM, error: System Error [1003] - Error code 00008086, parameter1 00000000, parameter2 00000000, parameter3 00000000, parameter4 00000000.

==== End Of File ===========================

garsar · 2009/08/08

This is the cobo log followed by the hijack log. For the moment we have the desktop back. I was able to do this previously by running the Katys Korner (195) twice and using the taskbar running a new exlorer.exe but after a reboot, the computer reverted to the problem, even after a restore to an earlier date was tried. Here are the logs.
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.3070.2566 [GMT 2:00]
Running from: F:\ComboFix.exe
AV: BitDefender Antivirus *On-access scanning disabled* (Updated) {6C4BB89C-B0ED-4F41-A29C-4373888923BB}
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\Installer\WMEncoder.msi
c:\windows\system32\_006192_.tmp.dll
c:\windows\system32\_006193_.tmp.dll
c:\windows\system32\_006194_.tmp.dll
c:\windows\system32\_006195_.tmp.dll
c:\windows\system32\_006202_.tmp.dll
c:\windows\system32\_006203_.tmp.dll
c:\windows\system32\_006204_.tmp.dll
c:\windows\system32\_006205_.tmp.dll
c:\windows\system32\_006207_.tmp.dll
c:\windows\system32\_006208_.tmp.dll
c:\windows\system32\_006211_.tmp.dll
c:\windows\system32\_006212_.tmp.dll
c:\windows\system32\_006214_.tmp.dll
c:\windows\system32\_006215_.tmp.dll
c:\windows\system32\_006216_.tmp.dll
c:\windows\system32\_006218_.tmp.dll
c:\windows\system32\_006221_.tmp.dll
c:\windows\system32\_006222_.tmp.dll
c:\windows\system32\_006226_.tmp.dll
c:\windows\system32\_006227_.tmp.dll
c:\windows\system32\_006229_.tmp.dll
c:\windows\system32\_006232_.tmp.dll
c:\windows\system32\_006234_.tmp.dll
c:\windows\system32\_006235_.tmp.dll
c:\windows\system32\_006236_.tmp.dll
c:\windows\system32\_006237_.tmp.dll
c:\windows\system32\_006238_.tmp.dll
c:\windows\system32\_006241_.tmp.dll
c:\windows\system32\_006242_.tmp.dll
c:\windows\system32\_006243_.tmp.dll
c:\windows\system32\_006244_.tmp.dll
c:\windows\system32\_006245_.tmp.dll
c:\windows\system32\_006250_.tmp.dll
c:\windows\system32\_006252_.tmp.dll

.
((((((((((((((((((((((((( Files Created from 2009-07-08 to 2009-08-08 )))))))))))))))))))))))))))))))
.

2009-08-07 07:54 . 2009-08-07 07:54 -------- d--h--w- c:\windows\system32\GroupPolicy
2009-08-07 07:39 . 2009-08-07 07:39 -------- d-----w- c:\temp\desktop fix
2009-08-06 19:01 . 2009-08-06 19:01 132 ----a-w- C:\httpdwl.dat
2009-08-06 18:54 . 2009-08-06 18:54 -------- d-----w- c:\windows\system32\wbem\Repository
2009-08-06 18:51 . 2009-08-06 18:51 -------- d---a-r- C:\PUBDATA
2009-07-29 13:53 . 2009-07-29 13:53 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Google
2009-07-15 10:11 . 2009-07-15 10:11 -------- d-----w- c:\documents and settings\Gary\Application Data\Ahead

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-08 07:26 . 2008-09-01 12:21 15872 ---h--w- C:\logicinf.bin
2009-08-08 07:24 . 2008-07-03 11:23 81984 ----a-w- c:\windows\system32\bdod.bin
2009-08-08 07:16 . 2009-04-06 08:20 -------- d-----w- c:\documents and settings\LocalService\Application Data\SACore
2009-08-07 12:46 . 2005-02-26 14:43 -------- d-----w- c:\program files\Mozilla Thunderbird
2009-08-07 10:12 . 2006-01-21 14:33 -------- d-----w- c:\documents and settings\Sarah Legon\Application Data\Skype
2009-07-29 13:53 . 2008-05-20 14:20 -------- d-----w- c:\program files\Picasa2
2009-07-28 06:41 . 2009-07-28 06:41 2584 ----a-w- c:\windows\system32\bda29.tmp
2009-07-21 16:52 . 2009-08-06 11:09 9262 ----a-w- c:\windows\PCHealth\HelpCtr\Config\Cache\Professional_32_1033.dat
2009-07-15 10:16 . 2005-08-07 13:31 -------- d-----w- c:\documents and settings\All Users\Application Data\DVD Shrink
2009-06-26 16:18 . 2004-02-06 17:05 659456 ----a-w- c:\windows\system32\wininet.dll
2009-06-26 16:18 . 2004-08-04 07:56 81920 ----a-w- c:\windows\system32\ieencode.dll
2009-06-16 14:55 . 2004-03-19 16:43 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-16 14:55 . 2004-03-19 16:37 82432 ----a-w- c:\windows\system32\fontsub.dll
2009-06-03 19:27 . 2003-05-30 08:00 1290752 ----a-w- c:\windows\system32\quartz.dll
2009-04-01 17:47 . 2008-10-30 16:34 61440 ----a-w- c:\program files\mozilla firefox\components\FFComm.dll
2006-10-11 08:04 . 2006-02-02 13:33 61036 ----a-w- c:\program files\mozilla firefox\components\jar50.dll
2006-10-11 08:04 . 2006-02-02 13:33 48742 ----a-w- c:\program files\mozilla firefox\components\jsd3250.dll
2006-10-11 08:05 . 2006-10-26 14:34 29313 ----a-w- c:\program files\mozilla firefox\components\myspell.dll
2006-10-11 08:05 . 2006-10-26 14:34 41082 ----a-w- c:\program files\mozilla firefox\components\spellchk.dll
2006-10-11 08:04 . 2006-02-02 13:33 166510 ----a-w- c:\program files\mozilla firefox\components\xpinstal.dll
2008-09-03 13:39 . 2008-09-03 13:37 48 --sha-w- c:\windows\S9677A04A.tmp
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}]
2009-02-14 15:58 204248 ----a-w- c:\program files\Hotspot Shield\HssIE\HssIE.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif "= "c:\program files\Intel\Intel Application Accelerator\iaanotif.exe" [2004-03-23 135168]
"ATIPTA "= "c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-05-25 335872]
"MXO Auto Loader "= "c:\windows\MXOALDR.EXE" [2003-04-07 118784]
"BDAgent "= "c:\program files\BitDefender\BitDefender 2009\bdagent.exe" [2009-04-29 778240]
"BitDefender Antiphishing Helper "= "c:\program files\BitDefender\BitDefender 2009\IEShow.exe" [2009-04-01 69632]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.exe.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2004-9-11 113664]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@= "Service "

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe "=
"c:\\Program Files\\Messenger\\msmsgs.exe "=
"c:\\Program Files\\LimeWire\\LimeWire.exe "=
"%windir%\\system32\\sessmgr.exe "=
"c:\\Program Files\\Skype\\Phone\\Skype.exe "=

R0 dcsnap;dcsnap;c:\windows\SYSTEM32\DRIVERS\dcsnap.sys [9/1/2008 2:21 PM 77472]
R0 ppa;Iomega Parallel Port Filter Driver;c:\windows\SYSTEM32\DRIVERS\ppa.sys [9/12/2004 3:13 PM 17792]
R1 DCDisk;DCDisk;c:\windows\SYSTEM32\DRIVERS\DCDisk.sys [9/1/2008 2:21 PM 155648]
R2 HssSrv;Hotspot Shield Helper Service;c:\program files\Hotspot Shield\HssWPR\hsssrv.exe [2/5/2009 11:56 PM 117208]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [4/5/2009 11:18 AM 210216]
R2 NsService;NovaStor NovaBACKUP Backup/Copy Engine;c:\program files\NovaStor\NovaStor NovaBACKUP\NsService.exe [6/17/2008 4:56 PM 207936]
R2 Real time Backup Loader;Real time Backup Loader;c:\program files\NovaStor\NovaStor NovaBACKUP\DR\FsLoader.exe [9/1/2008 2:20 PM 93248]
R3 bdfm;BDFM;c:\windows\SYSTEM32\DRIVERS\bdfm.sys [9/18/2008 12:09 PM 111112]
R3 HssDrv;Hotspot Shield Helper Miniport;c:\windows\SYSTEM32\DRIVERS\hssdrv.sys [2/14/2009 5:58 PM 31704]
R3 P1120VID;Creative WebCam NX Ultra;c:\windows\SYSTEM32\DRIVERS\P1120Vid.sys [1/28/2006 6:47 PM 1252474]
S1 efbDisk;efbDisk; [x]
S2 Backup Scheduler;Backup Scheduler;c:\program files\NovaStor\NovaStor NovaBACKUP\DR\CBP\DCSchdlerSRVC.exe [9/1/2008 2:21 PM 98304]
S2 DVR2INS;ADS Instant DVD 2.0;c:\windows\SYSTEM32\DRIVERS\dvr2ins.sys [4/7/2006 1:39 PM 34792]
S3 Arrakis3;BitDefender Arrakis Server;c:\program files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe [7/17/2008 1:06 PM 118784]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bdx REG_MULTI_SZ scan
.
- - - - ORPHANS REMOVED - - - -

Notify-dimsntfy - (no file)

.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
mStart Page = hxxp://www.euro.dell.com/countries/fr/fra/gen/default.htm
uInternet Connection Wizard,ShellNext = hxxp://www.euro.dell.com/countries/fr/fra/gen/default.htm
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Sarah Legon\Application Data\Mozilla\Firefox\Profiles\4nr8tqiw.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.nytimes.com/
FF - component: c:\program files\Mozilla Firefox\components\FFComm.dll
FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-08 09:27
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Iomega Activity Disk2]
"ImagePath "= "\ "\" "
.
------------------------ Other Running Processes ------------------------
.
c:\windows\SYSTEM32\ati2evxx.exe
c:\program files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
c:\program files\BitDefender\BitDefender 2009\vsserv.exe
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\program files\NovaStor\NovaStor NovaBACKUP\NsCtrl.exe
c:\program files\BitDefender\BitDefender 2009\seccenter.exe
c:\windows\SYSTEM32\CTSVCCDA.EXE
c:\program files\NovaStor\NovaStor NovaBACKUP\DR\CBP\DCSchdler.exe
c:\program files\Hotspot Shield\bin\openvpnas.exe
c:\program files\Intel\Intel Application Accelerator\IAANTmon.exe
c:\progra~1\Iomega\System32\AppServices.exe
c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
c:\combofix\hidec.exe
c:\combofix\Catchme.tmp
.
**************************************************************************
.
Completion time: 2009-08-08 9:32 - machine was rebooted
ComboFix-quarantined-files.txt 2009-08-08 07:31

Pre-Run: 28,783,828,992 bytes free
Post-Run: 41,609,302,016 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT= "Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS= "Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

178 --- E O F --- 2009-07-30 06:51

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:35:31 AM, on 8/8/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\MXOALDR.EXE
C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\NovaStor\NovaStor NovaBACKUP\NsCtrl.exe
C:\Program Files\BitDefender\BitDefender 2009\seccenter.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\NovaStor\NovaStor NovaBACKUP\DR\CBP\DCSchdler.exe
C:\Program Files\Hotspot Shield\bin\openvpnas.exe
C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe
C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
C:\Program Files\NovaStor\NovaStor NovaBACKUP\NsService.exe
C:\Program Files\NovaStor\NovaStor NovaBACKUP\DR\Fsloader.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.euro.dell.com/countries/fr/fra/gen/default.htm
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.euro.dell.com/countries/fr/fra/gen/default.htm
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: Hotspot Shield Class - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Program Files\Hotspot Shield\hssie\HssIE.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2009\IEToolbar.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe "
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe "
O4 - HKLM\..\Run: [MXO Auto Loader] "C:\WINDOWS\MXOALDR.EXE "
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe "
O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2009\IEShow.exe "
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Cordless DUALphone Startup.lnk = ?
O4 - Global Startup: NovaBACKUP Tray Control.lnk = C:\Program Files\NovaStor\NovaStor NovaBACKUP\NsCtrl.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.c...ls/en/x86/client/wuweb_site.cab?1095004391125
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: BitDefender Arrakis Server (Arrakis3) - BitDefender S.R.L. http://www.bitdefender.com - C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Backup Scheduler - Unknown owner - C:\Program Files\NovaStor\NovaStor NovaBACKUP\DR\CBP\DCSchdlerSRVC.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Hotspot Shield Service (HotspotShieldService) - Unknown owner - C:\Program Files\Hotspot Shield\bin\openvpnas.exe
O23 - Service: Hotspot Shield Helper Service (HssSrv) - AnchorFree Inc. - C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe
O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: NovaStor NovaBACKUP Backup/Copy Engine (NsService) - NovaStor - C:\Program Files\NovaStor\NovaStor NovaBACKUP\NsService.exe
O23 - Service: Real time Backup Loader - Unknown owner - C:\Program Files\NovaStor\NovaStor NovaBACKUP\DR\Fsloader.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S. R. L. - C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe
O23 - Service: Iomega Active Disk (_IOMEGA_ACTIVE_DISK_SERVICE_) - Iomega Corporation - C:\Program Files\Iomega\AutoDisk\ADService.exe

--
End of file - 7265 bytes

garsar · 2009/08/08

FYI: After Combo got the desktop back, went back online to send previous posts. Computer slowed then froze. Had to force reboot at which time the problem of no icons/desktop was back. It appears that after a minute or two the computer freezes. Seems part of the same problem. I await any input now.

broni · 2009/08/08

1. Please open Notepad

Click Start , then Run

Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:
Code:
File::
c:\windows\system32\bda29.tmp
c:\windows\S9677A04A.tmp


Folder::

Driver::
efbDisk


Registry::

RegLockDel::
3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

Combofix.txt

A new HijackThis log.

garsar · 2009/08/08

Here is the latest logs from Cobo and then Hijack. Desktop and icons back for the moment. I will reboot after this post and report if we are still in the problem or not but while I have the ease of a desktop, here goes:
ComboFix 09-08-07.09 - Sarah Legon 08/08/2009 18:46.2.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.3070.2538 [GMT 2:00]
Running from: F:\ComboFix.exe
Command switches used :: F:\CFScript.txt
AV: BitDefender Antivirus *On-access scanning disabled* (Updated) {6C4BB89C-B0ED-4F41-A29C-4373888923BB}

FILE ::
"c:\windows\S9677A04A.tmp "
"c:\windows\system32\bda29.tmp "
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\S9677A04A.tmp
c:\windows\system32\bda29.tmp

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_efbDisk

((((((((((((((((((((((((( Files Created from 2009-07-08 to 2009-08-08 )))))))))))))))))))))))))))))))
.

2009-08-08 07:34 . 2009-08-08 07:34 -------- d-----w- c:\program files\Trend Micro
2009-08-07 07:54 . 2009-08-07 07:54 -------- d--h--w- c:\windows\system32\GroupPolicy
2009-08-07 07:39 . 2009-08-07 07:39 -------- d-----w- c:\temp\desktop fix
2009-08-06 19:01 . 2009-08-06 19:01 132 ----a-w- C:\httpdwl.dat
2009-08-06 18:54 . 2009-08-06 18:54 -------- d-----w- c:\windows\system32\wbem\Repository
2009-08-06 18:51 . 2009-08-06 18:51 -------- d---a-r- C:\PUBDATA
2009-07-29 13:53 . 2009-07-29 13:53 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Google
2009-07-15 10:11 . 2009-07-15 10:11 -------- d-----w- c:\documents and settings\Gary\Application Data\Ahead

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-08 16:55 . 2008-09-01 12:21 15872 ---h--w- C:\logicinf.bin
2009-08-08 16:52 . 2008-07-03 11:23 81984 ----a-w- c:\windows\system32\bdod.bin
2009-08-08 09:41 . 2005-02-26 14:43 -------- d-----w- c:\program files\Mozilla Thunderbird
2009-08-08 07:16 . 2009-04-06 08:20 -------- d-----w- c:\documents and settings\LocalService\Application Data\SACore
2009-08-07 10:12 . 2006-01-21 14:33 -------- d-----w- c:\documents and settings\Sarah Legon\Application Data\Skype
2009-07-29 13:53 . 2008-05-20 14:20 -------- d-----w- c:\program files\Picasa2
2009-07-21 16:52 . 2009-08-06 11:09 9262 ----a-w- c:\windows\PCHealth\HelpCtr\Config\Cache\Professional_32_1033.dat
2009-07-15 10:16 . 2005-08-07 13:31 -------- d-----w- c:\documents and settings\All Users\Application Data\DVD Shrink
2009-06-26 16:18 . 2004-02-06 17:05 659456 ----a-w- c:\windows\system32\wininet.dll
2009-06-26 16:18 . 2004-08-04 07:56 81920 ----a-w- c:\windows\system32\ieencode.dll
2009-06-16 14:55 . 2004-03-19 16:43 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-16 14:55 . 2004-03-19 16:37 82432 ----a-w- c:\windows\system32\fontsub.dll
2009-06-03 19:27 . 2003-05-30 08:00 1290752 ----a-w- c:\windows\system32\quartz.dll
2009-04-01 17:47 . 2008-10-30 16:34 61440 ----a-w- c:\program files\mozilla firefox\components\FFComm.dll
2006-10-11 08:04 . 2006-02-02 13:33 61036 ----a-w- c:\program files\mozilla firefox\components\jar50.dll
2006-10-11 08:04 . 2006-02-02 13:33 48742 ----a-w- c:\program files\mozilla firefox\components\jsd3250.dll
2006-10-11 08:05 . 2006-10-26 14:34 29313 ----a-w- c:\program files\mozilla firefox\components\myspell.dll
2006-10-11 08:05 . 2006-10-26 14:34 41082 ----a-w- c:\program files\mozilla firefox\components\spellchk.dll
2006-10-11 08:04 . 2006-02-02 13:33 166510 ----a-w- c:\program files\mozilla firefox\components\xpinstal.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-08-08_07.27.36 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-08-08 07:23 . 2009-08-08 07:23 8192 c:\windows\ERDNT\subs\Users\00000004\UsrClass.dat
+ 2009-08-08 16:52 . 2009-08-08 16:52 8192 c:\windows\ERDNT\subs\Users\00000004\UsrClass.dat
+ 2009-08-08 16:52 . 2009-08-08 16:52 8192 c:\windows\ERDNT\subs\Users\00000002\UsrClass.dat
- 2009-08-08 07:23 . 2009-08-08 07:23 8192 c:\windows\ERDNT\subs\Users\00000002\UsrClass.dat
- 2009-08-08 07:23 . 2009-08-08 07:23 159744 c:\windows\ERDNT\subs\Users\00000006\UsrClass.dat
+ 2009-08-08 16:52 . 2009-08-08 16:52 159744 c:\windows\ERDNT\subs\Users\00000006\UsrClass.dat
+ 2009-08-08 16:52 . 2009-08-08 16:52 233472 c:\windows\ERDNT\subs\Users\00000003\ntuser.dat
- 2009-08-08 07:23 . 2009-08-08 07:23 233472 c:\windows\ERDNT\subs\Users\00000003\ntuser.dat
+ 2009-08-08 16:52 . 2009-08-08 16:52 233472 c:\windows\ERDNT\subs\Users\00000001\NTUSER.DAT
- 2009-08-08 07:23 . 2009-08-08 07:23 233472 c:\windows\ERDNT\subs\Users\00000001\NTUSER.DAT
- 2009-08-08 07:23 . 2009-08-08 07:23 12578816 c:\windows\ERDNT\subs\Users\00000005\ntuser.dat
+ 2009-08-08 16:52 . 2009-08-08 16:52 12578816 c:\windows\ERDNT\subs\Users\00000005\ntuser.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}]
2009-02-14 15:58 204248 ----a-w- c:\program files\Hotspot Shield\HssIE\HssIE.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif "= "c:\program files\Intel\Intel Application Accelerator\iaanotif.exe" [2004-03-23 135168]
"ATIPTA "= "c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-05-25 335872]
"MXO Auto Loader "= "c:\windows\MXOALDR.EXE" [2003-04-07 118784]
"BDAgent "= "c:\program files\BitDefender\BitDefender 2009\bdagent.exe" [2009-04-29 778240]
"BitDefender Antiphishing Helper "= "c:\program files\BitDefender\BitDefender 2009\IEShow.exe" [2009-04-01 69632]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.exe.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2004-9-11 113664]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@= "Service "

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe "=
"c:\\Program Files\\Messenger\\msmsgs.exe "=
"c:\\Program Files\\LimeWire\\LimeWire.exe "=
"%windir%\\system32\\sessmgr.exe "=
"c:\\Program Files\\Skype\\Phone\\Skype.exe "=

R0 dcsnap;dcsnap;c:\windows\SYSTEM32\DRIVERS\dcsnap.sys [9/1/2008 2:21 PM 77472]
R0 ppa;Iomega Parallel Port Filter Driver;c:\windows\SYSTEM32\DRIVERS\ppa.sys [9/12/2004 3:13 PM 17792]
R1 DCDisk;DCDisk;c:\windows\SYSTEM32\DRIVERS\DCDisk.sys [9/1/2008 2:21 PM 155648]
R2 HssSrv;Hotspot Shield Helper Service;c:\program files\Hotspot Shield\HssWPR\hsssrv.exe [2/5/2009 11:56 PM 117208]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [4/5/2009 11:18 AM 210216]
R2 NsService;NovaStor NovaBACKUP Backup/Copy Engine;c:\program files\NovaStor\NovaStor NovaBACKUP\NsService.exe [6/17/2008 4:56 PM 207936]
R2 Real time Backup Loader;Real time Backup Loader;c:\program files\NovaStor\NovaStor NovaBACKUP\DR\FsLoader.exe [9/1/2008 2:20 PM 93248]
R3 bdfm;BDFM;c:\windows\SYSTEM32\DRIVERS\bdfm.sys [9/18/2008 12:09 PM 111112]
R3 HssDrv;Hotspot Shield Helper Miniport;c:\windows\SYSTEM32\DRIVERS\hssdrv.sys [2/14/2009 5:58 PM 31704]
R3 P1120VID;Creative WebCam NX Ultra;c:\windows\SYSTEM32\DRIVERS\P1120Vid.sys [1/28/2006 6:47 PM 1252474]
S2 Backup Scheduler;Backup Scheduler;c:\program files\NovaStor\NovaStor NovaBACKUP\DR\CBP\DCSchdlerSRVC.exe [9/1/2008 2:21 PM 98304]
S2 DVR2INS;ADS Instant DVD 2.0;c:\windows\SYSTEM32\DRIVERS\dvr2ins.sys [4/7/2006 1:39 PM 34792]
S3 Arrakis3;BitDefender Arrakis Server;c:\program files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe [7/17/2008 1:06 PM 118784]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bdx REG_MULTI_SZ scan
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
mStart Page = hxxp://www.euro.dell.com/countries/fr/fra/gen/default.htm
uInternet Connection Wizard,ShellNext = hxxp://www.euro.dell.com/countries/fr/fra/gen/default.htm
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Sarah Legon\Application Data\Mozilla\Firefox\Profiles\4nr8tqiw.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.nytimes.com/
FF - component: c:\program files\Mozilla Firefox\components\FFComm.dll
FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-08 18:55
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Iomega Activity Disk2]
"ImagePath "= "\ "\" "
.
------------------------ Other Running Processes ------------------------
.
c:\windows\SYSTEM32\ati2evxx.exe
c:\program files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
c:\program files\BitDefender\BitDefender 2009\vsserv.exe
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\program files\NovaStor\NovaStor NovaBACKUP\NsCtrl.exe
c:\program files\BitDefender\BitDefender 2009\seccenter.exe
c:\program files\NovaStor\NovaStor NovaBACKUP\DR\CBP\DCSchdler.exe
c:\windows\SYSTEM32\CTSVCCDA.EXE
c:\program files\Hotspot Shield\bin\openvpnas.exe
c:\program files\Intel\Intel Application Accelerator\IAANTmon.exe
c:\progra~1\Iomega\System32\AppServices.exe
c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
.
**************************************************************************
.
Completion time: 2009-08-08 19:00 - machine was rebooted
ComboFix-quarantined-files.txt 2009-08-08 16:59
ComboFix2.txt 2009-08-08 07:32

Pre-Run: 41,614,409,728 bytes free
Post-Run: 41,579,008,000 bytes free

154 --- E O F --- 2009-07-30 06:51

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:01:45 PM, on 8/8/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\MXOALDR.EXE
C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe
C:\Program Files\NovaStor\NovaStor NovaBACKUP\NsCtrl.exe
C:\Program Files\BitDefender\BitDefender 2009\seccenter.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\NovaStor\NovaStor NovaBACKUP\DR\CBP\DCSchdler.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Hotspot Shield\bin\openvpnas.exe
C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe
C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
C:\Program Files\NovaStor\NovaStor NovaBACKUP\NsService.exe
C:\Program Files\NovaStor\NovaStor NovaBACKUP\DR\Fsloader.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.euro.dell.com/countries/fr/fra/gen/default.htm
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.euro.dell.com/countries/fr/fra/gen/default.htm
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: Hotspot Shield Class - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Program Files\Hotspot Shield\hssie\HssIE.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2009\IEToolbar.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe "
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe "
O4 - HKLM\..\Run: [MXO Auto Loader] "C:\WINDOWS\MXOALDR.EXE "
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe "
O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2009\IEShow.exe "
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Cordless DUALphone Startup.lnk = ?
O4 - Global Startup: NovaBACKUP Tray Control.lnk = C:\Program Files\NovaStor\NovaStor NovaBACKUP\NsCtrl.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.c...ls/en/x86/client/wuweb_site.cab?1095004391125
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: BitDefender Arrakis Server (Arrakis3) - BitDefender S.R.L. http://www.bitdefender.com - C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Backup Scheduler - Unknown owner - C:\Program Files\NovaStor\NovaStor NovaBACKUP\DR\CBP\DCSchdlerSRVC.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Hotspot Shield Service (HotspotShieldService) - Unknown owner - C:\Program Files\Hotspot Shield\bin\openvpnas.exe
O23 - Service: Hotspot Shield Helper Service (HssSrv) - AnchorFree Inc. - C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe
O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: NovaStor NovaBACKUP Backup/Copy Engine (NsService) - NovaStor - C:\Program Files\NovaStor\NovaStor NovaBACKUP\NsService.exe
O23 - Service: Real time Backup Loader - Unknown owner - C:\Program Files\NovaStor\NovaStor NovaBACKUP\DR\Fsloader.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S. R. L. - C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe
O23 - Service: Iomega Active Disk (_IOMEGA_ACTIVE_DISK_SERVICE_) - Iomega Corporation - C:\Program Files\Iomega\AutoDisk\ADService.exe

--
End of file - 7298 bytes

broni · 2009/08/08

Download Dr.Web CureIt to the desktop:
ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe

Doubleclick the drweb-cureit.exe file and click Scan to run express scan. Click OK in pop-up window to allow scan.

This will scan the files currently running in memory and when something is found, click the Yes button when it asks you if you want to cure it. This is only a short scan.

Once the short scan has finished, select Complete scan.

Click the green arrow at the right, and the scan will start.

Click Yes to all if it asks if you want to cure/move the file.

When the scan has finished, in the menu, click File and choose Save report list

Save the report to your desktop. The report will be called DrWeb.csv

Close Dr.Web Cureit.

Important! Reboot your computer because it could be possible that files in use will be moved/deleted during reboot.

Copy and paste that log in the next reply. You can use Notepad to open the DrWeb.cvs report.

NOTE. During the scan, pop-up window will open asking for full version purchase. Simply close the window by clicking on X in upper right corner.

Post fresh HijackThis log as well.

garsar · 2009/08/08

Quick note. The problem came back after a reboot. Maybe you know that. I will run the new program and send back. May take a little while as have to go out for a while.

broni · 2009/08/08

No problem

garsar · 2009/08/09

Dr Web can't be used. Tried it 3 times and at the beginning of the first scan of RAM memory and StartUp, it crashes to a blue screen error report. Each time the same exactly. It had happened maybe once before in all that we tried and it was the same tech details in all. Now I'm thinking we should try a restore from a C Image we have made with NovaStor and hope it wipes the C drive clean. We backed up everything new when this began, since that Image (February) was made. If you up, what's your opinion?

broni · 2009/08/09

Nah, not yet. We don't know how far back the infection goes.

Print these instructions out.

NOTE. If any of the programs listed below refuse to run, try renaming executive file to something else; for instance, rename hijackthis.exe to scanner.exe

***VERY IMPORTANT! Make sure, you update Superantispyware, and Malwarebytes before running the scans.***

STEP 1. Download SUPERAntiSpyware Free for Home Users:
http://www.superantispyware.com/

* Double-click SUPERAntiSpyware.exe and use the default settings for installation.
* An icon will be created on your desktop. Double-click that icon to launch the program.
* If asked to update the program definitions, click "Yes ". If not, update the definitions before scanning by selecting "Check for Updates ". (If you encounter any problems while downloading the updates, manually download and unzip them from here: http://www.superantispyware.com/definitions.html.)
* Close SUPERAntiSpyware.

PHYSICALLY DISCONNECT FROM THE INTERNET

Restart computer in Safe Mode.
To enter Safe Mode, restart computer, and keep tapping F8 key, until menu appears; select Safe Mode; you'll see "Safe Mode" in all four corners of your screen

* Open SUPERAntiSpyware.
* Click Scan your Computer... button.
* Click Scanning Preferences/Control Center... button.
* Under General and Startup tab, make sure, Start SUPERAntiSpyware when Windows starts option is UN-checked.
* Click the Scanning Control tab.
* Under Scanner Options make sure the following are checked (leave all others unchecked):
- Close browsers before scanning.
- Terminate memory threats before quarantining.
* Click the Close button to leave the control center screen.
* On the left, make sure you check C:\Fixed Drive.
* On the right, choose Perform Complete Scan.
* Click Next to start the scan. Please be patient while it scans your computer.
* After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click OK.
* Make sure everything has a checkmark next to it and click Next.
* A notification will appear that Quarantine and Removal is Complete. Click OK and then click the Finish button to return to the main menu.
* If asked if you want to reboot, click Yes.
* To retrieve the removal information after reboot, launch SUPERAntispyware again.
- Click Preferences, then click the Statistics/Logs tab.
- Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
- If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
- Please copy and paste the Scan Log results in your next reply.
* Click Close to exit the program.
Post SUPERAntiSpyware log.

RECONNECT TO THE INTERNET

RESTART COMPUTER!

STEP 2. Download Malwarebytes' Anti-Malware: http://www.malwarebytes.org/mbam.php to your desktop.
(Malwarebytes is free to use as a manual scanner. Payment is only required if you wish to have it run and update automatically which is not necessary for our purposes)

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.

The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

RESTART COMPUTER!

STEP 3.
Post fresh HijackThis log.
Do NOT attempt to "fix" anything!

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

garsar · 2009/08/10

A big THANKS for all the help. I feel like my malware consciousness has been raised.
We are fine now but I had to resort to the Image I had of the C drive from a while ago and then I did the scans.
The reason I had to do it that way was that the computer would no longer boot to anything other than a blue screen.
You were correct that there were still some problems to fix.
The only input I can add is that it pays to have an Image backup program for serious issues. I use NovaStor and prefer it to all the others because it did not effect anything else in the computer and works fine. I did test all the names.
I could not have gotten through this without the help and guidance I now have from BBS in case of future issues.

The logs are below.
Best regards,
Gary

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 08/10/2009 at 10:47 AM

Application Version : 4.27.1002

Core Rules Database Version : 4046
Trace Rules Database Version: 1986

Scan type : Complete Scan
Total Scan Time : 01:11:20

Memory items scanned : 201
Memory threats detected : 0
Registry items scanned : 5775
Registry threats detected : 0
File items scanned : 120980
File threats detected : 5

Adware.Vundo Variant
E:\GARY BACK\BESTTRAVEL\TRADEMARK2.DOC
E:\MY DOCUMENTS\BESTTRAVEL\TRADEMARK2.DOC

Trojan.Smitfraud Variant
E:\GARY BACK\BESTTRAVEL\TRADEMARKNAMELEGAL.DOC
E:\MY DOCUMENTS\BESTTRAVEL\TOURISTIQ1.DOC
E:\MY DOCUMENTS\BESTTRAVEL\TRADEMARKNAMELEGAL.DOC

Malwarebytes' Anti-Malware 1.40
Database version: 2589
Windows 5.1.2600 Service Pack 2

8/10/2009 11:50:45 AM
mbam-log-2009-08-10 (11-50-45).txt

Scan type: Full Scan (C:\|E:\|)
Objects scanned: 219688
Time elapsed: 46 minute(s), 29 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 3
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{8c875948-9c60-4381-9248-0df180542d53} (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{2b96d5cc-c5b5-49a5-a69d-cc0a30f9028c} (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{b64f4a7c-97c9-11da-8bde-f66bad1e3f3a} (Rogue.WinAntiVirus) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

broni · 2009/08/10

it pays to have an Image backup program for serious issues
Click to expand...

If only everyone had a backup like that......[Broni - dreaming]
I assume, the computer is more operable now, correct?
We'll have to repeat some scans though.

I'd like to see new Combofix, and HJT logs.
Delete any Combofix, you have there (if any):

Delete Combofix, Qoobox folders,and Combofix.txt file from C:
Delete Combofix from your desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

Please, never rename Combofix unless instructed.

Close any open browsers.

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results ".

Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

Close any open browsers.

WARNING: Combofix will disconnect your machine from the Internet as soon as it starts

Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.

If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

Double click on combofix.exe & follow the prompts.

When finished, it will produce a report for you.

Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

Make sure, you re-enable your security programs, when you're done with Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

garsar · 2009/08/10

Will do as soon as the thunderstorm we're in passes and we have consistent electricity to stay on. Yes, the computer is running fine. New logs coming but not sure when.

broni · 2009/08/10

No problem...stay safe

garsar · 2009/08/11

Here is the Combo and the Hijack:

ComboFix 09-08-10.06 - gary legon 08/11/2009 17:37.1.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.3070.2621 [GMT 2:00]
Running from: c:\documents and settings\Sarah Legon\Desktop\ComboFix.exe
AV: BitDefender Antivirus *On-access scanning disabled* (Updated) {6C4BB89C-B0ED-4F41-A29C-4373888923BB}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\Installer\WMEncoder.msi
c:\windows\system32\_006192_.tmp.dll
c:\windows\system32\_006193_.tmp.dll
c:\windows\system32\_006194_.tmp.dll
c:\windows\system32\_006195_.tmp.dll
c:\windows\system32\_006202_.tmp.dll
c:\windows\system32\_006203_.tmp.dll
c:\windows\system32\_006204_.tmp.dll
c:\windows\system32\_006205_.tmp.dll
c:\windows\system32\_006207_.tmp.dll
c:\windows\system32\_006208_.tmp.dll
c:\windows\system32\_006211_.tmp.dll
c:\windows\system32\_006212_.tmp.dll
c:\windows\system32\_006214_.tmp.dll
c:\windows\system32\_006215_.tmp.dll
c:\windows\system32\_006216_.tmp.dll
c:\windows\system32\_006218_.tmp.dll
c:\windows\system32\_006221_.tmp.dll
c:\windows\system32\_006222_.tmp.dll
c:\windows\system32\_006226_.tmp.dll
c:\windows\system32\_006227_.tmp.dll
c:\windows\system32\_006229_.tmp.dll
c:\windows\system32\_006232_.tmp.dll
c:\windows\system32\_006234_.tmp.dll
c:\windows\system32\_006235_.tmp.dll
c:\windows\system32\_006236_.tmp.dll
c:\windows\system32\_006237_.tmp.dll
c:\windows\system32\_006238_.tmp.dll
c:\windows\system32\_006241_.tmp.dll
c:\windows\system32\_006242_.tmp.dll
c:\windows\system32\_006243_.tmp.dll
c:\windows\system32\_006244_.tmp.dll
c:\windows\system32\_006245_.tmp.dll
c:\windows\system32\_006250_.tmp.dll
c:\windows\system32\_006252_.tmp.dll

.
((((((((((((((((((((((((( Files Created from 2009-07-11 to 2009-08-11 )))))))))))))))))))))))))))))))
.

2009-08-11 13:31 . 2008-02-26 11:59 294912 ------w- c:\windows\system32\dllcache\msctf.dll
2009-08-11 13:27 . 2009-08-11 13:27 0 ----a-w- c:\windows\system32\cd.dat
2009-08-10 11:43 . 2009-08-11 15:33 -------- d-----w- C:\Netbak
2009-08-10 09:01 . 2009-08-10 09:01 -------- d-----w- c:\documents and settings\Sarah Legon\Application Data\Malwarebytes
2009-08-10 09:01 . 2009-08-03 11:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-10 09:01 . 2009-08-10 09:01 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-08-10 09:01 . 2009-08-10 09:01 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-08-10 09:01 . 2009-08-03 11:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-08-10 07:15 . 2009-08-10 09:54 117760 ----a-w- c:\documents and settings\Sarah Legon\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-08-10 07:14 . 2009-08-10 07:14 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-08-10 07:14 . 2009-08-10 07:14 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-08-10 07:14 . 2009-08-10 07:14 -------- d-----w- c:\documents and settings\Sarah Legon\Application Data\SUPERAntiSpyware.com
2009-08-09 12:33 . 2009-08-09 12:33 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Google
2009-08-09 12:26 . 2009-08-09 12:26 -------- d-----w- C:\Hotspot Shield
2009-08-09 11:52 . 2009-08-11 15:44 15360 ---h--w- C:\logicinf.bin
2009-08-09 11:52 . 2009-05-20 18:02 77472 ----a-w- c:\windows\system32\drivers\dcsnap.sys
2009-08-09 11:52 . 2009-05-20 18:02 512 --sh--r- C:\FARSBOOT.BIN
2009-08-09 11:52 . 2009-05-20 18:02 155648 ----a-w- c:\windows\system32\drivers\DCDisk.sys
2009-08-09 11:40 . 2009-08-09 11:40 -------- d-----w- c:\documents and settings\Sarah Legon\Local Settings\Application Data\NovaStor
2009-08-09 11:39 . 2009-08-09 11:39 -------- d-----w- c:\program files\NovaStor
2009-08-09 11:39 . 2009-08-09 11:39 -------- d-----w- c:\documents and settings\All Users\Application Data\NovaStor
2009-08-09 09:38 . 2009-03-06 14:44 283648 ------w- c:\windows\system32\dllcache\pdh.dll
2009-08-09 09:38 . 2009-02-06 16:54 35328 ------w- c:\windows\system32\dllcache\sc.exe
2009-08-09 09:38 . 2005-07-26 04:39 60416 ------w- c:\windows\system32\dllcache\colbact.dll
2009-08-09 09:38 . 2009-02-09 10:20 399360 ------w- c:\windows\system32\dllcache\rpcss.dll
2009-08-09 09:38 . 2009-02-09 10:20 714752 ------w- c:\windows\system32\dllcache\ntdll.dll
2009-08-09 09:38 . 2009-02-09 10:20 616960 ------w- c:\windows\system32\dllcache\advapi32.dll
2009-08-09 09:38 . 2009-02-09 10:20 473088 ------w- c:\windows\system32\dllcache\fastprox.dll
2009-08-09 09:38 . 2009-02-09 10:20 453120 ------w- c:\windows\system32\dllcache\wmiprvsd.dll
2009-08-09 09:38 . 2009-02-06 17:14 110592 ------w- c:\windows\system32\dllcache\services.exe
2009-08-09 09:38 . 2009-02-06 16:39 227840 ------w- c:\windows\system32\dllcache\wmiprvse.exe
2009-08-09 09:37 . 2008-04-21 10:02 215552 ------w- c:\windows\system32\dllcache\wordpad.exe
2009-08-09 09:34 . 2009-08-09 09:34 -------- d-----w- c:\documents and settings\Sarah Legon\Application Data\BitDefender
2009-08-09 09:34 . 2009-08-09 10:58 -------- d-----w- c:\documents and settings\All Users\Application Data\BitDefender
2009-08-09 09:17 . 2009-08-10 06:51 -------- d-----w- C:\Tech Save
2009-07-21 23:22 . 2009-07-21 23:22 28592 ----a-w- c:\windows\system32\drivers\tap0901.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-11 15:43 . 2008-07-03 11:23 81984 ----a-w- c:\windows\system32\bdod.bin
2009-08-11 14:33 . 2005-02-26 14:43 -------- d-----w- c:\program files\Mozilla Thunderbird
2009-08-10 10:40 . 2008-10-22 07:58 229376 ---ha-w- C:\index.sys
2009-08-10 10:40 . 2008-10-22 07:57 2439119 ----a-w- C:\driverbmp.bin
2009-08-10 07:13 . 2008-09-10 08:37 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-08-09 16:52 . 2007-11-10 15:36 800355 ----a-w- c:\documents and settings\All Users\gl.zip
2009-08-09 12:33 . 2008-05-20 14:20 -------- d-----w- c:\program files\Picasa2
2009-08-09 12:26 . 2008-03-11 13:25 -------- d-----w- c:\program files\Hotspot Shield
2009-08-09 12:22 . 2004-09-14 12:48 -------- d-----w- c:\program files\Ahead
2009-08-09 12:07 . 2008-05-20 14:14 -------- d-----w- c:\program files\Google
2009-08-09 11:05 . 2007-04-13 06:01 -------- d-----w- c:\documents and settings\Sarah Legon\Application Data\SiteAdvisor
2009-08-09 09:34 . 2008-03-04 19:11 -------- d-----w- c:\program files\BitDefender
2009-08-09 09:34 . 2008-03-04 19:10 -------- d-----w- c:\program files\Common Files\BitDefender
2009-06-30 12:06 . 2009-06-30 12:06 33840 ----a-w- c:\windows\system32\drivers\HssDrv.sys
2009-06-26 16:18 . 2004-02-06 17:05 659456 ----a-w- c:\windows\system32\wininet.dll
2009-06-26 16:18 . 2004-08-04 07:56 81920 ----a-w- c:\windows\system32\ieencode.dll
2009-06-16 14:55 . 2004-03-19 16:43 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-16 14:55 . 2004-03-19 16:37 82432 ----a-w- c:\windows\system32\fontsub.dll
2009-06-03 19:27 . 2003-05-30 08:00 1290752 ----a-w- c:\windows\system32\quartz.dll
2009-05-20 18:02 . 2009-05-20 18:02 588856 ----a-w- c:\documents and settings\All Users\Application Data\NovaStor\NovaStor NovaBACKUP\nse_w32.dll
2009-03-05 16:08 . 2009-08-09 10:58 61440 ----a-w- c:\program files\mozilla firefox\components\FFComm.dll
2009-08-09 12:07 . 2009-08-09 12:07 122880 ----a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
2006-10-11 08:04 . 2006-02-02 13:33 61036 ----a-w- c:\program files\mozilla firefox\components\jar50.dll
2006-10-11 08:04 . 2006-02-02 13:33 48742 ----a-w- c:\program files\mozilla firefox\components\jsd3250.dll
2006-10-11 08:05 . 2006-10-26 14:34 29313 ----a-w- c:\program files\mozilla firefox\components\myspell.dll
2006-10-11 08:05 . 2006-10-26 14:34 41082 ----a-w- c:\program files\mozilla firefox\components\spellchk.dll
2006-10-11 08:04 . 2006-02-02 13:33 166510 ----a-w- c:\program files\mozilla firefox\components\xpinstal.dll
2008-09-03 13:39 . 2008-09-03 13:37 48 --sha-w- c:\windows\S9677A04A.tmp
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}]
2009-01-23 18:07 204248 ----a-w- c:\program files\Hotspot Shield\HssIE\HssIE.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif "= "c:\program files\Intel\Intel Application Accelerator\iaanotif.exe" [2004-03-23 135168]
"ATIPTA "= "c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-05-25 335872]
"MXO Auto Loader "= "c:\windows\MXOALDR.EXE" [2003-04-07 118784]
"BDAgent "= "c:\program files\BitDefender\BitDefender 2009\bdagent.exe" [2009-04-08 778240]
"BitDefender Antiphishing Helper "= "c:\program files\BitDefender\BitDefender 2009\IEShow.exe" [2009-02-23 69632]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.exe.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2004-9-11 113664]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} "= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 10:05 356352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@= "Service "

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe "=
"c:\\Program Files\\Messenger\\msmsgs.exe "=
"c:\\Program Files\\LimeWire\\LimeWire.exe "=
"%windir%\\system32\\sessmgr.exe "=
"c:\\Program Files\\Skype\\Phone\\Skype.exe "=

R0 dcsnap;dcsnap;c:\windows\SYSTEM32\DRIVERS\dcsnap.sys [8/9/2009 1:52 PM 77472]
R0 ppa;Iomega Parallel Port Filter Driver;c:\windows\SYSTEM32\DRIVERS\ppa.sys [9/12/2004 3:13 PM 17792]
R1 DCDisk;DCDisk;c:\windows\SYSTEM32\DRIVERS\DCDisk.sys [8/9/2009 1:52 PM 155648]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [8/5/2009 4:06 PM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [8/5/2009 4:06 PM 74480]
R2 HssSrv;Hotspot Shield Routing Service;c:\program files\Hotspot Shield\HssWPR\hsssrv.exe [6/15/2009 11:49 PM 331312]
R2 nsService;NovaStor NovaBACKUP Backup/Copy Engine;c:\program files\NovaStor\NovaStor NovaBACKUP\nsService.exe [6/22/2009 9:03 AM 257088]
R2 Real time Backup Loader;Real time Backup Loader;c:\program files\NovaStor\NovaStor NovaBACKUP\DR\FsLoader.exe [8/9/2009 1:52 PM 90112]
R3 bdfm;BDFM;c:\windows\SYSTEM32\DRIVERS\bdfm.sys [9/18/2008 12:09 PM 111112]
R3 P1120VID;Creative WebCam NX Ultra;c:\windows\SYSTEM32\DRIVERS\P1120Vid.sys [1/28/2006 6:47 PM 1252474]
R3 tap0901;TAP-Win32 Adapter V9;c:\windows\SYSTEM32\DRIVERS\tap0901.sys [7/22/2009 1:22 AM 28592]
S1 efbDisk;efbDisk; [x]
S2 Backup Scheduler;Backup Scheduler;c:\program files\NovaStor\NovaStor NovaBACKUP\DR\CBP\DCSchdlerSRVC.exe [8/9/2009 1:52 PM 98304]
S2 DVR2INS;ADS Instant DVD 2.0;c:\windows\SYSTEM32\DRIVERS\dvr2ins.sys [4/7/2006 1:39 PM 34792]
S3 Arrakis3;BitDefender Arrakis Server;c:\program files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe [1/20/2009 7:16 PM 172032]
S3 GoogleDesktopManager-060409-093314;Google Desktop Manager 5.9.906.4286;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [8/9/2009 2:07 PM 30192]
S3 HssTrayService;Hotspot Shield Tray Service;c:\program files\Hotspot Shield\bin\HssTrayService.exe [7/22/2009 1:23 AM 57640]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [8/5/2009 4:06 PM 7408]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bdx REG_MULTI_SZ scan
.
- - - - ORPHANS REMOVED - - - -

Notify-dimsntfy - (no file)

.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
mStart Page = hxxp://www.euro.dell.com/countries/fr/fra/gen/default.htm
uInternet Connection Wizard,ShellNext = hxxp://www.euro.dell.com/countries/fr/fra/gen/default.htm
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Sarah Legon\Application Data\Mozilla\Firefox\Profiles\4nr8tqiw.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.nytimes.com/
FF - component: c:\program files\Mozilla Firefox\components\FFComm.dll
FF - component: c:\program files\Mozilla Firefox\components\GoogleDesktopMozilla.dll
FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-11 18:33
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Iomega Activity Disk2]
"ImagePath "= "\ "\" "
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1140)
c:\program files\SUPERAntiSpyware\SASWINLO.dll

- - - - - - - > 'explorer.exe'(2364)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\SYSTEM32\ati2evxx.exe
c:\program files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
c:\program files\BitDefender\BitDefender 2009\vsserv.exe
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\program files\NovaStor\NovaStor NovaBACKUP\DR\CBP\DCSchdler.exe
c:\windows\SYSTEM32\CTSVCCDA.EXE
c:\program files\Hotspot Shield\bin\openvpnas.exe
c:\program files\Intel\Intel Application Accelerator\IAANTmon.exe
c:\progra~1\Iomega\System32\AppServices.exe
c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
c:\program files\NovaStor\NovaStor NovaBACKUP\nsCtrl.exe
c:\program files\BitDefender\BitDefender 2009\seccenter.exe
.
**************************************************************************
.
Completion time: 2009-08-11 18:37 - machine was rebooted [Sarah Legon]
ComboFix-quarantined-files.txt 2009-08-11 16:37

Pre-Run: 31,737,135,104 bytes free
Post-Run: 44,055,445,504 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT= "Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS= "Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

228 --- E O F --- 2009-08-11 13:33

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:50:40 PM, on 8/11/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\NovaStor\NovaStor NovaBACKUP\DR\CBP\DCSchdler.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Hotspot Shield\bin\openvpnas.exe
C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe
C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
C:\Program Files\NovaStor\NovaStor NovaBACKUP\nsService.exe
C:\Program Files\NovaStor\NovaStor NovaBACKUP\DR\Fsloader.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
C:\WINDOWS\MXOALDR.EXE
C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe
C:\Program Files\NovaStor\NovaStor NovaBACKUP\nsCtrl.exe
C:\Program Files\BitDefender\BitDefender 2009\seccenter.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Mozilla Firefox\firefox.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.euro.dell.com/countries/fr/fra/gen/default.htm
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.euro.dell.com/countries/fr/fra/gen/default.htm
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Hotspot Shield Class - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Program Files\Hotspot Shield\hssie\HssIE.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2009\IEToolbar.dll
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe "
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe "
O4 - HKLM\..\Run: [MXO Auto Loader] "C:\WINDOWS\MXOALDR.EXE "
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe "
O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2009\IEShow.exe "
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Cordless DUALphone Startup.lnk = ?
O4 - Global Startup: NovaBACKUP Tray Control.lnk = C:\Program Files\NovaStor\NovaStor NovaBACKUP\nsCtrl.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.c...ls/en/x86/client/wuweb_site.cab?1095004391125
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: BitDefender Arrakis Server (Arrakis3) - Unknown owner - C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Backup Scheduler - Unknown owner - C:\Program Files\NovaStor\NovaStor NovaBACKUP\DR\CBP\DCSchdlerSRVC.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Google Desktop Manager 5.9.906.4286 (GoogleDesktopManager-060409-093314) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Hotspot Shield Service (HotspotShieldService) - Unknown owner - C:\Program Files\Hotspot Shield\bin\openvpnas.exe
O23 - Service: Hotspot Shield Routing Service (HssSrv) - AnchorFree Inc. - C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe
O23 - Service: Hotspot Shield Tray Service (HssTrayService) - Unknown owner - C:\Program Files\Hotspot Shield\bin\HssTrayService.EXE
O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
O23 - Service: NovaStor NovaBACKUP Backup/Copy Engine (nsService) - NovaStor - C:\Program Files\NovaStor\NovaStor NovaBACKUP\nsService.exe
O23 - Service: Real time Backup Loader - Unknown owner - C:\Program Files\NovaStor\NovaStor NovaBACKUP\DR\Fsloader.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S. R. L. - C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe
O23 - Service: Iomega Active Disk (_IOMEGA_ACTIVE_DISK_SERVICE_) - Iomega Corporation - C:\Program Files\Iomega\AutoDisk\ADService.exe

--
End of file - 7223 bytes

broni · 2009/08/11

1. Please open Notepad

Click Start , then Run

Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:
Code:
File::
c:\windows\S9677A04A.tmp

Folder::

Driver::
efbDisk


Registry::

RegLockDel::
3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

Combofix.txt

A new HijackThis log.

garsar · 2009/08/12

Here are the 2 latest logs:
ComboFix 09-08-10.06 - Sarah Legon 08/12/2009 7:40.2.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.3070.2618 [GMT 2:00]
Running from: c:\documents and settings\Sarah Legon\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Sarah Legon\My Documents\CFScript.txt
AV: BitDefender Antivirus *On-access scanning disabled* (Updated) {6C4BB89C-B0ED-4F41-A29C-4373888923BB}

FILE ::
"c:\windows\S9677A04A.tmp "
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\S9677A04A.tmp

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_efbDisk

((((((((((((((((((((((((( Files Created from 2009-07-12 to 2009-08-12 )))))))))))))))))))))))))))))))
.

2009-08-11 16:44 . 2009-08-11 16:44 -------- d-----w- c:\program files\Trend Micro
2009-08-11 13:31 . 2008-02-26 11:59 294912 ------w- c:\windows\system32\dllcache\msctf.dll
2009-08-11 13:27 . 2009-08-11 13:27 0 ----a-w- c:\windows\system32\cd.dat
2009-08-10 11:43 . 2009-08-11 15:33 -------- d-----w- C:\Netbak
2009-08-10 09:01 . 2009-08-10 09:01 -------- d-----w- c:\documents and settings\Sarah Legon\Application Data\Malwarebytes
2009-08-10 09:01 . 2009-08-03 11:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-10 09:01 . 2009-08-10 09:01 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-08-10 09:01 . 2009-08-10 09:01 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-08-10 09:01 . 2009-08-03 11:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-08-10 07:15 . 2009-08-10 09:54 117760 ----a-w- c:\documents and settings\Sarah Legon\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-08-10 07:14 . 2009-08-10 07:14 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-08-10 07:14 . 2009-08-10 07:14 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-08-10 07:14 . 2009-08-10 07:14 -------- d-----w- c:\documents and settings\Sarah Legon\Application Data\SUPERAntiSpyware.com
2009-08-09 12:33 . 2009-08-09 12:33 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Google
2009-08-09 12:26 . 2009-08-09 12:26 -------- d-----w- C:\Hotspot Shield
2009-08-09 11:52 . 2009-08-12 05:47 15360 ---h--w- C:\logicinf.bin
2009-08-09 11:52 . 2009-05-20 18:02 77472 ----a-w- c:\windows\system32\drivers\dcsnap.sys
2009-08-09 11:52 . 2009-05-20 18:02 512 --sh--r- C:\FARSBOOT.BIN
2009-08-09 11:52 . 2009-05-20 18:02 155648 ----a-w- c:\windows\system32\drivers\DCDisk.sys
2009-08-09 11:40 . 2009-08-09 11:40 -------- d-----w- c:\documents and settings\Sarah Legon\Local Settings\Application Data\NovaStor
2009-08-09 11:39 . 2009-08-09 11:39 -------- d-----w- c:\program files\NovaStor
2009-08-09 11:39 . 2009-08-09 11:39 -------- d-----w- c:\documents and settings\All Users\Application Data\NovaStor
2009-08-09 09:38 . 2009-03-06 14:44 283648 ------w- c:\windows\system32\dllcache\pdh.dll
2009-08-09 09:38 . 2009-02-06 16:54 35328 ------w- c:\windows\system32\dllcache\sc.exe
2009-08-09 09:38 . 2005-07-26 04:39 60416 ------w- c:\windows\system32\dllcache\colbact.dll
2009-08-09 09:38 . 2009-02-09 10:20 399360 ------w- c:\windows\system32\dllcache\rpcss.dll
2009-08-09 09:38 . 2009-02-09 10:20 714752 ------w- c:\windows\system32\dllcache\ntdll.dll
2009-08-09 09:38 . 2009-02-09 10:20 616960 ------w- c:\windows\system32\dllcache\advapi32.dll
2009-08-09 09:38 . 2009-02-09 10:20 473088 ------w- c:\windows\system32\dllcache\fastprox.dll
2009-08-09 09:38 . 2009-02-09 10:20 453120 ------w- c:\windows\system32\dllcache\wmiprvsd.dll
2009-08-09 09:38 . 2009-02-06 17:14 110592 ------w- c:\windows\system32\dllcache\services.exe
2009-08-09 09:38 . 2009-02-06 16:39 227840 ------w- c:\windows\system32\dllcache\wmiprvse.exe
2009-08-09 09:37 . 2008-04-21 10:02 215552 ------w- c:\windows\system32\dllcache\wordpad.exe
2009-08-09 09:34 . 2009-08-09 09:34 -------- d-----w- c:\documents and settings\Sarah Legon\Application Data\BitDefender
2009-08-09 09:34 . 2009-08-09 10:58 -------- d-----w- c:\documents and settings\All Users\Application Data\BitDefender
2009-08-09 09:17 . 2009-08-10 06:51 -------- d-----w- C:\Tech Save
2009-07-21 23:22 . 2009-07-21 23:22 28592 ----a-w- c:\windows\system32\drivers\tap0901.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-12 05:45 . 2008-07-03 11:23 81984 ----a-w- c:\windows\system32\bdod.bin
2009-08-12 05:31 . 2006-02-23 13:48 -------- d-----w- c:\documents and settings\Sarah Legon\Application Data\AdobeUM
2009-08-12 05:30 . 2004-09-11 08:36 -------- d-----w- c:\program files\Common Files\Adobe
2009-08-12 05:16 . 2005-02-26 14:43 -------- d-----w- c:\program files\Mozilla Thunderbird
2009-08-10 10:40 . 2008-10-22 07:58 229376 ---ha-w- C:\index.sys
2009-08-10 10:40 . 2008-10-22 07:57 2439119 ----a-w- C:\driverbmp.bin
2009-08-10 07:13 . 2008-09-10 08:37 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-08-09 16:52 . 2007-11-10 15:36 800355 ----a-w- c:\documents and settings\All Users\gl.zip
2009-08-09 12:33 . 2008-05-20 14:20 -------- d-----w- c:\program files\Picasa2
2009-08-09 12:26 . 2008-03-11 13:25 -------- d-----w- c:\program files\Hotspot Shield
2009-08-09 12:22 . 2004-09-14 12:48 -------- d-----w- c:\program files\Ahead
2009-08-09 12:07 . 2008-05-20 14:14 -------- d-----w- c:\program files\Google
2009-08-09 11:05 . 2007-04-13 06:01 -------- d-----w- c:\documents and settings\Sarah Legon\Application Data\SiteAdvisor
2009-08-09 09:34 . 2008-03-04 19:11 -------- d-----w- c:\program files\BitDefender
2009-08-09 09:34 . 2008-03-04 19:10 -------- d-----w- c:\program files\Common Files\BitDefender
2009-06-30 12:06 . 2009-06-30 12:06 33840 ----a-w- c:\windows\system32\drivers\HssDrv.sys
2009-06-26 16:18 . 2004-02-06 17:05 659456 ----a-w- c:\windows\system32\wininet.dll
2009-06-26 16:18 . 2004-08-04 07:56 81920 ----a-w- c:\windows\system32\ieencode.dll
2009-06-16 14:55 . 2004-03-19 16:43 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-16 14:55 . 2004-03-19 16:37 82432 ----a-w- c:\windows\system32\fontsub.dll
2009-06-03 19:27 . 2003-05-30 08:00 1290752 ----a-w- c:\windows\system32\quartz.dll
2009-05-20 18:02 . 2009-05-20 18:02 588856 ----a-w- c:\documents and settings\All Users\Application Data\NovaStor\NovaStor NovaBACKUP\nse_w32.dll
2009-03-05 16:08 . 2009-08-09 10:58 61440 ----a-w- c:\program files\mozilla firefox\components\FFComm.dll
2009-08-09 12:07 . 2009-08-09 12:07 122880 ----a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
2006-10-11 08:04 . 2006-02-02 13:33 61036 ----a-w- c:\program files\mozilla firefox\components\jar50.dll
2006-10-11 08:04 . 2006-02-02 13:33 48742 ----a-w- c:\program files\mozilla firefox\components\jsd3250.dll
2006-10-11 08:05 . 2006-10-26 14:34 29313 ----a-w- c:\program files\mozilla firefox\components\myspell.dll
2006-10-11 08:05 . 2006-10-26 14:34 41082 ----a-w- c:\program files\mozilla firefox\components\spellchk.dll
2006-10-11 08:04 . 2006-02-02 13:33 166510 ----a-w- c:\program files\mozilla firefox\components\xpinstal.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-08-11_16.33.54 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-08-12 05:45 . 2009-08-12 05:45 8192 c:\windows\ERDNT\subs\Users\00000004\UsrClass.dat
- 2009-08-11 15:42 . 2009-08-11 15:42 8192 c:\windows\ERDNT\subs\Users\00000004\UsrClass.dat
- 2009-08-11 15:42 . 2009-08-11 15:42 8192 c:\windows\ERDNT\subs\Users\00000002\UsrClass.dat
+ 2009-08-12 05:45 . 2009-08-12 05:45 8192 c:\windows\ERDNT\subs\Users\00000002\UsrClass.dat
- 2009-08-11 15:42 . 2009-08-11 15:42 163840 c:\windows\ERDNT\subs\Users\00000006\UsrClass.dat
+ 2009-08-12 05:45 . 2009-08-12 05:45 163840 c:\windows\ERDNT\subs\Users\00000006\UsrClass.dat
- 2009-08-11 15:42 . 2009-08-11 15:42 237568 c:\windows\ERDNT\subs\Users\00000003\NTUSER.DAT
+ 2009-08-12 05:45 . 2009-08-12 05:45 237568 c:\windows\ERDNT\subs\Users\00000003\NTUSER.DAT
- 2009-08-11 15:42 . 2009-08-11 15:42 237568 c:\windows\ERDNT\subs\Users\00000001\NTUSER.DAT
+ 2009-08-12 05:45 . 2009-08-12 05:45 237568 c:\windows\ERDNT\subs\Users\00000001\NTUSER.DAT
+ 2009-08-12 05:45 . 2009-08-12 05:45 12103680 c:\windows\ERDNT\subs\Users\00000005\ntuser.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}]
2009-01-23 18:07 204248 ----a-w- c:\program files\Hotspot Shield\HssIE\HssIE.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif "= "c:\program files\Intel\Intel Application Accelerator\iaanotif.exe" [2004-03-23 135168]
"ATIPTA "= "c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-05-25 335872]
"MXO Auto Loader "= "c:\windows\MXOALDR.EXE" [2003-04-07 118784]
"BDAgent "= "c:\program files\BitDefender\BitDefender 2009\bdagent.exe" [2009-04-08 778240]
"BitDefender Antiphishing Helper "= "c:\program files\BitDefender\BitDefender 2009\IEShow.exe" [2009-02-23 69632]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.exe.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2004-9-11 113664]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} "= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 10:05 356352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@= "Service "

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe "=
"c:\\Program Files\\Messenger\\msmsgs.exe "=
"c:\\Program Files\\LimeWire\\LimeWire.exe "=
"%windir%\\system32\\sessmgr.exe "=
"c:\\Program Files\\Skype\\Phone\\Skype.exe "=

R0 dcsnap;dcsnap;c:\windows\SYSTEM32\DRIVERS\dcsnap.sys [8/9/2009 1:52 PM 77472]
R0 ppa;Iomega Parallel Port Filter Driver;c:\windows\SYSTEM32\DRIVERS\ppa.sys [9/12/2004 3:13 PM 17792]
R1 DCDisk;DCDisk;c:\windows\SYSTEM32\DRIVERS\DCDisk.sys [8/9/2009 1:52 PM 155648]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [8/5/2009 4:06 PM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [8/5/2009 4:06 PM 74480]
R2 HssSrv;Hotspot Shield Routing Service;c:\program files\Hotspot Shield\HssWPR\hsssrv.exe [6/15/2009 11:49 PM 331312]
R2 nsService;NovaStor NovaBACKUP Backup/Copy Engine;c:\program files\NovaStor\NovaStor NovaBACKUP\nsService.exe [6/22/2009 9:03 AM 257088]
R2 Real time Backup Loader;Real time Backup Loader;c:\program files\NovaStor\NovaStor NovaBACKUP\DR\FsLoader.exe [8/9/2009 1:52 PM 90112]
R3 bdfm;BDFM;c:\windows\SYSTEM32\DRIVERS\bdfm.sys [9/18/2008 12:09 PM 111112]
R3 P1120VID;Creative WebCam NX Ultra;c:\windows\SYSTEM32\DRIVERS\P1120Vid.sys [1/28/2006 6:47 PM 1252474]
R3 tap0901;TAP-Win32 Adapter V9;c:\windows\SYSTEM32\DRIVERS\tap0901.sys [7/22/2009 1:22 AM 28592]
S2 Backup Scheduler;Backup Scheduler;c:\program files\NovaStor\NovaStor NovaBACKUP\DR\CBP\DCSchdlerSRVC.exe [8/9/2009 1:52 PM 98304]
S2 DVR2INS;ADS Instant DVD 2.0;c:\windows\SYSTEM32\DRIVERS\dvr2ins.sys [4/7/2006 1:39 PM 34792]
S3 Arrakis3;BitDefender Arrakis Server;c:\program files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe [1/20/2009 7:16 PM 172032]
S3 GoogleDesktopManager-060409-093314;Google Desktop Manager 5.9.906.4286;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [8/9/2009 2:07 PM 30192]
S3 HssTrayService;Hotspot Shield Tray Service;c:\program files\Hotspot Shield\bin\HssTrayService.exe [7/22/2009 1:23 AM 57640]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [8/5/2009 4:06 PM 7408]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bdx REG_MULTI_SZ scan
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
mStart Page = hxxp://www.euro.dell.com/countries/fr/fra/gen/default.htm
uInternet Connection Wizard,ShellNext = hxxp://www.euro.dell.com/countries/fr/fra/gen/default.htm
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Sarah Legon\Application Data\Mozilla\Firefox\Profiles\4nr8tqiw.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.nytimes.com/
FF - component: c:\program files\Mozilla Firefox\components\FFComm.dll
FF - component: c:\program files\Mozilla Firefox\components\GoogleDesktopMozilla.dll
FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-12 08:01
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Iomega Activity Disk2]
"ImagePath "= "\ "\" "
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1132)
c:\program files\SUPERAntiSpyware\SASWINLO.dll

- - - - - - - > 'explorer.exe'(3132)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\SYSTEM32\ati2evxx.exe
c:\program files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
c:\program files\BitDefender\BitDefender 2009\vsserv.exe
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\windows\SYSTEM32\CTSVCCDA.EXE
c:\program files\NovaStor\NovaStor NovaBACKUP\DR\CBP\DCSchdler.exe
c:\program files\Hotspot Shield\bin\openvpnas.exe
c:\program files\Intel\Intel Application Accelerator\IAANTmon.exe
c:\progra~1\Iomega\System32\AppServices.exe
c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
c:\program files\NovaStor\NovaStor NovaBACKUP\nsCtrl.exe
c:\program files\BitDefender\BitDefender 2009\seccenter.exe
.
**************************************************************************
.
Completion time: 2009-08-12 8:06 - machine was rebooted
ComboFix-quarantined-files.txt 2009-08-12 06:06
ComboFix2.txt 2009-08-11 16:37

Pre-Run: 43,935,506,432 bytes free
Post-Run: 43,889,410,048 bytes free

207 --- E O F --- 2009-08-11 13:33

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:23:04 AM, on 8/12/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\NovaStor\NovaStor NovaBACKUP\DR\CBP\DCSchdler.exe
C:\Program Files\Hotspot Shield\bin\openvpnas.exe
C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe
C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
C:\Program Files\NovaStor\NovaStor NovaBACKUP\nsService.exe
C:\Program Files\NovaStor\NovaStor NovaBACKUP\DR\Fsloader.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
C:\WINDOWS\MXOALDR.EXE
C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe
C:\Program Files\NovaStor\NovaStor NovaBACKUP\nsCtrl.exe
C:\Program Files\BitDefender\BitDefender 2009\seccenter.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.euro.dell.com/countries/fr/fra/gen/default.htm
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.euro.dell.com/countries/fr/fra/gen/default.htm
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Hotspot Shield Class - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Program Files\Hotspot Shield\hssie\HssIE.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2009\IEToolbar.dll
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe "
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe "
O4 - HKLM\..\Run: [MXO Auto Loader] "C:\WINDOWS\MXOALDR.EXE "
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe "
O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2009\IEShow.exe "
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Cordless DUALphone Startup.lnk = ?
O4 - Global Startup: NovaBACKUP Tray Control.lnk = C:\Program Files\NovaStor\NovaStor NovaBACKUP\nsCtrl.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.c...ls/en/x86/client/wuweb_site.cab?1095004391125
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: BitDefender Arrakis Server (Arrakis3) - Unknown owner - C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Backup Scheduler - Unknown owner - C:\Program Files\NovaStor\NovaStor NovaBACKUP\DR\CBP\DCSchdlerSRVC.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Google Desktop Manager 5.9.906.4286 (GoogleDesktopManager-060409-093314) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Hotspot Shield Service (HotspotShieldService) - Unknown owner - C:\Program Files\Hotspot Shield\bin\openvpnas.exe
O23 - Service: Hotspot Shield Routing Service (HssSrv) - AnchorFree Inc. - C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe
O23 - Service: Hotspot Shield Tray Service (HssTrayService) - Unknown owner - C:\Program Files\Hotspot Shield\bin\HssTrayService.EXE
O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
O23 - Service: NovaStor NovaBACKUP Backup/Copy Engine (nsService) - NovaStor - C:\Program Files\NovaStor\NovaStor NovaBACKUP\nsService.exe
O23 - Service: Real time Backup Loader - Unknown owner - C:\Program Files\NovaStor\NovaStor NovaBACKUP\DR\Fsloader.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S. R. L. - C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe
O23 - Service: Iomega Active Disk (_IOMEGA_ACTIVE_DISK_SERVICE_) - Iomega Corporation - C:\Program Files\Iomega\AutoDisk\ADService.exe

--
End of file - 7223 bytes

broni · 2009/08/12

Uninstall Combofix:
Go Start > Run
Type in:
combofix /u
Note the space between the "combofix" and the "/u "
Restart computer.

Download Dr.Web CureIt to the desktop:
ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe

Doubleclick the drweb-cureit.exe file and click Scan to run express scan. Click OK in pop-up window to allow scan.

This will scan the files currently running in memory and when something is found, click the Yes button when it asks you if you want to cure it. This is only a short scan.

Once the short scan has finished, select Complete scan.

Click the green arrow at the right, and the scan will start.

Click Yes to all if it asks if you want to cure/move the file.

When the scan has finished, in the menu, click File and choose Save report list

Save the report to your desktop. The report will be called DrWeb.csv

Close Dr.Web Cureit.

Important! Reboot your computer because it could be possible that files in use will be moved/deleted during reboot.

Copy and paste that log in the next reply. You can use Notepad to open the DrWeb.cvs report.

NOTE. During the scan, pop-up window will open asking for full version purchase. Simply close the window by clicking on X in upper right corner.

Post fresh HijackThis log as well.

Log in or Sign up

Active missing icons/desktop

garsar Well-Known Member Thread Starter

broni Moderator Malware Analyst

garsar Well-Known Member Thread Starter

garsar Well-Known Member Thread Starter

garsar Well-Known Member Thread Starter

broni Moderator Malware Analyst

garsar Well-Known Member Thread Starter

broni Moderator Malware Analyst

garsar Well-Known Member Thread Starter

broni Moderator Malware Analyst

garsar Well-Known Member Thread Starter

broni Moderator Malware Analyst

garsar Well-Known Member Thread Starter

broni Moderator Malware Analyst

garsar Well-Known Member Thread Starter

broni Moderator Malware Analyst

garsar Well-Known Member Thread Starter

broni Moderator Malware Analyst

garsar Well-Known Member Thread Starter

broni Moderator Malware Analyst

Share This Page

Log in or Sign up

Active missing icons/desktop

garsar Well-Known Member Thread Starter

broni Moderator Malware Analyst

garsar Well-Known Member Thread Starter

garsar Well-Known Member Thread Starter

garsar Well-Known Member Thread Starter

broni Moderator Malware Analyst

garsar Well-Known Member Thread Starter

broni Moderator Malware Analyst

garsar Well-Known Member Thread Starter

broni Moderator Malware Analyst

garsar Well-Known Member Thread Starter

broni Moderator Malware Analyst

garsar Well-Known Member Thread Starter

broni Moderator Malware Analyst

garsar Well-Known Member Thread Starter

broni Moderator Malware Analyst

garsar Well-Known Member Thread Starter

broni Moderator Malware Analyst

garsar Well-Known Member Thread Starter

broni Moderator Malware Analyst

Share This Page

Useful Searches