(Active) idlist not found...Virus Caused?

My desktop and taskbar have become unstable....they flash on and off about every 10 to 15 seconds. Through windows task manager I am able to get the desktop to show up on demand, but an error "Windows Cannot Find idlist, :1204,c:\documents" comes up.

I hope I am in the right forum!
Please Help!!!

Thanks,
BigBadRadDad


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:55:46 PM, on 2/18/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\lxctcoms.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\twc\medicsp2\bin\sprtsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ps2.exe
C:\WINDOWS\system32\hphmon06.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\windows\system\hpsysdrv.exe
C:\Program Files\twc\medicsp2\bin\sprtcmd.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Dean\Desktop\Ad-AwareAE.exe
C:\DOCUME~1\Dean\LOCALS~1\Temp\mia2B.tmp\Ad-AwareAE.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Yahoo!
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: (no name) - {00D6A7E7-4A97-456f-848A-3B75BF7554D7} - (no file)
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - C:\WINDOWS\system32\tuvSMEXQ.dll
O2 - BHO: (no name) - {F5981755-C709-424B-A8CE-4EC093BD4916} - C:\WINDOWS\system32\nnnkHwUl.dll
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe "
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [WinPatrol] C:\PROGRA~1\BILLPS~1\WINPAT~1\winpatrol.exe
O4 - HKLM\..\Run: [LXCTCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCTtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe "
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe "
O4 - HKLM\..\Run: [medicsp2] C:\Program Files\twc\medicsp2\bin\sprtcmd.exe /P medicsp2
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll "
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: AutorunsDisabled
O8 - Extra context menu item: Add To HP Organize... - C:\PROGRA~1\HEWLET~1\HPORGA~1\bin\core.hp.main\SendTo.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - AutorunsDisabled - (no file)
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} - http://upload.facebook.com/controls/FacebookPhotoUploader2.cab
O16 - DPF: {88D758A3-D33B-45FD-91E3-67749B4057FA} - http://dm.screensavers.com/dm/installers/si/1/sinstaller.cab
O20 - Winlogon Notify: tuvSMEXQ - C:\WINDOWS\SYSTEM32\tuvSMEXQ.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: lxct_device - - C:\WINDOWS\system32\lxctcoms.exe
O23 - Service: SupportSoft Sprocket Service (medicsp2) (sprtsvc_medicsp2) - SupportSoft, Inc. - C:\Program Files\twc\medicsp2\bin\sprtsvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

--
End of file - 6838 bytes

 

Yes, my apologies! Right now it is off to work for the day. I will comply when I get home this evening.

Thanks

Pete C.....Here they are......Thank You in advance!



DDS (Ver_09-02-01.01)

Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume2
Install Date: 10/17/2004 6:52:40 PM
System Uptime: 2/20/2009 5:09:58 PM (0 hours ago)

Motherboard: ASUSTeK Computer INC. | | Puffer
Processor: Intel(R) Pentium(R) 4 CPU 3.40GHz | CPU 1 | 3401/200mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 227 GiB total, 39.245 GiB free.
D: is FIXED (FAT32) - 6 GiB total, 0.758 GiB free.
E: is CDROM ()
F: is CDROM ()
G: is Removable
H: is Removable
I: is Removable
J: is Removable
K: is Removable

==== Disabled Device Manager Items =============

Class GUID: {4D36E96E-E325-11CE-BFC1-08002BE10318}
Description:
Device ID: ROOT\MONITOR\0000
Manufacturer: HP
Name:
PNP Device ID: ROOT\MONITOR\0000
Service:

==== System Restore Points ===================

RP1401: 11/20/2008 1:25:01 PM - System Checkpoint
RP1402: 11/21/2008 8:15:29 PM - System Checkpoint
RP1403: 11/22/2008 8:44:19 PM - System Checkpoint
RP1404: 11/23/2008 9:15:16 PM - System Checkpoint
RP1405: 11/24/2008 9:33:56 PM - System Checkpoint
RP1406: 11/25/2008 10:33:28 PM - System Checkpoint
RP1407: 11/28/2008 8:26:47 PM - System Checkpoint
RP1408: 11/29/2008 8:53:32 PM - System Checkpoint
RP1409: 11/30/2008 8:31:48 PM - Software Distribution Service 3.0
RP1410: 11/30/2008 8:38:12 PM - Installed Windows Media Player 11
RP1411: 11/30/2008 8:39:50 PM - Installed Windows XP Wudf01000.
RP1412: 11/30/2008 8:46:41 PM - Installed Windows XP MSCompPackV1.
RP1413: 12/1/2008 8:53:22 PM - System Checkpoint
RP1414: 12/2/2008 5:00:35 PM - Software Distribution Service 3.0
RP1415: 12/4/2008 5:39:38 PM - System Checkpoint
RP1416: 12/5/2008 5:46:35 PM - System Checkpoint
RP1417: 12/6/2008 6:46:33 PM - System Checkpoint
RP1418: 12/7/2008 7:19:31 PM - System Checkpoint
RP1419: 12/8/2008 7:21:15 PM - System Checkpoint
RP1420: 12/9/2008 4:49:11 PM - Software Distribution Service 3.0
RP1421: 12/10/2008 5:05:43 PM - System Checkpoint
RP1422: 12/11/2008 5:48:25 PM - System Checkpoint
RP1423: 12/12/2008 5:48:47 AM - Software Distribution Service 3.0
RP1424: 12/13/2008 6:48:26 AM - System Checkpoint
RP1425: 12/16/2008 5:02:21 PM - System Checkpoint
RP1426: 12/17/2008 6:00:18 PM - System Checkpoint
RP1427: 12/17/2008 7:20:32 PM - Software Distribution Service 3.0
RP1428: 12/18/2008 7:42:29 PM - System Checkpoint
RP1429: 12/19/2008 8:13:28 PM - System Checkpoint
RP1430: 12/20/2008 9:13:26 PM - System Checkpoint
RP1431: 12/21/2008 10:13:27 PM - System Checkpoint
RP1432: 12/22/2008 10:14:16 PM - System Checkpoint
RP1433: 12/23/2008 11:13:08 PM - System Checkpoint
RP1434: 12/24/2008 11:24:57 PM - System Checkpoint
RP1435: 12/26/2008 12:13:12 AM - System Checkpoint
RP1436: 12/27/2008 9:30:38 AM - System Checkpoint
RP1437: 12/28/2008 10:18:02 AM - System Checkpoint
RP1438: 12/29/2008 11:07:08 AM - System Checkpoint
RP1439: 12/30/2008 11:42:32 AM - System Checkpoint
RP1440: 12/31/2008 12:54:37 PM - System Checkpoint
RP1441: 1/1/2009 1:01:56 PM - System Checkpoint
RP1442: 1/2/2009 1:36:48 PM - System Checkpoint
RP1443: 1/3/2009 1:54:48 PM - System Checkpoint
RP1444: 1/6/2009 6:22:22 PM - System Checkpoint
RP1445: 1/7/2009 6:53:35 PM - System Checkpoint
RP1446: 1/8/2009 7:44:58 PM - System Checkpoint
RP1447: 1/9/2009 8:44:58 PM - System Checkpoint
RP1448: 1/10/2009 9:44:58 PM - System Checkpoint
RP1449: 1/11/2009 10:44:58 PM - System Checkpoint
RP1450: 1/12/2009 11:45:10 PM - System Checkpoint
RP1451: 1/14/2009 12:44:27 AM - System Checkpoint
RP1452: 1/14/2009 12:47:40 PM - Software Distribution Service 3.0
RP1453: 1/15/2009 1:31:16 PM - System Checkpoint
RP1454: 1/16/2009 2:32:19 PM - System Checkpoint
RP1455: 1/17/2009 3:31:15 PM - System Checkpoint
RP1456: 1/18/2009 3:32:19 PM - System Checkpoint
RP1457: 1/19/2009 4:31:14 PM - System Checkpoint
RP1458: 1/20/2009 5:31:16 PM - System Checkpoint
RP1459: 1/21/2009 6:32:33 PM - System Checkpoint
RP1460: 1/22/2009 7:04:16 PM - System Checkpoint
RP1461: 1/23/2009 11:38:15 PM - System Checkpoint
RP1462: 1/25/2009 12:31:18 AM - System Checkpoint
RP1463: 1/26/2009 9:04:03 AM - System Checkpoint
RP1464: 1/27/2009 7:17:32 PM - System Checkpoint
RP1465: 1/28/2009 8:18:49 PM - System Checkpoint
RP1466: 1/29/2009 8:36:47 PM - System Checkpoint
RP1467: 1/30/2009 9:24:05 PM - System Checkpoint
RP1468: 1/31/2009 10:25:15 PM - System Checkpoint
RP1469: 2/1/2009 11:23:50 PM - System Checkpoint
RP1470: 2/3/2009 12:23:52 AM - System Checkpoint
RP1471: 2/4/2009 1:23:51 AM - System Checkpoint
RP1472: 2/5/2009 1:35:49 AM - System Checkpoint
RP1473: 2/6/2009 2:35:33 AM - System Checkpoint
RP1474: 2/7/2009 3:35:33 AM - System Checkpoint
RP1475: 2/8/2009 4:35:33 AM - System Checkpoint
RP1476: 2/9/2009 5:52:49 AM - System Checkpoint
RP1477: 2/10/2009 6:24:11 AM - System Checkpoint
RP1478: 2/11/2009 6:36:24 AM - System Checkpoint
RP1479: 2/12/2009 6:44:05 AM - System Checkpoint
RP1480: 2/13/2009 5:44:50 AM - Software Distribution Service 3.0
RP1481: 2/14/2009 6:06:19 AM - System Checkpoint
RP1482: 2/15/2009 7:06:34 AM - System Checkpoint
RP1483: 2/16/2009 7:07:22 AM - System Checkpoint
RP1484: 2/17/2009 7:42:16 AM - System Checkpoint
RP1485: 2/17/2009 7:14:26 PM - Last known good configuration

==== Installed Programs ======================

µTorrent
123 Free Solitaire
A.F.5 Rename your files 1.1
ABBYY FineReader 6.0 Sprint
Absolute Poker Basic
Ad-Aware
Adobe Acrobat 5.0
Adobe Download Manager 2.0 (Remove Only)
Adobe Flash Player 10 ActiveX
Adobe Reader 7.0.5
Advertisement Service
Agere Systems PCI Soft Modem
AiO_Scan
AiOSoftware
AppCore
Apple Mobile Device Support
Apple Software Update
ATI Control Panel
ATI Display Driver
AutoUpdate
AV
Bonjour
BufferChm
CameraDrivers
ccCommon
CCleaner (remove only)
Copy
CreativeProjects
CreativeProjectsTemplates
CueTour
Destinations
Director
DivX Codec
DivX Converter
DivX Player
DivX Web Player
DocProc
DocumentViewer
ewido anti-spyware 4.0
Fax
GdiplusUpgrade
Help and Support Additions
High Definition Audio Driver Package - KB835221
HijackThis 2.0.2
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB952287)
HP Deskjet Preloaded Printer Drivers
HP Diagnostic Assistant
hp f1903 INF and ICM software
HP Image Zone 4.2
HP Image Zone Plus 4.2
HP Organize
HP Photo & Imaging 3.5 - HP Devices
HP PSC & OfficeJet 4.0
HP Software Update
hpg2436
hpg3970
hpg4600
hpg5530
hpg8200
HPHDiscovery
HPIZ402
HPODiscovery
HpSdpAppCoreApp
HPSystemDiagnostics
InstantShare
IntelliMover Data Transfer Demo
Internet Worm Protection
InterVideo WinDVD Player
iTunes
J2SE Runtime Environment 5.0 Update 2
Java 2 Runtime Environment, SE v1.4.2_06
K-Lite Codec Pack 2.72 Full
KBD
Lexmark 5400 Series
LiveUpdate 3.2 (Symantec Corporation)
LiveUpdate Notice (Symantec Corporation)
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0 Service Pack 1
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft IntelliPoint 5.0
Microsoft IntelliType Pro 5.0
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office Standard Edition 2003
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Works 7.0
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
Norton AntiVirus
Norton AntiVirus (Symantec Corporation)
Norton AntiVirus Help
Norton AntiVirus Parent MSI
Norton AntiVirus SYMLT MSI
Norton Protection Center
PC-Doctor for Windows
Photo Explosion Special Edition
PhotoGallery
Photosmart 320,370,7400,8100,8400 Series
PrintScreen
PS2
PSPrinters06
Python 2.2 combined Win32 extensions
Python 2.2.1
QFolder
QuickPar 0.9
QuickProjects
QuickTime
Readme
Realtek AC'97 Audio
Realtek High Definition Audio Driver
Road Runner Medic 6.1
Safari
Scan
Scrapbook Factory 3.0
Security Update for Step By Step Interactive Training (KB898458)
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Internet Explorer 7 (KB928090)
Security Update for Windows Internet Explorer 7 (KB929969)
Security Update for Windows Internet Explorer 7 (KB931768)
Security Update for Windows Internet Explorer 7 (KB933566)
Security Update for Windows Internet Explorer 7 (KB937143)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player 10 (KB911565)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 10 (KB936782)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB960715)
SkinsHP1
SkinsHP2
Sonic RecordNow!
SPBBC 32bit
Spybot - Search & Destroy 1.4
SpywareBlaster 4.1
Symantec
Symantec KB-DocID:2003093015493306
Symantec Real Time Storage Protection Component
SymNet
TrayApp
TurboTax Deluxe 2007
TurboTax Deluxe Deduction Maximizer 2006
TurboTax ItsDeductible 2005
TurboTax ItsDeductible 2006
Unload
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
Updates from HP
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
WCreator2
WebFldrs XP
WebReg
WexTech AnswerWorks
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage v1.3.0254.0
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 7
Windows Media Format 11 runtime
Windows Media Player 11
Windows XP Service Pack 3
WinPatrol
WinRAR archiver

==== Event Viewer Messages From Past Week ========

2/18/2009 5:43:46 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: pbidlpcb
2/17/2009 7:14:43 PM, error: Service Control Manager [7000] - The aylnlfdx service failed to start due to the following error: The system cannot find message text for message number 0x%1 in the message file for %2.
2/17/2009 7:14:36 PM, error: Service Control Manager [7000] - The mnjoibco service failed to start due to the following error: The system cannot find message text for message number 0x%1 in the message file for %2.
2/17/2009 7:08:58 PM, error: Service Control Manager [7034] - The Windows Installer service terminated unexpectedly. It has done this 1 time(s).
2/16/2009 5:42:12 AM, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service upnphost with arguments " " in order to run the server: {204810B9-73B2-11D4-BF42-00B0D0118B56}
2/18/2009 4:19:49 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments " " in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
2/18/2009 4:20:40 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBT service which failed to start because of the following error: A device attached to the system is not functioning.
2/18/2009 4:20:40 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
2/18/2009 4:20:40 PM, error: Service Control Manager [7001] - The Apple Mobile Device service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
2/18/2009 4:20:40 PM, error: Service Control Manager [7001] - The Bonjour Service service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
2/18/2009 4:20:40 PM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.
2/18/2009 4:20:40 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD eeCtrl ewido anti-spyware 4.0 driver Fips intelppm IPSec MRxSmb NetBIOS NetBT pbidlpcb RasAcd Rdbss SRTSPX SYMTDI Tcpip WS2IFSL
2/18/2009 4:32:17 PM, error: Service Control Manager [7034] - The Bonjour Service service terminated unexpectedly. It has done this 1 time(s).
2/18/2009 4:32:26 PM, error: Service Control Manager [7034] - The Ati HotKey Poller service terminated unexpectedly. It has done this 1 time(s).
2/18/2009 5:00:42 PM, error: Service Control Manager [7034] - The Office Source Engine service terminated unexpectedly. It has done this 1 time(s).
2/18/2009 5:04:16 PM, error: Service Control Manager [7034] - The Ad-Aware 2007 Service service terminated unexpectedly. It has done this 1 time(s).
2/18/2009 5:47:23 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD eeCtrl ewido anti-spyware 4.0 driver Fips intelppm IPSec MRxSmb NetBIOS NetBT pbidlpcb RasAcd Rdbss SRTSP SRTSPX SYMTDI Tcpip WS2IFSL
2/18/2009 6:47:44 PM, error: Service Control Manager [7034] - The Ad-Aware 2007 Service service terminated unexpectedly. It has done this 2 time(s).
2/18/2009 6:49:30 PM, error: Service Control Manager [7034] - The Ad-Aware 2007 Service service terminated unexpectedly. It has done this 3 time(s).
2/18/2009 7:49:07 PM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC0000001' while processing the file '' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume.
2/20/2009 5:57:35 AM, error: Service Control Manager [7000] - The ouamkgws service failed to start due to the following error: The system cannot find message text for message number 0x%1 in the message file for %2.
2/20/2009 5:14:44 PM, error: Service Control Manager [7000] - The mleireug service failed to start due to the following error: The system cannot find message text for message number 0x%1 in the message file for %2.

==== End Of File ===========================
ank You
DDS (Ver_09-02-01.01) - NTFSx86
Run by Dean at 17:16:57.32 on Fri 02/20/2009
Internet Explorer: 7.0.5730.11
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.179 [GMT -8:00]

AV: Norton AntiVirus *On-access scanning enabled* (Outdated)
FW: Norton AntiVirus *enabled*

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINDOWS\system32\ps2.exe
C:\WINDOWS\system32\hphmon06.exe
C:\WINDOWS\system32\lxctcoms.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\windows\system\hpsysdrv.exe
C:\PROGRA~1\BILLPS~1\WINPAT~1\winpatrol.exe
C:\Program Files\twc\medicsp2\bin\sprtsvc.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\frmwrk32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\ntdll64.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Documents and Settings\Dean\Desktop\Utilities\HiJack This\dds.pif
C:\Program Files\Symantec\LiveUpdate\AUPDATE.EXE
C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uWindow Title = Windows Internet Explorer provided by Yahoo!
uInternet Settings,ProxyOverride = *.local
uURLSearchHooks: H - No File
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -
BHO: {6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} - c:\windows\system32\tuvSMEXQ.dll
BHO: {6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} - c:\windows\system32\tuvSMEXQ.dll
TB: {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - No File
EB: &Discuss: {bdeade7f-c265-11d0-bced-00a0c90ab50f} - shdocvw.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [Recguard] c:\windows\sminst\RECGUARD.EXE
mRun: [PS2] c:\windows\system32\ps2.exe
mRun: [HPHmon06] c:\windows\system32\hphmon06.exe
mRun: [AGRSMMSG] AGRSMMSG.exe
mRun: [type32] "c:\program files\microsoft intellitype pro\type32.exe "
mRun: [hpsysdrv] c:\windows\system\hpsysdrv.exe
mRun: [WinPatrol] c:\progra~1\billps~1\winpat~1\winpatrol.exe
mRun: [LXCTCATS] rundll32 c:\windows\system32\spool\drivers\w32x86\3\LXCTtime.dll,_RunDLLEntry@16
mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe "
mRun: [osCheck] "c:\program files\norton antivirus\osCheck.exe "
mRun: [medicsp2] c:\program files\twc\medicsp2\bin\sprtcmd.exe /P medicsp2
mRun: [Symantec PIF AlertEng] "c:\program files\common files\symantec shared\pif\{b8e1dd85-8582-4c61-b58f-2f227fca9a08}\pifsvc.exe" /a /m "c:\program files\common files\symantec shared\pif\{b8e1dd85-8582-4c61-b58f-2f227fca9a08}\AlertEng.dll "
mRun: [Framework Windows] frmwrk32.exe
uPolicies-explorer: NoSetActiveDesktop = 1 (0x1)
uPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
uPolicies-system: DisableTaskMgr = 1 (0x1)
mPolicies-explorer: NoSetActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
dPolicies-explorer: NoSetActiveDesktop = 1 (0x1)
dPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
dPolicies-system: DisableTaskMgr = 1 (0x1)
IE: Add To HP Organize... - c:\progra~1\hewlet~1\hporga~1\bin\core.hp.main\SendTo.html
IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office11\EXCEL.EXE/3000
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {08B0E5C0-4FCB-11CF-AAA5-00401C608501}
LSP: c:\windows\temp\ntdll64.dll
Trusted Zone: turbotax.com
DPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab
DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} - hxxp://upload.facebook.com/controls/FacebookPhotoUploader2.cab
DPF: {88D758A3-D33B-45FD-91E3-67749B4057FA} - hxxp://dm.screensavers.com/dm/installers/si/1/sinstaller.cab
Notify: igfxcui - igfxsrvc.dll
Notify: tuvSMEXQ - tuvSMEXQ.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: CShellExecuteHookImpl Object: {57b86673-276a-48b2-bae7-c6dbb3020eb8} - c:\program files\ewido anti-spyware 4.0\shellexecutehook.dll
SEH: {6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} - c:\windows\system32\tuvSMEXQ.dll

============= SERVICES / DRIVERS ===============

R1 ewido anti-spyware 4.0 driver;ewido anti-spyware 4.0 driver;c:\program files\ewido anti-spyware 4.0\guard.sys [2006-6-16 3968]
R2 ccSetMgr;Symantec Settings Manager;c:\program files\common files\symantec shared\ccSvcHst.exe [2007-1-9 108648]
R2 ewido anti-spyware 4.0 guard;ewido anti-spyware 4.0 guard;c:\program files\ewido anti-spyware 4.0\guard.exe [2006-6-16 172032]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-1-18 921936]
R3 ccEvtMgr;Symantec Event Manager;c:\program files\common files\symantec shared\ccSvcHst.exe [2007-1-9 108648]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2007-4-15 106808]
R3 NAVENG;NAVENG;c:\progra~1\common~1\symant~1\virusd~1\20070527.009\NAVENG.SYS [2007-5-28 77688]
R3 NAVEX15;NAVEX15;c:\progra~1\common~1\symant~1\virusd~1\20070527.009\NAVEX15.SYS [2007-5-28 852824]
S0 aylnlfdx;aylnlfdx;c:\windows\system32\drivers\phqghume.sys [2009-2-17 25088]
S0 mleireug;mleireug;c:\windows\system32\drivers\gwhipbzf.sys [2009-2-20 25088]
S0 mnjoibco;mnjoibco;c:\windows\system32\drivers\tfficbol.sys [2009-2-17 25088]
S0 ouamkgws;ouamkgws;c:\windows\system32\drivers\vxvfhufn.sys [2009-2-20 25088]
S0 pbidlpcb;pbidlpcb;c:\windows\system32\drivers\cslytsdw.sys []

=============== Created Last 30 ================

2009-02-20 17:14 25,088 a------- c:\windows\system32\drivers\gwhipbzf.sys
2009-02-20 05:57 25,088 a------- c:\windows\system32\drivers\vxvfhufn.sys
2009-02-19 17:02 48,128 a------- c:\windows\system32\urqQiIYs.dll
2009-02-19 17:02 104,960 a------- c:\windows\system32\ntdll64.exe
2009-02-19 16:30 4,785 a------- c:\windows\system32\warning.gif
2009-02-19 16:30 1,347 a------- c:\windows\system32\ahtn.htm
2009-02-19 16:30 457 a------- c:\windows\system32\win32hlp.cnf
2009-02-19 16:30 104,960 ac------ c:\windows\system32\dllcache\userinit.exe
2009-02-19 16:30 1 a------- c:\windows\system32\uniq.tll
2009-02-19 16:30 26,624 a------- c:\windows\system32\frmwrk32.exe
2009-02-19 16:30 26,624 a------- c:\windows\system32\998.exe
2009-02-18 19:51 <DIR> -cd-h--- c:\docume~1\alluse~1\applic~1\{83C91755-2546-441D-AC40-9A6B4B860800}
2009-02-18 19:50 <DIR> --d----- c:\program files\Lavasoft
2009-02-17 19:22 47,616 a------- c:\windows\system32\ddcAtrQJ.dll
2009-02-17 19:16 48,640 a------- c:\windows\system32\wvUnLBUK.dll
2009-02-17 19:14 25,088 a------- c:\windows\system32\drivers\phqghume.sys
2009-02-17 19:14 25,088 a------- c:\windows\system32\drivers\tfficbol.sys
2009-02-17 19:13 4,040 a------- c:\windows\pbidlpcb
2009-02-17 19:13 372 a--sh--- c:\windows\system32\lUwHknnn.ini2
2009-02-17 19:13 372 a--sh--- c:\windows\system32\lUwHknnn.ini
2009-02-17 19:08 47,616 a------- c:\windows\system32\tuvSMEXQ.dll
2009-02-17 19:07 44,824 a------- c:\windows\system32\prunnet.exe
2009-02-08 20:32 <DIR> --d----- c:\program files\uTorrent
2009-02-08 20:32 <DIR> --d----- c:\docume~1\dean\applic~1\uTorrent

==================== Find3M ====================

2009-02-19 16:30 104,960 a------- c:\windows\system32\userinit.exe
2008-12-20 15:15 826,368 a------- c:\windows\system32\wininet.dll
2007-01-30 05:02 981,319 a--sh--- c:\windows\fonts\lurnima.bak1
2007-02-02 18:53 967,653 a--sh--- c:\windows\fonts\lurnima.bak2
2007-02-03 06:55 969,661 a--sh--- c:\windows\fonts\lurnima.ini2
2004-11-11 19:26 56 -c-shr-- c:\windows\system32\CE0A64F4CF.sys
2006-05-19 05:57 569,396 ---sh--- c:\windows\system32\geebb.dll
2004-11-11 19:26 1,682 ac-sh--- c:\windows\system32\KGyGaAvL.sys
2008-09-25 14:52 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008092520080926\index.dat

============= FINISH: 17:18:51.04 ===============

 

Hi and welcome


Download Combofix from any of the links below. You must rename it before saving it. Save it to your desktop.

Link 1
Link 2
Link 3





--------------------------------------------------------------------
Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools

Please navigate to the system tray on the bottom right hand corner and look for the Norton icon.

* right-click it -> chose "Disable Auto-Protect. "
* select a duration of 5 hours (this assures no interference with the cleanup of your pc)
* click "Ok. "
* a popup will warn that protection will now be disabled and the sign will now have a Yellow X over the icon


(Click on this link to see a list of programs that should be disabled.)
http://www.bleepingcomputer.com/forums/topic114351.html


Double click on Combo-Fix.exe & follow the prompts.

Please allow ComboFix to install, if needed, Windows Recovery Console. It is a simple procedure that will only take a few moments of your time.

No Validation is Required.

The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.



** Please Note:
At times ComboFix may appear to stall, please be patient.

• When finished, it will produce a report for you.
• Please post the C:\ComboFix.txt along with a HijackThis log so we can continue cleaning the system.

Please only run the tool once, ty.

Extra note: After you have installed the Recovery Console - if you reboot your computer, right after reboot, you'll see the option for the Recovery Console now as well.
Don't select to run the Recovery Console as we don't need it.
By default, your main OS is selected there. The screen stays for 2 seconds and then it proceeds to load Windows.

You may need several replies to post the requested logs, otherwise they might get cut off.