1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Solved Can't use System Restore

Discussion in 'Malware and Virus Removal Archive' started by murdawg67, 2008/07/04.

Page 1 of 2
  1. 2008/07/04
    murdawg67

    murdawg67 Inactive Thread Starter

    Joined:
    2008/07/04
    Messages:
    11
    Likes Received:
    0
    [Resolved] Can't use System Restore

    Hi all,

    I need some help. I was doing a search on the internet today and clicked the wrong search title. The site that came up was trying to get me to download an antivirus program. The name of the program is IE Antivirus. I immiediately shutdown the browser but it was to late. I don't even know what the url for the site was. Anyway now when I start the browser it shows about:blank in the address bar and gives me one of the windows security screens with two choices to continue unprotected or to download the program. If you press to continue unprotected it take me to hxxp://free-viruscan.com/id/xxxx/3/1/. After a while another little screen pops up asking if I want to download it. If I press cancel it just repeats the process.
    I have norton security online up to date and it does not find anything. I have also ran the latest addition of microsoft malicious software removal tool and it found nothing. So I thought I would try to do a system restore to back to before the site was vistited and restore tells me that I cannot restore to that point so I tried several others with the same results. This popup also occurs when I am opening folders as well. Can anyone help me?

    Thanks
     
    Last edited by a moderator: 2008/07/04
    murdawg67,
    #1
  2. 2008/07/05
    goddez1

    goddez1 Inactive

    Joined:
    2002/01/12
    Messages:
    2,975
    Likes Received:
    49
    Hi murdawg67,

    Your in the wrong forum for this critter. Please read this:
    http://www.windowsbbs.com/announcement.php?f=41

    Do as asked in the above link and post results in the "Removing Spyware and Viruses" forum.

    Hope all goes well. ;)
     
    goddez1,
    #2


  3. to hide this advert.

  4. 2008/07/05
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,896
    Likes Received:
    389
    murdawg67 - Welcome to the Board :)

    I have moved your thread to the Removing Spyware & Viruses forum so just post the logs (copy/paste) in your next post in this thread - spread over 2 posts if necessary (character count limitation).
     
    PeteC,
    #3
  5. 2008/07/05
    murdawg67

    murdawg67 Inactive Thread Starter

    Joined:
    2008/07/04
    Messages:
    11
    Likes Received:
    0
    Hijackthis results

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 7:52:16 AM, on 7/5/2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    C:\Program Files\Common Files\Microsoft Shared\Ink\KeyboardSurrogate.exe
    C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
    C:\Program Files\iolo\common\lib\ioloServiceManager.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe
    C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\SYSTEM32\WISPTIS.EXE
    C:\WINDOWS\System32\tabbtnu.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Microsoft Shared\Ink\TCServer.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\Program Files\Common Files\Microsoft Shared\Ink\TabTip.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
    C:\WINDOWS\stsystra.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\iolo\System Mechanic 7\SMSystemAnalyzer.exe
    C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
    C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
    C:\Program Files\Hewlett-Packard\hp deskjet 460 series\Toolbox\HPWRTBX.exe
    C:\WINDOWS\system32\igfxtray.exe
    C:\WINDOWS\system32\hkcmd.exe
    C:\WINDOWS\system32\igfxpers.exe
    C:\Program Files\HP Wireless 4 Button Laser Mouse\KMaestro.exe
    C:\PROGRA~1\Yahoo!\YOP\yop.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\WINDOWS\system32\igfxsrvc.exe
    C:\Program Files\Starfield\Desktop Notifier\wben.exe
    C:\Program Files\DNA\btdna.exe
    C:\Program Files\ALLTEL Communications\ALLTEL Internet Accelerator Client\NGSpawner.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
    C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
    C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
    C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
    C:\PROGRA~1\Yahoo!\browser\ycommon.exe
    C:\PROGRA~1\Yahoo!\YOP\SSDK02.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\Program Files\ALLTEL Communications\ALLTEL Internet Accelerator Client\NettGain1200_C.exe
    C:\Documents and Settings\murrays\Application Data\U3\0000060327035453\LaunchPad.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\system32\msiexec.exe
    C:\Program Files\StudioLine Web\SLUninst.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =

    http://www.gateway.com/g/sidepanel.html?Ch=Professional&Br=GTW&Loc=ENG_US&Sys=PTB&M=M285-E
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.my.yahoo.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

    http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

    http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

    http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

    http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

    http://www.gateway.com/g/sidepanel.html?Ch=Professional&Br=GTW&Loc=ENG_US&Sys=PTB&M=M285-E
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer =

    f‘|»‘|´Ã‚²vh²v
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride =

    ê‘|f‘|»‘|
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program

    Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program

    Files\Java\jre1.6.0_03\bin\ssv.dll
    O4 - HKLM\..\Run: [TabletWizard] C:\WINDOWS\help\SplshWrp.exe
    O4 - HKLM\..\Run: [TabletTip] "C:\Program Files\Common Files\microsoft

    shared\ink\tabtip.exe" /resume
    O4 - HKLM\..\Run: [Snippet] "C:\Program Files\Microsoft Experience Pack\Snipping

    Tool\SnippingTool.exe" /i
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe "
    O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage

    Manager\iaanotif.exe
    O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE
    O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
    O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe

    bthprops.cpl,,BluetoothAuthenticationAgent
    O4 - HKLM\..\Run: [SMSystemAnalyzer] "C:\Program Files\iolo\System Mechanic

    7\SMSystemAnalyzer.exe "
    O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe "
    O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf

    Intel PROSet/Wireless
    O4 - HKLM\..\Run: [HPWRTOOLBOX] C:\Program Files\Hewlett-Packard\hp deskjet 460

    series\Toolbox\HPWRTBX.exe "-i "
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
    O4 - HKLM\..\Run: [BtcMouseMaestro] "C:\Program Files\HP Wireless 4 Button Laser

    Mouse\KMaestro.exe "
    O4 - HKLM\..\Run: [YOP] C:\PROGRA~1\Yahoo!\YOP\yop.exe /autostart
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe "
    O4 - HKLM\..\Run: [osCheck] "C:\PROGRA~1\Symantec\osCheck.exe "
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [wben] "C:\Program Files\Starfield\Desktop Notifier\wben.exe "
    O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe "
    O4 - HKUS\S-1-5-19\..\Run: [TabletWizard] %windir%\help\wizard.hta (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [TabletWizard] %windir%\help\wizard.hta (User 'NETWORK SERVICE')
    O4 - S-1-5-18 Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program

    Files\Microsoft Office\Office12\ONENOTEM.EXE (User 'SYSTEM')
    O4 - .DEFAULT Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program

    Files\Microsoft Office\Office12\ONENOTEM.EXE (User 'Default user')
    O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft

    Office\Office12\ONENOTEM.EXE
    O4 - Global Startup: ALLTEL Internet Accelerator Client.lnk = C:\Program Files\ALLTEL

    Communications\ALLTEL Internet Accelerator Client\NGSpawner.exe
    O4 - Global Startup: Bluetooth.lnk = ?
    O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital

    Imaging\bin\hpqthb08.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel -

    res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
    O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program

    Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
    O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program

    Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
    O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program

    Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
    O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program

    Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
    O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program

    Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program

    Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -

    C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} -

    C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} -

    C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
    O9 - Extra button: Send to OneNote - {6EB2AA45-3F30-40e1-9864-45EB153C6EDC} -

    C:\WINDOWS\system32\mscoree.DLL
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} -

    C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network

    Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} -

    C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: (no name) - {F37F00B3-19B2-4a69-B923-7A24AF07EE68} -

    C:\WINDOWS\system32\mscoree.DLL
    O9 - Extra 'Tools' menuitem: Send to OneNote Settings -

    {F37F00B3-19B2-4a69-B923-7A24AF07EE68} - C:\WINDOWS\system32\mscoree.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

    Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -

    C:\Program Files\Messenger\msmsgs.exe
    O15 - Trusted Zone: *.netflix.com
    O15 - Trusted Zone: http://*.turbotax.com
    O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) -

    http://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.

    cab
    O16 - DPF: {10E0E75E-6701-4134-9D95-C0942ED1F1C8} (Snapfish Outlook Import ActiveX Control)

    - http://photos.walmart.com/WalmartOutlookImport.cab
    O16 - DPF: {1A1F56AA-3401-46F9-B277-D57F3421F821} (FunGamesLoader Object) -

    http://mypoints.worldwinner.com/games/v47/shared/FunGamesLoader.cab
    O16 - DPF: {2C153C75-8476-434B-B3C3-57B63A3D1939} (Brickout Control) -

    http://www.worldwinner.com/games/v48/brickout/brickout.cab
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program

    Files\Yahoo!\Common\Yinsthelper.dll
    O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) -

    http://photos.walmart.com/WalmartActivia.cab
    O16 - DPF: {410A8B3C-7CCB-40E8-8B11-28B099E5C488} (Trend Micro Security Services Control) -

    http://tmss.trendmicro.com/Dashboard/controls/activex_11/en-US/TMSSReportW.CAB
    O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) -

    https://www-secure.symantec.com/techsupp/asa/ss/sa/sa_cabs/tgctlsr.cab
    O16 - DPF: {5E92F538-B50B-46C5-9C5F-C6EECED3F6C6} -

    http://www.infospace.com/mypoints.main/tbar/mypointsSetup.exe
    O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) -

    https://www.worldwinner.com/games/shared/wwlaunch.cab
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) -

    http://javadl-esd.sun.com/update/1.6.0/jinstall-6u3-windows-i586-jc.cab
    O16 - DPF: {9903F4ED-B673-456A-A15F-ED90C7DE9EF5} (Sol Control) -

    http://www.worldwinner.com/games/v46/sol/sol.cab
    O16 - DPF: {9A57B18E-2F5D-11D5-8997-00104BD12D94} (compid Class) -

    http://support.gateway.com/support/serialharvest/gwCID.CAB
    O16 - DPF: {A91FB93D-7561-4524-8484-5C27C8FA8D42} (WwLuxor Control) -

    http://www.worldwinner.com/games/v49/luxor/luxor.cab
    O16 - DPF: {CF969D51-F764-4FBF-9E90-475248601C8A} (FamilyFeud Control) -

    http://www.worldwinner.com/games/v47/familyfeud/familyfeud.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -

    http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
    O16 - DPF: {FFD85DC8-5261-4D11-B728-F7C59D911691} (iolo.ProductDetector) -

    https://secure.iolo.com/app/ocx/UpgradeVerify.ocx
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program

    Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program

    Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program

    Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program

    Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation -

    C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common

    Files\Symantec Shared\VAScanner\comHost.exe
    O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program

    Files\Intel\Wireless\Bin\EvtEng.exe
    O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation -

    C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
    O23 - Service: iolo FileInfoList Service (ioloFileInfoList) - Unknown owner - C:\Program

    Files\iolo\common\lib\ioloServiceManager.exe
    O23 - Service: iolo System Service (ioloSystemService) - Unknown owner - C:\Program

    Files\iolo\common\lib\ioloServiceManager.exe
    O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation -

    C:\PROGRA~1\Symantec\isPwdSvc.exe
    O23 - Service: LiveUpdate - Symantec Corporation -

    C:\PROGRA~1\Symantec\LIVEUP~1\LuComServer_3_2.EXE
    O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New

    Boundary\PrismXL\PRISMXL.SYS
    O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation -

    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation -

    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common

    Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program

    Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

    --
    End of file - 14655 bytes
     
    murdawg67,
    #4
  6. 2008/07/05
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Hi murdawg67, and welcome :)

    We need to get a better look at things. Download Deckard's System Scanner (dss.exe) and save it to your desktop.
    • Close all applications and windows.
    • Double click on dss.exe to run it and follow the prompts.
    • When the scan is complete, two text files will open; main.txt, which will be maximized and extra.txt, which will be minimized.
    Post the contents of main.txt only for now.

    Please do not edit the log in any way. Thanks!
     
    noahdfear,
    #5
  7. 2008/07/05
    murdawg67

    murdawg67 Inactive Thread Starter

    Joined:
    2008/07/04
    Messages:
    11
    Likes Received:
    0
    I got impatient

    I know you all are very busy and I take a lot of you time to help people out. I know we all really apprieciate it.

    However I needed to do some work and it was preventing me from working effectively so I downloaded MBAM and it seemed to have removed it.

    If you still want to look at things I have just run DSS and here are the results:

    Deckard's System Scanner v20071014.68
    Run by murrays on 2008-07-05 13:32:36
    Computer is in Normal Mode.
    --------------------------------------------------------------------------------



    -- HijackThis (run as murrays.exe) ---------------------------------------------

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 1:32:46 PM, on 7/5/2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16674)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    C:\Program Files\Common Files\Microsoft Shared\Ink\KeyboardSurrogate.exe
    C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
    C:\Program Files\iolo\common\lib\ioloServiceManager.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe
    C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\SYSTEM32\WISPTIS.EXE
    C:\WINDOWS\System32\tabbtnu.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Common Files\Microsoft Shared\Ink\TCServer.exe
    C:\Program Files\Common Files\Microsoft Shared\Ink\TabTip.exe
    C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
    C:\WINDOWS\stsystra.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\iolo\System Mechanic 7\SMSystemAnalyzer.exe
    C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
    C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
    C:\Program Files\Hewlett-Packard\hp deskjet 460 series\Toolbox\HPWRTBX.exe
    C:\WINDOWS\system32\igfxtray.exe
    C:\WINDOWS\system32\hkcmd.exe
    C:\WINDOWS\system32\igfxsrvc.exe
    C:\WINDOWS\system32\igfxpers.exe
    C:\Program Files\HP Wireless 4 Button Laser Mouse\KMaestro.exe
    C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
    C:\PROGRA~1\Yahoo!\YOP\yop.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\Starfield\Desktop Notifier\wben.exe
    C:\Program Files\DNA\btdna.exe
    C:\PROGRA~1\Yahoo!\browser\ycommon.exe
    C:\Program Files\ALLTEL Communications\ALLTEL Internet Accelerator Client\NGSpawner.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
    C:\Program Files\ALLTEL Communications\ALLTEL Internet Accelerator Client\NettGain1200_C.exe
    C:\PROGRA~1\Yahoo!\YOP\SSDK02.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
    C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Documents and Settings\murrays\Desktop\dss.exe
    C:\PROGRA~1\TRENDM~1\HijackThis\murrays.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.gateway.com/g/sidepanel.html?Ch=Professional&Br=GTW&Loc=ENG_US&Sys=PTB&M=M285-E
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.my.yahoo.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.gateway.com/g/sidepanel.html?Ch=Professional&Br=GTW&Loc=ENG_US&Sys=PTB&M=M285-E
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = f‘|»‘|´Ã‚²vh²v
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ê‘|f‘|»‘|
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O4 - HKLM\..\Run: [TabletWizard] C:\WINDOWS\help\SplshWrp.exe
    O4 - HKLM\..\Run: [TabletTip] "C:\Program Files\Common Files\microsoft shared\ink\tabtip.exe" /resume
    O4 - HKLM\..\Run: [Snippet] "C:\Program Files\Microsoft Experience Pack\Snipping Tool\SnippingTool.exe" /i
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe "
    O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
    O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE
    O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
    O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
    O4 - HKLM\..\Run: [SMSystemAnalyzer] "C:\Program Files\iolo\System Mechanic 7\SMSystemAnalyzer.exe "
    O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe "
    O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
    O4 - HKLM\..\Run: [HPWRTOOLBOX] C:\Program Files\Hewlett-Packard\hp deskjet 460 series\Toolbox\HPWRTBX.exe "-i "
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
    O4 - HKLM\..\Run: [BtcMouseMaestro] "C:\Program Files\HP Wireless 4 Button Laser Mouse\KMaestro.exe "
    O4 - HKLM\..\Run: [YOP] C:\PROGRA~1\Yahoo!\YOP\yop.exe /autostart
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe "
    O4 - HKLM\..\Run: [osCheck] "C:\PROGRA~1\Symantec\osCheck.exe "
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [wben] "C:\Program Files\Starfield\Desktop Notifier\wben.exe "
    O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe "
    O4 - HKUS\S-1-5-19\..\Run: [TabletWizard] %windir%\help\wizard.hta (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [TabletWizard] %windir%\help\wizard.hta (User 'NETWORK SERVICE')
    O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
    O4 - Global Startup: ALLTEL Internet Accelerator Client.lnk = C:\Program Files\ALLTEL Communications\ALLTEL Internet Accelerator Client\NGSpawner.exe
    O4 - Global Startup: Bluetooth.lnk = ?
    O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
    O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
    O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
    O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
    O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
    O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
    O9 - Extra button: Send to OneNote - {6EB2AA45-3F30-40e1-9864-45EB153C6EDC} - C:\WINDOWS\system32\mscoree.DLL
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: (no name) - {F37F00B3-19B2-4a69-B923-7A24AF07EE68} - C:\WINDOWS\system32\mscoree.DLL
    O9 - Extra 'Tools' menuitem: Send to OneNote Settings - {F37F00B3-19B2-4a69-B923-7A24AF07EE68} - C:\WINDOWS\system32\mscoree.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O15 - Trusted Zone: *.netflix.com
    O15 - Trusted Zone: http://*.turbotax.com
    O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
    O16 - DPF: {10E0E75E-6701-4134-9D95-C0942ED1F1C8} (Snapfish Outlook Import ActiveX Control) - http://photos.walmart.com/WalmartOutlookImport.cab
    O16 - DPF: {1A1F56AA-3401-46F9-B277-D57F3421F821} (FunGamesLoader Object) - http://mypoints.worldwinner.com/games/v47/shared/FunGamesLoader.cab
    O16 - DPF: {2C153C75-8476-434B-B3C3-57B63A3D1939} (Brickout Control) - http://www.worldwinner.com/games/v48/brickout/brickout.cab
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
    O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photos.walmart.com/WalmartActivia.cab
    O16 - DPF: {410A8B3C-7CCB-40E8-8B11-28B099E5C488} (Trend Micro Security Services Control) - http://tmss.trendmicro.com/Dashboard/controls/activex_11/en-US/TMSSReportW.CAB
    O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - https://www-secure.symantec.com/techsupp/asa/ss/sa/sa_cabs/tgctlsr.cab
    O16 - DPF: {5E92F538-B50B-46C5-9C5F-C6EECED3F6C6} - http://www.infospace.com/mypoints.main/tbar/mypointsSetup.exe
    O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - https://www.worldwinner.com/games/shared/wwlaunch.cab
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jinstall-6u3-windows-i586-jc.cab
    O16 - DPF: {9903F4ED-B673-456A-A15F-ED90C7DE9EF5} (Sol Control) - http://www.worldwinner.com/games/v46/sol/sol.cab
    O16 - DPF: {9A57B18E-2F5D-11D5-8997-00104BD12D94} (compid Class) - http://support.gateway.com/support/serialharvest/gwCID.CAB
    O16 - DPF: {A91FB93D-7561-4524-8484-5C27C8FA8D42} (WwLuxor Control) - http://www.worldwinner.com/games/v49/luxor/luxor.cab
    O16 - DPF: {CF969D51-F764-4FBF-9E90-475248601C8A} (FamilyFeud Control) - http://www.worldwinner.com/games/v47/familyfeud/familyfeud.cab
    O16 - DPF: {FFD85DC8-5261-4D11-B728-F7C59D911691} (iolo.ProductDetector) - https://secure.iolo.com/app/ocx/UpgradeVerify.ocx
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
    O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
    O23 - Service: iolo FileInfoList Service (ioloFileInfoList) - Unknown owner - C:\Program Files\iolo\common\lib\ioloServiceManager.exe
    O23 - Service: iolo System Service (ioloSystemService) - Unknown owner - C:\Program Files\iolo\common\lib\ioloServiceManager.exe
    O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\PROGRA~1\Symantec\isPwdSvc.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LuComServer_3_2.EXE
    O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
    O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

    --
    End of file - 13888 bytes

    -- Files created between 2008-06-05 and 2008-07-05 -----------------------------

    2008-07-05 09:51:27 0 d-------- C:\Documents and Settings\murrays\Application Data\Malwarebytes
    2008-07-05 09:51:25 0 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-07-05 09:51:24 0 d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-07-05 07:44:27 41010 --a------ C:\W48117.exe
    2008-07-04 13:15:48 26624 --a------ C:\WINDOWS\system32\avgsafe.dll
    2008-07-04 13:13:06 26624 --a------ C:\WINDOWS\system32\antsafe.dll
    2008-07-04 13:12:38 26624 --a------ C:\WINDOWS\system32\ant_ss.dll
    2008-07-04 12:54:14 0 d-------- C:\Documents and Settings\murrays\Application Data\Thinstall
    2008-07-04 12:35:54 0 d-------- C:\NetObjects Fusion 7
    2008-07-04 12:35:53 0 d-------- C:\NetObjects Fusion 7.5
    2008-07-04 09:13:37 0 d-------- C:\Documents and Settings\All Users\Application Data\Arkadium
    2008-07-04 02:09:39 1056768 --a------ C:\WINDOWS\system32\ROBOEX32.DLL <Not Verified; Blue Sky Software Corporation.; RoboHELP Classic 2000>
    2008-07-04 02:09:39 28672 --a------ C:\WINDOWS\system32\nnr.dll
    2008-07-04 02:09:39 49152 --a------ C:\WINDOWS\system32\INETWH32.DLL <Not Verified; Blue Sky Software Corporation.; Blue Sky Software - INETWH32>
    2008-06-30 21:38:54 0 d-------- C:\Documents and Settings\murrays\Application Data\ViquaSoft
    2008-06-30 19:04:00 0 d-------- C:\StudioLine3
    2008-06-30 19:04:00 0 d-------- C:\Program Files\StudioLine Web
    2008-06-30 18:58:23 13 ---h----- C:\Documents and Settings\All Users\Application Data\ÃÙÃÄ3113›.sys
    2008-06-29 10:04:04 737280 --a------ C:\WINDOWS\iun6002.exe <Not Verified; Indigo Rose Corporation; Setup Factory 6.0 Runtime Module>
    2008-06-29 10:04:02 0 d-------- C:\Program Files\TZO
    2008-06-29 08:31:33 0 d-------- C:\Program Files\Easy Chat Server
    2008-06-29 08:14:55 8 --a------ C:\WINDOWS\system32\lssexp.dll
    2008-06-29 08:14:32 0 d-------- C:\vfolders
    2008-06-28 22:15:24 0 d-------- C:\WINDOWS\CSC
    2008-06-28 21:09:21 0 d-------- C:\Program Files\Photo Pos Pro
    2008-06-28 20:56:40 0 d-------- C:\Program Files\Paint.NET
    2008-06-28 12:11:40 4456448 --a------ C:\Documents and Settings\murrays\ntuser.dat
    2008-06-27 08:57:56 0 d-------- C:\Documents and Settings\murrays\Application Data\Playrix Entertainment
    2008-06-26 07:46:49 0 d-------- C:\Documents and Settings\murrays\Application Data\Reflexive
    2008-06-25 21:29:02 0 d-------- C:\Documents and Settings\All Users\Application Data\Wal-Mart
    2008-06-25 21:29:01 0 d-------- C:\Program Files\Wal-Mart
    2008-06-25 21:27:36 0 d-------- C:\Documents and Settings\murrays\Application Data\Wal-Mart Digital Photo Manager
    2008-06-25 20:23:19 0 d-------- C:\Documents and Settings\murrays\Application Data\Printer Info Cache
    2008-06-25 18:57:50 0 d-------- C:\Documents and Settings\murrays\Application Data\Wal-Mart Digital Photo Viewer
    2008-06-23 13:21:42 13 ---h----- C:\Documents and Settings\All Users\Application Data\ÃÃÄ3113.sys
    2008-06-23 13:19:14 13 ---h----- C:\Documents and Settings\All Users\Application Data\ÃÃÄΛÒ3113›.sys
    2008-06-23 13:15:38 13 ---h----- C:\Documents and Settings\All Users\Application Data\1ÌØ13.sys
    2008-06-23 13:04:11 108 ---hs---- C:\WINDOWS\WSYS049.SYS
    2008-06-23 12:56:43 0 d-------- C:\Program Files\CoffeeCup Software
    2008-06-23 11:10:08 0 d-------- C:\Documents and Settings\murrays\Application Data\WinRAR
    2008-06-23 10:53:15 0 d-------- C:\Documents and Settings\All Users\Application Data\BackToTheBeach
    2008-06-23 10:52:23 0 d-------- C:\Program Files\BackToTheBeach
    2008-06-21 09:29:46 0 d-------- C:\Documents and Settings\murrays\Application Data\MysteryStudio
    2008-06-15 21:05:09 0 d-------- C:\Documents and Settings\Netflix\Application Data\Yahoo!
    2008-06-15 19:54:51 0 d-------- C:\Documents and Settings\Netflix\Application Data\Smith Micro
    2008-06-12 23:17:40 0 d-------- C:\Documents and Settings\murrays\Application Data\Gogii Games
    2008-06-12 23:17:40 0 d-------- C:\Documents and Settings\All Users\Application Data\Gogii Games
    2008-06-12 21:40:52 0 d-------- C:\Documents and Settings\murrays\Application Data\Yahoo!
    2008-06-12 21:29:31 0 d-------- C:\graphics
    2008-06-12 21:29:31 0 d-------- C:\Documents and Settings\All Users\Application Data\Yahoo!
    2008-06-12 21:29:15 65536 --a------ C:\WINDOWS\system32\YCRWin32.dll <Not Verified; ; YCRWin32 Module>
    2008-06-12 20:13:48 0 d-------- C:\Program Files\Yahoo!
    2008-06-12 19:37:35 0 d-------- C:\WINDOWS\system32\Debug
    2008-06-12 18:39:58 0 d-------- C:\Program Files\NetObjects
    2008-06-12 15:56:32 29696 --a------ C:\WINDOWS\system32\VB5STKIT.DLL <Not Verified; Microsoft Corporation; Microsoft® Visual Basic for Windows>
    2008-06-12 15:56:31 185344 --a------ C:\WINDOWS\system32\iwpsetup.exe <Not Verified; Incomedia - www.websitex5.com; Incomedia Setup>
    2008-06-12 00:42:09 0 d-------- C:\Documents and Settings\murrays\Application Data\Nvu
    2008-06-08 22:17:59 0 d-------- C:\Documents and Settings\murrays\Application Data\MAGIX
    2008-06-08 22:17:59 0 d-------- C:\Documents and Settings\All Users\Application Data\MAGIX
    2008-06-08 22:17:39 0 d-------- C:\Program Files\Common Files\xara
    2008-06-08 22:17:11 0 d-------- C:\Documents and Settings\All Users\Application Data\Xara
    2008-06-08 22:17:10 120200 --a------ C:\WINDOWS\system32\DLLDEV32i.dll <Not Verified; ; DLLDEV32i>
    2008-06-08 22:16:45 700416 --a------ C:\WINDOWS\system32\mgxoschk.dll <Not Verified; MAGIX AG; mgxoschk>
    2008-06-08 22:16:45 0 d-------- C:\WINDOWS\system32\MAGIX


    -- Find3M Report ---------------------------------------------------------------

    2008-07-05 13:25:04 0 d-------- C:\Documents and Settings\murrays\Application Data\DNA
    2008-07-05 13:22:23 0 d-------- C:\Program Files\Common Files\Symantec Shared
    2008-07-05 12:45:40 12 --a------ C:\WINDOWS\bthservsdp.dat
    2008-07-05 08:12:18 0 d-------- C:\Documents and Settings\murrays\Application Data\U3
    2008-07-05 07:51:32 0 d-------- C:\Program Files\Trend Micro
    2008-07-05 07:49:05 0 d-------- C:\Program Files\PowerToys for Tablet PC
    2008-07-05 07:44:11 0 d--h----- C:\Program Files\InstallShield Installation Information
    2008-07-05 07:43:48 0 d-------- C:\Program Files\Common Files
    2008-06-29 05:12:48 0 d-------- C:\Program Files\Symantec
    2008-06-23 22:34:54 0 d-------- C:\Documents and Settings\murrays\Application Data\PlayFirst
    2008-06-12 19:43:16 0 d-------- C:\Documents and Settings\murrays\Application Data\Move Networks
    2008-06-12 19:37:41 0 d-------- C:\Program Files\CA
    2008-06-08 21:56:25 35128 --a------ C:\Documents and Settings\murrays\Application Data\GDIPFONTCACHEV1.DAT
    2008-06-03 22:54:04 16 --a------ C:\WINDOWS\popcinfo.dat
    2008-06-03 20:19:58 0 d-------- C:\Documents and Settings\murrays\Application Data\GamesCafe
    2008-06-02 22:09:38 0 d-------- C:\Program Files\Coupons
    2008-06-02 16:31:16 0 d-------- C:\Program Files\HP Wireless 4 Button Laser Mouse
    2008-05-31 15:00:37 0 d-------- C:\Documents and Settings\murrays\Application Data\Flood Light Games
    2008-05-31 14:51:24 0 d-------- C:\Program Files\V CAST Music Manager
    2008-05-28 16:20:02 0 d-------- C:\Documents and Settings\murrays\Application Data\ITTNord
    2008-05-26 16:46:54 0 d-------- C:\Program Files\Common Files\KAKE First Alert
    2008-05-26 16:46:53 61440 --a------ C:\WINDOWS\wnUninstall.exe
    2008-05-22 17:53:08 0 d-------- C:\Documents and Settings\murrays\Application Data\Boomzap
    2008-05-19 06:55:22 0 d-------- C:\Documents and Settings\murrays\Application Data\Magic Seeds
    2008-05-15 20:34:06 0 d-------- C:\Documents and Settings\murrays\Application Data\Gaijin Ent
    2008-05-15 19:50:23 0 d-------- C:\Documents and Settings\murrays\Application Data\iWin
    2008-05-09 08:03:18 0 d-------- C:\Program Files\MySpace
    2008-05-08 19:24:47 0 d-------- C:\Documents and Settings\murrays\Application Data\Sudden Games
    2008-05-07 20:13:08 0 d-------- C:\Documents and Settings\murrays\Application Data\Cat's Eye Games
    2008-05-07 08:54:59 0 d-------- C:\Program Files\Messenger
    2008-05-07 08:54:51 0 d-------- C:\Program Files\Windows Journal
    2008-05-07 08:54:03 0 d-------- C:\Program Files\Movie Maker
    2008-05-07 08:49:38 0 d-------- C:\Program Files\Windows NT


    -- Registry Dump ---------------------------------------------------------------

    *Note* empty entries & legit default entries are not shown


    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "TabletWizard "= "C:\WINDOWS\help\SplshWrp.exe" [04/13/2008 07:12 PM]
    "TabletTip "= "C:\Program Files\Common Files\microsoft shared\ink\tabtip.exe" [04/13/2008 07:12 PM]
    "Snippet "= "C:\Program Files\Microsoft Experience Pack\Snipping Tool\SnippingTool.exe" [02/25/2005 11:20 PM]
    "RemoteControl "= "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [01/12/2005 05:01 AM]
    "SynTPLpr "= "C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [11/05/2004 11:47 AM]
    "SynTPEnh "= "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [11/05/2004 11:47 AM]
    "IAAnotif "= "C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [10/12/2005 02:30 PM]
    "Recguard "= "%WINDIR%\SMINST\RECGUARD.EXE" []
    "SigmatelSysTrayApp "= "stsystra.exe" [12/27/2005 12:20 PM C:\WINDOWS\stsystra.exe]
    "BluetoothAuthenticationAgent "= "bthprops.cpl" [04/13/2008 07:12 PM C:\WINDOWS\system32\bthprops.cpl]
    "SMSystemAnalyzer "= "C:\Program Files\iolo\System Mechanic 7\SMSystemAnalyzer.exe" [05/06/2008 04:36 PM]
    "IntelZeroConfig "= "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [11/01/2007 02:51 PM]
    "IntelWireless "= "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [11/01/2007 02:47 PM]
    "HPWRTOOLBOX "= "C:\Program Files\Hewlett-Packard\hp deskjet 460 series\Toolbox\HPWRTBX.exe" [10/26/2005 02:29 AM]
    "IgfxTray "= "C:\WINDOWS\system32\igfxtray.exe" [12/19/2007 12:08 PM]
    "HotKeysCmds "= "C:\WINDOWS\system32\hkcmd.exe" [12/19/2007 12:08 PM]
    "Persistence "= "C:\WINDOWS\system32\igfxpers.exe" [12/19/2007 12:07 PM]
    "BtcMouseMaestro "= "C:\Program Files\HP Wireless 4 Button Laser Mouse\KMaestro.exe" [08/24/2007 04:32 AM]
    "YOP "= "C:\PROGRA~1\Yahoo!\YOP\yop.exe" [10/26/2007 03:42 PM]
    "ccApp "= "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [01/10/2007 12:59 AM]
    "osCheck "= "C:\PROGRA~1\Symantec\osCheck.exe" [01/14/2007 02:11 AM]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [04/13/2008 07:12 PM]
    "wben "= "C:\Program Files\Starfield\Desktop Notifier\wben.exe" [11/06/2007 02:12 PM]
    "BitTorrent DNA "= "C:\Program Files\DNA\btdna.exe" [05/10/2008 08:02 AM]

    C:\Documents and Settings\murrays\Start Menu\Programs\Startup\
    OneNote 2007 Screen Clipper and Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [8/24/2007 5:45:42 AM]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    ALLTEL Internet Accelerator Client.lnk - C:\Program Files\ALLTEL Communications\ALLTEL Internet Accelerator Client\NGSpawner.exe [1/11/2008 1:00:41 PM]
    Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [3/14/2006 3:42:18 PM]
    HP Photosmart Premier Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [12/15/2005 2:00:54 PM]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy]
    C:\WINDOWS\System32\dimsntfy.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\loginkey]
    C:\Program Files\Common Files\Microsoft Shared\Ink\loginkey.dll 04/13/2008 07:11 PM 47104 C:\Program Files\Common Files\Microsoft Shared\Ink\loginkey.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\TabBtnWL]
    TabBtnWL.dll 08/29/2002 01:41 PM 11776 C:\WINDOWS\system32\tabbtnwl.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpgwlnotify]
    tpgwlnot.dll 04/13/2008 07:12 PM 32256 C:\WINDOWS\system32\tpgwlnot.dll

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
    SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
    @= "Service "

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
    @= "Volume shadow copy "

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    bthsvcs BthServ
    eapsvcs eaphost
    dot3svc dot3svc

    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
    napagent
    hkmsvc

    *Newly Created Service* - COMHOST



    -- End of Deckard's System Scanner: finished at 2008-07-05 13:35:11 ------------
     
    murdawg67,
    #6
  8. 2008/07/05
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Download ComboFix by sUBs from here, saving the file to your desktop.


    Please disable realtime protection applications as they sometimes interfere with the tool. Check this link for your applicable programs.

    • Close all open programs and windows
    • Double click combofix.exe and follow the prompts.
    • It may reboot your computer and resume running when you logon. Wait for it to complete. When finished, it will open a log for you. Post that log and a new HijackThis log in your next reply.
    Note: Do not mouseclick combofix's window while its running. That may cause it to stall
     
    noahdfear,
    #7
  9. 2008/07/05
    murdawg67

    murdawg67 Inactive Thread Starter

    Joined:
    2008/07/04
    Messages:
    11
    Likes Received:
    0
    ComboFix 08-07-04.6 - murrays 2008-07-05 17:02:31.1 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.545 [GMT -5:00]
    Running from: C:\Documents and Settings\murrays\Desktop\ComboFix.exe
    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\Documents and Settings\murrays\Application Data\.#
    C:\WINDOWS\system32\lssexp.dll
    D:\Autorun.inf

    .
    ((((((((((((((((((((((((( Files Created from 2008-06-05 to 2008-07-05 )))))))))))))))))))))))))))))))
    .

    2008-07-05 15:37 . 2008-07-05 15:37 <DIR> d-------- C:\Documents and Settings\murrays\Application Data\PlanetPlayMore
    2008-07-05 11:20 . 2008-04-22 23:16 6,066,176 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll
    2008-07-05 11:20 . 2007-04-17 04:32 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat
    2008-07-05 11:20 . 2007-03-08 00:10 991,232 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
    2008-07-05 11:20 . 2008-04-22 23:16 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll
    2008-07-05 11:20 . 2008-04-22 23:16 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll
    2008-07-05 11:20 . 2008-04-22 23:16 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll
    2008-07-05 11:20 . 2008-04-22 23:16 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll
    2008-07-05 11:20 . 2008-04-22 23:16 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
    2008-07-05 11:20 . 2008-04-22 02:39 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe
    2008-07-05 09:51 . 2008-07-05 09:51 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-07-05 09:51 . 2008-07-05 09:51 <DIR> d-------- C:\Documents and Settings\murrays\Application Data\Malwarebytes
    2008-07-05 09:51 . 2008-07-05 09:51 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-07-05 09:51 . 2008-06-28 14:21 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
    2008-07-05 09:51 . 2008-06-28 14:21 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
    2008-07-05 08:00 . 2008-07-05 08:00 <DIR> d-------- C:\Deckard
    2008-07-05 07:44 . 2007-07-27 15:45 41,010 --a------ C:\W48117.exe
    2008-07-04 13:15 . 2008-07-04 13:15 26,624 --a------ C:\WINDOWS\system32\avgsafe.dll
    2008-07-04 13:13 . 2008-07-04 13:13 26,624 --a------ C:\WINDOWS\system32\antsafe.dll
    2008-07-04 13:12 . 2008-07-04 13:12 26,624 --a------ C:\WINDOWS\system32\ant_ss.dll
    2008-07-04 12:54 . 2008-07-04 12:54 <DIR> d-------- C:\Documents and Settings\murrays\Application Data\Thinstall
    2008-07-04 12:35 . 2008-07-04 12:35 <DIR> d-------- C:\NetObjects Fusion 7.5
    2008-07-04 12:35 . 2008-07-04 12:35 <DIR> d-------- C:\NetObjects Fusion 7
    2008-07-04 09:13 . 2008-07-04 09:13 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Arkadium
    2008-07-04 02:09 . 2008-05-27 16:55 1,056,768 --a------ C:\WINDOWS\system32\ROBOEX32.DLL
    2008-07-04 02:09 . 2008-05-27 16:55 49,152 --a------ C:\WINDOWS\system32\INETWH32.DLL
    2008-07-04 02:09 . 2008-05-27 16:55 28,672 --a------ C:\WINDOWS\system32\nnr.dll
    2008-06-30 21:38 . 2008-06-30 21:38 <DIR> d-------- C:\Documents and Settings\murrays\Application Data\ViquaSoft
    2008-06-30 19:04 . 2008-06-30 19:13 <DIR> d-------- C:\StudioLine3
    2008-06-30 19:04 . 2008-07-05 07:44 <DIR> d-------- C:\Program Files\StudioLine Web
    2008-06-30 19:04 . 2008-06-30 19:04 52 --a------ C:\WINDOWS\Relax.ini
    2008-06-30 18:58 . 2008-06-30 18:58 13 ---h----- C:\Documents and Settings\All Users\Application Data\ÃÙÃÄ3113›.sys
    2008-06-29 10:04 . 2008-06-29 20:10 <DIR> d-------- C:\Program Files\TZO
    2008-06-29 10:04 . 2008-06-29 10:03 737,280 --a------ C:\WINDOWS\iun6002.exe
    2008-06-29 08:31 . 2008-07-01 09:12 <DIR> d-------- C:\Program Files\Easy Chat Server
    2008-06-29 08:14 . 2008-07-01 09:12 <DIR> d-------- C:\vfolders
    2008-06-29 05:12 . 2008-03-06 21:32 23,904 --a------ C:\WINDOWS\system32\drivers\COH_Mon.sys
    2008-06-29 05:12 . 2008-03-06 21:32 10,537 --a------ C:\WINDOWS\system32\drivers\COH_Mon.cat
    2008-06-29 05:12 . 2008-03-06 21:32 706 --a------ C:\WINDOWS\system32\drivers\COH_Mon.inf
    2008-06-28 22:44 . 2008-06-28 22:58 16 --a------ C:\WINDOWS\system32\coh.cache
    2008-06-28 22:29 . 2008-06-28 22:40 123,952 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS
    2008-06-28 22:29 . 2008-06-28 22:40 60,800 --a------ C:\WINDOWS\system32\S32EVNT1.DLL
    2008-06-28 22:29 . 2008-06-28 22:40 10,671 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.CAT
    2008-06-28 22:29 . 2008-06-28 22:40 805 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.INF
    2008-06-28 21:09 . 2008-06-28 21:37 <DIR> d-------- C:\Program Files\Photo Pos Pro
    2008-06-28 20:56 . 2008-06-28 21:37 <DIR> d-------- C:\Program Files\Paint.NET
    2008-06-27 08:57 . 2008-06-27 08:57 <DIR> d-------- C:\Documents and Settings\murrays\Application Data\Playrix Entertainment
    2008-06-26 07:46 . 2008-06-26 07:46 <DIR> d-------- C:\Documents and Settings\murrays\Application Data\Reflexive
    2008-06-25 21:29 . 2008-06-25 21:29 <DIR> d-------- C:\Program Files\Wal-Mart
    2008-06-25 21:29 . 2008-06-25 21:29 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Wal-Mart
    2008-06-25 21:27 . 2008-06-25 21:27 <DIR> d-------- C:\Documents and Settings\murrays\Application Data\Wal-Mart Digital Photo Manager
    2008-06-25 20:23 . 2008-06-25 20:23 <DIR> d-------- C:\Documents and Settings\murrays\Application Data\Printer Info Cache
    2008-06-25 18:57 . 2008-06-26 17:15 <DIR> d-------- C:\Documents and Settings\murrays\Application Data\Wal-Mart Digital Photo Viewer
    2008-06-23 13:30 . 2008-06-24 06:28 13 --a------ C:\WINDOWS\system32\WinSys16.crc
    2008-06-23 13:22 . 2008-06-23 13:22 13 ---h----- C:\Documents and Settings\All Users\Application Data\˜113.›sys
    2008-06-23 13:21 . 2008-06-23 13:21 13 ---h----- C:\Documents and Settings\All Users\Application Data\ÃÃÄ3113.sys
    2008-06-23 13:19 . 2008-06-23 13:19 13 ---h----- C:\Documents and Settings\All Users\Application Data\ÃÃÄΛÒ3113›.sys
    2008-06-23 13:15 . 2006-01-27 01:56 938,272 --a------ C:\WINDOWS\system32\WODFTP~1.OCX
    2008-06-23 13:15 . 2008-06-23 13:15 13 ---h----- C:\Documents and Settings\All Users\Application Data\1ÌØ13.sys
    2008-06-23 13:04 . 2002-07-31 19:55 108 ---hs---- C:\WINDOWS\WSYS049.SYS
    2008-06-23 13:04 . 2001-09-05 12:28 41 ---h----- C:\WINDOWS\trfntw32.cfg
    2008-06-23 12:56 . 2008-07-04 17:08 <DIR> d-------- C:\Program Files\CoffeeCup Software
    2008-06-23 12:56 . 2006-01-26 18:56 831,776 --a------ C:\WINDOWS\system32\wodFtpDLX.dll
    2008-06-23 12:56 . 2003-10-09 14:10 274,976 --a------ C:\WINDOWS\system32\XceedFtp.dll
    2008-06-23 10:53 . 2008-06-23 10:53 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\BackToTheBeach
    2008-06-23 10:52 . 2008-06-23 10:52 <DIR> d-------- C:\Program Files\BackToTheBeach
    2008-06-21 09:29 . 2008-06-21 09:29 <DIR> d-------- C:\Documents and Settings\murrays\Application Data\MysteryStudio
    2008-06-15 21:05 . 2008-06-15 21:05 <DIR> d-------- C:\Documents and Settings\Netflix\Application Data\Yahoo!
    2008-06-15 19:54 . 2008-06-15 19:54 <DIR> d-------- C:\Documents and Settings\Netflix\Application Data\Smith Micro
    2008-06-12 23:17 . 2008-06-12 23:17 <DIR> d-------- C:\Documents and Settings\murrays\Application Data\Gogii Games
    2008-06-12 23:17 . 2008-06-12 23:17 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Gogii Games
    2008-06-12 21:40 . 2008-06-12 21:40 <DIR> d-------- C:\Documents and Settings\murrays\Application Data\Yahoo!
    2008-06-12 21:29 . 2008-06-12 21:29 <DIR> d-------- C:\graphics
    2008-06-12 21:29 . 2008-06-28 22:28 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Yahoo!
    2008-06-12 21:29 . 2002-01-05 06:18 84,992 --a------ C:\WINDOWS\system32\ATL70.DLL
    2008-06-12 21:29 . 2001-10-11 11:26 65,536 --a------ C:\WINDOWS\system32\YCRWin32.dll
    2008-06-12 20:13 . 2008-06-28 22:28 <DIR> d-------- C:\Program Files\Yahoo!
    2008-06-12 19:37 . 2008-06-12 19:37 <DIR> d-------- C:\WINDOWS\system32\Debug
    2008-06-12 18:39 . 2008-07-04 17:05 <DIR> d-------- C:\Program Files\NetObjects
    2008-06-12 15:56 . 2007-08-23 15:05 185,344 --a------ C:\WINDOWS\system32\iwpsetup.exe
    2008-06-12 15:56 . 1997-01-16 00:00 29,696 --a------ C:\WINDOWS\system32\VB5STKIT.DLL
    2008-06-12 15:56 . 1997-01-16 13:42 6,114 --a------ C:\WINDOWS\system32\SHELLLNK.TLB
    2008-06-12 00:42 . 2008-06-12 00:42 <DIR> d-------- C:\Documents and Settings\murrays\Application Data\Nvu
    2008-06-11 06:49 . 2008-05-08 09:02 203,136 -----c--- C:\WINDOWS\system32\dllcache\rmcast.sys
    2008-06-08 22:17 . 2008-06-08 22:17 <DIR> d-------- C:\Program Files\Common Files\xara
    2008-06-08 22:17 . 2008-06-08 22:17 <DIR> d-------- C:\Documents and Settings\murrays\Application Data\MAGIX
    2008-06-08 22:17 . 2008-06-08 22:17 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Xara
    2008-06-08 22:17 . 2008-06-08 22:17 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\MAGIX
    2008-06-08 22:17 . 2007-04-27 10:43 120,200 --a------ C:\WINDOWS\system32\DLLDEV32i.dll
    2008-06-08 22:16 . 2008-06-09 07:54 <DIR> d-------- C:\WINDOWS\system32\MAGIX
    2008-06-08 22:16 . 2008-04-08 10:24 700,416 --a------ C:\WINDOWS\system32\mgxoschk.dll
    2008-06-08 22:16 . 2008-06-08 22:16 5,937 --a------ C:\WINDOWS\mgxoschk.ini
    2008-06-06 18:08 . 2008-06-06 18:08 0 --a------ C:\WINDOWS\LTO08.INI

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-07-05 22:07 --------- d-----w C:\Program Files\Common Files\Symantec Shared
    2008-07-05 22:06 --------- d-----w C:\Documents and Settings\murrays\Application Data\DNA
    2008-07-05 13:12 --------- d-----w C:\Documents and Settings\murrays\Application Data\U3
    2008-07-05 12:51 --------- d-----w C:\Program Files\Trend Micro
    2008-07-05 12:49 --------- d-----w C:\Program Files\PowerToys for Tablet PC
    2008-07-05 12:44 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-06-29 10:12 --------- d-----w C:\Program Files\Symantec
    2008-06-29 10:12 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
    2008-06-28 12:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\Sandlot Games
    2008-06-24 03:34 --------- d-----w C:\Documents and Settings\murrays\Application Data\PlayFirst
    2008-06-24 03:34 --------- d-----w C:\Documents and Settings\All Users\Application Data\PlayFirst
    2008-06-13 11:05 272,128 ----a-w C:\WINDOWS\system32\drivers\bthport.sys
    2008-06-13 00:43 --------- d-----w C:\Documents and Settings\murrays\Application Data\Move Networks
    2008-06-13 00:37 --------- d-----w C:\Program Files\CA
    2008-06-10 03:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\Astar Games
    2008-06-09 02:56 35,128 ----a-w C:\Documents and Settings\murrays\Application Data\GDIPFONTCACHEV1.DAT
    2008-06-04 01:19 --------- d-----w C:\Documents and Settings\murrays\Application Data\GamesCafe
    2008-06-03 03:09 --------- d-----w C:\Program Files\Coupons
    2008-06-02 21:31 --------- d-----w C:\Program Files\HP Wireless 4 Button Laser Mouse
    2008-05-31 20:00 --------- d-----w C:\Documents and Settings\murrays\Application Data\Flood Light Games
    2008-05-31 20:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\Flood Light Games
    2008-05-31 19:51 --------- d-----w C:\Program Files\V CAST Music Manager
    2008-05-28 21:20 --------- d-----w C:\Documents and Settings\murrays\Application Data\ITTNord
    2008-05-26 21:46 61,440 ----a-w C:\WINDOWS\wnUninstall.exe
    2008-05-26 21:46 --------- d-----w C:\Program Files\Common Files\KAKE First Alert
    2008-05-22 22:53 --------- d-----w C:\Documents and Settings\murrays\Application Data\Boomzap
    2008-05-22 01:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\Hot Lava Games
    2008-05-19 11:55 --------- d-----w C:\Documents and Settings\murrays\Application Data\Magic Seeds
    2008-05-16 01:34 --------- d-----w C:\Documents and Settings\murrays\Application Data\Gaijin Ent
    2008-05-16 00:50 --------- d-----w C:\Documents and Settings\murrays\Application Data\iWin
    2008-05-10 13:04 680,960 ----a-w C:\WINDOWS\isRS-000.tmp
    2008-05-09 13:03 --------- d-----w C:\Program Files\MySpace
    2008-05-09 00:24 --------- d-----w C:\Documents and Settings\murrays\Application Data\Sudden Games
    2008-05-08 14:02 203,136 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
    2008-05-08 01:13 --------- d-----w C:\Documents and Settings\murrays\Application Data\Cat's Eye Games
    2008-05-07 13:54 --------- d-----w C:\Program Files\Windows Journal
    2008-05-07 05:12 1,288,192 ----a-w C:\WINDOWS\system32\quartz.dll
    2008-05-06 21:36 428,904 ----a-w C:\WINDOWS\system32\Incinerator.dll
    2008-04-23 04:16 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
    2008-04-14 10:42 985,088 ----a-w C:\WINDOWS\system32\setupapi.dll
    2008-04-14 10:42 11,264 ----a-w C:\WINDOWS\system32\spnpinst.exe
    2008-04-14 10:41 423,936 ----a-w C:\WINDOWS\system32\licdll.dll
    2008-04-14 00:25 1,804 ----a-w C:\WINDOWS\system32\dcache.bin
    2008-04-14 00:16 329,728 ----a-w C:\WINDOWS\system32\netsetup.exe
    2008-04-14 00:13 92,424 ----a-w C:\WINDOWS\system32\rdpdd.dll
    2008-04-14 00:13 87,176 ----a-w C:\WINDOWS\system32\rdpwsx.dll
    2008-04-14 00:13 12,168 ----a-w C:\WINDOWS\system32\tsddd.dll
    2008-04-14 00:11 997,376 ----a-w C:\WINDOWS\system32\msgina.dll
    2008-04-14 00:10 53,279 ----a-w C:\WINDOWS\system32\odbcji32.dll
    2008-04-14 00:10 4,126 ----a-w C:\WINDOWS\system32\msdxmlc.dll
    2008-04-14 00:10 3,584 ----a-w C:\WINDOWS\system32\msafd.dll
    2008-04-13 19:30 1,845,632 ----a-w C:\WINDOWS\system32\win32k.sys
    2008-04-13 19:24 2,145,280 ----a-w C:\WINDOWS\system32\ntoskrnl.exe
    2008-04-13 18:44 17,664 ----a-w C:\WINDOWS\system32\watchdog.sys
    2008-04-13 18:43 9,728 ------w C:\WINDOWS\system32\comsdupd.exe
    2008-04-13 18:43 12,800 ----a-w C:\WINDOWS\system32\spiisupd.exe
    2008-04-13 18:31 7,424 ----a-w C:\WINDOWS\system32\kd1394.dll
    2008-04-13 18:31 2,023,936 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe
    2008-04-13 18:30 61,440 ---h--w C:\WINDOWS\system32\msvcrt40.dll
    2008-04-13 18:14 76,800 ------w C:\WINDOWS\system32\msshavmsg.dll
    2008-04-13 17:39 438,784 ----a-w C:\WINDOWS\system32\xpob2res.dll
    2008-04-13 17:39 2,897,920 ----a-w C:\WINDOWS\system32\xpsp2res.dll
    2008-04-13 17:39 187,392 ----a-w C:\WINDOWS\system32\xpsp1res.dll
    2008-04-13 17:37 208,384 ----a-w C:\WINDOWS\system32\rsaenh.dll
    2008-04-13 17:37 138,752 ----a-w C:\WINDOWS\system32\dssenh.dll
    2008-04-13 17:27 79,872 ----a-w C:\WINDOWS\system32\msxml6r.dll
    2008-04-13 17:26 94,208 ----a-w C:\WINDOWS\system32\odbcint.dll
    2008-04-13 17:26 12,288 ----a-w C:\WINDOWS\system32\odbcp32r.dll
    2008-04-13 17:26 12,288 ----a-w C:\WINDOWS\system32\mscpx32r.dll
    2008-04-13 17:24 20,480 ----a-w C:\WINDOWS\system32\msorc32r.dll
    2008-04-13 17:21 733,696 ----a-w C:\WINDOWS\system32\qedwipes.dll
    2008-04-13 17:09 4,096 ----a-w C:\WINDOWS\system32\dsprpres.dll
    2008-04-13 17:03 63,488 ----a-w C:\WINDOWS\system32\browselc.dll
    2008-04-13 17:03 549,376 ----a-w C:\WINDOWS\system32\shdoclc.dll
    2008-04-13 16:48 1,647,616 ----a-w C:\WINDOWS\system32\winbrand.dll
    2008-04-13 16:45 216,064 ----a-w C:\WINDOWS\system32\moricons.dll
    2008-04-13 16:37 2,630,144 ----a-w C:\WINDOWS\Help\tpc_oobe.dll
    2008-04-13 16:36 2,560 ----a-w C:\WINDOWS\system32\pipres.dll
    2008-04-13 16:36 154,624 ----a-w C:\WINDOWS\system32\tipres.dll
    2008-04-13 16:23 48,128 ----a-w C:\WINDOWS\system32\msprivs.dll
    2008-04-13 16:22 48,128 ----a-w C:\WINDOWS\system32\inetres.dll
    2008-04-13 15:39 884,736 ----a-w C:\WINDOWS\system32\msimsg.dll
    2008-01-11 18:00 2,429 ----a-w C:\Program Files\ALLTEL Internet Accelerator Client setup.log
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 19:12 15360]
    "wben "= "C:\Program Files\Starfield\Desktop Notifier\wben.exe" [2007-11-06 14:12 312024]
    "BitTorrent DNA "= "C:\Program Files\DNA\btdna.exe" [2008-05-10 08:02 289088]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "TabletWizard "= "C:\WINDOWS\help\SplshWrp.exe" [2008-04-13 19:12 16384]
    "TabletTip "= "C:\Program Files\Common Files\microsoft shared\ink\tabtip.exe" [2008-04-13 19:12 271872]
    "Snippet "= "C:\Program Files\Microsoft Experience Pack\Snipping Tool\SnippingTool.exe" [2005-02-25 23:20 68296]
    "RemoteControl "= "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2005-01-12 05:01 32768]
    "SynTPLpr "= "C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-11-05 11:47 98394]
    "SynTPEnh "= "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-11-05 11:47 688218]
    "IAAnotif "= "C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2005-10-12 14:30 139264]
    "SMSystemAnalyzer "= "C:\Program Files\iolo\System Mechanic 7\SMSystemAnalyzer.exe" [2008-05-06 16:36 764776]
    "IntelZeroConfig "= "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [2007-11-01 14:51 995328]
    "IntelWireless "= "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2007-11-01 14:47 1101824]
    "HPWRTOOLBOX "= "C:\Program Files\Hewlett-Packard\hp deskjet 460 series\Toolbox\HPWRTBX.exe" [2005-10-26 02:29 344064]
    "IgfxTray "= "C:\WINDOWS\system32\igfxtray.exe" [2007-12-19 12:08 135168]
    "HotKeysCmds "= "C:\WINDOWS\system32\hkcmd.exe" [2007-12-19 12:08 159744]
    "Persistence "= "C:\WINDOWS\system32\igfxpers.exe" [2007-12-19 12:07 131072]
    "BtcMouseMaestro "= "C:\Program Files\HP Wireless 4 Button Laser Mouse\KMaestro.exe" [2007-08-24 04:32 344064]
    "YOP "= "C:\PROGRA~1\Yahoo!\YOP\yop.exe" [2007-10-26 15:42 509224]
    "ccApp "= "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-10 00:59 115816]
    "osCheck "= "C:\PROGRA~1\Symantec\osCheck.exe" [2007-01-14 02:11 771704]
    "SigmatelSysTrayApp "= "stsystra.exe" [2005-12-27 12:20 413696 C:\WINDOWS\stsystra.exe]
    "BluetoothAuthenticationAgent "= "bthprops.cpl" [2008-04-13 19:12 110592 C:\WINDOWS\system32\bthprops.cpl]

    C:\Documents and Settings\murrays\Start Menu\Programs\Startup\
    OneNote 2007 Screen Clipper and Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2007-08-24 05:45:42 101784]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    ALLTEL Internet Accelerator Client.lnk - C:\Program Files\ALLTEL Communications\ALLTEL Internet Accelerator Client\NGSpawner.exe [2008-01-11 13:00:41 45056]
    Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-03-14 15:42:18 622653]
    HP Photosmart Premier Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2005-12-15 14:00:54 73728]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\loginkey]
    2008-04-13 19:11 47104 C:\Program Files\Common Files\Microsoft Shared\Ink\loginkey.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\TabBtnWL]
    2002-08-29 13:41 11776 C:\WINDOWS\system32\tabbtnwl.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpgwlnotify]
    2008-04-13 19:12 32256 C:\WINDOWS\system32\tpgwlnot.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "msacm.clmp3enc "= C:\PROGRA~1\CYBERL~1\Power2Go\CLMP3Enc.ACM

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
    "DisableMonitoring "=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring "=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring "=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall "= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe "=
    "C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE "=
    "C:\\Program Files\\ALLTEL Communications\\ALLTEL Internet Accelerator Client\\NettGain1200_C.exe "=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe "=
    "C:\\Program Files\\DNA\\btdna.exe "=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe "=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe "=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe "=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe "=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe "=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe "=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe "=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe "=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe "=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe "=
    "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe "=
    "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe "=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe "=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe "=
    "C:\\Program Files\\Common Files\\KAKE First Alert\\TrueWeather.exe "=
    "C:\\Program Files\\Hewlett-Packard\\hp deskjet 460 series\\Toolbox\\HPWRTBX.exe "=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
    "AllowInboundEchoRequest "= 1 (0x1)

    R2 ioloFileInfoList;iolo FileInfoList Service;C:\Program Files\iolo\common\lib\ioloServiceManager.exe [2008-05-02 12:31]
    R2 ioloSystemService;iolo System Service;C:\Program Files\iolo\common\lib\ioloServiceManager.exe [2008-05-02 12:31]
    R3 FinePnt;FinePoint Innovations HID Driver;C:\WINDOWS\system32\DRIVERS\FpHidDrv.sys [2006-10-30 12:17]
    R3 MSTabBtn;Quanta Computer Tablet PC Buttons HID Driver;C:\WINDOWS\system32\DRIVERS\MSTabBtn.sys [2007-03-09 11:40]
    R3 PTDCBus;PANTECH PC Card Composite Device Driver (UDP);C:\WINDOWS\system32\DRIVERS\PTDCBus.sys [2007-01-11 03:30]
    R3 PTDCMdm;PANTECH PC Card Drivers (UDP);C:\WINDOWS\system32\DRIVERS\PTDCMdm.sys [2007-01-11 03:30]
    R3 PTDCVsp;PANTECH PC Card Diagnostic Serial Port (UDP);C:\WINDOWS\system32\DRIVERS\PTDCVsp.sys [2007-01-11 03:30]

    *Newly Created Service* - CATCHME
    *Newly Created Service* - COMHOST
    .
    Contents of the 'Scheduled Tasks' folder
    "2008-07-01 14:01:05 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job "
    - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
    "2007-08-31 12:09:40 C:\WINDOWS\Tasks\ISP signup reminder 1.job "
    - C:\WINDOWS\system32\OOBE\oobebaln.exe
    "2007-08-31 12:09:40 C:\WINDOWS\Tasks\ISP signup reminder 2.job "
    - C:\WINDOWS\system32\OOBE\oobebaln.exe
    "2007-08-31 12:09:40 C:\WINDOWS\Tasks\ISP signup reminder 3.job "
    - C:\WINDOWS\system32\OOBE\oobebaln.exe
    "2008-06-29 03:35:39 C:\WINDOWS\Tasks\Norton Security Online - Run Full System Scan - Netflix.job "
    - C:\PROGRA~1\Symantec\Norton AntiVirus\Navw32.exeh/TASK:
    .
    - - - - ORPHANS REMOVED - - - -

    WebBrowser-{A057A204-BACC-4D26-CEC4-75A487FD6484} - (no file)
    Notify-NavLogon - (no file)


    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-07-05 17:07:40
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2008-07-05 17:08:38
    ComboFix-quarantined-files.txt 2008-07-05 22:08:28

    Pre-Run: 27,418,038,272 bytes free
    Post-Run: 27,931,336,704 bytes free

    310 --- E O F --- 2008-07-05 15:51:40
     
    murdawg67,
    #8
  10. 2008/07/05
    murdawg67

    murdawg67 Inactive Thread Starter

    Joined:
    2008/07/04
    Messages:
    11
    Likes Received:
    0
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 5:11:27 PM, on 7/5/2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16674)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    C:\Program Files\Common Files\Microsoft Shared\Ink\KeyboardSurrogate.exe
    C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
    C:\Program Files\iolo\common\lib\ioloServiceManager.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe
    C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\SYSTEM32\WISPTIS.EXE
    C:\WINDOWS\System32\tabbtnu.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Common Files\Microsoft Shared\Ink\TCServer.exe
    C:\Program Files\Common Files\Microsoft Shared\Ink\TabTip.exe
    C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
    C:\WINDOWS\stsystra.exe
    C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
    C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
    C:\WINDOWS\system32\igfxtray.exe
    C:\WINDOWS\system32\hkcmd.exe
    C:\WINDOWS\system32\igfxsrvc.exe
    C:\WINDOWS\system32\igfxpers.exe
    C:\Program Files\HP Wireless 4 Button Laser Mouse\KMaestro.exe
    C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
    C:\PROGRA~1\Yahoo!\YOP\yop.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\DNA\btdna.exe
    C:\PROGRA~1\Yahoo!\browser\ycommon.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
    C:\PROGRA~1\Yahoo!\YOP\SSDK02.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
    C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\WINDOWS\system32\notepad.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.my.yahoo.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = f‘|»‘|´Ã‚²vh²v
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ê‘|f‘|»‘|
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O4 - HKLM\..\Run: [TabletWizard] C:\WINDOWS\help\SplshWrp.exe
    O4 - HKLM\..\Run: [TabletTip] "C:\Program Files\Common Files\microsoft shared\ink\tabtip.exe" /resume
    O4 - HKLM\..\Run: [Snippet] "C:\Program Files\Microsoft Experience Pack\Snipping Tool\SnippingTool.exe" /i
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe "
    O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
    O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE
    O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
    O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
    O4 - HKLM\..\Run: [SMSystemAnalyzer] "C:\Program Files\iolo\System Mechanic 7\SMSystemAnalyzer.exe "
    O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe "
    O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
    O4 - HKLM\..\Run: [HPWRTOOLBOX] C:\Program Files\Hewlett-Packard\hp deskjet 460 series\Toolbox\HPWRTBX.exe "-i "
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
    O4 - HKLM\..\Run: [BtcMouseMaestro] "C:\Program Files\HP Wireless 4 Button Laser Mouse\KMaestro.exe "
    O4 - HKLM\..\Run: [YOP] C:\PROGRA~1\Yahoo!\YOP\yop.exe /autostart
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe "
    O4 - HKLM\..\Run: [osCheck] "C:\PROGRA~1\Symantec\osCheck.exe "
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [wben] "C:\Program Files\Starfield\Desktop Notifier\wben.exe "
    O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe "
    O4 - HKUS\S-1-5-19\..\Run: [TabletWizard] %windir%\help\wizard.hta (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [TabletWizard] %windir%\help\wizard.hta (User 'NETWORK SERVICE')
    O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
    O4 - Global Startup: ALLTEL Internet Accelerator Client.lnk = C:\Program Files\ALLTEL Communications\ALLTEL Internet Accelerator Client\NGSpawner.exe
    O4 - Global Startup: Bluetooth.lnk = ?
    O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
    O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
    O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
    O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
    O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
    O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
    O9 - Extra button: Send to OneNote - {6EB2AA45-3F30-40e1-9864-45EB153C6EDC} - C:\WINDOWS\system32\mscoree.DLL
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: (no name) - {F37F00B3-19B2-4a69-B923-7A24AF07EE68} - C:\WINDOWS\system32\mscoree.DLL
    O9 - Extra 'Tools' menuitem: Send to OneNote Settings - {F37F00B3-19B2-4a69-B923-7A24AF07EE68} - C:\WINDOWS\system32\mscoree.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O15 - Trusted Zone: *.netflix.com
    O15 - Trusted Zone: http://*.turbotax.com
    O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
    O16 - DPF: {10E0E75E-6701-4134-9D95-C0942ED1F1C8} (Snapfish Outlook Import ActiveX Control) - http://photos.walmart.com/WalmartOutlookImport.cab
    O16 - DPF: {1A1F56AA-3401-46F9-B277-D57F3421F821} (FunGamesLoader Object) - http://mypoints.worldwinner.com/games/v47/shared/FunGamesLoader.cab
    O16 - DPF: {2C153C75-8476-434B-B3C3-57B63A3D1939} (Brickout Control) - http://www.worldwinner.com/games/v48/brickout/brickout.cab
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
    O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photos.walmart.com/WalmartActivia.cab
    O16 - DPF: {410A8B3C-7CCB-40E8-8B11-28B099E5C488} (Trend Micro Security Services Control) - http://tmss.trendmicro.com/Dashboard/controls/activex_11/en-US/TMSSReportW.CAB
    O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - https://www-secure.symantec.com/techsupp/asa/ss/sa/sa_cabs/tgctlsr.cab
    O16 - DPF: {5E92F538-B50B-46C5-9C5F-C6EECED3F6C6} - http://www.infospace.com/mypoints.main/tbar/mypointsSetup.exe
    O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - https://www.worldwinner.com/games/shared/wwlaunch.cab
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jinstall-6u3-windows-i586-jc.cab
    O16 - DPF: {9903F4ED-B673-456A-A15F-ED90C7DE9EF5} (Sol Control) - http://www.worldwinner.com/games/v46/sol/sol.cab
    O16 - DPF: {9A57B18E-2F5D-11D5-8997-00104BD12D94} (compid Class) - http://support.gateway.com/support/serialharvest/gwCID.CAB
    O16 - DPF: {A91FB93D-7561-4524-8484-5C27C8FA8D42} (WwLuxor Control) - http://www.worldwinner.com/games/v49/luxor/luxor.cab
    O16 - DPF: {CF969D51-F764-4FBF-9E90-475248601C8A} (FamilyFeud Control) - http://www.worldwinner.com/games/v47/familyfeud/familyfeud.cab
    O16 - DPF: {FFD85DC8-5261-4D11-B728-F7C59D911691} (iolo.ProductDetector) - https://secure.iolo.com/app/ocx/UpgradeVerify.ocx
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
    O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
    O23 - Service: iolo FileInfoList Service (ioloFileInfoList) - Unknown owner - C:\Program Files\iolo\common\lib\ioloServiceManager.exe
    O23 - Service: iolo System Service (ioloSystemService) - Unknown owner - C:\Program Files\iolo\common\lib\ioloServiceManager.exe
    O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\PROGRA~1\Symantec\isPwdSvc.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LuComServer_3_2.EXE
    O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
    O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

    --
    End of file - 13187 bytes
     
    murdawg67,
    #9
  11. 2008/07/05
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Wow .... this was quite a log to research, what with the games and web site apps you've got onboard. :)

    I'd like you to scan again with HijackThis and place a check next to the following entries, close all other windows, then click Fix Checked.

    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = f‘|»‘|´Ã‚²vh²v
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ê‘|f‘|»‘|

    Restart the computer and verify that you still have internet connectivity, and that any ftp apps still function properly (like Coffee Cup, if you are using it). If you've any problem connecting, open HijackThis to the Misc Tools section, Backups, then select those 2 entries and click Restore. Reboot.


    Delete the following files, then empty the recycle bin.

    C:\WINDOWS\LTO08.INI
    C:\WINDOWS\isRS-000.tmp


    Next, download ATF Cleaner by Atribune and save it to your Desktop.
    • Double click ATF-Cleaner.exe to run the program.
    • Check the boxes to the left of:

      • Windows Temp
      • Current User Temp
      • All Users Temp
      • Temporary Internet Files
      • Prefetch
      • Java Cache
      • Recycle bin

    • The rest are optional - if you want it to remove everything check "Select All ".
    • Finally, click Empty Selected. When you get the "Done Cleaning" message, click OK then exit.
    Reboot


    Finally, scan with Kaspersky WebScanner

    You will be promted to install an ActiveX component from Kaspersky, Click Yes.
    • The program will launch and then begin downloading the latest definition files:
    • Once the files have been downloaded click on NEXT
    • Now click on Scan Settings
    • In the scan settings make that the following are selected:
      • Scan using the following Anti-Virus database:
      • Extended (if available otherwise Standard)
      • Scan Options:
      • Scan Archives
        Scan Mail Bases
    • Click OK
    • Now under select a target to scan:
      • Select My Computer
    • This will program will start and scan your system.
    • The scan will take a while so be patient and let it run.
    • Once the scan is complete it will display if your system has been infected.
      • Now click on the Save as Text button:
    • Save the file to your desktop.

    Post the Kaspersky log and a fresh HijackThis log to this topic.
     
    noahdfear,
    #10
  12. 2008/07/06
    murdawg67

    murdawg67 Inactive Thread Starter

    Joined:
    2008/07/04
    Messages:
    11
    Likes Received:
    0
    -------------------------------------------------------------------------------
    KASPERSKY ONLINE SCANNER REPORT
    Sunday, July 06, 2008 8:24:17 AM
    Operating System: Microsoft Windows XP Professional, Service Pack 3 (Build 2600)
    Kaspersky Online Scanner version: 5.0.98.0
    Kaspersky Anti-Virus database last update: 5/07/2008
    Kaspersky Anti-Virus database records: 916362
    -------------------------------------------------------------------------------

    Scan Settings:
    Scan using the following antivirus database: extended
    Scan Archives: true
    Scan Mail Bases: true

    Scan Target - My Computer:
    C:\
    D:\
    E:\

    Scan Statistics:
    Total number of scanned objects: 158803
    Number of viruses found: 2
    Number of infected objects: 6
    Number of suspicious objects: 0
    Duration of the scan process: 01:37:34

    Infected Object Name / Virus Name / Last Action
    C:\Documents and Settings\All Users\Application Data\iolo\FileInfoList\IOLOFIL.FDB Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\2008-07-05_Log.ALUSchedulerSvc.LiveUpdate Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBConfig.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBDebug.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBDetect.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBNotify.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBRefr.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetCfg.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetCfg2.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetDev.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetLoc.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetUsr.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBStHash.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBValid.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\SPPolicy.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\SPStart.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\SPStop.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtErEvt.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtETmp\59BDE0D0.TMP Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtETmp\699B001C.TMP Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtMoEvt.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtNvEvt.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtScEvt.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtTxFEvt.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtViEvt.log Object is locked skipped
    C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\LocalService\NTUSER.DAT.LOG Object is locked skipped
    C:\Documents and Settings\murrays\Application Data\iolo\SystemAnalyzer.log Object is locked skipped
    C:\Documents and Settings\murrays\Application Data\Sun\Java\Deployment\cache\6.0\35\663965a3-6db50ad0/Matrix.class Infected: Trojan-Downloader.Java.OpenStream.c skipped
    C:\Documents and Settings\murrays\Application Data\Sun\Java\Deployment\cache\6.0\35\663965a3-6db50ad0 ZIP: infected - 1 skipped
    C:\Documents and Settings\murrays\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Application Data\ApplicationHistory\hpqimzone.exe.3204510e.ini.inuse Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Application Data\ApplicationHistory\TCServer.exe.7c11743d.ini.inuse Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Application Data\HP\Digital Imaging\db\administrativeInfo.dbf Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Application Data\HP\Digital Imaging\db\albumImagesTable.cdx Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Application Data\HP\Digital Imaging\db\albumImagesTable.dbf Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Application Data\HP\Digital Imaging\db\albumTable.cdx Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Application Data\HP\Digital Imaging\db\albumTable.dbf Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Application Data\HP\Digital Imaging\db\CB_Server_Errors.txt Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Application Data\HP\Digital Imaging\db\EXIFTable.cdx Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Application Data\HP\Digital Imaging\db\EXIFTable.dbf Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Application Data\HP\Digital Imaging\db\imageTable.cdx Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Application Data\HP\Digital Imaging\db\imageTable.dbf Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Application Data\HP\Digital Imaging\db\imageTable.fpt Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Application Data\HP\Digital Imaging\db\keywordImagesTable.cdx Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Application Data\HP\Digital Imaging\db\keywordImagesTable.dbf Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Application Data\HP\Digital Imaging\db\keywordTable.cdx Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Application Data\HP\Digital Imaging\db\keywordTable.dbf Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Application Data\HP\Digital Imaging\db\managedFolderTable.dbf Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Application Data\HP\Digital Imaging\db\pathnameTable.cdx Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Application Data\HP\Digital Imaging\db\pathnameTable.dbf Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Application Data\HP\Digital Imaging\db\propertiesTable.cdx Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Application Data\HP\Digital Imaging\db\propertiesTable.dbf Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Application Data\HP\Digital Imaging\db\ROFImagesTable.cdx Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Application Data\HP\Digital Imaging\db\ROFImagesTable.dbf Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Application Data\HP\Digital Imaging\db\ROFTable.cdx Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Application Data\HP\Digital Imaging\db\ROFTable.dbf Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Application Data\Microsoft\CardSpace\CardSpace.db Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Application Data\Microsoft\CardSpace\CardSpace.db.shadow Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\History\History.IE5\MSHist012008070520080706\index.dat Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Temp\fb_3128.lck Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Temp\Perflib_Perfdata_c38.dat Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Temp\Perflib_Perfdata_d34.dat Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Temp\~DFD802.tmp Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\murrays\ntuser.dat Object is locked skipped
    C:\Documents and Settings\murrays\NTUSER.DAT.LOG Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\NetworkService\NTUSER.DAT.LOG Object is locked skipped
    C:\Program Files\ALLTEL Communications\ALLTEL Internet Accelerator Client\Logs\BstDebug_0.txt Object is locked skipped
    C:\Program Files\ALLTEL Communications\ALLTEL Internet Accelerator Client\Logs\BstDebug_900.txt Object is locked skipped
    C:\Program Files\ALLTEL Communications\ALLTEL Internet Accelerator Client\Logs\BstDebug_901.txt Object is locked skipped
    C:\Program Files\ALLTEL Communications\ALLTEL Internet Accelerator Client\Logs\BstDebug_998.txt Object is locked skipped
    C:\Program Files\ALLTEL Communications\ALLTEL Internet Accelerator Client\Logs\BstDebug_999.txt Object is locked skipped
    C:\Program Files\ALLTEL Communications\ALLTEL Internet Accelerator Client\Logs\GADebugA0.txt Object is locked skipped
    C:\Program Files\ALLTEL Communications\ALLTEL Internet Accelerator Client\Logs\gui_log.txt Object is locked skipped
    C:\Program Files\ALLTEL Communications\ALLTEL Internet Accelerator Client\Logs\NGClient.txt Object is locked skipped
    C:\Program Files\ALLTEL Communications\ALLTEL Internet Accelerator Client\Logs\NGManagement.txt Object is locked skipped
    C:\Program Files\ALLTEL Communications\ALLTEL Internet Accelerator Client\Logs\TcpByPassMode.txt Object is locked skipped
    C:\Program Files\ALLTEL Communications\ALLTEL Internet Accelerator Client\Logs\WindowsApplications.log Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcrst.dll Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\EENGINE\EPERSIST.DAT Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\NFWEVT.LOG Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SNDALRT.log Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SNDCON.log Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SNDDBG.log Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SNDFW.log Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SNDIDS.log Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SNDSYS.log Object is locked skipped
    C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf Object is locked skipped
    C:\Program Files\Microsoft SQL Server\MSSQL\Data\mastlog.ldf Object is locked skipped
    C:\Program Files\Microsoft SQL Server\MSSQL\Data\model.mdf Object is locked skipped
    C:\Program Files\Microsoft SQL Server\MSSQL\Data\modellog.ldf Object is locked skipped
    C:\Program Files\Microsoft SQL Server\MSSQL\Data\tempdb.mdf Object is locked skipped
    C:\Program Files\Microsoft SQL Server\MSSQL\Data\templog.ldf Object is locked skipped
    C:\Program Files\Microsoft SQL Server\MSSQL\LOG\ERRORLOG Object is locked skipped
    C:\Program Files\Symantec\Norton AntiVirus\AVApp.log Object is locked skipped
    C:\Program Files\Symantec\Norton AntiVirus\AVError.log Object is locked skipped
    C:\Program Files\Symantec\Norton AntiVirus\AVVirus.log Object is locked skipped
    C:\Program Files\Trend Micro\HijackThis\backups\backup-20080705-075750-185.dll Infected: Trojan.Win32.BHO.etm skipped
    C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
    C:\System Volume Information\_restore{8BC79291-E322-403F-8E40-1FBD3FCA0EBD}\RP229\change.log Object is locked skipped
    C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
    C:\WINDOWS\SchedLgU.Txt Object is locked skipped
    C:\WINDOWS\SoftwareDistribution\EventCache\{ECF1FABD-1CE4-44EE-8834-4615C14CAB72}.bin Object is locked skipped
    C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
    C:\WINDOWS\Sti_Trace.log Object is locked skipped
    C:\WINDOWS\system32\antsafe.dll Infected: Trojan.Win32.BHO.etm skipped
    C:\WINDOWS\system32\ant_ss.dll Infected: Trojan.Win32.BHO.etm skipped
    C:\WINDOWS\system32\avgsafe.dll Infected: Trojan.Win32.BHO.etm skipped
    C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
    C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
    C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\default Object is locked skipped
    C:\WINDOWS\system32\config\default.LOG Object is locked skipped
    C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
    C:\WINDOWS\system32\config\ODiag.evt Object is locked skipped
    C:\WINDOWS\system32\config\OSession.evt Object is locked skipped
    C:\WINDOWS\system32\config\SAM Object is locked skipped
    C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\SECURITY Object is locked skipped
    C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
    C:\WINDOWS\system32\config\software Object is locked skipped
    C:\WINDOWS\system32\config\software.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\system Object is locked skipped
    C:\WINDOWS\system32\config\system.LOG Object is locked skipped
    C:\WINDOWS\system32\h323log.txt Object is locked skipped
    C:\WINDOWS\system32\LogFiles\WUDF\WUDFTrace.etl Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
    C:\WINDOWS\Temp\fb_240.lck Object is locked skipped
    C:\WINDOWS\Temp\Perflib_Perfdata_268.dat Object is locked skipped
    C:\WINDOWS\wiadebug.log Object is locked skipped
    C:\WINDOWS\wiaservc.log Object is locked skipped
    C:\WINDOWS\WindowsUpdate.log Object is locked skipped
    D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

    Scan process completed.



    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 8:27:01 AM, on 7/6/2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16674)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\Microsoft Shared\Ink\KeyboardSurrogate.exe
    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    C:\WINDOWS\SYSTEM32\WISPTIS.EXE
    C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    C:\WINDOWS\System32\tabbtnu.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
    C:\Program Files\iolo\common\lib\ioloServiceManager.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe
    C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\Microsoft Shared\Ink\TCServer.exe
    C:\Program Files\Common Files\Microsoft Shared\Ink\TabTip.exe
    C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
    C:\WINDOWS\stsystra.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\iolo\System Mechanic 7\SMSystemAnalyzer.exe
    C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
    C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
    C:\Program Files\Hewlett-Packard\hp deskjet 460 series\Toolbox\HPWRTBX.exe
    C:\WINDOWS\system32\igfxtray.exe
    C:\WINDOWS\system32\hkcmd.exe
    C:\WINDOWS\system32\igfxpers.exe
    C:\Program Files\HP Wireless 4 Button Laser Mouse\KMaestro.exe
    C:\PROGRA~1\Yahoo!\YOP\yop.exe
    C:\WINDOWS\system32\igfxsrvc.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\DNA\btdna.exe
    C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
    C:\Program Files\ALLTEL Communications\ALLTEL Internet Accelerator Client\NGSpawner.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
    C:\PROGRA~1\Yahoo!\browser\ycommon.exe
    C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
    C:\PROGRA~1\Yahoo!\YOP\SSDK02.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\Program Files\ALLTEL Communications\ALLTEL Internet Accelerator Client\NettGain1200_C.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.my.yahoo.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O4 - HKLM\..\Run: [TabletWizard] C:\WINDOWS\help\SplshWrp.exe
    O4 - HKLM\..\Run: [TabletTip] "C:\Program Files\Common Files\microsoft shared\ink\tabtip.exe" /resume
    O4 - HKLM\..\Run: [Snippet] "C:\Program Files\Microsoft Experience Pack\Snipping Tool\SnippingTool.exe" /i
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe "
    O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
    O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE
    O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
    O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
    O4 - HKLM\..\Run: [SMSystemAnalyzer] "C:\Program Files\iolo\System Mechanic 7\SMSystemAnalyzer.exe "
    O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe "
    O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
    O4 - HKLM\..\Run: [HPWRTOOLBOX] C:\Program Files\Hewlett-Packard\hp deskjet 460 series\Toolbox\HPWRTBX.exe "-i "
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
    O4 - HKLM\..\Run: [BtcMouseMaestro] "C:\Program Files\HP Wireless 4 Button Laser Mouse\KMaestro.exe "
    O4 - HKLM\..\Run: [YOP] C:\PROGRA~1\Yahoo!\YOP\yop.exe /autostart
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe "
    O4 - HKLM\..\Run: [osCheck] "C:\PROGRA~1\Symantec\osCheck.exe "
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [wben] "C:\Program Files\Starfield\Desktop Notifier\wben.exe "
    O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe "
    O4 - HKUS\S-1-5-19\..\Run: [TabletWizard] %windir%\help\wizard.hta (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [TabletWizard] %windir%\help\wizard.hta (User 'NETWORK SERVICE')
    O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
    O4 - Global Startup: ALLTEL Internet Accelerator Client.lnk = C:\Program Files\ALLTEL Communications\ALLTEL Internet Accelerator Client\NGSpawner.exe
    O4 - Global Startup: Bluetooth.lnk = ?
    O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
    O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
    O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
    O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
    O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
    O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
    O9 - Extra button: Send to OneNote - {6EB2AA45-3F30-40e1-9864-45EB153C6EDC} - C:\WINDOWS\system32\mscoree.DLL
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: (no name) - {F37F00B3-19B2-4a69-B923-7A24AF07EE68} - C:\WINDOWS\system32\mscoree.DLL
    O9 - Extra 'Tools' menuitem: Send to OneNote Settings - {F37F00B3-19B2-4a69-B923-7A24AF07EE68} - C:\WINDOWS\system32\mscoree.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O15 - Trusted Zone: *.netflix.com
    O15 - Trusted Zone: http://*.turbotax.com
    O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.nl/scanforvirus-en/kavwebscan_unicode.cab
    O16 - DPF: {10E0E75E-6701-4134-9D95-C0942ED1F1C8} (Snapfish Outlook Import ActiveX Control) - http://photos.walmart.com/WalmartOutlookImport.cab
    O16 - DPF: {1A1F56AA-3401-46F9-B277-D57F3421F821} (FunGamesLoader Object) - http://mypoints.worldwinner.com/games/v47/shared/FunGamesLoader.cab
    O16 - DPF: {2C153C75-8476-434B-B3C3-57B63A3D1939} (Brickout Control) - http://www.worldwinner.com/games/v48/brickout/brickout.cab
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
    O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photos.walmart.com/WalmartActivia.cab
    O16 - DPF: {410A8B3C-7CCB-40E8-8B11-28B099E5C488} (Trend Micro Security Services Control) - http://tmss.trendmicro.com/Dashboard/controls/activex_11/en-US/TMSSReportW.CAB
    O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - https://www-secure.symantec.com/techsupp/asa/ss/sa/sa_cabs/tgctlsr.cab
    O16 - DPF: {5E92F538-B50B-46C5-9C5F-C6EECED3F6C6} - http://www.infospace.com/mypoints.main/tbar/mypointsSetup.exe
    O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - https://www.worldwinner.com/games/shared/wwlaunch.cab
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jinstall-6u3-windows-i586-jc.cab
    O16 - DPF: {9903F4ED-B673-456A-A15F-ED90C7DE9EF5} (Sol Control) - http://www.worldwinner.com/games/v46/sol/sol.cab
    O16 - DPF: {9A57B18E-2F5D-11D5-8997-00104BD12D94} (compid Class) - http://support.gateway.com/support/serialharvest/gwCID.CAB
    O16 - DPF: {A91FB93D-7561-4524-8484-5C27C8FA8D42} (WwLuxor Control) - http://www.worldwinner.com/games/v49/luxor/luxor.cab
    O16 - DPF: {CF969D51-F764-4FBF-9E90-475248601C8A} (FamilyFeud Control) - http://www.worldwinner.com/games/v47/familyfeud/familyfeud.cab
    O16 - DPF: {FFD85DC8-5261-4D11-B728-F7C59D911691} (iolo.ProductDetector) - https://secure.iolo.com/app/ocx/UpgradeVerify.ocx
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
    O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
    O23 - Service: iolo FileInfoList Service (ioloFileInfoList) - Unknown owner - C:\Program Files\iolo\common\lib\ioloServiceManager.exe
    O23 - Service: iolo System Service (ioloSystemService) - Unknown owner - C:\Program Files\iolo\common\lib\ioloServiceManager.exe
    O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\PROGRA~1\Symantec\isPwdSvc.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LuComServer_3_2.EXE
    O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
    O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

    --
    End of file - 13489 bytes
     
    murdawg67,
    #11
  13. 2008/07/06
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Please download JavaRa and save the file to your desktop.
    • Right click and Extract All
    • Once extracted, open and run JavaRa.exe
    • Click Search For Updates
    • Select Update Using jucheck.exe
    • Click Search
    • If a newer version is found, allow it to be installed
    • When complete, click Remove Older Versions in the JavaRa interface and allow it to proceed
    • When that is complete, click Additional Tasks, then select Remove Useless JRE Files and click Go
    • Exit the tool when complete.



    Please delete the ComboFix.exe file you currently have and download a fresh copy from here, saving it to your desktop.

    Once again, please disable any realtime protection applications. Highlight and copy the contents of the code box below and paste it into a blank notepad, then save it to your desktop as;

    Filename: CFScript.txt
    Save As Type: All Files (*.*)

    Code:
    
http://www.windowsbbs.com/showthread.php?t=74875

Collect::
C:\WINDOWS\system32\antsafe.dll
C:\WINDOWS\system32\ant_ss.dll
C:\WINDOWS\system32\avgsafe.dll
    Close all other windows and programs. Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button. Combofix should run and may reboot the computer when it's done. A log will open when it's complete. Post the contents of that log and a fresh HijackThis log.

    Please do not click on the ComboFix window while it is running a scan. This can cause it to stall.


    Please note that I have instructed CFScript to collect some files. This means that at some point, likely after reboot when ComboFix finishes, you will be prompted to allow ComboFix to upload a zip file that was created on your desktop. The zip contains the aforementioned files. Please copy the path shown in the prompt and paste it into the box, then click Send. This will assist the author in adding the files for removal in future updates. Thanks!
     
    noahdfear,
    #12
  14. 2008/07/06
    murdawg67

    murdawg67 Inactive Thread Starter

    Joined:
    2008/07/04
    Messages:
    11
    Likes Received:
    0
    combofix log

    ComboFix 08-07-05.1 - murrays 2008-07-06 11:44:51.2 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.302 [GMT -5:00]
    Running from: C:\Documents and Settings\murrays\Desktop\ComboFix.exe
    Command switches used :: C:\Documents and Settings\murrays\Desktop\CFScript.txt
    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\WINDOWS\system32\ant_ss.dll
    C:\WINDOWS\system32\antsafe.dll
    C:\WINDOWS\system32\avgsafe.dll

    .
    ((((((((((((((((((((((((( Files Created from 2008-06-06 to 2008-07-06 )))))))))))))))))))))))))))))))
    .

    2008-07-05 23:17 . 2008-07-05 23:17 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
    2008-07-05 23:17 . 2008-07-05 23:17 <DIR> d-------- C:\WINDOWS\LastGood
    2008-07-05 23:17 . 2008-07-05 23:17 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
    2008-07-05 15:37 . 2008-07-05 15:37 <DIR> d-------- C:\Documents and Settings\murrays\Application Data\PlanetPlayMore
    2008-07-05 11:20 . 2008-04-22 23:16 6,066,176 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll
    2008-07-05 11:20 . 2007-04-17 04:32 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat
    2008-07-05 11:20 . 2007-03-08 00:10 991,232 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
    2008-07-05 11:20 . 2008-04-22 23:16 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll
    2008-07-05 11:20 . 2008-04-22 23:16 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll
    2008-07-05 11:20 . 2008-04-22 23:16 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll
    2008-07-05 11:20 . 2008-04-22 23:16 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll
    2008-07-05 11:20 . 2008-04-22 23:16 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
    2008-07-05 11:20 . 2008-04-22 02:39 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe
    2008-07-05 09:51 . 2008-07-05 09:51 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-07-05 09:51 . 2008-07-05 09:51 <DIR> d-------- C:\Documents and Settings\murrays\Application Data\Malwarebytes
    2008-07-05 09:51 . 2008-07-05 09:51 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-07-05 09:51 . 2008-06-28 14:21 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
    2008-07-05 09:51 . 2008-06-28 14:21 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
    2008-07-05 08:00 . 2008-07-05 08:00 <DIR> d-------- C:\Deckard
    2008-07-05 07:44 . 2007-07-27 15:45 41,010 --a------ C:\W48117.exe
    2008-07-04 12:54 . 2008-07-04 12:54 <DIR> d-------- C:\Documents and Settings\murrays\Application Data\Thinstall
    2008-07-04 12:35 . 2008-07-04 12:35 <DIR> d-------- C:\NetObjects Fusion 7.5
    2008-07-04 12:35 . 2008-07-04 12:35 <DIR> d-------- C:\NetObjects Fusion 7
    2008-07-04 09:13 . 2008-07-04 09:13 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Arkadium
    2008-07-04 02:09 . 2008-05-27 16:55 1,056,768 --a------ C:\WINDOWS\system32\ROBOEX32.DLL
    2008-07-04 02:09 . 2008-05-27 16:55 49,152 --a------ C:\WINDOWS\system32\INETWH32.DLL
    2008-07-04 02:09 . 2008-05-27 16:55 28,672 --a------ C:\WINDOWS\system32\nnr.dll
    2008-06-30 21:38 . 2008-06-30 21:38 <DIR> d-------- C:\Documents and Settings\murrays\Application Data\ViquaSoft
    2008-06-30 19:04 . 2008-06-30 19:13 <DIR> d-------- C:\StudioLine3
    2008-06-30 19:04 . 2008-07-05 07:44 <DIR> d-------- C:\Program Files\StudioLine Web
    2008-06-30 19:04 . 2008-06-30 19:04 52 --a------ C:\WINDOWS\Relax.ini
    2008-06-30 18:58 . 2008-06-30 18:58 13 ---h----- C:\Documents and Settings\All Users\Application Data\ÃÙÃÄ3113›.sys
    2008-06-29 10:04 . 2008-06-29 20:10 <DIR> d-------- C:\Program Files\TZO
    2008-06-29 10:04 . 2008-06-29 10:03 737,280 --a------ C:\WINDOWS\iun6002.exe
    2008-06-29 08:31 . 2008-07-01 09:12 <DIR> d-------- C:\Program Files\Easy Chat Server
    2008-06-29 08:14 . 2008-07-01 09:12 <DIR> d-------- C:\vfolders
    2008-06-29 05:12 . 2008-03-06 21:32 23,904 --a------ C:\WINDOWS\system32\drivers\COH_Mon.sys
    2008-06-29 05:12 . 2008-03-06 21:32 10,537 --a------ C:\WINDOWS\system32\drivers\COH_Mon.cat
    2008-06-29 05:12 . 2008-03-06 21:32 706 --a------ C:\WINDOWS\system32\drivers\COH_Mon.inf
    2008-06-28 22:44 . 2008-06-28 22:58 16 --a------ C:\WINDOWS\system32\coh.cache
    2008-06-28 22:29 . 2008-06-28 22:40 123,952 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS
    2008-06-28 22:29 . 2008-06-28 22:40 60,800 --a------ C:\WINDOWS\system32\S32EVNT1.DLL
    2008-06-28 22:29 . 2008-06-28 22:40 10,671 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.CAT
    2008-06-28 22:29 . 2008-06-28 22:40 805 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.INF
    2008-06-28 21:09 . 2008-06-28 21:37 <DIR> d-------- C:\Program Files\Photo Pos Pro
    2008-06-28 20:56 . 2008-06-28 21:37 <DIR> d-------- C:\Program Files\Paint.NET
    2008-06-27 08:57 . 2008-06-27 08:57 <DIR> d-------- C:\Documents and Settings\murrays\Application Data\Playrix Entertainment
    2008-06-26 07:46 . 2008-06-26 07:46 <DIR> d-------- C:\Documents and Settings\murrays\Application Data\Reflexive
    2008-06-25 21:29 . 2008-06-25 21:29 <DIR> d-------- C:\Program Files\Wal-Mart
    2008-06-25 21:29 . 2008-06-25 21:29 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Wal-Mart
    2008-06-25 21:27 . 2008-06-25 21:27 <DIR> d-------- C:\Documents and Settings\murrays\Application Data\Wal-Mart Digital Photo Manager
    2008-06-25 20:23 . 2008-06-25 20:23 <DIR> d-------- C:\Documents and Settings\murrays\Application Data\Printer Info Cache
    2008-06-25 18:57 . 2008-06-26 17:15 <DIR> d-------- C:\Documents and Settings\murrays\Application Data\Wal-Mart Digital Photo Viewer
    2008-06-23 13:30 . 2008-06-24 06:28 13 --a------ C:\WINDOWS\system32\WinSys16.crc
    2008-06-23 13:22 . 2008-06-23 13:22 13 ---h----- C:\Documents and Settings\All Users\Application Data\˜113.›sys
    2008-06-23 13:21 . 2008-06-23 13:21 13 ---h----- C:\Documents and Settings\All Users\Application Data\ÃÃÄ3113.sys
    2008-06-23 13:19 . 2008-06-23 13:19 13 ---h----- C:\Documents and Settings\All Users\Application Data\ÃÃÄΛÒ3113›.sys
    2008-06-23 13:15 . 2006-01-27 01:56 938,272 --a------ C:\WINDOWS\system32\WODFTP~1.OCX
    2008-06-23 13:15 . 2008-06-23 13:15 13 ---h----- C:\Documents and Settings\All Users\Application Data\1ÌØ13.sys
    2008-06-23 13:04 . 2002-07-31 19:55 108 ---hs---- C:\WINDOWS\WSYS049.SYS
    2008-06-23 13:04 . 2001-09-05 12:28 41 ---h----- C:\WINDOWS\trfntw32.cfg
    2008-06-23 12:56 . 2008-07-04 17:08 <DIR> d-------- C:\Program Files\CoffeeCup Software
    2008-06-23 12:56 . 2006-01-26 18:56 831,776 --a------ C:\WINDOWS\system32\wodFtpDLX.dll
    2008-06-23 12:56 . 2003-10-09 14:10 274,976 --a------ C:\WINDOWS\system32\XceedFtp.dll
    2008-06-23 10:53 . 2008-06-23 10:53 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\BackToTheBeach
    2008-06-23 10:52 . 2008-06-23 10:52 <DIR> d-------- C:\Program Files\BackToTheBeach
    2008-06-21 09:29 . 2008-06-21 09:29 <DIR> d-------- C:\Documents and Settings\murrays\Application Data\MysteryStudio
    2008-06-15 21:05 . 2008-06-15 21:05 <DIR> d-------- C:\Documents and Settings\Netflix\Application Data\Yahoo!
    2008-06-15 19:54 . 2008-06-15 19:54 <DIR> d-------- C:\Documents and Settings\Netflix\Application Data\Smith Micro
    2008-06-12 23:17 . 2008-06-12 23:17 <DIR> d-------- C:\Documents and Settings\murrays\Application Data\Gogii Games
    2008-06-12 23:17 . 2008-06-12 23:17 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Gogii Games
    2008-06-12 21:40 . 2008-06-12 21:40 <DIR> d-------- C:\Documents and Settings\murrays\Application Data\Yahoo!
    2008-06-12 21:29 . 2008-06-12 21:29 <DIR> d-------- C:\graphics
    2008-06-12 21:29 . 2008-06-28 22:28 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Yahoo!
    2008-06-12 21:29 . 2002-01-05 06:18 84,992 --a------ C:\WINDOWS\system32\ATL70.DLL
    2008-06-12 21:29 . 2001-10-11 11:26 65,536 --a------ C:\WINDOWS\system32\YCRWin32.dll
    2008-06-12 20:13 . 2008-06-28 22:28 <DIR> d-------- C:\Program Files\Yahoo!
    2008-06-12 19:37 . 2008-06-12 19:37 <DIR> d-------- C:\WINDOWS\system32\Debug
    2008-06-12 18:39 . 2008-07-04 17:05 <DIR> d-------- C:\Program Files\NetObjects
    2008-06-12 15:56 . 2007-08-23 15:05 185,344 --a------ C:\WINDOWS\system32\iwpsetup.exe
    2008-06-12 15:56 . 1997-01-16 00:00 29,696 --a------ C:\WINDOWS\system32\VB5STKIT.DLL
    2008-06-12 15:56 . 1997-01-16 13:42 6,114 --a------ C:\WINDOWS\system32\SHELLLNK.TLB
    2008-06-12 00:42 . 2008-06-12 00:42 <DIR> d-------- C:\Documents and Settings\murrays\Application Data\Nvu
    2008-06-11 06:49 . 2008-05-08 09:02 203,136 -----c--- C:\WINDOWS\system32\dllcache\rmcast.sys
    2008-06-08 22:17 . 2008-06-08 22:17 <DIR> d-------- C:\Program Files\Common Files\xara
    2008-06-08 22:17 . 2008-06-08 22:17 <DIR> d-------- C:\Documents and Settings\murrays\Application Data\MAGIX
    2008-06-08 22:17 . 2008-06-08 22:17 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Xara
    2008-06-08 22:17 . 2008-06-08 22:17 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\MAGIX
    2008-06-08 22:17 . 2007-04-27 10:43 120,200 --a------ C:\WINDOWS\system32\DLLDEV32i.dll
    2008-06-08 22:16 . 2008-06-09 07:54 <DIR> d-------- C:\WINDOWS\system32\MAGIX
    2008-06-08 22:16 . 2008-04-08 10:24 700,416 --a------ C:\WINDOWS\system32\mgxoschk.dll
    2008-06-08 22:16 . 2008-06-08 22:16 5,937 --a------ C:\WINDOWS\mgxoschk.ini

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-07-06 16:42 --------- d-----w C:\Documents and Settings\murrays\Application Data\DNA
    2008-07-06 16:38 --------- d-----w C:\Program Files\Common Files\Symantec Shared
    2008-07-06 16:32 --------- d-----w C:\Program Files\Java
    2008-07-05 13:12 --------- d-----w C:\Documents and Settings\murrays\Application Data\U3
    2008-07-05 12:51 --------- d-----w C:\Program Files\Trend Micro
    2008-07-05 12:49 --------- d-----w C:\Program Files\PowerToys for Tablet PC
    2008-07-05 12:44 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-06-29 10:12 --------- d-----w C:\Program Files\Symantec
    2008-06-29 10:12 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
    2008-06-28 12:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\Sandlot Games
    2008-06-24 03:34 --------- d-----w C:\Documents and Settings\murrays\Application Data\PlayFirst
    2008-06-24 03:34 --------- d-----w C:\Documents and Settings\All Users\Application Data\PlayFirst
    2008-06-13 11:05 272,128 ----a-w C:\WINDOWS\system32\drivers\bthport.sys
    2008-06-13 00:43 --------- d-----w C:\Documents and Settings\murrays\Application Data\Move Networks
    2008-06-13 00:37 --------- d-----w C:\Program Files\CA
    2008-06-10 03:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\Astar Games
    2008-06-09 02:56 35,128 ----a-w C:\Documents and Settings\murrays\Application Data\GDIPFONTCACHEV1.DAT
    2008-06-04 01:19 --------- d-----w C:\Documents and Settings\murrays\Application Data\GamesCafe
    2008-06-03 03:09 --------- d-----w C:\Program Files\Coupons
    2008-06-02 21:31 --------- d-----w C:\Program Files\HP Wireless 4 Button Laser Mouse
    2008-05-31 20:00 --------- d-----w C:\Documents and Settings\murrays\Application Data\Flood Light Games
    2008-05-31 20:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\Flood Light Games
    2008-05-31 19:51 --------- d-----w C:\Program Files\V CAST Music Manager
    2008-05-28 21:20 --------- d-----w C:\Documents and Settings\murrays\Application Data\ITTNord
    2008-05-26 21:46 61,440 ----a-w C:\WINDOWS\wnUninstall.exe
    2008-05-26 21:46 --------- d-----w C:\Program Files\Common Files\KAKE First Alert
    2008-05-22 22:53 --------- d-----w C:\Documents and Settings\murrays\Application Data\Boomzap
    2008-05-22 01:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\Hot Lava Games
    2008-05-19 11:55 --------- d-----w C:\Documents and Settings\murrays\Application Data\Magic Seeds
    2008-05-16 01:34 --------- d-----w C:\Documents and Settings\murrays\Application Data\Gaijin Ent
    2008-05-16 00:50 --------- d-----w C:\Documents and Settings\murrays\Application Data\iWin
    2008-05-09 13:03 --------- d-----w C:\Program Files\MySpace
    2008-05-09 00:24 --------- d-----w C:\Documents and Settings\murrays\Application Data\Sudden Games
    2008-05-08 14:02 203,136 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
    2008-05-08 01:13 --------- d-----w C:\Documents and Settings\murrays\Application Data\Cat's Eye Games
    2008-05-07 13:54 --------- d-----w C:\Program Files\Windows Journal
    2008-05-07 05:12 1,288,192 ----a-w C:\WINDOWS\system32\quartz.dll
    2008-05-06 21:36 428,904 ----a-w C:\WINDOWS\system32\Incinerator.dll
    2008-04-23 04:16 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
    2008-04-14 10:42 985,088 ----a-w C:\WINDOWS\system32\setupapi.dll
    2008-04-14 10:42 11,264 ----a-w C:\WINDOWS\system32\spnpinst.exe
    2008-04-14 10:41 423,936 ----a-w C:\WINDOWS\system32\licdll.dll
    2008-04-14 00:25 1,804 ----a-w C:\WINDOWS\system32\dcache.bin
    2008-04-14 00:16 329,728 ----a-w C:\WINDOWS\system32\netsetup.exe
    2008-04-14 00:13 92,424 ----a-w C:\WINDOWS\system32\rdpdd.dll
    2008-04-14 00:13 87,176 ----a-w C:\WINDOWS\system32\rdpwsx.dll
    2008-04-14 00:13 12,168 ----a-w C:\WINDOWS\system32\tsddd.dll
    2008-04-14 00:11 997,376 ----a-w C:\WINDOWS\system32\msgina.dll
    2008-04-14 00:10 53,279 ----a-w C:\WINDOWS\system32\odbcji32.dll
    2008-04-14 00:10 4,126 ----a-w C:\WINDOWS\system32\msdxmlc.dll
    2008-04-14 00:10 3,584 ----a-w C:\WINDOWS\system32\msafd.dll
    2008-04-13 19:30 1,845,632 ----a-w C:\WINDOWS\system32\win32k.sys
    2008-04-13 19:24 2,145,280 ----a-w C:\WINDOWS\system32\ntoskrnl.exe
    2008-04-13 18:44 17,664 ----a-w C:\WINDOWS\system32\watchdog.sys
    2008-04-13 18:43 9,728 ------w C:\WINDOWS\system32\comsdupd.exe
    2008-04-13 18:43 12,800 ----a-w C:\WINDOWS\system32\spiisupd.exe
    2008-04-13 18:31 7,424 ----a-w C:\WINDOWS\system32\kd1394.dll
    2008-04-13 18:31 2,023,936 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe
    2008-04-13 18:30 61,440 ---h--w C:\WINDOWS\system32\msvcrt40.dll
    2008-04-13 18:14 76,800 ------w C:\WINDOWS\system32\msshavmsg.dll
    2008-04-13 17:39 438,784 ----a-w C:\WINDOWS\system32\xpob2res.dll
    2008-04-13 17:39 2,897,920 ----a-w C:\WINDOWS\system32\xpsp2res.dll
    2008-04-13 17:39 187,392 ----a-w C:\WINDOWS\system32\xpsp1res.dll
    2008-04-13 17:37 208,384 ----a-w C:\WINDOWS\system32\rsaenh.dll
    2008-04-13 17:37 138,752 ----a-w C:\WINDOWS\system32\dssenh.dll
    2008-04-13 17:27 79,872 ----a-w C:\WINDOWS\system32\msxml6r.dll
    2008-04-13 17:26 94,208 ----a-w C:\WINDOWS\system32\odbcint.dll
    2008-04-13 17:26 12,288 ----a-w C:\WINDOWS\system32\odbcp32r.dll
    2008-04-13 17:26 12,288 ----a-w C:\WINDOWS\system32\mscpx32r.dll
    2008-04-13 17:24 20,480 ----a-w C:\WINDOWS\system32\msorc32r.dll
    2008-04-13 17:21 733,696 ----a-w C:\WINDOWS\system32\qedwipes.dll
    2008-04-13 17:09 4,096 ----a-w C:\WINDOWS\system32\dsprpres.dll
    2008-04-13 17:03 63,488 ----a-w C:\WINDOWS\system32\browselc.dll
    2008-04-13 17:03 549,376 ----a-w C:\WINDOWS\system32\shdoclc.dll
    2008-04-13 16:48 1,647,616 ----a-w C:\WINDOWS\system32\winbrand.dll
    2008-04-13 16:45 216,064 ----a-w C:\WINDOWS\system32\moricons.dll
    2008-04-13 16:37 2,630,144 ----a-w C:\WINDOWS\Help\tpc_oobe.dll
    2008-04-13 16:36 2,560 ----a-w C:\WINDOWS\system32\pipres.dll
    2008-04-13 16:36 154,624 ----a-w C:\WINDOWS\system32\tipres.dll
    2008-04-13 16:23 48,128 ----a-w C:\WINDOWS\system32\msprivs.dll
    2008-04-13 16:22 48,128 ----a-w C:\WINDOWS\system32\inetres.dll
    2008-04-13 15:39 884,736 ----a-w C:\WINDOWS\system32\msimsg.dll
    2008-01-11 18:00 2,429 ----a-w C:\Program Files\ALLTEL Internet Accelerator Client setup.log
    .

    ((((((((((((((((((((((((((((( snapshot@2008-07-05_17.08.19.84 )))))))))))))))))))))))))))))))))))))))))
    .
    - 2008-07-05 17:47:10 2,048 --s-a-w C:\WINDOWS\bootstat.dat
    + 2008-07-06 04:09:46 2,048 --s-a-w C:\WINDOWS\bootstat.dat
    - 2007-09-25 04:30:28 135,168 ----a-w C:\WINDOWS\system32\java.exe
    + 2008-02-22 06:23:35 135,168 ----a-w C:\WINDOWS\system32\java.exe
    - 2007-09-25 04:30:30 135,168 ----a-w C:\WINDOWS\system32\javaw.exe
    + 2008-02-22 06:23:39 135,168 ----a-w C:\WINDOWS\system32\javaw.exe
    - 2007-09-25 05:31:42 139,264 ----a-w C:\WINDOWS\system32\javaws.exe
    + 2008-02-22 07:33:32 139,264 ----a-w C:\WINDOWS\system32\javaws.exe
    + 2005-05-24 17:27:16 213,048 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll
    + 2007-08-29 20:47:20 94,208 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe
    + 2007-08-29 20:49:54 950,272 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll
    + 2008-07-06 04:10:45 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_268.dat
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 19:12 15360]
    "wben "= "C:\Program Files\Starfield\Desktop Notifier\wben.exe" [2007-11-06 14:12 312024]
    "BitTorrent DNA "= "C:\Program Files\DNA\btdna.exe" [2008-05-10 08:02 289088]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "TabletWizard "= "C:\WINDOWS\help\SplshWrp.exe" [2008-04-13 19:12 16384]
    "TabletTip "= "C:\Program Files\Common Files\microsoft shared\ink\tabtip.exe" [2008-04-13 19:12 271872]
    "Snippet "= "C:\Program Files\Microsoft Experience Pack\Snipping Tool\SnippingTool.exe" [2005-02-25 23:20 68296]
    "RemoteControl "= "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2005-01-12 05:01 32768]
    "SynTPLpr "= "C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-11-05 11:47 98394]
    "SynTPEnh "= "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-11-05 11:47 688218]
    "IAAnotif "= "C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2005-10-12 14:30 139264]
    "SMSystemAnalyzer "= "C:\Program Files\iolo\System Mechanic 7\SMSystemAnalyzer.exe" [2008-05-06 16:36 764776]
    "IntelZeroConfig "= "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [2007-11-01 14:51 995328]
    "IntelWireless "= "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2007-11-01 14:47 1101824]
    "HPWRTOOLBOX "= "C:\Program Files\Hewlett-Packard\hp deskjet 460 series\Toolbox\HPWRTBX.exe" [2005-10-26 02:29 344064]
    "IgfxTray "= "C:\WINDOWS\system32\igfxtray.exe" [2007-12-19 12:08 135168]
    "HotKeysCmds "= "C:\WINDOWS\system32\hkcmd.exe" [2007-12-19 12:08 159744]
    "Persistence "= "C:\WINDOWS\system32\igfxpers.exe" [2007-12-19 12:07 131072]
    "BtcMouseMaestro "= "C:\Program Files\HP Wireless 4 Button Laser Mouse\KMaestro.exe" [2007-08-24 04:32 344064]
    "YOP "= "C:\PROGRA~1\Yahoo!\YOP\yop.exe" [2007-10-26 15:42 509224]
    "ccApp "= "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-10 00:59 115816]
    "osCheck "= "C:\PROGRA~1\Symantec\osCheck.exe" [2007-01-14 02:11 771704]
    "SunJavaUpdateSched "= "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
    "SigmatelSysTrayApp "= "stsystra.exe" [2005-12-27 12:20 413696 C:\WINDOWS\stsystra.exe]
    "BluetoothAuthenticationAgent "= "bthprops.cpl" [2008-04-13 19:12 110592 C:\WINDOWS\system32\bthprops.cpl]

    C:\Documents and Settings\murrays\Start Menu\Programs\Startup\
    OneNote 2007 Screen Clipper and Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2007-08-24 05:45:42 101784]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    ALLTEL Internet Accelerator Client.lnk - C:\Program Files\ALLTEL Communications\ALLTEL Internet Accelerator Client\NGSpawner.exe [2008-01-11 13:00:41 45056]
    Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-03-14 15:42:18 622653]
    HP Photosmart Premier Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2005-12-15 14:00:54 73728]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\loginkey]
    2008-04-13 19:11 47104 C:\Program Files\Common Files\Microsoft Shared\Ink\loginkey.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\TabBtnWL]
    2002-08-29 13:41 11776 C:\WINDOWS\system32\tabbtnwl.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpgwlnotify]
    2008-04-13 19:12 32256 C:\WINDOWS\system32\tpgwlnot.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "msacm.clmp3enc "= C:\PROGRA~1\CYBERL~1\Power2Go\CLMP3Enc.ACM

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
    "DisableMonitoring "=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring "=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring "=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall "= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe "=
    "C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE "=
    "C:\\Program Files\\ALLTEL Communications\\ALLTEL Internet Accelerator Client\\NettGain1200_C.exe "=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe "=
    "C:\\Program Files\\DNA\\btdna.exe "=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe "=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe "=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe "=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe "=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe "=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe "=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe "=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe "=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe "=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe "=
    "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe "=
    "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe "=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe "=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe "=
    "C:\\Program Files\\Common Files\\KAKE First Alert\\TrueWeather.exe "=
    "C:\\Program Files\\Hewlett-Packard\\hp deskjet 460 series\\Toolbox\\HPWRTBX.exe "=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
    "AllowInboundEchoRequest "= 1 (0x1)

    R2 ioloFileInfoList;iolo FileInfoList Service;C:\Program Files\iolo\common\lib\ioloServiceManager.exe [2008-05-02 12:31]
    R2 ioloSystemService;iolo System Service;C:\Program Files\iolo\common\lib\ioloServiceManager.exe [2008-05-02 12:31]
    R3 FinePnt;FinePoint Innovations HID Driver;C:\WINDOWS\system32\DRIVERS\FpHidDrv.sys [2006-10-30 12:17]
    R3 MSTabBtn;Quanta Computer Tablet PC Buttons HID Driver;C:\WINDOWS\system32\DRIVERS\MSTabBtn.sys [2007-03-09 11:40]
    R3 PTDCBus;PANTECH PC Card Composite Device Driver (UDP);C:\WINDOWS\system32\DRIVERS\PTDCBus.sys [2007-01-11 03:30]
    R3 PTDCMdm;PANTECH PC Card Drivers (UDP);C:\WINDOWS\system32\DRIVERS\PTDCMdm.sys [2007-01-11 03:30]
    R3 PTDCVsp;PANTECH PC Card Diagnostic Serial Port (UDP);C:\WINDOWS\system32\DRIVERS\PTDCVsp.sys [2007-01-11 03:30]

    *Newly Created Service* - COMHOST
    .
    Contents of the 'Scheduled Tasks' folder
    "2008-07-01 14:01:05 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job "
    - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
    "2007-08-31 12:09:40 C:\WINDOWS\Tasks\ISP signup reminder 1.job "
    - C:\WINDOWS\system32\OOBE\oobebaln.exe
    "2007-08-31 12:09:40 C:\WINDOWS\Tasks\ISP signup reminder 2.job "
    - C:\WINDOWS\system32\OOBE\oobebaln.exe
    "2007-08-31 12:09:40 C:\WINDOWS\Tasks\ISP signup reminder 3.job "
    - C:\WINDOWS\system32\OOBE\oobebaln.exe
    "2008-06-29 03:35:39 C:\WINDOWS\Tasks\Norton Security Online - Run Full System Scan - Netflix.job "
    - C:\PROGRA~1\Symantec\Norton AntiVirus\Navw32.exeh/TASK:
    .
    - - - - ORPHANS REMOVED - - - -

    WebBrowser-{A057A204-BACC-4D26-CEC4-75A487FD6484} - (no file)


    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-07-06 11:47:55
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2008-07-06 11:48:57
    ComboFix-quarantined-files.txt 2008-07-06 16:48:48
    ComboFix2.txt 2008-07-05 22:08:39

    Pre-Run: 27,734,765,568 bytes free
    Post-Run: 27,754,143,744 bytes free

    325 --- E O F --- 2008-07-05 15:51:40
     
    murdawg67,
    #13
  15. 2008/07/06
    murdawg67

    murdawg67 Inactive Thread Starter

    Joined:
    2008/07/04
    Messages:
    11
    Likes Received:
    0
    hijackthis log

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 11:57:21 AM, on 7/6/2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16674)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\Microsoft Shared\Ink\KeyboardSurrogate.exe
    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    C:\WINDOWS\SYSTEM32\WISPTIS.EXE
    C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    C:\WINDOWS\System32\tabbtnu.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
    C:\Program Files\iolo\common\lib\ioloServiceManager.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe
    C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\Microsoft Shared\Ink\TCServer.exe
    C:\Program Files\Common Files\Microsoft Shared\Ink\TabTip.exe
    C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
    C:\WINDOWS\stsystra.exe
    C:\Program Files\iolo\System Mechanic 7\SMSystemAnalyzer.exe
    C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
    C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
    C:\WINDOWS\system32\igfxtray.exe
    C:\WINDOWS\system32\hkcmd.exe
    C:\WINDOWS\system32\igfxpers.exe
    C:\Program Files\HP Wireless 4 Button Laser Mouse\KMaestro.exe
    C:\PROGRA~1\Yahoo!\YOP\yop.exe
    C:\WINDOWS\system32\igfxsrvc.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\DNA\btdna.exe
    C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
    C:\PROGRA~1\Yahoo!\browser\ycommon.exe
    C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
    C:\PROGRA~1\Yahoo!\YOP\SSDK02.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.my.yahoo.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O4 - HKLM\..\Run: [TabletWizard] C:\WINDOWS\help\SplshWrp.exe
    O4 - HKLM\..\Run: [TabletTip] "C:\Program Files\Common Files\microsoft shared\ink\tabtip.exe" /resume
    O4 - HKLM\..\Run: [Snippet] "C:\Program Files\Microsoft Experience Pack\Snipping Tool\SnippingTool.exe" /i
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe "
    O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
    O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE
    O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
    O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
    O4 - HKLM\..\Run: [SMSystemAnalyzer] "C:\Program Files\iolo\System Mechanic 7\SMSystemAnalyzer.exe "
    O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe "
    O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
    O4 - HKLM\..\Run: [HPWRTOOLBOX] C:\Program Files\Hewlett-Packard\hp deskjet 460 series\Toolbox\HPWRTBX.exe "-i "
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
    O4 - HKLM\..\Run: [BtcMouseMaestro] "C:\Program Files\HP Wireless 4 Button Laser Mouse\KMaestro.exe "
    O4 - HKLM\..\Run: [YOP] C:\PROGRA~1\Yahoo!\YOP\yop.exe /autostart
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe "
    O4 - HKLM\..\Run: [osCheck] "C:\PROGRA~1\Symantec\osCheck.exe "
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe "
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [wben] "C:\Program Files\Starfield\Desktop Notifier\wben.exe "
    O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe "
    O4 - HKUS\S-1-5-19\..\Run: [TabletWizard] %windir%\help\wizard.hta (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [TabletWizard] %windir%\help\wizard.hta (User 'NETWORK SERVICE')
    O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
    O4 - Global Startup: ALLTEL Internet Accelerator Client.lnk = C:\Program Files\ALLTEL Communications\ALLTEL Internet Accelerator Client\NGSpawner.exe
    O4 - Global Startup: Bluetooth.lnk = ?
    O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
    O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
    O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
    O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
    O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
    O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
    O9 - Extra button: Send to OneNote - {6EB2AA45-3F30-40e1-9864-45EB153C6EDC} - C:\WINDOWS\system32\mscoree.DLL
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: (no name) - {F37F00B3-19B2-4a69-B923-7A24AF07EE68} - C:\WINDOWS\system32\mscoree.DLL
    O9 - Extra 'Tools' menuitem: Send to OneNote Settings - {F37F00B3-19B2-4a69-B923-7A24AF07EE68} - C:\WINDOWS\system32\mscoree.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O15 - Trusted Zone: *.netflix.com
    O15 - Trusted Zone: http://*.turbotax.com
    O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.nl/scanforvirus-en/kavwebscan_unicode.cab
    O16 - DPF: {10E0E75E-6701-4134-9D95-C0942ED1F1C8} (Snapfish Outlook Import ActiveX Control) - http://photos.walmart.com/WalmartOutlookImport.cab
    O16 - DPF: {1A1F56AA-3401-46F9-B277-D57F3421F821} (FunGamesLoader Object) - http://mypoints.worldwinner.com/games/v47/shared/FunGamesLoader.cab
    O16 - DPF: {2C153C75-8476-434B-B3C3-57B63A3D1939} (Brickout Control) - http://www.worldwinner.com/games/v48/brickout/brickout.cab
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
    O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photos.walmart.com/WalmartActivia.cab
    O16 - DPF: {410A8B3C-7CCB-40E8-8B11-28B099E5C488} (Trend Micro Security Services Control) - http://tmss.trendmicro.com/Dashboard/controls/activex_11/en-US/TMSSReportW.CAB
    O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - https://www-secure.symantec.com/techsupp/asa/ss/sa/sa_cabs/tgctlsr.cab
    O16 - DPF: {5E92F538-B50B-46C5-9C5F-C6EECED3F6C6} - http://www.infospace.com/mypoints.main/tbar/mypointsSetup.exe
    O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - https://www.worldwinner.com/games/shared/wwlaunch.cab
    O16 - DPF: {9903F4ED-B673-456A-A15F-ED90C7DE9EF5} (Sol Control) - http://www.worldwinner.com/games/v46/sol/sol.cab
    O16 - DPF: {9A57B18E-2F5D-11D5-8997-00104BD12D94} (compid Class) - http://support.gateway.com/support/serialharvest/gwCID.CAB
    O16 - DPF: {A91FB93D-7561-4524-8484-5C27C8FA8D42} (WwLuxor Control) - http://www.worldwinner.com/games/v49/luxor/luxor.cab
    O16 - DPF: {CF969D51-F764-4FBF-9E90-475248601C8A} (FamilyFeud Control) - http://www.worldwinner.com/games/v47/familyfeud/familyfeud.cab
    O16 - DPF: {FFD85DC8-5261-4D11-B728-F7C59D911691} (iolo.ProductDetector) - https://secure.iolo.com/app/ocx/UpgradeVerify.ocx
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
    O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
    O23 - Service: iolo FileInfoList Service (ioloFileInfoList) - Unknown owner - C:\Program Files\iolo\common\lib\ioloServiceManager.exe
    O23 - Service: iolo System Service (ioloSystemService) - Unknown owner - C:\Program Files\iolo\common\lib\ioloServiceManager.exe
    O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\PROGRA~1\Symantec\isPwdSvc.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LuComServer_3_2.EXE
    O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
    O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

    --
    End of file - 13131 bytes
     
    murdawg67,
    #14
  16. 2008/07/06
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Looks good. Thanks for the upload!

    Click Start>Run and type ComboFix /u then hit Enter to uninstall ComboFix and remove the files it has quarantined. This action will also reset the System Restore points, removing the infected files there as well. The C:\Deckard's folder will also be removed. You can delete any logs that were created/saved too.

    Run ATF Cleaner again to clean out temps and recycle bin, then I recommend you run Kaspersky 1 more time to be sure. Save and post the report if anything is reported infected.
     
    noahdfear,
    #15
  17. 2008/07/06
    murdawg67

    murdawg67 Inactive Thread Starter

    Joined:
    2008/07/04
    Messages:
    11
    Likes Received:
    0
    It still shows a few infections. Here is the log. Why does my Norton not detect these?

    KASPERSKY ONLINE SCANNER REPORT
    Sunday, July 06, 2008 2:37:35 PM
    Operating System: Microsoft Windows XP Professional, Service Pack 3 (Build 2600)
    Kaspersky Online Scanner version: 5.0.98.0
    Kaspersky Anti-Virus database last update: 6/07/2008
    Kaspersky Anti-Virus database records: 918686
    -------------------------------------------------------------------------------

    Scan Settings:
    Scan using the following antivirus database: extended
    Scan Archives: true
    Scan Mail Bases: true

    Scan Target - My Computer:
    C:\
    D:\
    E:\

    Scan Statistics:
    Total number of scanned objects: 151882
    Number of viruses found: 2
    Number of infected objects: 3
    Number of suspicious objects: 0
    Duration of the scan process: 01:28:47

    Infected Object Name / Virus Name / Last Action
    C:\Documents and Settings\All Users\Application Data\iolo\FileInfoList\IOLOFIL.FDB Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\2008-07-06_Log.ALUSchedulerSvc.LiveUpdate Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBConfig.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBDebug.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBDetect.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBNotify.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBRefr.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetCfg.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetCfg2.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetDev.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetLoc.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetUsr.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBStHash.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBValid.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\SPPolicy.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\SPStart.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\SPStop.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtErEvt.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtETmp\59BDE0D0.TMP Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtETmp\699B001C.TMP Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtMoEvt.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtNvEvt.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtScEvt.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtTxFEvt.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtViEvt.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\SubEng\submissions.idx Object is locked skipped
    C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\LocalService\NTUSER.DAT.LOG Object is locked skipped
    C:\Documents and Settings\murrays\Application Data\iolo\SystemAnalyzer.log Object is locked skipped
    C:\Documents and Settings\murrays\Application Data\Sun\Java\Deployment\cache\6.0\35\663965a3-6db50ad0/Matrix.class Infected: Trojan-Downloader.Java.OpenStream.c skipped
    C:\Documents and Settings\murrays\Application Data\Sun\Java\Deployment\cache\6.0\35\663965a3-6db50ad0 ZIP: infected - 1 skipped
    C:\Documents and Settings\murrays\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Application Data\ApplicationHistory\hpqimzone.exe.3204510e.ini.inuse Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Application Data\ApplicationHistory\TCServer.exe.7c11743d.ini.inuse Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Application Data\HP\Digital Imaging\db\administrativeInfo.dbf Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Application Data\HP\Digital Imaging\db\albumImagesTable.cdx Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Application Data\HP\Digital Imaging\db\albumImagesTable.dbf Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Application Data\HP\Digital Imaging\db\albumTable.cdx Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Application Data\HP\Digital Imaging\db\albumTable.dbf Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Application Data\HP\Digital Imaging\db\CB_Server_Errors.txt Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Application Data\HP\Digital Imaging\db\EXIFTable.cdx Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Application Data\HP\Digital Imaging\db\EXIFTable.dbf Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Application Data\HP\Digital Imaging\db\imageTable.cdx Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Application Data\HP\Digital Imaging\db\imageTable.dbf Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Application Data\HP\Digital Imaging\db\imageTable.fpt Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Application Data\HP\Digital Imaging\db\keywordImagesTable.cdx Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Application Data\HP\Digital Imaging\db\keywordImagesTable.dbf Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Application Data\HP\Digital Imaging\db\keywordTable.cdx Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Application Data\HP\Digital Imaging\db\keywordTable.dbf Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Application Data\HP\Digital Imaging\db\managedFolderTable.dbf Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Application Data\HP\Digital Imaging\db\pathnameTable.cdx Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Application Data\HP\Digital Imaging\db\pathnameTable.dbf Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Application Data\HP\Digital Imaging\db\propertiesTable.cdx Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Application Data\HP\Digital Imaging\db\propertiesTable.dbf Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Application Data\HP\Digital Imaging\db\ROFImagesTable.cdx Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Application Data\HP\Digital Imaging\db\ROFImagesTable.dbf Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Application Data\HP\Digital Imaging\db\ROFTable.cdx Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Application Data\HP\Digital Imaging\db\ROFTable.dbf Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Application Data\Microsoft\CardSpace\CardSpace.db Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Application Data\Microsoft\CardSpace\CardSpace.db.shadow Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Temp\fb_3128.lck Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Temp\Perflib_Perfdata_c38.dat Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Temp\Perflib_Perfdata_d34.dat Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Temp\~DFD802.tmp Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
    C:\Documents and Settings\murrays\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\murrays\ntuser.dat Object is locked skipped
    C:\Documents and Settings\murrays\NTUSER.DAT.LOG Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\NetworkService\NTUSER.DAT.LOG Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcrst.dll Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\EENGINE\EPERSIST.DAT Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\NFWEVT.LOG Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SNDALRT.log Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SNDCON.log Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SNDDBG.log Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SNDFW.log Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SNDIDS.log Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SNDSYS.log Object is locked skipped
    C:\Program Files\Microsoft SQL Server\MSSQL\Data\fh_ksfm.mdf Object is locked skipped
    C:\Program Files\Microsoft SQL Server\MSSQL\Data\fh_ksfm_log.LDF Object is locked skipped
    C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf Object is locked skipped
    C:\Program Files\Microsoft SQL Server\MSSQL\Data\mastlog.ldf Object is locked skipped
    C:\Program Files\Microsoft SQL Server\MSSQL\Data\model.mdf Object is locked skipped
    C:\Program Files\Microsoft SQL Server\MSSQL\Data\modellog.ldf Object is locked skipped
    C:\Program Files\Microsoft SQL Server\MSSQL\Data\tempdb.mdf Object is locked skipped
    C:\Program Files\Microsoft SQL Server\MSSQL\Data\templog.ldf Object is locked skipped
    C:\Program Files\Microsoft SQL Server\MSSQL\LOG\ERRORLOG Object is locked skipped
    C:\Program Files\Symantec\Norton AntiVirus\AVApp.log Object is locked skipped
    C:\Program Files\Symantec\Norton AntiVirus\AVError.log Object is locked skipped
    C:\Program Files\Symantec\Norton AntiVirus\AVVirus.log Object is locked skipped
    C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
    C:\System Volume Information\_restore{8BC79291-E322-403F-8E40-1FBD3FCA0EBD}\RP232\A0091161.dll Infected: Trojan.Win32.BHO.etm skipped
    C:\System Volume Information\_restore{8BC79291-E322-403F-8E40-1FBD3FCA0EBD}\RP232\change.log Object is locked skipped
    C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
    C:\WINDOWS\SchedLgU.Txt Object is locked skipped
    C:\WINDOWS\SoftwareDistribution\EventCache\{ECF1FABD-1CE4-44EE-8834-4615C14CAB72}.bin Object is locked skipped
    C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
    C:\WINDOWS\Sti_Trace.log Object is locked skipped
    C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
    C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
    C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\default Object is locked skipped
    C:\WINDOWS\system32\config\default.LOG Object is locked skipped
    C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
    C:\WINDOWS\system32\config\ODiag.evt Object is locked skipped
    C:\WINDOWS\system32\config\OSession.evt Object is locked skipped
    C:\WINDOWS\system32\config\SAM Object is locked skipped
    C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\SECURITY Object is locked skipped
    C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
    C:\WINDOWS\system32\config\software Object is locked skipped
    C:\WINDOWS\system32\config\software.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\system Object is locked skipped
    C:\WINDOWS\system32\config\system.LOG Object is locked skipped
    C:\WINDOWS\system32\h323log.txt Object is locked skipped
    C:\WINDOWS\system32\LogFiles\WUDF\WUDFTrace.etl Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
    C:\WINDOWS\Temp\fb_240.lck Object is locked skipped
    C:\WINDOWS\Temp\Perflib_Perfdata_268.dat Object is locked skipped
    C:\WINDOWS\wiadebug.log Object is locked skipped
    C:\WINDOWS\wiaservc.log Object is locked skipped
    C:\WINDOWS\WindowsUpdate.log Object is locked skipped
    D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
    D:\System Volume Information\_restore{8BC79291-E322-403F-8E40-1FBD3FCA0EBD}\RP232\change.log Object is locked skipped

    Scan process completed.
     
    murdawg67,
    #16
  18. 2008/07/06
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    No biggie ..... just an item in the Java cache and another in a System Restore point. Let's make sure Java is up-to-date. Please download JavaRa and save the file to your desktop.
    • Right click and Extract All
    • Once extracted, open and run JavaRa.exe
    • Click Search For Updates
    • Select Update Using jucheck.exe
    • Click Search
    • If a newer version is found, allow it to be installed
    • When complete, click Remove Older Versions in the JavaRa interface and allow it to proceed
    • When that is complete, click Additional Tasks, then select Remove Useless JRE Files and click Go
    • Exit the tool when complete.

    Now, just to be sure, open ATF Cleaner and make sure Java Cache is selected then click Empty Selected. Exit when complete.

    Lets manually reset System Restore.

    Clear past system restore points and create a new one.
    Right click My Computer and select Properties. On the System Restore tab, check the box to turn System Restore off. Click Apply. Now, uncheck the box and click Apply to turn System Restore back on. Click OK, then OK to close the System Properties dialog.

    Verify a new restore point was created.
    Click Start>All Programs>Accessories>System Tools>System Restore
    Select 'Restore my computer to an earlier time', then click next.
    You should have a newly created System Checkpoint available. If so, click Cancel. If not, click Back and select 'Create a restore point' then click Next. Give the restore point a name and click next.


    You can run Kaspersky again if you want, but I think you're good to go. How's the computer behaving now?
     
    noahdfear,
    #17
  19. 2008/07/06
    murdawg67

    murdawg67 Inactive Thread Starter

    Joined:
    2008/07/04
    Messages:
    11
    Likes Received:
    0
    ok I ran javara and it says I have the latest version. ATF-Cleaner did not find any files to remove. I deleted the restore points and a new one was created. Kaspersky still shows the two files in the java folder as infected.

    The computer is running fine and have had no problems.

    Thanks for all your help.
     
    murdawg67,
    #18
  20. 2008/07/06
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Copy the following bolded command.

    %appdata%\Sun\Java\Deployment\cache\6.0\35

    Click Start>Run and paste the command on the run line then hit Enter.

    Delete the following file.

    663965a3-6db50ad0

    Empty the recycle bin.

    If successful, we're done. :)
     
    noahdfear,
    #19
  21. 2008/07/07
    murdawg67

    murdawg67 Inactive Thread Starter

    Joined:
    2008/07/04
    Messages:
    11
    Likes Received:
    0
    Everything is clean. Thanks again. :D
     
    murdawg67,
    #20
Page 1 of 2

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...