Alien Ware laptop running slow, please look at my log file.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:23:46 AM, on 8/9/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\system32\Tablet.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\WTablet\TabUserW.exe
C:\WINDOWS\system32\Tablet.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\BisonCam\BisonTrayIcon.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\SNDVOL32.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe "
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [FunctionKeyCtrl] C:\Program Files\Function Key Controller\FKC.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe "
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe "
O4 - HKLM\..\Run: [BisonTrayIcon] C:\WINDOWS\BisonCam\BisonTrayIcon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe "
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe "
O4 - HKLM\..\Run: [PremierOpinion] C:\Program Files\PremierOpinion\pmropn.exe -boot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe "
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe "
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKLM\..\Policies\Explorer\Run: [TWu8PAdSLX] C:\Documents and Settings\All Users.WINDOWS\Application Data\dczobute\lavqzkju.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Flash Saver - {09EA1F80-F40A-11D1-B792-444553540001} - C:\PROGRA~1\FLASHS~1\save.htm
O9 - Extra 'Tools' menuitem: Flash Saver - {09EA1F80-F40A-11D1-B792-444553540001} - C:\PROGRA~1\FLASHS~1\save.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {459E93B6-150E-45D5-8D4B-45C66FC035FE} (get_atlcom Class) - http://apps.corel.com/nos_dl_manager_dev/plugin/IEGetPlugin.ocx
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1208722158640
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (file missing)
O20 - AppInit_DLLs: C:\Program Files\PremierOpinion\pmai.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: PremierOpinion - C:\Program Files\PremierOpinion\pmls.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: CSIScanner - Prevx - C:\Program Files\PrevxCSI\prevxcsi.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

--
End of file - 11066 bytes

 

Hi BrynTheSkits
Welcome back

Please do this.

Download ComboFix from Here to your Desktop.

It's best to disable realtime protection applications as they sometimes interfere with the tool.
Check this link for any applicable programs you may have.

• Close all open programs and windows
• Double click combofix.exe and follow the prompts.
• Vista users right click Combofix.exe and select Run As Administrator.
• When finished, it shall produce a log for you. Post the Combofix log

Note: Do not mouseclick combofix's window while its running. That may cause it to stall

Note - ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.

Note - Combofix makes some changes when run to prevent autorun/autoplay of ALL CDs, floppies and USB devices, to assist with malware removal & increase security. If this is an issue or makes it difficult for you to use those devices, please ask how to reset it.

Thanks
Geri

 

ComboFix 08-08-09.03 - Marker 2008-08-09 16:57:20.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2472 [GMT -7:00]
Running from: C:\Documents and Settings\Marker\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\h@tkeysh@@k.dll
C:\WINDOWS\system32\MSINET.oca

.
((((((((((((((((((((((((( Files Created from 2008-07-10 to 2008-08-10 )))))))))))))))))))))))))))))))
.

2008-08-09 02:23 . 2008-08-09 02:23 <DIR> d-------- C:\Program Files\Trend Micro
2008-08-09 01:51 . 2008-08-09 01:51 <DIR> d-------- C:\Program Files\PrevxCSI
2008-08-09 01:51 . 2008-08-09 13:00 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\PrevxCSI
2008-08-09 01:51 . 2008-08-09 01:51 17,408 --a------ C:\WINDOWS\system32\drivers\pxark.sys
2008-08-09 01:15 . 2008-08-09 01:15 <DIR> d-------- C:\Documents and Settings\Marker\Application Data\SpywareRemover
2008-08-08 20:32 . 2008-08-08 20:32 <DIR> d-------- C:\Documents and Settings\Marker\Application Data\ooVoo Details
2008-08-08 01:46 . 2008-08-08 01:46 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\dczobute
2008-08-06 17:02 . 2008-08-06 17:02 <DIR> d-------- C:\Documents and Settings\Marker\Application Data\Media Player Classic
2008-08-06 16:03 . 2008-08-06 16:03 <DIR> d-------- C:\Documents and Settings\Marker\Application Data\InstallShield
2008-08-06 14:41 . 2008-08-06 14:41 <DIR> d-------- C:\Cavedog
2008-08-06 11:25 . 2008-08-06 11:26 <DIR> d-------- C:\Program Files\Natural Mod
2008-08-05 21:48 . 2008-08-05 21:48 <DIR> d-------- C:\Documents and Settings\Marker\Application Data\Corel
2008-08-05 15:28 . 2008-08-05 15:28 <DIR> d-------- C:\Documents and Settings\Marker\Application Data\Apple Computer
2008-08-05 12:31 . 2008-08-05 12:31 <DIR> d-------- C:\Program Files\Mp3tag
2008-08-05 12:31 . 2008-08-05 12:39 <DIR> d-------- C:\Documents and Settings\Marker\Application Data\Mp3tag
2008-08-05 12:11 . 2008-08-05 12:39 <DIR> d-------- C:\Program Files\MP3Gain
2008-08-05 11:36 . 2008-08-05 11:36 268 --ah----- C:\sqmdata05.sqm
2008-08-05 11:36 . 2008-08-05 11:36 244 --ah----- C:\sqmnoopt05.sqm
2008-08-05 11:28 . 2008-08-05 11:28 <DIR> d-------- C:\Program Files\MediaMonkey
2008-08-05 10:50 . 2008-08-05 10:50 <DIR> d-------- C:\Program Files\aeroFox
2008-08-04 20:27 . 2008-08-04 20:27 <DIR> d-------- C:\Program Files\CCleaner
2008-08-04 14:57 . 2008-08-04 14:57 <DIR> d-------- C:\Program Files\ooVoo
2008-07-31 16:57 . 2008-07-31 16:59 <DIR> d-------- C:\WINDOWS\.jagex_cache_32
2008-07-31 14:28 . 2008-07-31 14:28 <DIR> d-------- C:\Program Files\Windows Live Safety Center
2008-07-28 19:12 . 2008-07-28 19:12 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\InstallShield
2008-07-28 19:11 . 2008-07-28 19:11 <DIR> d-------- C:\WINDOWS\system32\AGEIA
2008-07-28 19:11 . 2008-07-28 19:11 <DIR> d-------- C:\Program Files\AGEIA Technologies
2008-07-28 18:38 . 2008-07-28 18:38 <DIR> d-------- C:\NVIDIA
2008-07-26 10:42 . 2008-08-08 20:53 1,056 --ahs---- C:\WINDOWS\system32\KGyGaAvL.sys
2008-07-26 10:42 . 2008-08-08 20:53 88 -r-hs---- C:\WINDOWS\system32\D6AA5B26BF.sys
2008-07-26 10:33 . 2008-07-26 10:33 <DIR> d-------- C:\Program Files\Corel
2008-07-26 10:33 . 2008-07-26 10:33 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Corel
2008-07-24 19:02 . 2008-07-24 19:02 <DIR> d-------- C:\4cc6c458b4f7a5666061b59094
2008-07-23 23:18 . 2008-07-23 23:18 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\MSN6
2008-07-23 23:16 . 2008-07-23 23:16 244 --ah----- C:\sqmnoopt04.sqm
2008-07-23 23:16 . 2008-07-23 23:16 232 --ah----- C:\sqmdata04.sqm
2008-07-10 19:33 . 2008-07-10 19:33 <DIR> d-------- C:\Program Files\Groove Games
2008-07-10 10:34 . 2008-07-10 10:34 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\FLEXnet
2008-07-10 10:23 . 2008-07-10 10:23 <DIR> d-------- C:\Program Files\Common Files\Macrovision Shared

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-09 19:12 --------- d---a-w C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP
2008-08-09 09:04 --------- d-----w C:\Program Files\PremierOpinion
2008-08-09 08:50 --------- d-----w C:\Documents and Settings\Marker\Application Data\uTorrent
2008-08-09 08:36 --------- d-----w C:\Program Files\Spyware Doctor
2008-08-09 03:33 --------- d-----w C:\Program Files\Steam
2008-08-08 20:37 --------- d-----w C:\Documents and Settings\LocalService.NT AUTHORITY\Application Data\WTablet
2008-08-08 00:27 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-08-06 23:03 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-08-05 23:37 --------- d-----w C:\Program Files\Common Files\AOL
2008-08-05 23:37 --------- d-----w C:\Program Files\AlienGUIse
2008-08-05 23:37 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\AOL
2008-08-05 17:41 --------- d-----w C:\Program Files\Bonjour
2008-08-05 17:37 --------- d-----w C:\Program Files\Common Files\Stardock
2008-08-05 05:27 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-08-05 05:27 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-08-05 05:26 669,184 ----a-w C:\WINDOWS\system32\pbsvc.exe
2008-08-05 05:26 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
2008-08-05 05:07 --------- d-----w C:\Program Files\Skype
2008-08-05 05:07 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Skype
2008-08-05 04:43 --------- d-----w C:\Program Files\Eltima Software
2008-08-05 01:12 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec
2008-07-31 00:42 23,888 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.sys
2008-07-31 00:28 706 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.inf
2008-07-31 00:28 10,537 ----a-w C:\WINDOWS\system32\drivers\coh_mon.cat
2008-07-29 02:13 5,120 ----a-w C:\WINDOWS\system32\BReWErS.dll
2008-07-29 02:11 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-07-29 02:05 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-07-25 03:52 --------- d-----w C:\Program Files\WarRock
2008-07-16 16:27 --------- d-----w C:\Program Files\Flash Saver
2008-07-10 17:31 --------- d-----w C:\Program Files\Common Files\Adobe
2008-07-09 16:52 --------- d-----w C:\Program Files\Norton AntiVirus
2008-07-08 20:56 805 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
2008-07-08 20:56 60,800 ----a-w C:\WINDOWS\system32\S32EVNT1.DLL
2008-07-08 20:56 123,952 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2008-07-08 20:56 10,671 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2008-07-08 20:56 --------- d-----w C:\Program Files\Symantec
2008-07-08 20:44 --------- d-----w C:\Program Files\Windows Sidebar
2008-07-04 16:47 --------- d-----w C:\Program Files\StuffPlug3
2008-06-28 20:06 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-06-25 22:05 --------- d-----w C:\Program Files\Unlocker
2008-06-24 03:25 --------- d-----w C:\Program Files\Common Files\Adobe Systems Shared
2008-06-21 03:37 --------- d-----w C:\Program Files\IDoser v4
2008-06-21 00:30 --------- d-----w C:\Documents and Settings\Marker\Application Data\WTablet
2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-18 22:32 --------- d-----w C:\Program Files\Apple Software Update
2008-06-18 05:12 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Move Bore Curb Tool
2008-06-18 01:08 --------- d-----w C:\Program Files\SUPERAntiSpyware
2008-06-18 01:08 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\SUPERAntiSpyware.com
2008-06-16 23:20 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\avg8
2008-06-16 23:18 --------- d-----w C:\Program Files\AVG
2008-06-13 21:45 579,464 ----a-w C:\WINDOWS\system32\SymNeti.dll
2008-06-13 21:45 207,240 ----a-w C:\WINDOWS\system32\SymRedir.dll
2008-06-13 21:14 31,280 ----a-w C:\WINDOWS\system32\drivers\SymIM.sys
2008-06-13 21:14 13,093 ----a-w C:\WINDOWS\system32\drivers\SymRedir.cat
2008-06-13 21:14 1,611 ----a-w C:\WINDOWS\system32\drivers\SymRedir.inf
2008-06-13 21:13 96,432 ----a-w C:\WINDOWS\system32\drivers\symfw.sys
2008-06-13 21:13 41,008 ----a-w C:\WINDOWS\system32\drivers\symndisv.sys
2008-06-13 21:13 38,576 ----a-w C:\WINDOWS\system32\drivers\symids.sys
2008-06-13 21:13 37,424 ----a-w C:\WINDOWS\system32\drivers\symndis.sys
2008-06-13 21:13 22,320 ----a-w C:\WINDOWS\system32\drivers\symredrv.sys
2008-06-13 21:13 184,240 ----a-w C:\WINDOWS\system32\drivers\symtdi.sys
2008-06-13 21:13 13,616 ----a-w C:\WINDOWS\system32\drivers\symdns.sys
2008-06-13 13:10 272,128 ----a-w C:\WINDOWS\system32\drivers\bthport.sys
2008-05-20 23:32 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-04-25 05:06 32 ----a-w C:\Documents and Settings\All Users.WINDOWS\Application Data\ezsid.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56 15360]
"msnmsgr "= "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelZeroConfig "= "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [2008-03-04 14:46 999424]
"IntelWireless "= "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2008-03-04 14:41 1101824]
"NvCplDaemon "= "C:\WINDOWS\system32\NvCpl.dll" [2007-03-07 09:41 7700480]
"FunctionKeyCtrl "= "C:\Program Files\Function Key Controller\FKC.exe" [2006-05-25 16:49 49152]
"SynTPEnh "= "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-08-11 18:56 794714]
"ccApp "= "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-02-14 11:01 51048]
"Adobe Reader Speed Launcher "= "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"BisonTrayIcon "= "C:\WINDOWS\BisonCam\BisonTrayIcon.exe" [2005-10-06 18:49 40960]
"SunJavaUpdateSched "= "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"PWRISOVM.EXE "= "C:\Program Files\PowerISO\PWRISOVM.EXE" [2008-03-14 16:50 233472]
"UnlockerAssistant "= "C:\Program Files\Unlocker\UnlockerAssistant.exe" [2006-09-07 10:19 15872]
"QuickTime Task "= "C:\Program Files\QuickTime\qttask.exe" [2008-03-28 23:37 413696]
"iTunesHelper "= "C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
"osCheck "= "C:\Program Files\Norton AntiVirus\osCheck.exe" [2007-08-24 21:53 714608]
"nwiz "= "nwiz.exe" [2007-03-07 09:41 1622016 C:\WINDOWS\system32\nwiz.exe]
"BluetoothAuthenticationAgent "= "bthprops.cpl" [2004-08-04 00:56 110592 C:\WINDOWS\system32\bthprops.cpl]
"RTHDCPL "= "RTHDCPL.EXE" [2007-01-30 18:54 16116224 C:\WINDOWS\RTHDCPL.exe]
"SkyTel "= "SkyTel.EXE" [2006-05-16 18:04 2879488 C:\WINDOWS\SkyTel.exe]
"AGRSMMSG "= "AGRSMMSG.exe" [2006-06-29 13:32 89541 C:\WINDOWS\AGRSMMSG.exe]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run]
"TWu8PAdSLX "= "C:\Documents and Settings\All Users.WINDOWS\Application Data\dczobute\lavqzkju.exe" [2008-08-08 01:46 61440]

C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 15:05:56 65588]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} "= "C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 10:13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\PremierOpinion]
2008-08-05 10:30 348160 C:\Program Files\PremierOpinion\pmls.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring "=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring "=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall "= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"C:\\Program Files\\Steam\\steamapps\\spartan1351\\garrysmod\\hl2.exe "=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
"C:\\Program Files\\Steam\\steamapps\\spartan1351\\counter-strike source\\hl2.exe "=
"C:\\Program Files\\uTorrent\\uTorrent.exe "=
"C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe "=
"C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe "=
"C:\\WINDOWS\\system32\\PnkBstrA.exe "=
"C:\\WINDOWS\\system32\\PnkBstrB.exe "=
"C:\\Program Files\\iTunes\\iTunes.exe "=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"443:TCP "= 443:TCPoVoo TCP port 443
"443:UDP "= 443:UDPoVoo UDP port 443
"37674:TCP "= 37674:TCPoVoo TCP port 37674
"37674:UDP "= 37674:UDPoVoo UDP port 37674
"37675:UDP "= 37675:UDPoVoo UDP port 37675

R0 pxark;pxark;C:\WINDOWS\system32\drivers\pxark.sys [2008-08-09 01:51]
R2 CSIScanner;CSIScanner;C:\Program Files\PrevxCSI\prevxcsi.exe [2008-08-09 01:51]
R2 LiveUpdate Notice;LiveUpdate Notice;C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2008-02-14 11:02]
R2 Viewpoint Manager Service;Viewpoint Manager Service;C:\Program Files\Viewpoint\Common\ViewpointService.exe [2007-01-04 14:38]
R3 wacommousefilter;Wacom Mouse Filter Driver;C:\WINDOWS\system32\DRIVERS\wacommousefilter.sys [2006-02-14 14:18]
R3 wacomvhid;Wacom Virtual Hid Driver;C:\WINDOWS\system32\DRIVERS\wacomvhid.sys [2006-11-15 12:55]
S3 COH_Mon;COH_Mon;C:\WINDOWS\system32\Drivers\COH_Mon.sys [2008-07-30 17:42]
S3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.10.1;C:\WINDOWS\system32\drivers\libusb0.sys [2005-03-09 20:50]
.
Contents of the 'Scheduled Tasks' folder

2008-06-23 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:57]

2008-08-05 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - Invd.job
- C:\Program Files\Norton AntiVirus\Navw32.exe [2007-08-26 18:19]

2008-08-04 C:\WINDOWS\Tasks\Norton SystemWorks One Button Checkup.job
- C:\Program Files\Norton SystemWorks\OBC.exe [2004-11-03 22:19]

2008-08-09 C:\WINDOWS\Tasks\Symantec Drmc.job
- C:\Program Files\Common Files\Symantec Shared\SymDrmc.exe [2004-10-27 11:48]
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-PremierOpinion - C:\Program Files\PremierOpinion\pmropn.exe
Notify-WB - C:\Program Files\AlienGUIse\fastload.dll


.
------- Supplementary Scan -------
.
O8 -: &Windows Live Search - C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm


**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-09 17:03:03
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\explorer.exe
-> C:\Program Files\Unlocker\UnlockerHook.dll
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PSIService.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\Tablet.exe
C:\WINDOWS\system32\WTablet\TabUserW.exe
C:\WINDOWS\system32\Tablet.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Java\jre1.6.0_05\bin\jucheck.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\verclsid.exe
.
**************************************************************************
.
Completion time: 2008-08-09 17:08:36 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-10 00:08:18

Pre-Run: 21,759,700,992 bytes free
Post-Run: 21,700,222,976 bytes free

256 --- E O F --- 2008-07-24 06:37:04

 

Hi

Do you belong to Premier Opinion online market research community?

I see you have P2P software ( Limewire, BitTorrent uTorrent, IDoser v4 etc… ) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information.

Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares and their infections.

References for the risk of these programs are here,
here and here.

I would strongly recommend that you uninstall them, however that choice is up to you. If you choose to remove these programs, you can do so via Control Panel >> Add or Remove Programs.

Note: Please be advised that continued use of these programs after being warned of the danger of infections from them, may result in the discontinued help of future cleaning of your system here at Windowsbbs Malware and Virus removal.


Highlight and copy the contents of the code box below and paste it into a blank notepad, then save it to your desktop as;

Filename: CFScript.txt
Save As Type: All Files (*.*)

Close all other windows and programs. Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button.
Click here to see how to use CFScript.txt
Combofix should run and may reboot the computer when it's done. A log will open when it's complete. Post the contents of that log and another fresh HijackThis log.

Please do not click on the ComboFix window while it is running a scan. This can cause it to stall.

Code:

File::
C:\Documents and Settings\All Users.WINDOWS\Application Data\dczobute\lavqzkju.exe

Folder::
C:\Documents and Settings\All Users.WINDOWS\Application Data\Move Bore Curb Tool

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run]
 "TWu8PAdSLX "=- 

Please post the Combofix log and let me know about Premier Opinion

Thanks
Geri

 

ComboFix 08-08-10.02 - Marker 2008-08-10 22:12:46.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2414 [GMT -7:00]
Running from: C:\Documents and Settings\Marker\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Marker\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\Documents and Settings\All Users.WINDOWS\Application Data\dczobute\lavqzkju.exe
.

((((((((((((((((((((((((( Files Created from 2008-07-11 to 2008-08-11 )))))))))))))))))))))))))))))))
.

2008-08-09 18:22 . 2008-08-09 18:22 <DIR> dr-h----- C:\Documents and Settings\Marker\Application Data\SecuROM
2008-08-09 02:23 . 2008-08-09 02:23 <DIR> d-------- C:\Program Files\Trend Micro
2008-08-09 01:51 . 2008-08-09 01:51 <DIR> d-------- C:\Program Files\PrevxCSI
2008-08-09 01:51 . 2008-08-10 02:03 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\PrevxCSI
2008-08-09 01:51 . 2008-08-09 01:51 17,408 --a------ C:\WINDOWS\system32\drivers\pxark.sys
2008-08-09 01:15 . 2008-08-09 01:15 <DIR> d-------- C:\Documents and Settings\Marker\Application Data\SpywareRemover
2008-08-08 20:32 . 2008-08-08 20:32 <DIR> d-------- C:\Documents and Settings\Marker\Application Data\ooVoo Details
2008-08-08 01:46 . 2008-08-10 13:30 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\dczobute
2008-08-06 17:02 . 2008-08-06 17:02 <DIR> d-------- C:\Documents and Settings\Marker\Application Data\Media Player Classic
2008-08-06 16:03 . 2008-08-06 16:03 <DIR> d-------- C:\Documents and Settings\Marker\Application Data\InstallShield
2008-08-06 14:41 . 2008-08-06 14:41 <DIR> d-------- C:\Cavedog
2008-08-06 11:25 . 2008-08-06 11:26 <DIR> d-------- C:\Program Files\Natural Mod
2008-08-05 21:48 . 2008-08-05 21:48 <DIR> d-------- C:\Documents and Settings\Marker\Application Data\Corel
2008-08-05 15:28 . 2008-08-05 15:28 <DIR> d-------- C:\Documents and Settings\Marker\Application Data\Apple Computer
2008-08-05 12:31 . 2008-08-05 12:31 <DIR> d-------- C:\Program Files\Mp3tag
2008-08-05 12:31 . 2008-08-05 12:39 <DIR> d-------- C:\Documents and Settings\Marker\Application Data\Mp3tag
2008-08-05 12:11 . 2008-08-05 12:39 <DIR> d-------- C:\Program Files\MP3Gain
2008-08-05 11:36 . 2008-08-05 11:36 268 --ah----- C:\sqmdata05.sqm
2008-08-05 11:36 . 2008-08-05 11:36 244 --ah----- C:\sqmnoopt05.sqm
2008-08-05 11:28 . 2008-08-05 11:28 <DIR> d-------- C:\Program Files\MediaMonkey
2008-08-05 10:50 . 2008-08-05 10:50 <DIR> d-------- C:\Program Files\aeroFox
2008-08-04 20:27 . 2008-08-04 20:27 <DIR> d-------- C:\Program Files\CCleaner
2008-08-04 14:57 . 2008-08-04 14:57 <DIR> d-------- C:\Program Files\ooVoo
2008-07-31 16:57 . 2008-07-31 16:59 <DIR> d-------- C:\WINDOWS\.jagex_cache_32
2008-07-31 14:28 . 2008-07-31 14:28 <DIR> d-------- C:\Program Files\Windows Live Safety Center
2008-07-28 19:12 . 2008-07-28 19:12 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\InstallShield
2008-07-28 19:11 . 2008-07-28 19:11 <DIR> d-------- C:\WINDOWS\system32\AGEIA
2008-07-28 19:11 . 2008-07-28 19:11 <DIR> d-------- C:\Program Files\AGEIA Technologies
2008-07-28 18:38 . 2008-07-28 18:38 <DIR> d-------- C:\NVIDIA
2008-07-26 10:42 . 2008-08-10 11:23 1,056 --ahs---- C:\WINDOWS\system32\KGyGaAvL.sys
2008-07-26 10:42 . 2008-08-10 11:23 88 -r-hs---- C:\WINDOWS\system32\D6AA5B26BF.sys
2008-07-26 10:33 . 2008-07-26 10:33 <DIR> d-------- C:\Program Files\Corel
2008-07-26 10:33 . 2008-07-26 10:33 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Corel
2008-07-24 19:02 . 2008-07-24 19:02 <DIR> d-------- C:\4cc6c458b4f7a5666061b59094
2008-07-23 23:18 . 2008-07-23 23:18 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\MSN6
2008-07-23 23:16 . 2008-07-23 23:16 244 --ah----- C:\sqmnoopt04.sqm
2008-07-23 23:16 . 2008-07-23 23:16 232 --ah----- C:\sqmdata04.sqm

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-11 03:37 --------- d-----w C:\Program Files\Steam
2008-08-10 20:42 --------- d-----w C:\Documents and Settings\LocalService.NT AUTHORITY\Application Data\WTablet
2008-08-09 19:12 --------- d---a-w C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP
2008-08-09 09:04 --------- d-----w C:\Program Files\PremierOpinion
2008-08-09 08:50 --------- d-----w C:\Documents and Settings\Marker\Application Data\uTorrent
2008-08-09 08:36 --------- d-----w C:\Program Files\Spyware Doctor
2008-08-08 00:27 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-08-06 23:03 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-08-05 23:37 --------- d-----w C:\Program Files\Common Files\AOL
2008-08-05 23:37 --------- d-----w C:\Program Files\AlienGUIse
2008-08-05 23:37 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\AOL
2008-08-05 17:41 --------- d-----w C:\Program Files\Bonjour
2008-08-05 17:37 --------- d-----w C:\Program Files\Common Files\Stardock
2008-08-05 05:27 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-08-05 05:27 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-08-05 05:26 669,184 ----a-w C:\WINDOWS\system32\pbsvc.exe
2008-08-05 05:26 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
2008-08-05 05:07 --------- d-----w C:\Program Files\Skype
2008-08-05 05:07 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Skype
2008-08-05 04:43 --------- d-----w C:\Program Files\Eltima Software
2008-08-05 01:12 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec
2008-07-31 00:42 23,888 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.sys
2008-07-31 00:28 706 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.inf
2008-07-31 00:28 10,537 ----a-w C:\WINDOWS\system32\drivers\coh_mon.cat
2008-07-29 02:13 5,120 ----a-w C:\WINDOWS\system32\BReWErS.dll
2008-07-29 02:11 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-07-29 02:05 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-07-25 03:52 --------- d-----w C:\Program Files\WarRock
2008-07-16 16:27 --------- d-----w C:\Program Files\Flash Saver
2008-07-11 02:33 --------- d-----w C:\Program Files\Groove Games
2008-07-10 17:34 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\FLEXnet
2008-07-10 17:31 --------- d-----w C:\Program Files\Common Files\Adobe
2008-07-10 17:23 --------- d-----w C:\Program Files\Common Files\Macrovision Shared
2008-07-09 16:52 --------- d-----w C:\Program Files\Norton AntiVirus
2008-07-08 20:56 805 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
2008-07-08 20:56 60,800 ----a-w C:\WINDOWS\system32\S32EVNT1.DLL
2008-07-08 20:56 123,952 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2008-07-08 20:56 10,671 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2008-07-08 20:56 --------- d-----w C:\Program Files\Symantec
2008-07-08 20:44 --------- d-----w C:\Program Files\Windows Sidebar
2008-07-04 16:47 --------- d-----w C:\Program Files\StuffPlug3
2008-06-28 20:06 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-06-25 22:05 --------- d-----w C:\Program Files\Unlocker
2008-06-24 03:25 --------- d-----w C:\Program Files\Common Files\Adobe Systems Shared
2008-06-21 03:37 --------- d-----w C:\Program Files\IDoser v4
2008-06-21 00:30 --------- d-----w C:\Documents and Settings\Marker\Application Data\WTablet
2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-18 22:32 --------- d-----w C:\Program Files\Apple Software Update
2008-06-18 01:08 --------- d-----w C:\Program Files\SUPERAntiSpyware
2008-06-18 01:08 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\SUPERAntiSpyware.com
2008-06-16 23:20 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\avg8
2008-06-16 23:18 --------- d-----w C:\Program Files\AVG
2008-06-13 21:45 579,464 ----a-w C:\WINDOWS\system32\SymNeti.dll
2008-06-13 21:45 207,240 ----a-w C:\WINDOWS\system32\SymRedir.dll
2008-06-13 21:14 31,280 ----a-w C:\WINDOWS\system32\drivers\SymIM.sys
2008-06-13 21:14 13,093 ----a-w C:\WINDOWS\system32\drivers\SymRedir.cat
2008-06-13 21:14 1,611 ----a-w C:\WINDOWS\system32\drivers\SymRedir.inf
2008-06-13 21:13 96,432 ----a-w C:\WINDOWS\system32\drivers\symfw.sys
2008-06-13 21:13 41,008 ----a-w C:\WINDOWS\system32\drivers\symndisv.sys
2008-06-13 21:13 38,576 ----a-w C:\WINDOWS\system32\drivers\symids.sys
2008-06-13 21:13 37,424 ----a-w C:\WINDOWS\system32\drivers\symndis.sys
2008-06-13 21:13 22,320 ----a-w C:\WINDOWS\system32\drivers\symredrv.sys
2008-06-13 21:13 184,240 ----a-w C:\WINDOWS\system32\drivers\symtdi.sys
2008-06-13 21:13 13,616 ----a-w C:\WINDOWS\system32\drivers\symdns.sys
2008-06-13 13:10 272,128 ----a-w C:\WINDOWS\system32\drivers\bthport.sys
2008-05-20 23:32 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-04-25 05:06 32 ----a-w C:\Documents and Settings\All Users.WINDOWS\Application Data\ezsid.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56 15360]
"msnmsgr "= "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelZeroConfig "= "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [2008-03-04 14:46 999424]
"IntelWireless "= "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2008-03-04 14:41 1101824]
"NvCplDaemon "= "C:\WINDOWS\system32\NvCpl.dll" [2007-03-07 09:41 7700480]
"FunctionKeyCtrl "= "C:\Program Files\Function Key Controller\FKC.exe" [2006-05-25 16:49 49152]
"SynTPEnh "= "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-08-11 18:56 794714]
"ccApp "= "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-02-14 11:01 51048]
"Adobe Reader Speed Launcher "= "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"BisonTrayIcon "= "C:\WINDOWS\BisonCam\BisonTrayIcon.exe" [2005-10-06 18:49 40960]
"SunJavaUpdateSched "= "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"PWRISOVM.EXE "= "C:\Program Files\PowerISO\PWRISOVM.EXE" [2008-03-14 16:50 233472]
"UnlockerAssistant "= "C:\Program Files\Unlocker\UnlockerAssistant.exe" [2006-09-07 10:19 15872]
"QuickTime Task "= "C:\Program Files\QuickTime\qttask.exe" [2008-03-28 23:37 413696]
"iTunesHelper "= "C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
"osCheck "= "C:\Program Files\Norton AntiVirus\osCheck.exe" [2007-08-24 21:53 714608]
"nwiz "= "nwiz.exe" [2007-03-07 09:41 1622016 C:\WINDOWS\system32\nwiz.exe]
"BluetoothAuthenticationAgent "= "bthprops.cpl" [2004-08-04 00:56 110592 C:\WINDOWS\system32\bthprops.cpl]
"RTHDCPL "= "RTHDCPL.EXE" [2007-01-30 18:54 16116224 C:\WINDOWS\RTHDCPL.exe]
"SkyTel "= "SkyTel.EXE" [2006-05-16 18:04 2879488 C:\WINDOWS\SkyTel.exe]
"AGRSMMSG "= "AGRSMMSG.exe" [2006-06-29 13:32 89541 C:\WINDOWS\AGRSMMSG.exe]

C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 15:05:56 65588]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} "= "C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 10:13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\PremierOpinion]
2008-08-05 10:30 348160 C:\Program Files\PremierOpinion\pmls.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring "=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring "=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall "= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"C:\\Program Files\\Steam\\steamapps\\spartan1351\\garrysmod\\hl2.exe "=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
"C:\\Program Files\\Steam\\steamapps\\spartan1351\\counter-strike source\\hl2.exe "=
"C:\\Program Files\\uTorrent\\uTorrent.exe "=
"C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe "=
"C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe "=
"C:\\WINDOWS\\system32\\PnkBstrA.exe "=
"C:\\WINDOWS\\system32\\PnkBstrB.exe "=
"C:\\Program Files\\iTunes\\iTunes.exe "=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"443:TCP "= 443:TCPoVoo TCP port 443
"443:UDP "= 443:UDPoVoo UDP port 443
"37674:TCP "= 37674:TCPoVoo TCP port 37674
"37674:UDP "= 37674:UDPoVoo UDP port 37674
"37675:UDP "= 37675:UDPoVoo UDP port 37675

R0 pxark;pxark;C:\WINDOWS\system32\drivers\pxark.sys [2008-08-09 01:51]
R2 CSIScanner;CSIScanner;C:\Program Files\PrevxCSI\prevxcsi.exe [2008-08-09 01:51]
R2 LiveUpdate Notice;LiveUpdate Notice;C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2008-02-14 11:02]
R2 Viewpoint Manager Service;Viewpoint Manager Service;C:\Program Files\Viewpoint\Common\ViewpointService.exe [2007-01-04 14:38]
R3 wacommousefilter;Wacom Mouse Filter Driver;C:\WINDOWS\system32\DRIVERS\wacommousefilter.sys [2006-02-14 14:18]
R3 wacomvhid;Wacom Virtual Hid Driver;C:\WINDOWS\system32\DRIVERS\wacomvhid.sys [2006-11-15 12:55]
S3 COH_Mon;COH_Mon;C:\WINDOWS\system32\Drivers\COH_Mon.sys [2008-07-30 17:42]
S3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.10.1;C:\WINDOWS\system32\drivers\libusb0.sys [2005-03-09 20:50]
.
Contents of the 'Scheduled Tasks' folder

2008-06-23 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:57]

2008-08-05 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - Invd.job
- C:\Program Files\Norton AntiVirus\Navw32.exe [2007-08-26 18:19]

2008-08-04 C:\WINDOWS\Tasks\Norton SystemWorks One Button Checkup.job
- C:\Program Files\Norton SystemWorks\OBC.exe [2004-11-03 22:19]

2008-08-10 C:\WINDOWS\Tasks\Symantec Drmc.job
- C:\Program Files\Common Files\Symantec Shared\SymDrmc.exe [2004-10-27 11:48]
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-10 22:16:05
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-08-10 22:17:17
ComboFix-quarantined-files.txt 2008-08-11 05:17:10
ComboFix2.txt 2008-08-10 20:34:52
ComboFix3.txt 2008-08-10 00:08:36

Pre-Run: 21,616,422,912 bytes free
Post-Run: 21,712,809,984 bytes free

219 --- E O F --- 2008-07-24 06:37:04

 

Hi
Ok please delete this file.

Using Windows Explorer (to get there right-click your Start button and go to "Explore "), please delete these files (if present):

C:\WINDOWS\system32\BReWErS.dll

Then do this.


Download ATF Cleaner by Atribune and save it to your Desktop.
This is a good tool to get rid of the temporary garbage you pick up while surfing the net.
Double click ATF-Cleaner.exe to run the program.
Check the boxes to the left of:

Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache
Recycle bin

The rest are optional - if you want it to remove everything check "Select All ".
Finally, click Empty Selected. When you get the "Done Cleaning" message, click OK

Now lets get a on-line scan.

Please do an online scan with Kaspersky WebScanner

Click on “Accept” If your pop –up blocker blocks any windows from opening.

Click Run on the window that opens.
Windows Vista users you must open the web browser using the Run as Administrator command.

• The program will launch and then begin downloading the latest definition files:
• Under Scan on the left side.Click on My Computer
• This will start the program and scan your system.
• Click the “Scan Report” On the left side.
• The scan will take a while so be patient and let it run.
• Once the scan is complete it will display if your system has been infected.
  • Click the Save Report As button, and in the Browse dialog box, type a name for the scan report file that you want to create and select its type Text file. Click OK to save the file.:
• Save the text file to your desktop.
• Copy and paste that information in your next post.

Please post the Kaspersky results.

Thanks
Geri