Solved pls help this keeps popping up (your computer is infected)

[Resolved] pls help this keeps popping up (your computer is infected)

hi
i keep getting a pop up in the right corner at the bottom saying
your computer is infected
windows has dectected spyware infection
and says it has 2 download an antispyare to delete the virus
also there are other viruses on my comp pls help
i had avast home edition it kept detecting viruses and deleting them but they came back so in removed it and installed kaspersky trial version still the same didnt help

thanks
looking forward for your reply

 

hi
sorry i am a noob
i dont no how to Disable any script blocking protection
and wen i click on dss opens and says the system cannot find the file specified
sorry pls help

 

hi i use avast home but could not disable it so uninstalled it
and i managed to remove that pop up at the bottom but there are many more viruses

combo fix

ComboFix 09-08-10.06 - Airtel 08/14/2009 18:51.2.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.446.175 [GMT 5.5:30]
Running from: c:\documents and settings\Airtel\Desktop\ComboFix.exe
.

((((((((((((((((((((((((( Files Created from 2009-07-14 to 2009-08-14 )))))))))))))))))))))))))))))))
.

2009-08-13 09:54 . 2009-08-13 09:54 18755 ----a-w- c:\documents and settings\LocalService\Application Data\rymixuru.pif
2009-08-13 09:54 . 2009-08-13 09:54 17472 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\ybebogy.sys
2009-08-13 09:54 . 2009-08-13 09:54 17136 ----a-w- c:\program files\Common Files\gilezukyv.dll
2009-08-13 09:54 . 2009-08-13 09:54 16275 ----a-w- c:\program files\Common Files\lemyxuheho.pif
2009-08-13 09:54 . 2009-08-13 09:54 16008 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\wacifor.exe
2009-08-13 09:54 . 2009-08-13 09:54 15134 ----a-w- c:\documents and settings\LocalService\Application Data\paxugomi.exe
2009-08-13 09:54 . 2009-08-13 09:54 13284 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\itas.bat
2009-08-13 09:54 . 2009-08-13 09:54 12949 ----a-w- c:\windows\wazerory.com
2009-08-13 09:54 . 2009-08-13 09:54 10907 ----a-w- c:\windows\jiryze.dat
2009-08-13 09:54 . 2009-08-13 09:54 10161 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\ojogy.dll
2009-08-13 09:54 . 2009-08-13 09:54 13911 ----a-w- c:\windows\system32\zebyposege.bat
2009-08-13 09:51 . 2009-08-13 09:51 -------- d-----w- C:\PC_Antispyware2010
2009-08-13 05:29 . 2009-07-10 13:27 1315328 -c----w- c:\windows\system32\dllcache\msoe.dll
2009-08-12 20:57 . 2009-08-12 20:57 -------- d-----w- c:\documents and settings\LocalService\Application Data\SACore
2009-08-12 20:57 . 2009-08-12 20:57 -------- d-----w- c:\windows\system32\config\systemprofile\Application Data\SACore
2009-08-12 20:57 . 2009-08-12 20:57 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Kaspersky Lab Setup Files
2009-08-12 20:56 . 2009-08-12 20:56 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\SiteAdvisor
2009-08-12 20:41 . 2009-08-03 08:06 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-12 20:41 . 2009-08-12 20:41 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-08-12 20:41 . 2009-08-03 08:06 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-08-12 20:35 . 2009-08-12 20:35 -------- d-----w- c:\program files\Trend Micro
2009-08-12 20:19 . 2001-08-23 12:00 2944 -c--a-w- c:\windows\system32\dllcache\null.sys
2009-08-12 20:19 . 2001-08-23 12:00 2944 ----a-w- c:\windows\system32\drivers\null.sys
2009-08-12 20:17 . 2009-08-12 20:17 619584 -c--a-w- c:\windows\system32\dllcache\ntfs.sys
2009-08-12 18:23 . 2008-04-13 18:45 26112 -c--a-w- c:\windows\system32\dllcache\usbser.sys
2009-08-12 18:23 . 2008-04-13 18:45 26112 ----a-w- c:\windows\system32\drivers\usbser.sys
2009-08-12 18:22 . 2008-03-21 08:27 14640 ------w- c:\windows\system32\spmsgXP_2k3.dll
2009-08-12 18:19 . 2009-08-12 18:38 -------- d-----w- c:\documents and settings\Airtel\Application Data\Nokia
2009-08-12 18:19 . 2009-08-12 18:23 -------- d-----w- c:\documents and settings\Airtel\Application Data\PC Suite
2009-08-12 18:19 . 2009-08-12 18:19 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\PC Suite
2009-08-12 18:13 . 2009-02-09 03:07 91136 ----a-w- c:\windows\system32\nmwcdcls.dll
2009-08-12 18:13 . 2009-08-12 18:01 33773208 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Nokia_PC_Suite_7_1_30_9_eng_web.exe
2009-08-12 18:12 . 2009-08-12 18:12 95232 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Installer\CommonCustomActions\pcswpcsi.exe
2009-08-12 18:12 . 2009-08-12 18:12 8192 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Installer\CommonCustomActions\UninstCCD.exe
2009-08-12 18:12 . 2009-08-12 18:12 61440 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Installer\CommonCustomActions\UninstPCSFEMsi.exe
2009-08-12 18:12 . 2009-08-12 18:12 10240 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Installer\CommonCustomActions\UninstPCS.exe
2009-08-12 18:12 . 2009-08-12 18:12 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Installations
2009-08-12 16:41 . 2008-04-13 18:47 25856 -c--a-w- c:\windows\system32\dllcache\usbprint.sys
2009-08-12 16:41 . 2008-04-13 18:47 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys
2009-08-12 16:41 . 2008-04-13 18:45 32128 -c--a-w- c:\windows\system32\dllcache\usbccgp.sys
2009-08-12 16:41 . 2008-04-13 18:45 32128 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2009-08-11 14:03 . 2009-08-11 14:03 -------- d-----w- c:\documents and settings\Airtel\Application Data\AdobeUM
2009-08-10 13:31 . 2009-08-10 13:31 -------- d-----w- c:\documents and settings\Airtel\Application Data\Malwarebytes
2009-08-10 13:31 . 2009-08-10 13:31 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Malwarebytes
2009-08-09 16:38 . 2009-08-09 16:38 -------- d-----w- c:\documents and settings\Airtel\Application Data\Windows Search
2009-08-09 16:25 . 2009-08-09 16:25 -------- d-----w- c:\program files\Microsoft Silverlight
2009-08-09 16:20 . 2009-08-09 16:20 -------- d-----w- c:\windows\system32\XPSViewer
2009-08-09 16:20 . 2009-08-09 16:20 -------- d-----w- c:\program files\MSBuild
2009-08-09 16:20 . 2009-08-09 16:20 -------- d-----w- c:\program files\Reference Assemblies
2009-08-09 16:20 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll
2009-08-09 16:20 . 2009-08-09 16:20 -------- d-----w- C:\3da9b14326d2e030cb0bbfa3e528
2009-08-09 16:20 . 2008-07-06 12:06 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-08-09 16:20 . 2008-07-06 12:06 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll
2009-08-09 16:20 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll
2009-08-09 16:20 . 2008-07-06 12:06 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll
2009-08-09 16:20 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll
2009-08-09 16:20 . 2008-07-06 10:50 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-08-09 16:14 . 2009-08-09 16:14 -------- d-----w- c:\documents and settings\Airtel\Application Data\Windows Desktop Search
2009-08-09 16:14 . 2009-08-10 20:00 -------- d-----w- c:\program files\Windows Desktop Search
2009-08-09 16:14 . 2009-08-09 16:14 -------- d-----w- c:\windows\system32\GroupPolicy
2009-08-09 16:13 . 2008-03-07 17:02 98304 -c----w- c:\windows\system32\dllcache\nlhtml.dll
2009-08-09 16:13 . 2008-03-07 17:02 29696 -c----w- c:\windows\system32\dllcache\mimefilt.dll
2009-08-09 16:13 . 2008-03-07 17:02 192000 -c----w- c:\windows\system32\dllcache\offfilt.dll
2009-08-08 20:21 . 2009-08-08 20:21 -------- d-----w- c:\program files\Ashampoo
2009-08-08 20:21 . 2009-08-08 20:21 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\page
2009-08-08 16:53 . 2008-04-13 18:45 26368 -c--a-w- c:\windows\system32\dllcache\usbstor.sys
2009-08-08 15:46 . 2009-08-08 15:47 -------- d-----w- c:\documents and settings\Airtel\Local Settings\Application Data\Adobe
2009-08-07 18:01 . 2009-08-07 18:01 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2009-08-07 16:46 . 2009-08-07 16:46 -------- d-----w- c:\documents and settings\Airtel\Local Settings\Application Data\Identities
2009-08-06 22:30 . 2009-08-06 22:30 -------- d-----w- c:\program files\Microsoft CAPICOM 2.1.0.2
2009-08-06 17:21 . 2009-08-06 17:21 -------- d-----w- c:\documents and settings\Airtel\Application Data\Ashampoo
2009-08-06 17:19 . 2009-08-06 17:19 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\ashampoo
2009-08-06 17:19 . 2009-08-06 17:19 -------- d-----w- c:\documents and settings\Airtel\Local Settings\Application Data\ashampoo
2009-08-06 04:05 . 2009-08-11 20:59 -------- d-----w- c:\documents and settings\Airtel\Application Data\LimeWire
2009-08-06 04:05 . 2009-08-06 04:05 -------- d-----w- c:\program files\LimeWire
2009-08-05 23:22 . 2008-10-16 08:36 268648 ----a-w- c:\windows\system32\mucltui.dll
2009-08-05 23:22 . 2008-10-16 08:36 208744 ----a-w- c:\windows\system32\muweb.dll
2009-08-05 10:28 . 2009-08-12 19:18 -------- d-----w- c:\documents and settings\Airtel\Tracing
2009-08-05 10:18 . 2009-08-05 10:18 -------- d-----w- c:\program files\Microsoft
2009-08-05 10:18 . 2009-08-05 10:18 -------- d-----w- c:\program files\Windows Live SkyDrive
2009-08-05 10:18 . 2009-08-05 10:18 -------- d-----w- c:\program files\Windows Live
2009-08-05 09:01 . 2009-08-05 09:01 204800 -c----w- c:\windows\system32\dllcache\mswebdvd.dll
2009-08-05 04:30 . 2009-08-05 04:30 -------- d-----w- c:\windows\Sun
2009-08-04 14:37 . 2009-08-04 14:37 -------- d-----w- c:\program files\Languages
2009-08-04 14:36 . 2007-11-08 13:42 114688 ----a-w- c:\program files\Firefox Ultimate Optimizer.exe
2009-08-04 12:59 . 2009-08-04 14:38 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-08-04 12:53 . 2009-08-07 02:09 -------- d-----w- c:\windows\SxsCaPendDel
2009-08-04 12:46 . 2009-08-04 14:38 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton
2009-08-04 12:46 . 2009-08-04 12:46 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Symantec
2009-08-04 12:46 . 2009-08-04 12:46 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\NortonInstaller
2009-08-04 12:33 . 2009-08-04 12:35 -------- d-----w- c:\windows\system32\Adobe
2009-08-04 12:32 . 2009-08-04 12:42 -------- d-----w- c:\program files\NOS
2009-08-04 12:32 . 2009-08-04 12:42 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\NOS
2009-08-04 11:31 . 2009-08-04 11:31 0 ----a-w- c:\windows\ativpsrm.bin
2009-08-04 11:30 . 2009-08-04 11:30 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\ATI
2009-08-04 11:30 . 2009-08-04 11:30 -------- d-----w- c:\documents and settings\Airtel\Local Settings\Application Data\ATI
2009-08-04 11:30 . 2009-08-04 11:30 -------- d-----w- c:\documents and settings\Airtel\Application Data\ATI
2009-08-04 11:29 . 2009-08-04 11:29 -------- d-----w- c:\program files\Common Files\ATI Technologies
2009-08-04 10:31 . 2009-08-04 10:31 766 ----a-r- c:\documents and settings\Airtel\Application Data\Microsoft\Installer\{F5242227-2051-4158-AC42-0F2BAA3CD3D6}\ARPPRODUCTICON.exe
2009-08-04 10:31 . 2009-08-04 10:31 40960 ----a-r- c:\documents and settings\Airtel\Application Data\Microsoft\Installer\{F5242227-2051-4158-AC42-0F2BAA3CD3D6}\New_Shortcut_S1425_ADB54615A0E240F89C5EFD8513472ED3.exe
2009-08-04 10:31 . 2009-08-04 10:31 -------- d-----w- c:\program files\COMPAQ
2009-08-04 10:19 . 2009-08-04 10:19 -------- d-----w- c:\program files\Common Files\Windows Live
2009-08-04 09:58 . 2009-08-04 11:29 -------- d-----w- c:\program files\ATI Technologies
2009-08-04 09:57 . 2009-08-04 09:57 -------- d-----w- C:\ATI
2009-08-04 07:52 . 2009-08-04 07:52 -------- d-sh--w- c:\documents and settings\Airtel\IECompatCache
2009-08-04 07:51 . 2009-08-04 07:51 -------- d-sh--w- c:\documents and settings\Airtel\PrivacIE
2009-08-04 07:49 . 2009-08-04 07:49 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2009-08-04 07:48 . 2009-08-04 07:48 -------- d-sh--w- c:\documents and settings\Airtel\IETldCache
2009-08-04 07:45 . 2009-07-03 17:09 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2009-08-04 07:44 . 2009-07-03 17:09 594432 -c----w- c:\windows\system32\dllcache\msfeeds.dll
2009-08-04 07:44 . 2009-07-03 17:09 55296 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll
2009-08-04 07:44 . 2009-07-03 17:09 1985536 -c----w- c:\windows\system32\dllcache\iertutil.dll
2009-08-04 07:44 . 2009-07-19 13:18 11067392 -c----w- c:\windows\system32\dllcache\ieframe.dll
2009-08-04 07:44 . 2009-07-03 17:09 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2009-08-04 07:44 . 2009-08-04 07:45 -------- d-----w- c:\windows\ie8updates
2009-08-04 07:44 . 2009-07-01 07:08 101376 -c----w- c:\windows\system32\dllcache\iecompat.dll
2009-08-04 07:43 . 2009-08-04 07:44 -------- dc-h--w- c:\windows\ie8
2009-08-04 03:54 . 2009-08-04 03:54 -------- d-----w- c:\program files\MSXML 4.0
2009-08-04 03:45 . 2009-03-06 14:22 284160 -c----w- c:\windows\system32\dllcache\pdh.dll
2009-08-04 03:45 . 2009-02-09 12:10 729088 -c----w- c:\windows\system32\dllcache\lsasrv.dll
2009-08-04 03:45 . 2009-02-09 12:10 617472 -c----w- c:\windows\system32\dllcache\advapi32.dll
2009-08-04 03:45 . 2009-02-09 12:10 473600 -c----w- c:\windows\system32\dllcache\fastprox.dll
2009-08-04 03:45 . 2009-02-09 12:10 453120 -c----w- c:\windows\system32\dllcache\wmiprvsd.dll
2009-08-04 03:45 . 2009-02-09 12:10 401408 -c----w- c:\windows\system32\dllcache\rpcss.dll
2009-08-04 03:45 . 2009-02-06 11:11 110592 -c----w- c:\windows\system32\dllcache\services.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-12 18:22 . 2009-08-12 18:22 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01007.Wdf
2009-08-12 18:22 . 2009-08-12 18:22 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
2009-08-12 18:15 . 2009-08-12 18:14 -------- d-----w- c:\program files\DIFX
2009-08-12 18:14 . 2009-08-12 18:14 -------- d-----w- c:\program files\Common Files\PCSuite
2009-08-12 18:14 . 2009-08-12 18:14 -------- d-----w- c:\program files\Common Files\Nokia
2009-08-12 18:14 . 2009-08-12 18:13 -------- d-----w- c:\program files\Nokia
2009-08-12 18:14 . 2009-08-12 18:14 -------- d-----w- c:\program files\PC Connectivity Solution
2009-08-05 09:01 . 2004-08-03 19:26 204800 ----a-w- c:\windows\system32\mswebdvd.dll
2009-08-04 03:24 . 2009-08-03 11:26 -------- d-----w- c:\documents and settings\Airtel\Application Data\Winamp
2009-08-04 02:56 . 2009-08-03 08:55 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-08-03 20:33 . 2009-08-03 20:33 -------- d-----w- c:\program files\Realtek AC97
2009-08-03 11:30 . 2009-08-03 11:26 -------- d-----w- c:\program files\Winamp
2009-08-03 09:34 . 2009-08-03 09:34 -------- d-----w- c:\program files\CONEXANT
2009-08-03 09:16 . 2009-08-03 09:16 5311 ----a-w- C:\huadio.tmp
2009-08-03 08:56 . 2009-08-03 08:56 -------- d-----w- c:\program files\microsoft frontpage
2009-08-03 08:51 . 2009-08-03 08:51 21640 ----a-w- c:\windows\system32\emptyregdb.dat
2009-07-17 19:01 . 2004-08-03 19:26 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-12 06:51 . 2004-08-03 19:26 233472 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-03 17:09 . 2004-08-03 19:26 915456 ----a-w- c:\windows\system32\wininet.dll
2009-06-26 16:50 . 2009-06-26 16:50 81920 ------w- c:\windows\system32\ieencode.dll
2009-06-16 14:36 . 2004-08-03 19:26 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-16 14:36 . 2001-08-23 12:00 81920 ----a-w- c:\windows\system32\fontsub.dll
2009-06-12 12:31 . 2004-08-03 19:26 80896 ----a-w- c:\windows\system32\tlntsess.exe
2009-06-12 12:31 . 2004-08-03 19:26 76288 ----a-w- c:\windows\system32\telnet.exe
2009-06-10 14:13 . 2004-08-03 19:26 84992 ----a-w- c:\windows\system32\avifil32.dll
2009-06-10 06:14 . 2004-08-03 19:26 132096 ----a-w- c:\windows\system32\wkssvc.dll
2009-06-10 03:49 . 2009-08-03 08:50 2066432 ----a-w- c:\windows\system32\mstscax.dll
2009-06-03 19:09 . 2004-08-03 19:26 1291264 ----a-w- c:\windows\system32\quartz.dll
2009-05-24 18:54 . 2008-05-26 16:48 350208 ------w- c:\windows\system32\mssph.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-08-14_12.54.31 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-08-14 13:19 . 2009-08-14 13:19 16384 c:\windows\Temp\Perflib_Perfdata_6c8.dat
+ 2009-06-12 12:31 . 2009-06-12 12:31 80896 c:\windows\system32\dllcache\tlntsess.exe
+ 2009-06-12 12:31 . 2009-06-12 12:31 76288 c:\windows\system32\dllcache\telnet.exe
+ 2009-06-10 14:13 . 2009-06-10 14:13 84992 c:\windows\system32\dllcache\avifil32.dll
+ 2009-07-17 19:01 . 2009-07-17 19:01 58880 c:\windows\system32\dllcache\atl.dll
- 2009-08-03 09:05 . 2009-08-08 22:34 23040 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
+ 2009-08-03 09:05 . 2009-08-14 13:08 23040 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
+ 2009-08-03 09:05 . 2009-08-14 13:08 61440 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pubs.exe
- 2009-08-03 09:05 . 2009-08-08 22:34 61440 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pubs.exe
- 2009-08-03 09:05 . 2009-08-08 22:34 27136 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
+ 2009-08-03 09:05 . 2009-08-14 13:08 27136 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
- 2009-08-03 09:05 . 2009-08-08 22:34 11264 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
+ 2009-08-03 09:05 . 2009-08-14 13:08 11264 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
- 2009-08-03 09:05 . 2009-08-08 22:34 86016 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\inficon.exe
+ 2009-08-03 09:05 . 2009-08-14 13:08 86016 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\inficon.exe
- 2009-08-03 09:05 . 2009-08-08 22:34 12288 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
+ 2009-08-03 09:05 . 2009-08-14 13:08 12288 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
- 2009-08-03 09:05 . 2009-08-08 22:34 4096 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
+ 2009-08-03 09:05 . 2009-08-14 13:08 4096 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
- 2004-08-03 19:26 . 2008-04-14 00:12 233472 c:\windows\system32\dllcache\wmpdxm.dll
+ 2004-08-03 19:26 . 2009-07-12 06:51 233472 c:\windows\system32\dllcache\wmpdxm.dll
+ 2009-06-10 06:14 . 2009-06-10 06:14 132096 c:\windows\system32\dllcache\wkssvc.dll
- 2009-08-03 09:05 . 2009-08-08 22:34 409600 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
+ 2009-08-03 09:05 . 2009-08-14 13:08 409600 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
+ 2009-08-03 09:05 . 2009-08-14 13:08 286720 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
- 2009-08-03 09:05 . 2009-08-08 22:34 286720 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
+ 2009-08-03 09:05 . 2009-08-14 13:08 249856 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pptico.exe
- 2009-08-03 09:05 . 2009-08-08 22:34 249856 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pptico.exe
+ 2009-08-03 09:05 . 2009-08-14 13:08 794624 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\outicon.exe
- 2009-08-03 09:05 . 2009-08-08 22:34 794624 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\outicon.exe
+ 2009-08-03 09:05 . 2009-08-14 13:08 135168 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\misc.exe
- 2009-08-03 09:05 . 2009-08-08 22:34 135168 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\misc.exe
- 2009-08-03 09:05 . 2009-08-08 22:34 593920 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\accicons.exe
+ 2009-08-03 09:05 . 2009-08-14 13:08 593920 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\accicons.exe
+ 2003-07-14 21:48 . 2003-07-14 21:48 141360 c:\windows\Installer\$PatchCache$\Managed\9040110900063D11C8EF10054038389C\11.0.5614\ATP.DLL
- 2004-08-03 19:26 . 2008-04-14 00:12 4874240 c:\windows\system32\wmp.dll
+ 2004-08-03 19:26 . 2009-07-12 06:51 4874240 c:\windows\system32\wmp.dll
+ 2004-08-03 19:26 . 2009-07-12 06:51 4874240 c:\windows\system32\dllcache\wmp.dll
- 2004-08-03 19:26 . 2008-04-14 00:12 4874240 c:\windows\system32\dllcache\wmp.dll
+ 2009-08-03 08:50 . 2009-06-10 03:49 2066432 c:\windows\system32\dllcache\mstscax.dll
+ 2009-08-04 20:41 . 2009-08-04 20:41 5518848 c:\windows\Installer\ded30.msp
+ 2009-07-01 07:51 . 2009-07-01 07:51 8891904 c:\windows\Installer\ded18.msp
+ 2007-05-10 08:15 . 2007-05-10 08:15 8069464 c:\windows\Installer\$PatchCache$\Managed\9040110900063D11C8EF10054038389C\11.0.8173\OWC11.DLL
+ 2007-03-14 07:40 . 2007-03-14 07:40 7255384 c:\windows\Installer\$PatchCache$\Managed\9040110900063D11C8EF10054038389C\11.0.8173\OWC10.DLL
+ 2009-08-04 07:42 . 2009-07-30 00:49 24281536 c:\windows\system32\MRT.exe
+ 2009-07-01 07:49 . 2009-07-01 07:49 10607104 c:\windows\Installer\ded19.msp
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Advanced SystemCare 3 "= "c:\program files\IObit\Advanced SystemCare 3\AWC.exe" [2009-06-30 2329224]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SetRefresh "= "c:\program files\COMPAQ\SetRefresh\\SetRefresh.exe" [2003-11-20 525824]
"FirefoxUltimateOptimizer "= "c:\program files\Firefox Ultimate Optimizer.exe" [2007-11-08 114688]
"Malwarebytes' Anti-Malware "= "c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2009-08-03 419088]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel "= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5} "= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@= "Driver "

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"msnmsgr "= "c:\program files\Windows Live\Messenger\msnmsgr.exe" /background
"Advanced SystemCare 3 "= "c:\program files\IObit\Advanced SystemCare 3\AWC.exe" /startup

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"StartCCC "= "c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"c:\\Program Files\\uTorrent\\uTorrent.exe "=
"c:\\Program Files\\Messenger\\msmsgs.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe "=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
"c:\\Program Files\\LimeWire\\LimeWire.exe "=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1723:TCP "= 1723:TCPxpsp2res.dll,-22015
"1701:UDP "= 1701:UDPxpsp2res.dll,-22016
"500:UDP "= 500:UDPxpsp2res.dll,-22017

R0 SI3112r;ATI-4379 Serial ATA Controller;c:\windows\system32\drivers\SI3112r.sys [8/29/2007 3:04 AM 116264]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [8/13/2009 2:11 AM 232720]
R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service;c:\windows\system32\TUProgSt.exe [8/4/2009 1:06 AM 604488]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [8/13/2009 2:11 AM 19096]
S1 soqwx32;soqwx32;\??\c:\windows\system32\drivers\soqwx32.sys --> c:\windows\system32\drivers\soqwx32.sys [?]
S3 autorun;autorun;C:\huadio.tmp [8/3/2009 2:46 PM 5311]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll ",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-08-14 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2009-07-16 05:24]

2009-08-14 c:\windows\Tasks\AWC AutoSweep.job
- c:\program files\IObit\Advanced SystemCare 3\AutoSweep.exe [2009-08-03 10:05]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com
mStart Page = hxxp://www.google.com
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: {CBA7686C-B0CB-4470-9D52-E95932CE7608} = 125.22.47.125,202.56.250.5
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
FF - ProfilePath - c:\documents and settings\Airtel\Application Data\Mozilla\Firefox\Profiles\pcene12w.default\
FF - prefs.js: browser.startup.homepage - google.com

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "media.enforce_same_site_origin ", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "media.cache_size ", 51200);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "media.ogg.enabled ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "media.wave.enabled ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "media.autoplay.enabled ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "browser.urlbar.autocomplete.enabled ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "capability.policy.mailnews.*.wholeText ", "noAccess ");
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "dom.storage.default_quota ", 5120);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "content.sink.event_probe_rate ", 3);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.http.prompt-temp-redirect ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "layout.css.dpi ", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "layout.css.devPixelsPerPx ", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "gestures.enable_single_finger_input ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "dom.max_chrome_script_run_time ", 0);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.tcp.sendbuffer ", 131072);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "geo.enabled ", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.remember_cert_checkbox_default_setting ", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref( "browser.search.param.yahoo-fr ", "moz35 ");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref( "browser.search.param.yahoo-fr-cjkt ", "moz35 ");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "extensions.blocklist.level ", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "browser.urlbar.restrict.typed ", "~ ");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "browser.urlbar.default.behavior ", 0);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "privacy.clearOnShutdown.history ", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "privacy.clearOnShutdown.formdata ", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "privacy.clearOnShutdown.passwords ", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "privacy.clearOnShutdown.downloads ", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "privacy.clearOnShutdown.cookies ", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "privacy.clearOnShutdown.cache ", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "privacy.clearOnShutdown.sessions ", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "privacy.clearOnShutdown.offlineApps ", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "privacy.clearOnShutdown.siteSettings ", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "privacy.cpd.history ", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "privacy.cpd.formdata ", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "privacy.cpd.passwords ", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "privacy.cpd.downloads ", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "privacy.cpd.cookies ", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "privacy.cpd.cache ", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "privacy.cpd.sessions ", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "privacy.cpd.offlineApps ", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "privacy.cpd.siteSettings ", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "privacy.sanitize.migrateFx3Prefs ", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "browser.ssl_override_behavior ", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "security.alternate_certificate_error_page ", "certerror ");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "browser.privatebrowsing.autostart ", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "browser.privatebrowsing.dont_prompt_on_enter ", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "geo.wifi.uri ", "https://www.google.com/loc/json ");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-14 18:54
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\autorun]
"ImagePath "= "\??\C:\huadio.tmp "
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@= "FlashBroker "
"LocalizedString "= "@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101 "

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled "=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@= "c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe "

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@= "IFlashBroker3 "

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@= "{00020424-0000-0000-C000-000000000046} "

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
"Version "= "1.0 "
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(496)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(2664)
c:\windows\system32\WININET.dll
c:\program files\Windows Desktop Search\deskbar.dll
c:\program files\Windows Desktop Search\en-us\dbres.dll.mui
c:\program files\Windows Desktop Search\dbres.dll
c:\program files\Windows Desktop Search\wordwheel.dll
c:\program files\Windows Desktop Search\en-us\msnlExtRes.dll.mui
c:\program files\Windows Desktop Search\msnlExtRes.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
Completion time: 2009-08-14 18:55
ComboFix-quarantined-files.txt 2009-08-14 13:25
ComboFix2.txt 2009-08-14 13:03

Pre-Run: 6,303,825,920 bytes free
Post-Run: 6,255,321,088 bytes free

374 --- E O F --- 2009-08-14 13:08

 

hijackthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:56:54 PM, on 8/14/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\WINDOWS\System32\TUProgSt.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Firefox Ultimate Optimizer.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O4 - HKLM\..\Run: [SetRefresh] C:\Program Files\COMPAQ\SetRefresh\\SetRefresh.exe
O4 - HKLM\..\Run: [FirefoxUltimateOptimizer] "C:\Program Files\Firefox Ultimate Optimizer.exe "
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKCU\..\Run: [Advanced SystemCare 3] "C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe" /startup
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} (MUCatalogWebControl Class) - http://catalog.update.microsoft.com.../en/x86/MuCatalogWebControl.cab?1249767006312
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1249337306546
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{CBA7686C-B0CB-4470-9D52-E95932CE7608}: NameServer = 125.22.47.125,202.56.250.5
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\WINDOWS\System32\TUProgSt.exe

--
End of file - 3811 bytes

 

combo fix
ComboFix 09-08-10.06 - Airtel 08/15/2009 9:52.3.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.446.208 [GMT 5.5:30]
Running from: c:\documents and settings\Airtel\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Airtel\Desktop\CFScript.txt
AV: avast! antivirus 4.8.1335 [VPS 090814-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

FILE ::
"c:\documents and settings\All Users.WINDOWS\Application Data\ojogy.dll "
"c:\documents and settings\LocalService\Application Data\paxugomi.exe "
"c:\documents and settings\LocalService\Local Settings\Application Data\itas.bat "
"c:\documents and settings\LocalService\Local Settings\Application Data\wacifor.exe "
"C:\huadio.tmp "
"c:\program files\Common Files\gilezukyv.dll "
"c:\program files\Common Files\lemyxuheho.pif "
"c:\windows\jiryze.dat "
"c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01007.Wdf "
"c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf "
"c:\windows\system32\drivers\soqwx32.sys "
"c:\windows\system32\zebyposege.bat "
"c:\windows\wazerory.com "
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Airtel\.exe
c:\documents and settings\All Users.WINDOWS\Application Data\ojogy.dll
c:\documents and settings\LocalService\Application Data\paxugomi.exe
c:\documents and settings\LocalService\Local Settings\Application Data\itas.bat
c:\documents and settings\LocalService\Local Settings\Application Data\wacifor.exe
C:\huadio.tmp
C:\PC_Antispyware2010
c:\pc_antispyware2010\PC_Antispyware2010.lnk
c:\pc_antispyware2010\Uninstall.lnk
c:\program files\Common Files\gilezukyv.dll
c:\program files\Common Files\lemyxuheho.pif
c:\windows\jiryze.dat
c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01007.Wdf
c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
c:\windows\system32\zebyposege.bat
c:\windows\wazerory.com

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_soqwx32
-------\Legacy_autorun
-------\Service_autorun


((((((((((((((((((((((((( Files Created from 2009-07-15 to 2009-08-15 )))))))))))))))))))))))))))))))
.

2009-08-14 13:52 . 2009-02-05 21:06 51376 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2009-08-14 13:52 . 2009-02-05 21:06 23152 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2009-08-14 13:52 . 2009-02-05 21:05 26944 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2009-08-14 13:52 . 2009-02-05 21:08 93296 ----a-w- c:\windows\system32\drivers\aswmon.sys
2009-08-14 13:52 . 2009-02-05 21:08 94032 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2009-08-14 13:52 . 2009-02-05 21:07 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2009-08-14 13:52 . 2009-02-05 21:07 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-08-14 13:52 . 2009-02-05 21:04 97480 ----a-w- c:\windows\system32\AvastSS.scr
2009-08-14 13:52 . 2009-02-05 21:11 1256296 ----a-w- c:\windows\system32\aswBoot.exe
2009-08-13 09:54 . 2009-08-13 09:54 18755 ----a-w- c:\documents and settings\LocalService\Application Data\rymixuru.pif
2009-08-13 09:54 . 2009-08-13 09:54 17472 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\ybebogy.sys
2009-08-13 05:29 . 2009-07-10 13:27 1315328 -c----w- c:\windows\system32\dllcache\msoe.dll
2009-08-12 20:57 . 2009-08-12 20:57 -------- d-----w- c:\documents and settings\LocalService\Application Data\SACore
2009-08-12 20:57 . 2009-08-12 20:57 -------- d-----w- c:\windows\system32\config\systemprofile\Application Data\SACore
2009-08-12 20:57 . 2009-08-12 20:57 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Kaspersky Lab Setup Files
2009-08-12 20:56 . 2009-08-12 20:56 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\SiteAdvisor
2009-08-12 20:41 . 2009-08-03 08:06 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-12 20:41 . 2009-08-12 20:41 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-08-12 20:41 . 2009-08-03 08:06 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-08-12 20:35 . 2009-08-12 20:35 -------- d-----w- c:\program files\Trend Micro
2009-08-12 20:19 . 2001-08-23 12:00 2944 -c--a-w- c:\windows\system32\dllcache\null.sys
2009-08-12 20:19 . 2001-08-23 12:00 2944 ----a-w- c:\windows\system32\drivers\null.sys
2009-08-12 20:17 . 2009-08-12 20:17 619584 -c--a-w- c:\windows\system32\dllcache\ntfs.sys
2009-08-12 18:23 . 2008-04-13 18:45 26112 -c--a-w- c:\windows\system32\dllcache\usbser.sys
2009-08-12 18:23 . 2008-04-13 18:45 26112 ----a-w- c:\windows\system32\drivers\usbser.sys
2009-08-12 18:22 . 2008-03-21 08:27 14640 ------w- c:\windows\system32\spmsgXP_2k3.dll
2009-08-12 18:19 . 2009-08-12 18:38 -------- d-----w- c:\documents and settings\Airtel\Application Data\Nokia
2009-08-12 18:19 . 2009-08-12 18:23 -------- d-----w- c:\documents and settings\Airtel\Application Data\PC Suite
2009-08-12 18:19 . 2009-08-12 18:19 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\PC Suite
2009-08-12 18:13 . 2009-02-09 03:07 91136 ----a-w- c:\windows\system32\nmwcdcls.dll
2009-08-12 18:13 . 2009-08-12 18:01 33773208 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Nokia_PC_Suite_7_1_30_9_eng_web.exe
2009-08-12 18:12 . 2009-08-12 18:12 95232 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Installer\CommonCustomActions\pcswpcsi.exe
2009-08-12 18:12 . 2009-08-12 18:12 8192 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Installer\CommonCustomActions\UninstCCD.exe
2009-08-12 18:12 . 2009-08-12 18:12 61440 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Installer\CommonCustomActions\UninstPCSFEMsi.exe
2009-08-12 18:12 . 2009-08-12 18:12 10240 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Installer\CommonCustomActions\UninstPCS.exe
2009-08-12 18:12 . 2009-08-12 18:12 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Installations
2009-08-12 16:41 . 2008-04-13 18:47 25856 -c--a-w- c:\windows\system32\dllcache\usbprint.sys
2009-08-12 16:41 . 2008-04-13 18:47 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys
2009-08-12 16:41 . 2008-04-13 18:45 32128 -c--a-w- c:\windows\system32\dllcache\usbccgp.sys
2009-08-12 16:41 . 2008-04-13 18:45 32128 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2009-08-11 14:03 . 2009-08-11 14:03 -------- d-----w- c:\documents and settings\Airtel\Application Data\AdobeUM
2009-08-10 13:31 . 2009-08-10 13:31 -------- d-----w- c:\documents and settings\Airtel\Application Data\Malwarebytes
2009-08-10 13:31 . 2009-08-10 13:31 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Malwarebytes
2009-08-09 16:38 . 2009-08-09 16:38 -------- d-----w- c:\documents and settings\Airtel\Application Data\Windows Search
2009-08-09 16:25 . 2009-08-09 16:25 -------- d-----w- c:\program files\Microsoft Silverlight
2009-08-09 16:20 . 2009-08-09 16:20 -------- d-----w- c:\windows\system32\XPSViewer
2009-08-09 16:20 . 2009-08-09 16:20 -------- d-----w- c:\program files\MSBuild
2009-08-09 16:20 . 2009-08-09 16:20 -------- d-----w- c:\program files\Reference Assemblies
2009-08-09 16:20 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll
2009-08-09 16:20 . 2009-08-09 16:20 -------- d-----w- C:\3da9b14326d2e030cb0bbfa3e528
2009-08-09 16:20 . 2008-07-06 12:06 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-08-09 16:20 . 2008-07-06 12:06 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll
2009-08-09 16:20 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll
2009-08-09 16:20 . 2008-07-06 12:06 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll
2009-08-09 16:20 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll
2009-08-09 16:20 . 2008-07-06 10:50 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-08-09 16:14 . 2009-08-09 16:14 -------- d-----w- c:\documents and settings\Airtel\Application Data\Windows Desktop Search
2009-08-09 16:14 . 2009-08-10 20:00 -------- d-----w- c:\program files\Windows Desktop Search
2009-08-09 16:14 . 2009-08-09 16:14 -------- d-----w- c:\windows\system32\GroupPolicy
2009-08-09 16:13 . 2008-03-07 17:02 98304 -c----w- c:\windows\system32\dllcache\nlhtml.dll
2009-08-09 16:13 . 2008-03-07 17:02 29696 -c----w- c:\windows\system32\dllcache\mimefilt.dll
2009-08-09 16:13 . 2008-03-07 17:02 192000 -c----w- c:\windows\system32\dllcache\offfilt.dll
2009-08-08 20:21 . 2009-08-08 20:21 -------- d-----w- c:\program files\Ashampoo
2009-08-08 20:21 . 2009-08-08 20:21 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\page
2009-08-08 16:53 . 2008-04-13 18:45 26368 -c--a-w- c:\windows\system32\dllcache\usbstor.sys
2009-08-08 15:46 . 2009-08-08 15:47 -------- d-----w- c:\documents and settings\Airtel\Local Settings\Application Data\Adobe
2009-08-07 18:01 . 2009-08-07 18:01 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2009-08-07 16:46 . 2009-08-07 16:46 -------- d-----w- c:\documents and settings\Airtel\Local Settings\Application Data\Identities
2009-08-06 22:30 . 2009-08-06 22:30 -------- d-----w- c:\program files\Microsoft CAPICOM 2.1.0.2
2009-08-06 17:21 . 2009-08-06 17:21 -------- d-----w- c:\documents and settings\Airtel\Application Data\Ashampoo
2009-08-06 17:19 . 2009-08-06 17:19 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\ashampoo
2009-08-06 17:19 . 2009-08-06 17:19 -------- d-----w- c:\documents and settings\Airtel\Local Settings\Application Data\ashampoo
2009-08-06 04:05 . 2009-08-11 20:59 -------- d-----w- c:\documents and settings\Airtel\Application Data\LimeWire
2009-08-06 04:05 . 2009-08-06 04:05 -------- d-----w- c:\program files\LimeWire
2009-08-05 23:22 . 2008-10-16 08:36 268648 ----a-w- c:\windows\system32\mucltui.dll
2009-08-05 23:22 . 2008-10-16 08:36 208744 ----a-w- c:\windows\system32\muweb.dll
2009-08-05 10:28 . 2009-08-12 19:18 -------- d-----w- c:\documents and settings\Airtel\Tracing
2009-08-05 10:18 . 2009-08-05 10:18 -------- d-----w- c:\program files\Microsoft
2009-08-05 10:18 . 2009-08-05 10:18 -------- d-----w- c:\program files\Windows Live SkyDrive
2009-08-05 10:18 . 2009-08-05 10:18 -------- d-----w- c:\program files\Windows Live
2009-08-05 09:01 . 2009-08-05 09:01 204800 -c----w- c:\windows\system32\dllcache\mswebdvd.dll
2009-08-05 04:30 . 2009-08-05 04:30 -------- d-----w- c:\windows\Sun
2009-08-04 14:37 . 2009-08-04 14:37 -------- d-----w- c:\program files\Languages
2009-08-04 14:36 . 2007-11-08 13:42 114688 ----a-w- c:\program files\Firefox Ultimate Optimizer.exe
2009-08-04 12:59 . 2009-08-04 14:38 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-08-04 12:53 . 2009-08-07 02:09 -------- d-----w- c:\windows\SxsCaPendDel
2009-08-04 12:46 . 2009-08-04 14:38 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton
2009-08-04 12:46 . 2009-08-04 12:46 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Symantec
2009-08-04 12:46 . 2009-08-04 12:46 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\NortonInstaller
2009-08-04 12:33 . 2009-08-04 12:35 -------- d-----w- c:\windows\system32\Adobe
2009-08-04 12:32 . 2009-08-04 12:42 -------- d-----w- c:\program files\NOS
2009-08-04 12:32 . 2009-08-04 12:42 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\NOS
2009-08-04 11:31 . 2009-08-04 11:31 0 ----a-w- c:\windows\ativpsrm.bin
2009-08-04 11:30 . 2009-08-04 11:30 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\ATI
2009-08-04 11:30 . 2009-08-04 11:30 -------- d-----w- c:\documents and settings\Airtel\Local Settings\Application Data\ATI
2009-08-04 11:30 . 2009-08-04 11:30 -------- d-----w- c:\documents and settings\Airtel\Application Data\ATI
2009-08-04 11:29 . 2009-08-04 11:29 -------- d-----w- c:\program files\Common Files\ATI Technologies
2009-08-04 10:31 . 2009-08-04 10:31 766 ----a-r- c:\documents and settings\Airtel\Application Data\Microsoft\Installer\{F5242227-2051-4158-AC42-0F2BAA3CD3D6}\ARPPRODUCTICON.exe
2009-08-04 10:31 . 2009-08-04 10:31 40960 ----a-r- c:\documents and settings\Airtel\Application Data\Microsoft\Installer\{F5242227-2051-4158-AC42-0F2BAA3CD3D6}\New_Shortcut_S1425_ADB54615A0E240F89C5EFD8513472ED3.exe
2009-08-04 10:31 . 2009-08-04 10:31 -------- d-----w- c:\program files\COMPAQ
2009-08-04 10:19 . 2009-08-04 10:19 -------- d-----w- c:\program files\Common Files\Windows Live
2009-08-04 09:58 . 2009-08-04 11:29 -------- d-----w- c:\program files\ATI Technologies
2009-08-04 09:57 . 2009-08-04 09:57 -------- d-----w- C:\ATI
2009-08-04 07:52 . 2009-08-04 07:52 -------- d-sh--w- c:\documents and settings\Airtel\IECompatCache
2009-08-04 07:51 . 2009-08-04 07:51 -------- d-sh--w- c:\documents and settings\Airtel\PrivacIE
2009-08-04 07:49 . 2009-08-04 07:49 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2009-08-04 07:48 . 2009-08-04 07:48 -------- d-sh--w- c:\documents and settings\Airtel\IETldCache
2009-08-04 07:45 . 2009-07-03 17:09 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2009-08-04 07:44 . 2009-07-03 17:09 594432 -c----w- c:\windows\system32\dllcache\msfeeds.dll
2009-08-04 07:44 . 2009-07-03 17:09 55296 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll
2009-08-04 07:44 . 2009-07-03 17:09 1985536 -c----w- c:\windows\system32\dllcache\iertutil.dll
2009-08-04 07:44 . 2009-07-19 13:18 11067392 -c----w- c:\windows\system32\dllcache\ieframe.dll
2009-08-04 07:44 . 2009-07-03 17:09 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2009-08-04 07:44 . 2009-08-04 07:45 -------- d-----w- c:\windows\ie8updates
2009-08-04 07:44 . 2009-07-01 07:08 101376 -c----w- c:\windows\system32\dllcache\iecompat.dll
2009-08-04 07:43 . 2009-08-04 07:44 -------- dc-h--w- c:\windows\ie8
2009-08-04 03:54 . 2009-08-04 03:54 -------- d-----w- c:\program files\MSXML 4.0
2009-08-04 03:45 . 2009-03-06 14:22 284160 -c----w- c:\windows\system32\dllcache\pdh.dll
2009-08-04 03:45 . 2009-02-09 12:10 729088 -c----w- c:\windows\system32\dllcache\lsasrv.dll
2009-08-04 03:45 . 2009-02-09 12:10 617472 -c----w- c:\windows\system32\dllcache\advapi32.dll
2009-08-04 03:45 . 2009-02-09 12:10 473600 -c----w- c:\windows\system32\dllcache\fastprox.dll
2009-08-04 03:45 . 2009-02-09 12:10 453120 -c----w- c:\windows\system32\dllcache\wmiprvsd.dll
2009-08-04 03:45 . 2009-02-09 12:10 401408 -c----w- c:\windows\system32\dllcache\rpcss.dll
2009-08-04 03:45 . 2009-02-06 11:11 110592 -c----w- c:\windows\system32\dllcache\services.exe
2009-08-04 03:45 . 2009-02-06 10:10 227840 -c----w- c:\windows\system32\dllcache\wmiprvse.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-12 18:15 . 2009-08-12 18:14 -------- d-----w- c:\program files\DIFX
2009-08-12 18:14 . 2009-08-12 18:14 -------- d-----w- c:\program files\Common Files\PCSuite
2009-08-12 18:14 . 2009-08-12 18:14 -------- d-----w- c:\program files\Common Files\Nokia
2009-08-12 18:14 . 2009-08-12 18:13 -------- d-----w- c:\program files\Nokia
2009-08-12 18:14 . 2009-08-12 18:14 -------- d-----w- c:\program files\PC Connectivity Solution
2009-08-05 09:01 . 2004-08-03 19:26 204800 ----a-w- c:\windows\system32\mswebdvd.dll
2009-08-04 03:24 . 2009-08-03 11:26 -------- d-----w- c:\documents and settings\Airtel\Application Data\Winamp
2009-08-04 02:56 . 2009-08-03 08:55 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-08-03 20:33 . 2009-08-03 20:33 -------- d-----w- c:\program files\Realtek AC97
2009-08-03 11:30 . 2009-08-03 11:26 -------- d-----w- c:\program files\Winamp
2009-08-03 09:34 . 2009-08-03 09:34 -------- d-----w- c:\program files\CONEXANT
2009-08-03 08:56 . 2009-08-03 08:56 -------- d-----w- c:\program files\microsoft frontpage
2009-08-03 08:51 . 2009-08-03 08:51 21640 ----a-w- c:\windows\system32\emptyregdb.dat
2009-07-17 19:01 . 2004-08-03 19:26 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-12 06:51 . 2004-08-03 19:26 233472 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-03 17:09 . 2004-08-03 19:26 915456 ----a-w- c:\windows\system32\wininet.dll
2009-06-26 16:50 . 2009-06-26 16:50 81920 ------w- c:\windows\system32\ieencode.dll
2009-06-16 14:36 . 2004-08-03 19:26 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-16 14:36 . 2001-08-23 12:00 81920 ----a-w- c:\windows\system32\fontsub.dll
2009-06-12 12:31 . 2004-08-03 19:26 80896 ----a-w- c:\windows\system32\tlntsess.exe
2009-06-12 12:31 . 2004-08-03 19:26 76288 ----a-w- c:\windows\system32\telnet.exe
2009-06-10 14:13 . 2004-08-03 19:26 84992 ----a-w- c:\windows\system32\avifil32.dll
2009-06-10 06:14 . 2004-08-03 19:26 132096 ----a-w- c:\windows\system32\wkssvc.dll
2009-06-10 03:49 . 2009-08-03 08:50 2066432 ----a-w- c:\windows\system32\mstscax.dll
2009-06-03 19:09 . 2004-08-03 19:26 1291264 ----a-w- c:\windows\system32\quartz.dll
2009-05-24 18:54 . 2008-05-26 16:48 350208 ------w- c:\windows\system32\mssph.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-08-14_12.54.31 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-08-14 14:10 . 2009-08-14 14:10 16384 c:\windows\Temp\Perflib_Perfdata_7d8.dat
+ 2009-08-15 04:26 . 2009-08-15 04:26 16384 c:\windows\Temp\Perflib_Perfdata_6b8.dat
+ 2009-08-15 04:26 . 2009-08-15 04:26 16384 c:\windows\Temp\Perflib_Perfdata_290.dat
+ 2009-06-12 12:31 . 2009-06-12 12:31 80896 c:\windows\system32\dllcache\tlntsess.exe
+ 2009-06-12 12:31 . 2009-06-12 12:31 76288 c:\windows\system32\dllcache\telnet.exe
+ 2009-06-10 14:13 . 2009-06-10 14:13 84992 c:\windows\system32\dllcache\avifil32.dll
+ 2009-07-17 19:01 . 2009-07-17 19:01 58880 c:\windows\system32\dllcache\atl.dll
+ 2009-08-03 09:05 . 2009-08-14 13:08 23040 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
- 2009-08-03 09:05 . 2009-08-08 22:34 23040 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
+ 2009-08-03 09:05 . 2009-08-14 13:08 61440 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pubs.exe
- 2009-08-03 09:05 . 2009-08-08 22:34 61440 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pubs.exe
- 2009-08-03 09:05 . 2009-08-08 22:34 27136 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
+ 2009-08-03 09:05 . 2009-08-14 13:08 27136 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
+ 2009-08-03 09:05 . 2009-08-14 13:08 11264 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
- 2009-08-03 09:05 . 2009-08-08 22:34 11264 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
+ 2009-08-03 09:05 . 2009-08-14 13:08 86016 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\inficon.exe
- 2009-08-03 09:05 . 2009-08-08 22:34 86016 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\inficon.exe
- 2009-08-03 09:05 . 2009-08-08 22:34 12288 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
+ 2009-08-03 09:05 . 2009-08-14 13:08 12288 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
+ 2009-08-03 09:05 . 2009-08-14 13:08 4096 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
- 2009-08-03 09:05 . 2009-08-08 22:34 4096 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
+ 2009-08-15 04:25 . 2009-08-15 04:25 8192 c:\windows\ERDNT\subs\Users\00000004\UsrClass.dat
+ 2009-08-15 04:25 . 2009-08-15 04:25 8192 c:\windows\ERDNT\subs\Users\00000002\UsrClass.dat
+ 2004-08-03 19:26 . 2009-07-12 06:51 233472 c:\windows\system32\dllcache\wmpdxm.dll
- 2004-08-03 19:26 . 2008-04-14 00:12 233472 c:\windows\system32\dllcache\wmpdxm.dll
+ 2009-06-10 06:14 . 2009-06-10 06:14 132096 c:\windows\system32\dllcache\wkssvc.dll
+ 2009-08-03 09:05 . 2009-08-14 13:08 409600 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
- 2009-08-03 09:05 . 2009-08-08 22:34 409600 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
+ 2009-08-03 09:05 . 2009-08-14 13:08 286720 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
- 2009-08-03 09:05 . 2009-08-08 22:34 286720 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
+ 2009-08-03 09:05 . 2009-08-14 13:08 249856 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pptico.exe
- 2009-08-03 09:05 . 2009-08-08 22:34 249856 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pptico.exe
- 2009-08-03 09:05 . 2009-08-08 22:34 794624 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\outicon.exe
+ 2009-08-03 09:05 . 2009-08-14 13:08 794624 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\outicon.exe
+ 2009-08-03 09:05 . 2009-08-14 13:08 135168 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\misc.exe
- 2009-08-03 09:05 . 2009-08-08 22:34 135168 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\misc.exe
- 2009-08-03 09:05 . 2009-08-08 22:34 593920 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\accicons.exe
+ 2009-08-03 09:05 . 2009-08-14 13:08 593920 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\accicons.exe
+ 2003-07-14 21:48 . 2003-07-14 21:48 141360 c:\windows\Installer\$PatchCache$\Managed\9040110900063D11C8EF10054038389C\11.0.5614\ATP.DLL
+ 2009-08-15 04:25 . 2009-08-15 04:25 192512 c:\windows\ERDNT\subs\Users\00000006\UsrClass.dat
+ 2009-08-15 04:25 . 2009-08-15 04:25 229376 c:\windows\ERDNT\subs\Users\00000003\NTUSER.DAT
+ 2009-08-15 04:25 . 2009-08-15 04:25 225280 c:\windows\ERDNT\subs\Users\00000001\NTUSER.DAT
+ 2004-08-03 19:26 . 2009-07-12 06:51 4874240 c:\windows\system32\wmp.dll
- 2004-08-03 19:26 . 2008-04-14 00:12 4874240 c:\windows\system32\wmp.dll
+ 2004-08-03 19:26 . 2009-07-12 06:51 4874240 c:\windows\system32\dllcache\wmp.dll
- 2004-08-03 19:26 . 2008-04-14 00:12 4874240 c:\windows\system32\dllcache\wmp.dll
+ 2009-08-03 08:50 . 2009-06-10 03:49 2066432 c:\windows\system32\dllcache\mstscax.dll
+ 2009-08-04 20:41 . 2009-08-04 20:41 5518848 c:\windows\Installer\ded30.msp
+ 2009-07-01 07:51 . 2009-07-01 07:51 8891904 c:\windows\Installer\ded18.msp
+ 2007-05-10 08:15 . 2007-05-10 08:15 8069464 c:\windows\Installer\$PatchCache$\Managed\9040110900063D11C8EF10054038389C\11.0.8173\OWC11.DLL
+ 2007-03-14 07:40 . 2007-03-14 07:40 7255384 c:\windows\Installer\$PatchCache$\Managed\9040110900063D11C8EF10054038389C\11.0.8173\OWC10.DLL
+ 2009-08-15 04:25 . 2009-08-15 04:25 2781184 c:\windows\ERDNT\subs\Users\00000005\NTUSER.DAT
+ 2009-08-04 07:42 . 2009-07-30 00:49 24281536 c:\windows\system32\MRT.exe
+ 2009-07-01 07:49 . 2009-07-01 07:49 10607104 c:\windows\Installer\ded19.msp
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Advanced SystemCare 3 "= "c:\program files\IObit\Advanced SystemCare 3\AWC.exe" [2009-06-30 2329224]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SetRefresh "= "c:\program files\COMPAQ\SetRefresh\\SetRefresh.exe" [2003-11-20 525824]
"FirefoxUltimateOptimizer "= "c:\program files\Firefox Ultimate Optimizer.exe" [2007-11-08 114688]
"Malwarebytes' Anti-Malware "= "c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2009-08-03 419088]
"avast! "= "c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel "= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5} "= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@= "Driver "

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"msnmsgr "= "c:\program files\Windows Live\Messenger\msnmsgr.exe" /background
"Advanced SystemCare 3 "= "c:\program files\IObit\Advanced SystemCare 3\AWC.exe" /startup

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"StartCCC "= "c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"c:\\Program Files\\uTorrent\\uTorrent.exe "=
"c:\\Program Files\\Messenger\\msmsgs.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe "=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
"c:\\Program Files\\LimeWire\\LimeWire.exe "=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1723:TCP "= 1723:TCPxpsp2res.dll,-22015
"1701:UDP "= 1701:UDPxpsp2res.dll,-22016
"500:UDP "= 500:UDPxpsp2res.dll,-22017

R0 SI3112r;ATI-4379 Serial ATA Controller;c:\windows\system32\drivers\SI3112r.sys [8/29/2007 3:04 AM 116264]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [8/14/2009 7:22 PM 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [8/14/2009 7:22 PM 20560]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [8/13/2009 2:11 AM 232720]
R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service;c:\windows\system32\TUProgSt.exe [8/4/2009 1:06 AM 604488]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [8/13/2009 2:11 AM 19096]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll ",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-08-15 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2009-07-16 05:24]

2009-08-15 c:\windows\Tasks\AWC AutoSweep.job
- c:\program files\IObit\Advanced SystemCare 3\AutoSweep.exe [2009-08-03 10:05]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com
mStart Page = hxxp://www.google.com
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: {CBA7686C-B0CB-4470-9D52-E95932CE7608} = 125.22.47.125,202.56.250.5
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
FF - ProfilePath - c:\documents and settings\Airtel\Application Data\Mozilla\Firefox\Profiles\pcene12w.default\
FF - prefs.js: browser.startup.homepage - google.com

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "media.enforce_same_site_origin ", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "media.cache_size ", 51200);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "media.ogg.enabled ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "media.wave.enabled ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "media.autoplay.enabled ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "browser.urlbar.autocomplete.enabled ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "capability.policy.mailnews.*.wholeText ", "noAccess ");
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "dom.storage.default_quota ", 5120);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "content.sink.event_probe_rate ", 3);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.http.prompt-temp-redirect ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "layout.css.dpi ", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "layout.css.devPixelsPerPx ", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "gestures.enable_single_finger_input ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "dom.max_chrome_script_run_time ", 0);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.tcp.sendbuffer ", 131072);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "geo.enabled ", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.remember_cert_checkbox_default_setting ", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref( "browser.search.param.yahoo-fr ", "moz35 ");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref( "browser.search.param.yahoo-fr-cjkt ", "moz35 ");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "extensions.blocklist.level ", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "browser.urlbar.restrict.typed ", "~ ");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "browser.urlbar.default.behavior ", 0);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "privacy.clearOnShutdown.history ", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "privacy.clearOnShutdown.formdata ", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "privacy.clearOnShutdown.passwords ", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "privacy.clearOnShutdown.downloads ", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "privacy.clearOnShutdown.cookies ", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "privacy.clearOnShutdown.cache ", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "privacy.clearOnShutdown.sessions ", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "privacy.clearOnShutdown.offlineApps ", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "privacy.clearOnShutdown.siteSettings ", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "privacy.cpd.history ", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "privacy.cpd.formdata ", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "privacy.cpd.passwords ", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "privacy.cpd.downloads ", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "privacy.cpd.cookies ", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "privacy.cpd.cache ", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "privacy.cpd.sessions ", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "privacy.cpd.offlineApps ", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "privacy.cpd.siteSettings ", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "privacy.sanitize.migrateFx3Prefs ", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "browser.ssl_override_behavior ", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "security.alternate_certificate_error_page ", "certerror ");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "browser.privatebrowsing.autostart ", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "browser.privatebrowsing.dont_prompt_on_enter ", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "geo.wifi.uri ", "https://www.google.com/loc/json ");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-15 09:57
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@= "FlashBroker "
"LocalizedString "= "@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101 "

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled "=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@= "c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe "

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@= "IFlashBroker3 "

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@= "{00020424-0000-0000-C000-000000000046} "

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
"Version "= "1.0 "
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(496)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(2364)
c:\windows\system32\WININET.dll
c:\program files\Windows Desktop Search\deskbar.dll
c:\program files\Windows Desktop Search\en-us\dbres.dll.mui
c:\program files\Windows Desktop Search\dbres.dll
c:\program files\Windows Desktop Search\wordwheel.dll
c:\program files\Windows Desktop Search\en-us\msnlExtRes.dll.mui
c:\program files\Windows Desktop Search\msnlExtRes.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\wdfmgr.exe
c:\windows\system32\searchindexer.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\windows\system32\searchprotocolhost.exe
c:\windows\system32\searchfilterhost.exe
.
**************************************************************************
.
Completion time: 2009-08-15 9:59 - machine was rebooted
ComboFix-quarantined-files.txt 2009-08-15 04:29
ComboFix2.txt 2009-08-14 13:25
ComboFix3.txt 2009-08-14 13:03

Pre-Run: 6,176,919,552 bytes free
Post-Run: 6,111,862,784 bytes free

437 --- E O F --- 2009-08-14 13:08

 

hijackthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:00:44 AM, on 8/15/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\WINDOWS\System32\TUProgSt.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Firefox Ultimate Optimizer.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O4 - HKLM\..\Run: [SetRefresh] C:\Program Files\COMPAQ\SetRefresh\\SetRefresh.exe
O4 - HKLM\..\Run: [FirefoxUltimateOptimizer] "C:\Program Files\Firefox Ultimate Optimizer.exe "
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [Advanced SystemCare 3] "C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe" /startup
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} (MUCatalogWebControl Class) - http://catalog.update.microsoft.com.../en/x86/MuCatalogWebControl.cab?1249767006312
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1249337306546
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{CBA7686C-B0CB-4470-9D52-E95932CE7608}: NameServer = 125.22.47.125,202.56.250.5
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\WINDOWS\System32\TUProgSt.exe

--
End of file - 4524 bytes

 

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 08/16/2009 at 12:31 PM

Application Version : 4.27.1002

Core Rules Database Version : 4058
Trace Rules Database Version: 1998

Scan type : Complete Scan
Total Scan Time : 00:32:40

Memory items scanned : 223
Memory threats detected : 0
Registry items scanned : 5124
Registry threats detected : 2
File items scanned : 36880
File threats detected : 0

Rogue.XP AntiSpyware 2009
HKU\.DEFAULT\Control Panel\don't load#wscui.cpl [ No ]
HKU\S-1-5-18\Control Panel\don't load#wscui.cpl [ No ]

 

Malwarebytes' Anti-Malware 1.40
Database version: 2634
Windows 5.1.2600 Service Pack 3 (Safe Mode)

8/16/2009 1:32:00 PM
mbam-log-2009-08-16 (13-32-00).txt

Scan type: Full Scan (C:\|D:\|E:\|)
Objects scanned: 126601
Time elapsed: 10 minute(s), 35 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

 

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:47:12 PM, on 8/16/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Firefox Ultimate Optimizer.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\WINDOWS\System32\TUProgSt.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O4 - HKLM\..\Run: [SetRefresh] C:\Program Files\COMPAQ\SetRefresh\\SetRefresh.exe
O4 - HKLM\..\Run: [FirefoxUltimateOptimizer] "C:\Program Files\Firefox Ultimate Optimizer.exe "
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [Advanced SystemCare 3] "C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe" /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} (MUCatalogWebControl Class) - http://catalog.update.microsoft.com.../en/x86/MuCatalogWebControl.cab?1249767006312
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1249337306546
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{CBA7686C-B0CB-4470-9D52-E95932CE7608}: NameServer = 125.22.47.125,202.56.250.5
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\WINDOWS\System32\TUProgSt.exe

--
End of file - 5032 bytes

 

thanks alot its fine thanks sooooo much