Solved Many problems with net-worm.win32.mytob.t

soxfan93 · 2009/12/29

[Resolved] Many problems with net-worm.win32.mytob.t

Hi everybody. I was recently infected with net-worm.win32.mytob.t, which I believe is some type of virus/spyware. It disabled my Norton 360 antivirus protection, and won't let me access some of my Control Panel (Security Center, others cause Windows to crash). I think that the virus also changed some of my firewall settings, but I can't get into the Control Panel to find out. I installed Spyware Doctor, which eliminated 34 infections, but my computer still isn't working correctly. I have uninstalled and reinstalled Norton 360 probably a half-dozen times, and it still won't work. I believe that this virus has made it's way into my registry, but I am not smart enough to eliminate it by myself. My father has, no clue, either. I could really use some help.

DDS (Ver_09-12-01.01) - NTFSx86
Run by Bobby at 15:48:28.21 on Tue 12/29/2009
Internet Explorer: 8.0.6001.18865
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3069.2123 [GMT -5:00]

SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\System32\svchost.exe -k NetworkService
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Program Files\Dell\DellDock\DockLogin.exe
C:\Windows\System32\WLTRYSVC.EXE
C:\Windows\System32\bcmwltry.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\WLANExt.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Dell\DellDock\DellDock.exe
C:\Windows\system32\aestsrv.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Windows\Explorer.EXE
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exe
C:\Program Files\DirecTV\DirecTV\Kernel\DMP\CLHNService.exe
C:\Windows\system32\libusbd-nt.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Windows\system32\STacSV.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\Program Files\Internet Explorer\Iexplore.exe
C:\Program Files\Internet Explorer\Iexplore.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Bobby\Desktop\dds.pif
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.aol.com/?src=aim
uWindow Title = Internet Explorer provided by Dell
uDefault_Page_URL = hxxp://www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=3090128
uSearch Bar = hxxp://www.google.com/ie
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s
uURLSearchHooks: UrlSearchHook Class: {00000000-6e41-4fd3-8538-502f5495e5fc} - c:\program files\ask.com\GenericAskToolbar.dll
uURLSearchHooks: AIM Toolbar Search Class: {03402f96-3dc7-4285-bc50-9e81fefafe43} - c:\program files\aim toolbar\aimtb.dll
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
mURLSearchHooks: AIM Toolbar Search Class: {03402f96-3dc7-4285-bc50-9e81fefafe43} - c:\program files\aim toolbar\aimtb.dll
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: PC Tools Browser Guard BHO: {2a0f3d1b-0909-4ff4-b272-609cce6054e7} - c:\program files\spyware doctor\bdt\PCTBrowserDefender.dll
BHO: {465E08E7-F005-4389-980F-1D8764B3486C} - No File
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_07\bin\ssv.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.4.4525.1752\swg.dll
BHO: AIM Toolbar Loader: {b0cda128-b425-4eef-a174-61a11ac5dbf8} - c:\program files\aim toolbar\aimtb.dll
BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_B7C5AC242193BB3E.dll
BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files\dell\bae\BAE.dll
BHO: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn\YTSingleInstance.dll
TB: AIM Toolbar: {61539ecd-cc67-4437-a03c-9aaccbd14326} - c:\program files\aim toolbar\aimtb.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
TB: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
TB: PC Tools Browser Guard: {472734ea-242a-422b-adf8-83d1e48cc825} - c:\program files\spyware doctor\bdt\PCTBrowserDefender.dll
TB: {6ADB0F93-1AA5-4BCF-9DF4-CEA689A3C111} - No File
TB: {724D43A0-0D85-11D4-9908-00400523E39A} - No File
TB: {98279C38-DE4B-4BCF-93C9-8EC26069D6F4} - No File
TB: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
uRun: [AdobeBridge]
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe "
uRun: [Vidalia] "c:\program files\vidalia bundle\vidalia\vidalia.exe "
uRun: [PeerBlock] c:\program files\peerblock\peerblock.exe
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [AlcoholAutomount] "c:\program files\alcohol soft\alcohol 120\axcmd.exe" /automount
mRun: [dellsupportcenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P dellsupportcenter
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
mRun: [AdobeCS4ServiceManager] "c:\program files\common files\adobe\cs4servicemanager\CS4ServiceManager.exe" -launchedbylogin
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe "
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe "
StartupFolder: c:\users\bobby\appdata\roaming\micros~1\windows\startm~1\programs\startup\delldo~1.lnk - c:\program files\dell\delldock\DellDock.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\quickset.lnk - c:\program files\dell\quickset\quickset.exe
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: &AIM Toolbar Search - c:\programdata\aim toolbar\ietoolbar\resources\en-us\local\search.html
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC} - c:\progra~1\java\jre16~1.0_0\bin\ssv.dll
IE: {0b83c99c-1efa-4259-858f-bcb33e007a5b} - {61539ecd-cc67-4437-a03c-9aaccbd14326} - c:\program files\aim toolbar\aimtb.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1257261144364
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1257261243579
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
TCP: {8A907C47-F04F-4B57-8AA9-2803A7B1C00F} = 192.168.1.1
TCP: {8FC1FA59-3448-4E1A-8AAB-C4EB442791E6} = 192.168.1.1
Notify: GoToAssist - c:\program files\citrix\gotoassist\514\G2AWinLogon.dll
AppInit_DLLs: c:\progra~1\google\google~3\GOEC62~1.DLL

================= FIREFOX ===================

FF - ProfilePath - c:\users\bobby\appdata\roaming\mozilla\firefox\profiles\aaj6q09d.default\
FF - prefs.js: browser.search.selectedEngine - Ask.com
FF - prefs.js: browser.startup.homepage - hxxp://www.mlbtraderumors.com/
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
FF - component: c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll
FF - plugin: c:\program files\viewpoint\viewpoint media player\npViewpoint.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\

---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref( "security.ssl3.rsa_seed_sha ", true);

============= SERVICES / DRIVERS ===============

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2009-12-24 207792]
R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2009-12-22 11608]
R2 AESTFilters;Andrea ST Filters Service;c:\windows\system32\AEstSrv.exe [2009-1-28 73728]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2009-12-22 55656]
R2 Browser Defender Update Service;Browser Defender Update Service;c:\program files\spyware doctor\bdt\BDTUpdateService.exe [2009-12-24 112592]
R2 CLHNService3;CLHNService3;c:\program files\directv\directv\kernel\dmp\CLHNService.exe [2008-9-26 98304]
R2 DockLoginService;Dock Login Service;c:\program files\dell\delldock\DockLogin.exe [2008-5-2 161048]
R2 libusbd;LibUsb-Win32 - Daemon, Version 0.1.10.1;system32\libusbd-nt.exe --> system32\libusbd-nt.exe [?]
R2 ntk3;ntk3;c:\program files\directv\directv\kernel\dmp\ntk3.sys [2008-9-26 120048]
R2 StarWindServiceAE;StarWind AE Service;c:\program files\alcohol soft\alcohol 120\starwind\StarWindServiceAE.exe [2007-5-28 275968]
R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-1-28 179712]
R3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.10.1;c:\windows\system32\drivers\libusb0.sys [2009-12-1 33792]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2009-12-22 108289]
S2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2009-12-22 185089]
S2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2009-2-27 24652]
S3 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-20 21504]
S3 GoogleDesktopManager-110309-193829;Google Desktop Manager 5.9.911.3589;c:\program files\google\google desktop search\GoogleDesktop.exe [2009-1-28 30192]
S3 pbfilter;pbfilter;c:\program files\peerblock\pbfilter.sys [2009-12-21 16472]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\spyware doctor\pctsAuxs.exe [2009-12-24 359624]
S3 sdCoreService;PC Tools Security Service;c:\program files\spyware doctor\pctsSvc.exe [2009-12-24 1141712]

=============== Created Last 30 ================

2009-12-29 20:20:12 0 d-----w- c:\program files\Trend Micro
2009-12-29 05:05:43 0 d-----w- c:\windows\pss
2009-12-29 04:51:13 0 d-----w- c:\program files\Norton 360
2009-12-29 02:14:22 0 d-----w- c:\programdata\{1C6FDDD8-FC9E-4C12-9FA5-1AAD377097B3}
2009-12-29 02:14:22 0 d-----w- c:\program files\GEAR Software
2009-12-26 01:31:56 23848 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2009-12-26 01:31:56 107368 ----a-w- c:\windows\system32\GEARAspi.dll
2009-12-26 00:58:07 31463 ----a-w- c:\windows\system32\peerblock.dmp
2009-12-25 01:48:43 767952 ----a-w- c:\windows\BDTSupport.dll
2009-12-25 01:48:42 883 ----a-w- c:\windows\RegSDImport.xml
2009-12-25 01:48:42 880 ----a-w- c:\windows\RegISSImport.xml
2009-12-25 01:48:42 165840 ----a-w- c:\windows\PCTBDRes.dll
2009-12-25 01:48:42 1640400 ----a-w- c:\windows\PCTBDCore.dll
2009-12-25 01:48:42 149456 ----a-w- c:\windows\SGDetectionTool.dll
2009-12-25 01:48:42 131 ----a-w- c:\windows\IDB.zip
2009-12-25 01:48:42 1152444 ----a-w- c:\windows\UDB.zip
2009-12-25 01:41:39 98600 ----a-w- c:\windows\system32\drivers\pctwfpfilter.sys
2009-12-25 01:41:39 7387 ----a-w- c:\windows\system32\drivers\pctgntdi.cat
2009-12-25 01:41:39 233136 ----a-w- c:\windows\system32\drivers\pctgntdi.sys
2009-12-25 01:41:29 87784 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys
2009-12-25 01:41:29 7412 ----a-w- c:\windows\system32\drivers\PCTAppEvent.cat
2009-12-25 01:41:29 7383 ----a-w- c:\windows\system32\drivers\pctcore.cat
2009-12-25 01:41:29 207792 ----a-w- c:\windows\system32\drivers\PCTCore.sys
2009-12-25 01:41:21 7383 ----a-w- c:\windows\system32\drivers\pctplsg.cat
2009-12-25 01:41:21 70408 ----a-w- c:\windows\system32\drivers\pctplsg.sys
2009-12-25 01:08:58 65536 --sha-w- c:\users\bobby\ntuser.dat{f7772b49-f0f1-11de-9a9d-0023aeb4abf6}.TM.blf
2009-12-25 01:08:58 524288 --sha-w- c:\users\bobby\ntuser.dat{f7772b49-f0f1-11de-9a9d-0023aeb4abf6}.TMContainer00000000000000000002.regtrans-ms
2009-12-25 01:08:58 524288 --sha-w- c:\users\bobby\ntuser.dat{f7772b49-f0f1-11de-9a9d-0023aeb4abf6}.TMContainer00000000000000000001.regtrans-ms
2009-12-23 20:47:21 0 d-----w- c:\users\bobby\appdata\roaming\CopyToDvd
2009-12-23 04:37:36 0 d-----w- c:\program files\common files\PC Tools
2009-12-23 04:37:35 0 d-----w- c:\users\bobby\appdata\roaming\PC Tools
2009-12-23 04:37:35 0 d-----w- c:\programdata\PC Tools
2009-12-23 04:37:35 0 d-----w- c:\program files\Spyware Doctor
2009-12-23 02:15:38 0 d-----w- c:\programdata\Avira(309)
2009-12-23 02:15:38 0 d-----w- c:\program files\Avira(185)
2009-12-22 23:22:07 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-12-22 23:22:06 0 d-----w- c:\programdata\Avira
2009-12-22 23:22:06 0 d-----w- c:\program files\Avira
2009-12-22 23:18:42 322354607 ----a-w- c:\windows\MEMORY.DMP
2009-12-22 22:44:15 489 ----a-w- c:\windows\system32\krl32mainweq.dll
2009-12-22 22:43:06 200 ----a-w- c:\windows\system32\srcr.dat
2009-12-22 04:26:55 0 d-----w- c:\program files\common files\DivX Shared
2009-12-22 04:26:54 0 d-----w- c:\program files\DivX
2009-12-21 23:29:03 0 d-----w- c:\program files\PeerBlock
2009-12-21 21:30:54 0 d-----w- c:\programdata\ALM
2009-12-17 19:12:07 0 d-----w- c:\program files\Pcsx2
2009-12-17 05:56:49 0 d-----w- c:\program files\PeerGuardian2
2009-12-16 16:46:32 766 ----a-w- c:\windows\CoD.INI
2009-12-16 16:30:25 334792 ----a-w- c:\windows\system32\_AxShlEx.dll
2009-12-16 16:28:31 0 d-----w- c:\program files\Alcohol Soft
2009-12-16 08:20:32 203 ----a-w- c:\windows\GSdx9 sse2.INI
2009-12-16 08:13:33 0 d--h--w- c:\windows\msdownld.tmp
2009-12-16 08:13:27 0 d-----w- c:\windows\system32\directx
2009-12-16 07:24:59 716272 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-12-16 06:00:18 0 d-----w- c:\program files\common files\Macrovision Shared
2009-12-16 05:10:56 0 d-----w- c:\program files\Elaborate Bytes
2009-12-15 23:28:07 0 d-----w- c:\users\bobby\appdata\roaming\BitTorrent
2009-12-15 23:25:58 0 d-----w- c:\program files\BitTorrent
2009-12-15 23:20:55 0 d-----w- c:\program files\Ask.com
2009-12-11 22:44:10 24064 ----a-w- c:\windows\system32\nshhttp.dll
2009-12-11 22:44:02 411648 ----a-w- c:\windows\system32\drivers\http.sys
2009-12-11 22:43:58 30720 ----a-w- c:\windows\system32\httpapi.dll
2009-12-02 04:20:42 0 d-----w- c:\program files\psx emulation cheater
2009-12-02 03:02:32 19456 ----a-w- c:\windows\system32\libusbd-9x.exe
2009-12-02 03:02:32 18944 ----a-w- c:\windows\system32\libusbd-nt.exe
2009-12-02 03:02:32 0 d-----w- c:\program files\PS3 Controller
2009-12-02 01:32:03 46592 ----a-w- c:\windows\system32\libusb0.dll
2009-12-02 01:32:03 33792 ----a-w- c:\windows\system32\drivers\libusb0.sys
2009-12-02 01:07:28 0 d-----w- c:\program files\Project64 1.6

==================== Find3M ====================

2009-12-29 19:42:01 86016 ----a-w- c:\windows\inf\infstor.dat
2009-12-29 19:42:01 51200 ----a-w- c:\windows\inf\infpub.dat
2009-12-29 19:42:01 143360 ----a-w- c:\windows\inf\infstrng.dat
2009-12-21 22:41:30 70600 ----a-w- c:\windows\system32\GDIPFONTCACHEV1.DAT
2009-12-16 07:33:54 73312 ----a-w- c:\windows\system32\drivers\adfs.sys
2009-12-15 21:26:01 27335 ----a-w- c:\users\bobby\appdata\roaming\nvModes.dat
2009-11-21 06:40:20 916480 ----a-w- c:\windows\system32\wininet.dll
2009-11-21 06:34:39 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-11-21 06:34:39 109056 ----a-w- c:\windows\system32\iesysprep.dll
2009-11-21 04:59:58 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2009-11-17 08:24:07 665600 ----a-w- c:\windows\inf\drvindex.dat
2009-11-17 08:23:54 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
2009-11-17 08:23:38 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_07_00.Wdf
2009-11-14 00:47:32 90112 ----a-w- c:\windows\system32\dpl100.dll
2009-11-14 00:47:28 856064 ----a-w- c:\windows\system32\divx_xx0c.dll
2009-11-14 00:47:28 856064 ----a-w- c:\windows\system32\divx_xx07.dll
2009-11-14 00:47:28 847872 ----a-w- c:\windows\system32\divx_xx0a.dll
2009-11-14 00:47:28 843776 ----a-w- c:\windows\system32\divx_xx16.dll
2009-11-14 00:47:28 839680 ----a-w- c:\windows\system32\divx_xx11.dll
2009-11-14 00:47:28 696320 ----a-w- c:\windows\system32\DivX.dll
2009-11-01 17:39:32 37665 ----a-w- c:\windows\fonts\GlobalUserInterface.CompositeFont
2009-10-29 09:17:42 2048 ----a-w- c:\windows\system32\tzres.dll
2009-10-08 23:14:32 87608 ----a-w- c:\users\bobby\appdata\roaming\inst.exe
2009-10-08 23:14:32 47360 ----a-w- c:\users\bobby\appdata\roaming\pcouffin.sys
2009-10-08 21:08:01 555520 ----a-w- c:\windows\system32\UIAutomationCore.dll
2009-10-08 21:08:01 234496 ----a-w- c:\windows\system32\oleacc.dll
2009-10-08 21:07:59 4096 ----a-w- c:\windows\system32\oleaccrc.dll
2009-10-07 21:29:58 124872 ---ha-w- c:\windows\system32\mlfcache.dat
2009-10-07 11:36:36 243712 ----a-w- c:\windows\system32\rastls.dll
2009-10-01 01:02:17 2537472 ----a-w- c:\windows\system32\wpdshext.dll
2009-10-01 01:02:05 30208 ----a-w- c:\windows\system32\WPDShextAutoplay.exe
2009-10-01 01:02:04 334848 ----a-w- c:\windows\system32\PortableDeviceApi.dll
2009-10-01 01:02:02 87552 ----a-w- c:\windows\system32\WPDShServiceObj.dll
2009-10-01 01:02:00 31232 ----a-w- c:\windows\system32\BthMtpContextHandler.dll
2009-10-01 01:01:59 546816 ----a-w- c:\windows\system32\wpd_ci.dll
2009-10-01 01:01:59 160256 ----a-w- c:\windows\system32\PortableDeviceTypes.dll
2009-10-01 01:01:56 60928 ----a-w- c:\windows\system32\PortableDeviceConnectApi.dll
2009-10-01 01:01:56 350208 ----a-w- c:\windows\system32\WPDSp.dll
2009-10-01 01:01:56 196608 ----a-w- c:\windows\system32\PortableDeviceWMDRM.dll
2009-10-01 01:01:56 100864 ----a-w- c:\windows\system32\PortableDeviceClassExtension.dll
2009-10-01 01:01:54 81920 ----a-w- c:\windows\system32\wpdbusenum.dll
2009-10-01 01:01:50 226816 ----a-w- c:\windows\system32\WpdMtp.dll
2009-10-01 01:01:49 61952 ----a-w- c:\windows\system32\WpdMtpUS.dll
2009-10-01 01:01:49 33280 ----a-w- c:\windows\system32\WpdConns.dll
2008-01-21 02:43:21 174 --sha-w- c:\program files\desktop.ini
2006-11-02 12:42:02 30674 ----a-w- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 12:42:02 30674 ----a-w- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 12:42:02 287440 ----a-w- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 12:42:02 287440 ----a-w- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 09:20:21 287440 ----a-w- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 09:20:21 287440 ----a-w- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 09:20:19 30674 ----a-w- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 09:20:19 30674 ----a-w- c:\windows\inf\perflib\0000\perfc.dat
2009-08-19 00:13:21 16384 --sha-w- c:\windows\system32\config\systemprofile\appdata\local\microsoft\feeds cache\index.dat
2009-08-19 00:13:21 32768 --sha-w- c:\windows\system32\config\systemprofile\appdata\local\microsoft\windows\history\history.ie5\mshist012009081820090819\index.dat
2009-08-19 00:13:21 16384 --sha-w- c:\windows\system32\config\systemprofile\appdata\roaming\microsoft\windows\iecompatcache\index.dat
2009-08-19 00:13:21 32768 --sha-w- c:\windows\system32\config\systemprofile\appdata\roaming\microsoft\windows\privacie\index.dat
2009-01-28 12:40:45 8192 --sha-w- c:\windows\users\default\NTUSER.DAT

============= FINISH: 15:49:02.05 ===============

Thank you so much in advance for the help. This has been killing me for a week now.

PeteC · 2009/12/29

Welcome to WindowsBBS

I ran HijackThis, as is recommended nearly everywhere
Click to expand...

Not here - it is not sufficient ......

Please read this as indicated at the head of the forum and post the logs requested in this thread.

soxfan93 · 2009/12/29

Thank you, and I apologize. I will update my post shortly.

PeteC · 2009/12/29

OK - please note .....

As a new member with less than 10 posts any post you make which contains a URL requires approval (moderation) before it is visible.
Click to expand...

Admin. · 2009/12/29

I see you have P2P software ( Azures, Limewire, BitTorrent, uTorrent etc…) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information.

Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares and their infections.

References for the risk of these programs are here, and here.

I would strongly recommend that you uninstall them,

Note: Please be advised that continued use of these programs after being warned of the danger of infections from them, may result in the discontinued help of future cleaning of your system here at WindowsBBS Malware and Virus removal.

A Malware expert will have a look at your log in due course.

soxfan93 · 2009/12/29

I understand the risks, but I was infected by visiting download.com. It started off as a pop-up on that site trying to sell me fake virus protection software, which I closed, but continued to re-appear. That pop-up said I was infected with this net-worm.win32.mytob.t thing. It had nothing to do with BitTorrent.

Admin. · 2009/12/29

Please carefully re-read the message above. Nowhere does it say that it "has to do" with BitTorrent. We're just trying to educate you a bit in the process. You *are* infected...

Also, you need to post the Attach.txt log

soxfan93 · 2009/12/29

Okay. It won't let me attach it, so here it is.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-12-01.01)

Microsoft® Windows Vistaâ„¢ Home Premium
Boot Device: \Device\HarddiskVolume3
Install Date: 1/28/2009 12:11:52 AM
System Uptime: 12/29/2009 3:00:52 PM (0 hours ago)

Motherboard: Dell Inc. | | 0PR853
Processor: Intel(R) Pentium(R) Dual CPU T2390 @ 1.86GHz | Microprocessor | 1867/133mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 220 GiB total, 27.024 GiB free.
D: is FIXED (NTFS) - 10 GiB total, 4.53 GiB free.
E: is CDROM (CDFS)
F: is CDROM ()

==== Disabled Device Manager Items =============

==== System Restore Points ===================

==== Installed Programs ======================

1Click DVD Copy Pro 4.1.7.0
1Click DVDTOIPOD 2.0.5.0
AAC Decoder
Acrobat.com
Adobe AIR
Adobe Anchor Service CS4
Adobe Bridge CS4
Adobe CMaps CS4
Adobe Color - Photoshop Specific CS4
Adobe Color EU Extra Settings CS4
Adobe Color JA Extra Settings CS4
Adobe Color NA Recommended Settings CS4
Adobe Color Video Profiles CS CS4
Adobe CSI CS4
Adobe Default Language CS4
Adobe Device Central CS4
Adobe Drive CS4
Adobe ExtendScript Toolkit CS4
Adobe Extension Manager CS4
Adobe Flash Player 10 Plugin
Adobe Fonts All
Adobe Illustrator CS4
Adobe Linguistics CS4
Adobe Media Player
Adobe Output Module
Adobe PDF Library Files CS4
Adobe Photoshop CS4
Adobe Photoshop CS4 Support
Adobe Reader 9.2
Adobe Search for Help
Adobe Service Manager Extension
Adobe Setup
Adobe Shockwave Player 11.5
Adobe Type Support CS4
Adobe Update Manager CS4
Adobe WinSoft Linguistics Plugin
Adobe XMP Panels CS4
AdobeColorCommonSetCMYK
AdobeColorCommonSetRGB
AIM 6
AIM Toolbar
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Ask Toolbar
Audacity 1.3.9 (Unicode)
AutoUpdate
Banctec Service Agreement
BitTorrent
Bonjour
Broadcom Management Programs
Browser Address Error Redirector
Browser Defender 2.0.6.11
Call of Duty
CamStudio
CCleaner (remove only)
Cisco EAP-FAST Module
Cisco LEAP Module
Cisco PEAP Module
Compatibility Pack for the 2007 Office system
Conexant HDA D330 MDC V.92 Modem
Connect
Dell-eBay
Dell Dock
Dell Driver Download Manager
Dell Getting Started Guide
Dell Support Center (Support Software)
Dell Touchpad
Dell Wireless WLAN Card Utility
Digital Line Detect
DIRECTV2PC(TM)
DivX Codec
DivX Converter
DivX Player
DivX Plus DirectShow Filters
DivX Plus Web Player
DivX Version Checker
Download Updater (AOL LLC)
DTV4PC 1.4
DVD43 v4.5.0
EA SPORTS online 2008
EclipseCrossword
EDocs
Eek! Adder 8
ESPN's Two Minute Drill
FFB - Facebook Friend Bomber
GEAR driver installer for x86 and x64
GEAR ISO Burn
GearDrvs
Google Desktop
Google Toolbar for Internet Explorer
GoToAssist 8.0.0.514
H.264 Decoder
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
HyperCam 2
iPhone Configuration Utility
iTunes
J2SE Runtime Environment 5.0 Update 6
Java(TM) 6 Update 7
kuler
LAME v3.98.2 for Audacity
LibUSB-Win32-0.1.10.1
MediaDirect
Microsoft .NET Framework 3.5 SP1
Microsoft Application Error Reporting
Microsoft Choice Guard
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Excel MUI (English) 2007
Microsoft Office Home and Student 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office PowerPoint Viewer 2007 (English)
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft SQL Server Compact 3.5 SP1 English
Microsoft VC9 runtime libraries
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Works
MKV Splitter
Modem Diagnostic Tool
Monopoly Here & Now Edition
Mozilla Firefox (3.5.6)
MSVCRT
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Netflix in Windows Media Center
NetWaiting
NVIDIA Drivers
OutlookAddinSetup
Pando Media Booster
Pcsx2 0.9.6
PDF Settings CS4
PeerBlock 1.0.0 (r181)
Photoshop Camera Raw
Prism Video Converter
Project64 1.6
QuickSet
QuickTime
Roxio Creator Audio
Roxio Creator Copy
Roxio Creator Data
Roxio Creator DE
Roxio Creator Tools
Roxio Express Labeler 3
Roxio Update Manager
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB973704)
Security Update for Microsoft Office Excel 2007 (KB973593)
Security Update for Microsoft Office PowerPoint 2007 (KB957789)
Security Update for Microsoft Office system 2007 (972581)
Security Update for Microsoft Office system 2007 (KB969613)
Security Update for Microsoft Office system 2007 (KB974234)
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
Spelling Dictionaries Support For Adobe Reader 9
Spyware Doctor 7.0
Suite Shared Configuration CS4
Supercast
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office InfoPath 2007 (KB976416)
Update for Microsoft Office OneNote 2007 Help (KB963670)
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 (KB974561)
Update for Microsoft Office Word 2007 Help (KB963665)
VC80CRTRedist - 8.0.50727.4053
VirtualCloneDrive
VSO CopyToDVD 4
WildTangent Games
Windows Live Communications Platform
Windows Live Essentials
Windows Live Movie Maker
Windows Live Photo Gallery
Windows Live Sign-in Assistant
Windows Live Sync
Windows Live Upload Tool
Windows Movie Maker 2.6
WinRAR archiver
Yahoo! Toolbar
YFB - Youtube Friend Bomber

==== End Of File ===========================
Click to expand...

broni · 2009/12/29

Print these instructions out.

NOTE. If any of the programs listed below refuse to run, try renaming executive file to something else; for instance, rename hijackthis.exe to scanner.exe

***VERY IMPORTANT! Make sure, you update Superantispyware, and Malwarebytes before running the scans.***

STEP 1. Download SUPERAntiSpyware Free for Home Users:
http://www.superantispyware.com/

* Double-click SUPERAntiSpyware.exe and use the default settings for installation.
* An icon will be created on your desktop. Double-click that icon to launch the program.
* If asked to update the program definitions, click "Yes ". If not, update the definitions before scanning by selecting "Check for Updates ". (If you encounter any problems while downloading the updates, manually download and unzip them from here: http://www.superantispyware.com/definitions.html.)
* Close SUPERAntiSpyware.

PHYSICALLY DISCONNECT FROM THE INTERNET

Restart computer in Safe Mode.
To enter Safe Mode, restart computer, and keep tapping F8 key, until menu appears; select Safe Mode; you'll see "Safe Mode" in all four corners of your screen

* Open SUPERAntiSpyware.
* Click Scan your Computer... button.
* Click Scanning Preferences/Control Center... button.
* Under General and Startup tab, make sure, Start SUPERAntiSpyware when Windows starts option is UN-checked.
* Click the Scanning Control tab.
* Under Scanner Options make sure the following are checked (leave all others unchecked):

Close browsers before scanning.

Terminate memory threats before quarantining.

* Click the Close button to leave the control center screen.
* On the left, make sure you check C:\Fixed Drive.
* On the right, choose Perform Complete Scan.
* Click Next to start the scan. Please be patient while it scans your computer.
* After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click OK.
* Make sure everything has a checkmark next to it and click Next.
* A notification will appear that Quarantine and Removal is Complete. Click OK and then click the Finish button to return to the main menu.
* If asked if you want to reboot, click Yes.
* To retrieve the removal information after reboot, launch SUPERAntispyware again.

Click Preferences, then click the Statistics/Logs tab.

Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.

If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.

Please copy and paste the Scan Log results in your next reply.

* Click Close to exit the program.
Post SUPERAntiSpyware log.

RECONNECT TO THE INTERNET

RESTART COMPUTER!

STEP 2. Download Malwarebytes' Anti-Malware: http://www.malwarebytes.org/mbam.php to your desktop.
(Malwarebytes is free to use as a manual scanner. Payment is only required if you wish to have it run and update automatically which is not necessary for our purposes)

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.

The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

RESTART COMPUTER!

STEP 3. Download GMER: http://www.gmer.net/files.php, by clicking on Download EXE button.
Alternative downloads:
- http://majorgeeks.com/GMER_d5198.html
- http://www.softpedia.com/get/Interne...ers/GMER.shtml
Double click on downloaded .exe file, select Rootkit tab and click the Scan button.
When scan is completed, click Save button, and save the results as gmer.log
Warning ! Please, do not select the "Show all" checkbox during the scan.
Post the log to your next reply.

RESTART COMPUTER

STEP 4. Download HijackThis:
http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download
by clicking on Installer under Version 2.0.2
[DO NOT download version 2.0.3 (beta)]
Install, and run it.
Post HijackThis log.
NOTE. If you're using Vista, right click on HijackThis, and click Run as Administrator
Do NOT attempt to "fix" anything!

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

soxfan93 · 2009/12/29

It won't let me install SUPERAntiSpyware, Windows just keeps crashing.

broni · 2009/12/29

Please download ComboFix from [color= "Red"]Here[/color] or [color= "#FF0000"]Here[/color] to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

Please, never rename Combofix unless instructed.

Close any open browsers.

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results ".

Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

NOTE. If Combofix asks you to install Recovery Console, please allow it.

Close any open browsers.

WARNING: Combofix will disconnect your machine from the Internet as soon as it starts

Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.

If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

Double click on combofix.exe & follow the prompts.

When finished, it will produce a report for you.

Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

Make sure, you re-enable your security programs, when you're done with Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

Download HijackThis:
http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download
by clicking on Installer under Version 2.0.2
[DO NOT download version 2.0.3 (beta)]
Install, and run it.
Post HijackTHis log.
Do NOT attempt to fix anything!

NOTE. If you're using Vista, right click on HijackThis, and click Run as Administrator

soxfan93 · 2009/12/29

Anytime I run the .exe file, a pop-up window tells me that it "has stopped working. Windows is looking for a solution." Then it says "A problem caused the program to stop working correctly. Windows will close the program and notify you if a solution is available. "

broni · 2009/12/29

Rename combofix.exe to combofix.com and try again. If still same problem, try Safe Mode.

soxfan93 · 2009/12/30

Switching it to .com worked.

ComboFix 09-12-29.04 - Bobby 12/30/2009 0:44.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3069.2138 [GMT -5:00]
Running from: c:\users\Bobby\Desktop\ComboFix.com
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\$recycle.bin\S-1-5-21-2747557039-398002934-3571994728-500
c:\$recycle.bin\S-1-5-21-2773397201-2855733099-4214572315-500
C:\install.exe
c:\programdata\Microsoft\Network\Downloader\qmgr0.dat
c:\programdata\Microsoft\Network\Downloader\qmgr1.dat
c:\users\Bobby\AppData\Roaming\inst.exe
c:\windows\system32\drivers\H8SRTmebuxsbwit.sys
c:\windows\system32\H8SRTcwhdowtfwi.dll
c:\windows\system32\H8SRTqeopapmygt.dll
c:\windows\system32\H8SRTvbowmxjxdn.dat
c:\windows\system32\krl32mainweq.dll
c:\windows\system32\oem7.inf
c:\windows\system32\srcr.dat

----- BITS: Possible infected sites -----

hxxp://armmf.adobe.com
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_H8SRTd.sys
-------\Legacy_H8SRTd.sys

((((((((((((((((((((((((( Files Created from 2009-11-28 to 2009-12-30 )))))))))))))))))))))))))))))))
.

2009-12-30 05:57 . 2009-12-30 06:00 -------- d-----w- c:\users\Bobby\AppData\Local\temp
2009-12-30 05:57 . 2009-12-30 05:57 -------- d-----w- c:\users\Default\AppData\Local\temp
2009-12-30 01:43 . 2009-12-30 01:53 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-12-30 01:43 . 2009-12-30 01:43 -------- d-----w- c:\users\Bobby\AppData\Roaming\SUPERAntiSpyware.com
2009-12-30 01:42 . 2009-12-30 01:42 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-12-29 20:20 . 2009-12-29 20:20 -------- d-----w- c:\program files\Trend Micro
2009-12-29 04:51 . 2009-12-29 20:01 -------- d-----w- c:\program files\Norton 360
2009-12-29 02:14 . 2009-12-29 02:14 -------- d-----w- c:\programdata\{1C6FDDD8-FC9E-4C12-9FA5-1AAD377097B3}
2009-12-29 02:14 . 2009-12-29 02:14 -------- d-----w- c:\program files\GEAR Software
2009-12-26 01:31 . 2009-01-15 17:19 23848 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2009-12-26 01:31 . 2008-04-17 17:12 107368 ----a-w- c:\windows\system32\GEARAspi.dll
2009-12-25 01:48 . 2009-11-10 15:26 767952 ----a-w- c:\windows\BDTSupport.dll
2009-12-25 01:48 . 2009-11-10 15:28 149456 ----a-w- c:\windows\SGDetectionTool.dll
2009-12-25 01:48 . 2009-11-10 15:28 165840 ----a-w- c:\windows\PCTBDRes.dll
2009-12-25 01:48 . 2009-11-10 15:28 1640400 ----a-w- c:\windows\PCTBDCore.dll
2009-12-25 01:48 . 2009-10-28 06:36 1152444 ----a-w- c:\windows\UDB.zip
2009-12-25 01:48 . 2008-11-26 17:08 131 ----a-w- c:\windows\IDB.zip
2009-12-25 01:41 . 2009-10-30 16:11 233136 ----a-w- c:\windows\system32\drivers\pctgntdi.sys
2009-12-25 01:41 . 2009-10-30 16:09 98600 ----a-w- c:\windows\system32\drivers\pctwfpfilter.sys
2009-12-25 01:41 . 2009-11-09 16:20 207792 ----a-w- c:\windows\system32\drivers\PCTCore.sys
2009-12-25 01:41 . 2009-10-06 21:31 87784 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys
2009-12-25 01:41 . 2009-09-03 14:45 70408 ----a-w- c:\windows\system32\drivers\pctplsg.sys
2009-12-23 20:47 . 2009-12-23 20:47 -------- d-----w- c:\users\Bobby\AppData\Roaming\CopyToDvd
2009-12-23 04:46 . 2009-12-23 04:46 -------- d-----w- c:\users\Bobby\AppData\Local\Threat Expert
2009-12-23 04:37 . 2009-12-25 01:41 -------- d-----w- c:\program files\Common Files\PC Tools
2009-12-23 04:37 . 2009-12-30 01:47 -------- d-----w- c:\program files\Spyware Doctor
2009-12-23 04:37 . 2009-12-23 04:37 -------- d-----w- c:\users\Bobby\AppData\Roaming\PC Tools
2009-12-23 04:37 . 2009-12-23 04:37 -------- d-----w- c:\programdata\PC Tools
2009-12-23 02:15 . 2009-12-23 02:15 -------- d-----w- c:\programdata\Avira(309)
2009-12-23 02:15 . 2009-12-23 02:15 -------- d-----w- c:\program files\Avira(185)
2009-12-22 23:22 . 2009-07-28 20:33 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-12-22 23:22 . 2009-03-30 14:33 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2009-12-22 23:22 . 2009-12-25 04:02 -------- d-----w- c:\programdata\Avira
2009-12-22 23:22 . 2009-12-25 04:01 -------- d-----w- c:\program files\Avira
2009-12-22 04:28 . 2009-12-22 04:28 -------- d-----w- c:\users\Bobby\AppData\Roaming\DivX
2009-12-22 04:26 . 2009-12-22 04:27 -------- d-----w- c:\program files\Common Files\DivX Shared
2009-12-22 04:26 . 2009-12-22 04:28 -------- d-----w- c:\program files\DivX
2009-12-21 23:29 . 2009-12-30 05:29 -------- d-----w- c:\program files\PeerBlock
2009-12-21 21:30 . 2009-12-21 21:30 -------- d-----w- c:\programdata\ALM
2009-12-17 19:12 . 2009-12-17 19:12 -------- d-----w- c:\program files\Pcsx2
2009-12-17 05:56 . 2009-12-21 23:27 -------- d-----w- c:\program files\PeerGuardian2
2009-12-16 16:30 . 2008-02-22 11:30 334792 ----a-w- c:\windows\system32\_AxShlEx.dll
2009-12-16 16:28 . 2009-12-16 16:28 -------- d-----w- c:\program files\Alcohol Soft
2009-12-16 08:13 . 2009-12-16 08:17 -------- d--h--w- c:\windows\msdownld.tmp
2009-12-16 07:24 . 2009-12-16 07:24 716272 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-12-16 06:00 . 2009-12-16 06:00 -------- d-----w- c:\program files\Common Files\Macrovision Shared
2009-12-16 05:10 . 2009-12-16 05:10 -------- d-----w- c:\program files\Elaborate Bytes
2009-12-15 23:28 . 2009-12-25 04:06 -------- d-----w- c:\users\Bobby\AppData\Roaming\BitTorrent
2009-12-15 23:25 . 2009-12-15 23:26 -------- d-----w- c:\program files\BitTorrent
2009-12-15 23:20 . 2009-12-15 23:21 -------- d-----w- c:\program files\Ask.com
2009-12-11 22:44 . 2009-11-09 12:31 24064 ----a-w- c:\windows\system32\nshhttp.dll
2009-12-11 22:44 . 2009-11-09 10:36 411648 ----a-w- c:\windows\system32\drivers\http.sys
2009-12-11 22:43 . 2009-11-09 12:30 30720 ----a-w- c:\windows\system32\httpapi.dll
2009-12-02 04:20 . 2009-12-02 04:20 -------- d-----w- c:\program files\psx emulation cheater
2009-12-02 03:02 . 2009-12-02 03:02 -------- d-----w- c:\program files\PS3 Controller
2009-12-02 03:02 . 2005-03-10 01:50 19456 ----a-w- c:\windows\system32\libusbd-9x.exe
2009-12-02 03:02 . 2005-03-10 01:50 18944 ----a-w- c:\windows\system32\libusbd-nt.exe
2009-12-02 01:32 . 2005-03-10 01:50 33792 ----a-w- c:\windows\system32\drivers\libusb0.sys
2009-12-02 01:32 . 2005-03-10 01:50 46592 ----a-w- c:\windows\system32\libusb0.dll
2009-12-02 01:07 . 2009-12-19 23:05 -------- d-----w- c:\program files\Project64 1.6

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-29 19:59 . 2009-02-27 21:23 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-12-29 04:53 . 2009-06-28 21:26 -------- d-----w- c:\programdata\NortonInstaller
2009-12-29 01:42 . 2009-02-27 21:23 -------- d-----w- c:\programdata\Symantec
2009-12-26 01:31 . 2009-06-28 21:36 -------- d-----w- c:\programdata\{7B6BA59A-FB0E-4499-8536-A7420338BF3B}
2009-12-25 13:17 . 2009-12-25 13:17 690952 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2009-12-25 04:06 . 2009-08-20 05:37 -------- d-----w- c:\programdata\FLEXnet
2009-12-25 04:06 . 2009-02-28 03:03 -------- d-----w- c:\programdata\OfficeGuardian
2009-12-25 04:06 . 2009-02-28 01:46 -------- d-----w- c:\programdata\Microsoft Help
2009-12-25 04:06 . 2009-01-28 11:45 -------- d-----w- c:\program files\Roxio
2009-12-25 04:06 . 2009-07-25 07:29 -------- d-----r- c:\program files\Norton Support
2009-12-25 04:06 . 2009-01-28 11:45 -------- d-----w- c:\program files\Microsoft Works
2009-12-25 04:06 . 2009-01-28 11:48 -------- d-----w- c:\program files\Common Files\SureThing Shared
2009-12-23 20:47 . 2009-06-24 00:34 -------- d-----w- c:\users\Bobby\AppData\Roaming\Vso
2009-12-22 04:27 . 2009-01-28 11:47 -------- d-----w- c:\program files\Common Files\PX Storage Engine
2009-12-21 22:41 . 2009-08-20 19:33 70600 ----a-w- c:\windows\system32\GDIPFONTCACHEV1.DAT
2009-12-21 22:11 . 2009-01-28 11:55 -------- d-----w- c:\program files\Common Files\Adobe
2009-12-17 19:12 . 2009-12-17 19:12 12862 ----a-r- c:\users\Bobby\AppData\Roaming\Microsoft\Installer\{0E2B767B-EA6A-489B-BF83-8083FE1DB661}\_1EEFFF72773535163E4216.exe
2009-12-16 17:56 . 2009-08-01 17:01 -------- d-----w- c:\program files\CamStudio
2009-12-16 17:22 . 2009-01-28 11:34 -------- d-----w- c:\program files\Broadcom
2009-12-16 07:33 . 2008-08-14 12:57 73312 ----a-w- c:\windows\system32\drivers\adfs.sys
2009-12-16 07:09 . 2009-03-05 01:10 -------- d-----w- c:\program files\EA SPORTS
2009-12-15 21:26 . 2009-02-27 23:49 27335 ----a-w- c:\users\Bobby\AppData\Roaming\nvModes.dat
2009-12-11 08:22 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-12-02 01:07 . 2009-12-02 01:07 8854 ----a-r- c:\users\Bobby\AppData\Roaming\Microsoft\Installer\{9559F7CA-5E34-4237-A2D9-D856464AD727}\Uninstall_Project64__9559F7CA5E344237A2D9D856464AD727.exe
2009-12-02 01:07 . 2009-12-02 01:07 40960 ----a-r- c:\users\Bobby\AppData\Roaming\Microsoft\Installer\{9559F7CA-5E34-4237-A2D9-D856464AD727}\NewShortcut1_9559F7CA5E344237A2D9D856464AD727.exe
2009-12-02 01:07 . 2009-12-02 01:07 40960 ----a-r- c:\users\Bobby\AppData\Roaming\Microsoft\Installer\{9559F7CA-5E34-4237-A2D9-D856464AD727}\ARPPRODUCTICON.exe
2009-11-27 18:06 . 2009-11-27 18:03 -------- d-----w- c:\users\Bobby\AppData\Roaming\Orbit
2009-11-27 18:03 . 2009-11-27 18:03 -------- d-----w- c:\users\Bobby\AppData\Roaming\GrabPro
2009-11-21 06:40 . 2009-12-10 19:31 916480 ----a-w- c:\windows\system32\wininet.dll
2009-11-21 06:34 . 2009-12-10 19:31 109056 ----a-w- c:\windows\system32\iesysprep.dll
2009-11-21 06:34 . 2009-12-10 19:31 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-11-21 04:59 . 2009-12-10 19:31 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2009-11-18 01:14 . 2009-11-18 01:14 -------- dc-h--w- c:\programdata\{0E5180DA-DACE-4845-8EA2-7A5331530348}
2009-11-17 08:24 . 2009-11-17 08:24 -------- d-----w- c:\program files\Windows Portable Devices
2009-11-17 08:24 . 2006-11-02 10:25 665600 ----a-w- c:\windows\inf\drvindex.dat
2009-11-17 08:23 . 2009-11-17 08:23 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
2009-11-17 08:23 . 2009-11-17 08:23 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_07_00.Wdf
2009-11-16 23:50 . 2009-11-16 23:48 -------- d-----w- c:\program files\NCH Software
2009-11-16 23:48 . 2009-11-16 23:48 -------- d-----w- c:\programdata\NCH Software
2009-11-16 23:36 . 2009-11-16 23:36 -------- d-----w- c:\program files\Microsoft
2009-11-16 23:36 . 2009-11-16 23:35 -------- d-----w- c:\program files\Windows Live
2009-11-16 23:36 . 2009-11-16 23:36 -------- d-----w- c:\program files\Windows Live SkyDrive
2009-11-16 23:33 . 2009-08-11 21:25 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition
2009-11-16 23:28 . 2009-11-16 23:28 -------- d-----w- c:\program files\Common Files\Windows Live
2009-11-14 00:47 . 2009-11-14 00:47 90112 ----a-w- c:\windows\system32\dpl100.dll
2009-11-14 00:47 . 2009-11-14 00:47 856064 ----a-w- c:\windows\system32\divx_xx0c.dll
2009-11-14 00:47 . 2009-11-14 00:47 856064 ----a-w- c:\windows\system32\divx_xx07.dll
2009-11-14 00:47 . 2009-11-14 00:47 847872 ----a-w- c:\windows\system32\divx_xx0a.dll
2009-11-14 00:47 . 2009-11-14 00:47 843776 ----a-w- c:\windows\system32\divx_xx16.dll
2009-11-14 00:47 . 2009-11-14 00:47 839680 ----a-w- c:\windows\system32\divx_xx11.dll
2009-11-14 00:47 . 2009-11-14 00:47 696320 ----a-w- c:\windows\system32\DivX.dll
2009-11-01 18:14 . 2009-10-25 20:44 -------- d-----w- c:\program files\VideoLAN
2009-11-01 17:52 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Calendar
2009-11-01 17:52 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Sidebar
2009-11-01 17:52 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Photo Gallery
2009-11-01 17:52 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Journal
2009-11-01 17:52 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Collaboration
2009-11-01 17:52 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Defender
2009-11-01 05:18 . 2009-06-14 21:04 -------- d-----w- c:\program files\iTunes
2009-11-01 05:18 . 2009-02-27 22:25 -------- d-----w- c:\program files\Common Files\Apple
2009-11-01 04:27 . 2009-11-01 04:03 -------- d-----w- c:\users\Bobby\AppData\Roaming\FMZilla
2009-10-30 01:15 . 2009-10-30 01:15 79144 ----a-w- c:\programdata\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe
2009-10-29 09:17 . 2009-11-25 08:03 2048 ----a-w- c:\windows\system32\tzres.dll
2009-10-17 14:18 . 2009-06-24 00:42 18816 ----a-w- c:\windows\system32\drivers\dvd43llh.sys
2009-10-11 20:29 . 2009-10-11 20:30 38208 ----a-w- c:\users\Bobby\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2009-10-11 20:29 . 2009-10-11 20:30 38208 ----a-w- c:\users\Default\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2009-10-08 23:14 . 2009-06-24 00:34 47360 ----a-w- c:\users\Bobby\AppData\Roaming\pcouffin.sys
2009-10-08 23:14 . 2009-06-24 00:34 47360 ----a-w- c:\users\Bobby\AppData\Roaming\pcouffin.sys
2009-10-08 21:08 . 2009-11-17 08:01 234496 ----a-w- c:\windows\system32\oleacc.dll
2009-10-08 21:08 . 2009-11-17 08:01 555520 ----a-w- c:\windows\system32\UIAutomationCore.dll
2009-10-08 21:07 . 2009-11-17 08:01 4096 ----a-w- c:\windows\system32\oleaccrc.dll
2009-10-07 21:29 . 2009-10-07 21:29 124872 ---ha-w- c:\windows\system32\mlfcache.dat
2009-10-07 11:36 . 2009-12-10 19:31 243712 ----a-w- c:\windows\system32\rastls.dll
2009-11-18 00:03 . 2009-11-18 00:03 119808 ----a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
2009-01-28 12:40 . 2009-01-28 12:35 8192 --sha-w- c:\windows\Users\Default\NTUSER.DAT
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC} "= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-11-18 1196936]

[HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2009-11-18 23:40 1196936 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440} "= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-11-18 1196936]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440} "= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-11-18 1196936]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg "= "c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-07-27 39408]
"PeerBlock "= "c:\program files\PeerBlock\peerblock.exe" [2009-09-28 1529432]
"ehTray.exe "= "c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"AlcoholAutomount "= "c:\program files\Alcohol Soft\Alcohol 120\axcmd.exe" [2009-12-16 4608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"dellsupportcenter "= "c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-10-04 206064]
"avgnt "= "c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"AdobeCS4ServiceManager "= "c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2009-12-16 611712]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM "= "c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]

c:\users\Bobby\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock.lnk - c:\program files\Dell\DellDock\DellDock.exe [2008-6-20 1221928]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2009-1-28 50688]
QuickSet.lnk - c:\program files\Dell\QuickSet\quickset.exe [2008-2-22 1193240]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA "= 0 (0x0)
"EnableUIADesktopToggle "= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2009-01-28 11:49 10536 ----a-w- c:\program files\Citrix\GoToAssist\514\g2awinlogon.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs "=c:\progra~1\Google\GOOGLE~3\GoogleDesktopNetwork3.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer "=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@= "Driver "

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@= "Service "

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2 "=hex(b):4c,35,2a,67,1d,5b,ca,01

R0 PCTCore;PCTools KDS;c:\windows\System32\drivers\PCTCore.sys [12/24/2009 8:41 PM 207792]
R2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\AEstSrv.exe [1/28/2009 12:09 AM 73728]
R2 Browser Defender Update Service;Browser Defender Update Service;c:\program files\Spyware Doctor\BDT\BDTUpdateService.exe [12/24/2009 8:48 PM 112592]
R2 CLHNService3;CLHNService3;c:\program files\DirecTV\DirecTV\Kernel\DMP\CLHNService.exe [9/26/2008 5:12 PM 98304]
R2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [5/2/2008 1:09 PM 161048]
R2 libusbd;LibUsb-Win32 - Daemon, Version 0.1.10.1;system32\libusbd-nt.exe --> system32\libusbd-nt.exe [?]
R2 ntk3;ntk3;c:\program files\DirecTV\DirecTV\Kernel\DMP\ntk3.sys [9/26/2008 5:12 PM 120048]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2/27/2009 7:51 PM 24652]
R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\System32\drivers\b57nd60x.sys [1/28/2009 8:01 AM 179712]
R3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.10.1;c:\windows\System32\drivers\libusb0.sys [12/1/2009 8:32 PM 33792]
R3 pbfilter;pbfilter;c:\program files\PeerBlock\pbfilter.sys [12/21/2009 6:29 PM 16472]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [12/22/2009 6:22 PM 108289]
S3 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [1/20/2008 9:23 PM 21504]
S3 GoogleDesktopManager-110309-193829;Google Desktop Manager 5.9.911.3589;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [1/28/2009 6:37 AM 30192]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [12/24/2009 8:41 PM 359624]
S4 sptd;sptd;c:\windows\System32\drivers\sptd.sys [12/16/2009 2:24 AM 716272]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder

2009-12-30 c:\windows\Tasks\User_Feed_Synchronization-{6218DA6C-8D9D-4E01-95E4-26EA8BFBA711}.job
- c:\windows\system32\msfeedssync.exe [2009-12-10 04:59]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.windowsbbs.com/malware-virus-removal/89811-active-many-problems-net-worm-win32-mytob-t.html#post491755
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s
IE: &AIM Toolbar Search - c:\programdata\AIM Toolbar\ieToolbar\resources\en-US\local\search.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: {8A907C47-F04F-4B57-8AA9-2803A7B1C00F} = 192.168.1.1
TCP: {8FC1FA59-3448-4E1A-8AAB-C4EB442791E6} = 192.168.1.1
FF - ProfilePath - c:\users\Bobby\AppData\Roaming\Mozilla\Firefox\Profiles\aaj6q09d.default\
FF - prefs.js: browser.search.selectedEngine - Ask.com
FF - prefs.js: browser.startup.homepage - hxxp://www.mlbtraderumors.com/
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
FF - component: c:\program files\Mozilla Firefox\components\GoogleDesktopMozilla.dll
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-AdobeBridge - (no file)
HKCU-Run-Vidalia - c:\program files\Vidalia Bundle\Vidalia\vidalia.exe
AddRemove-Call of Duty - c:\progra~1\CALLOF~1\Uninstall\Unwise.exe
AddRemove-{59366175-55F2-411B-9911-3D71D46CD073} - c:\users\Bobby\AppData\Local\{773E7240-B347-4DFF-A6EF-6E829EDD59DF}\Anonymizer_Software.exe

**************************************************************************
scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files:

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'Explorer.exe'(1452)
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\System32\WLTRYSVC.EXE
c:\windows\System32\bcmwltry.exe
c:\windows\system32\WLANExt.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\libusbd-nt.exe
c:\windows\system32\STacSV.exe
c:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
c:\windows\system32\DRIVERS\xaudio.exe
c:\program files\Windows Media Player\wmpnscfg.exe
c:\windows\ehome\ehmsas.exe
c:\program files\Dell Support Center\bin\sprtsvc.exe
.
**************************************************************************
.
Completion time: 2009-12-30 01:09:37 - machine was rebooted
ComboFix-quarantined-files.txt 2009-12-30 06:09

Pre-Run: 28,601,540,608 bytes free
Post-Run: 28,964,438,016 bytes free

- - End Of File - - 158E1EBB71E6E53B0B28F27095CFCE66
Click to expand...

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:12:35 AM, on 12/30/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18865)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Dell\DellDock\DellDock.exe
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\PeerBlock\peerblock.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\Explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.windowsbbs.com/malware-v...oblems-net-worm-win32-mytob-t.html#post491755
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll
R3 - URLSearchHook: AIM Toolbar Search Class - {03402f96-3dc7-4285-bc50-9e81fefafe43} - C:\Program Files\AIM Toolbar\aimtb.dll
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Browser Defender BHO - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll
O2 - BHO: (no name) - {465E08E7-F005-4389-980F-1D8764B3486C} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O2 - BHO: AIM Toolbar Loader - {b0cda128-b425-4eef-a174-61a11ac5dbf8} - C:\Program Files\AIM Toolbar\aimtb.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: AIM Toolbar - {61539ecd-cc67-4437-a03c-9aaccbd14326} - C:\Program Files\AIM Toolbar\aimtb.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O3 - Toolbar: PC Tools Browser Guard - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll
O4 - HKLM\..\Run: [dellsupportcenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P dellsupportcenter
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe "
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe "
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe "
O4 - HKCU\..\Run: [PeerBlock] C:\Program Files\PeerBlock\peerblock.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - .DEFAULT User Startup: Dell Dock First Run.lnk = C:\Program Files\Dell\DellDock\DellDock.exe (User 'Default user')
O4 - Startup: Dell Dock.lnk = C:\Program Files\Dell\DellDock\DellDock.exe
O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe
O4 - Global Startup: QuickSet.lnk = C:\Program Files\Dell\QuickSet\quickset.exe
O8 - Extra context menu item: &AIM Toolbar Search - C:\ProgramData\AIM Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra button: AIM Toolbar - {0b83c99c-1efa-4259-858f-bcb33e007a5b} - C:\Program Files\AIM Toolbar\aimtb.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1257261144364
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1257261243579
O17 - HKLM\System\CCS\Services\Tcpip\..\{8A907C47-F04F-4B57-8AA9-2803A7B1C00F}: NameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{8FC1FA59-3448-4E1A-8AAB-C4EB442791E6}: NameServer = 192.168.1.1
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GoogleDesktopNetwork3.dll
O20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll
O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\system32\aestsrv.exe
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Browser Defender Update Service - Threat Expert Ltd. - C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exe
O23 - Service: CLHNService3 - Unknown owner - C:\Program Files\DirecTV\DirecTV\Kernel\DMP\CLHNService.exe
O23 - Service: Dock Login Service (DockLoginService) - Stardock Corporation - C:\Program Files\Dell\DellDock\DockLogin.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\Dell Games\Dell Game Console\GameConsoleService.exe
O23 - Service: Google Desktop Manager 5.9.911.3589 (GoogleDesktopManager-110309-193829) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: GoToAssist - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LibUsb-Win32 - Daemon, Version 0.1.10.1 (libusbd) - http://libusb-win32.sourceforge.net - C:\Windows\system32\libusbd-nt.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: SupportSoft Sprocket Service (DellSupportCenter) (sprtsvc_DellSupportCenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: SigmaTel Audio Service (STacSV) - IDT, Inc. - C:\Windows\system32\STacSV.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 10381 bytes
Click to expand...

broni · 2009/12/30

Very good

Uninstall Combofix:
Go Start > Run [Vista users, go Start> "Start search"]
Type in:
Combofix /Uninstall
Note the space between the "Combofix" and the "/Uninstall "
Restart computer.

You have to decide, if you want to stay with Avira, or you want to reinstall Norton.
Let me know, before you do anything.

Now, try to run scans from my reply #9.

soxfan93 · 2009/12/30

I'd like to return to Norton... We are paying for it haha.

broni · 2009/12/30

No problem.
Uninstall Avira and see, if you can reinstall Norton now.
If it installs and runs fine, run the scans from my reply #9.
If Norton gives you any problems, turn Windows firewall on, for now and run scans.

soxfan93 · 2009/12/30

Norton's back and runs great. Now on to those scans.

broni · 2009/12/30

Cool

soxfan93 · 2009/12/30

Step 1

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 12/30/2009 at 05:51 PM

Application Version : 4.32.1000

Core Rules Database Version : 4424
Trace Rules Database Version: 2250

Scan type : Complete Scan
Total Scan Time : 02:32:58

Memory items scanned : 276
Memory threats detected : 0
Registry items scanned : 6976
Registry threats detected : 0
File items scanned : 247457
File threats detected : 0
Click to expand...

Log in or Sign up

Solved Many problems with net-worm.win32.mytob.t

soxfan93 Inactive Thread Starter

PeteC SuperGeek Staff

soxfan93 Inactive Thread Starter

PeteC SuperGeek Staff

Admin. Administrator Administrator Staff

soxfan93 Inactive Thread Starter

Admin. Administrator Administrator Staff

soxfan93 Inactive Thread Starter

broni Moderator Malware Analyst

soxfan93 Inactive Thread Starter

broni Moderator Malware Analyst

soxfan93 Inactive Thread Starter

broni Moderator Malware Analyst

soxfan93 Inactive Thread Starter

broni Moderator Malware Analyst

soxfan93 Inactive Thread Starter

broni Moderator Malware Analyst

soxfan93 Inactive Thread Starter

broni Moderator Malware Analyst

soxfan93 Inactive Thread Starter

Share This Page

Log in or Sign up

Solved Many problems with net-worm.win32.mytob.t

soxfan93 Inactive Thread Starter

PeteC SuperGeek Staff

soxfan93 Inactive Thread Starter

PeteC SuperGeek Staff

Admin. Administrator Administrator Staff

soxfan93 Inactive Thread Starter

Admin. Administrator Administrator Staff

soxfan93 Inactive Thread Starter

broni Moderator Malware Analyst

soxfan93 Inactive Thread Starter

broni Moderator Malware Analyst

soxfan93 Inactive Thread Starter

broni Moderator Malware Analyst

soxfan93 Inactive Thread Starter

broni Moderator Malware Analyst

soxfan93 Inactive Thread Starter

broni Moderator Malware Analyst

soxfan93 Inactive Thread Starter

broni Moderator Malware Analyst

soxfan93 Inactive Thread Starter

Share This Page

Useful Searches