1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Could someone please review my Office HijackThis Log?

Discussion in 'Malware and Virus Removal Archive' started by wirekid29, 2007/10/22.

  1. 2007/10/22
    wirekid29

    wirekid29 Inactive Thread Starter

    Joined:
    2007/10/22
    Messages:
    12
    Likes Received:
    0
    Hello and Good morning Windows BBS,

    I am having serious issues with my computer at work. While opening emails containing resumes for my employer, the computer became suddenly infected.
    My desktop wall paper has become a wall paper containing a Warning statement cautioning about spyware.

    I cannot access my internet, my IP address has been deactivated and I cannot change any desktop properties, I get the following "Run a DLL as an App" error report message when I try.

    I ran AVG 7.5 virus remover a couple of times, Ad-Aware Se Pro various times. According to these reports, my computer should be virus and malware free, but I still have the same problems.

    We are running Windows XP Pro - Service Pack 2 (Version 2002) and I am posting the HijackThis Log for someone to analyze. I scanned it using Hijack This with the internet and network disconnected. I am not sure if that alters results or not.

    Could someone please assist me with this "fatal infection" and all help is greatly appreciated.

    Thank you and good luck,

    wirekid29
     
    wirekid29,
    #1
  2. 2007/10/22
    wirekid29

    wirekid29 Inactive Thread Starter

    Joined:
    2007/10/22
    Messages:
    12
    Likes Received:
    0
    Here is the Log:


    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 10:19:19 AM, on 22/10/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\CTHELPER.EXE
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
    C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
    C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tmsmolds.com/
    O1 - Hosts: 66.98.148.65 auto.search.msn.com
    O1 - Hosts: 66.98.148.65 auto.search.msn.es
    O2 - BHO: (no name) - {029e02f0-a0e5-4b19-b958-7bf2db29fb13} - (no file)
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {2d7cb618-cc1c-4126-a7e3-f5b12d3bcf71} - (no file)
    O2 - BHO: (no name) - {51641ef3-8a7a-4d84-8659-b0911e947cc8} - (no file)
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: (no name) - {54645654-2225-4455-44A1-9F4543D34546} - (no file)
    O2 - BHO: (no name) - {6abc861a-31e7-4d91-b43b-d3c98f22a5c0} - (no file)
    O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
    O2 - BHO: (no name) - {a4a435cf-3583-11d4-91bd-0048546a1450} - (no file)
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
    O2 - BHO: (no name) - {c2680e10-1655-4a0e-87f8-4259325a84b7} - (no file)
    O2 - BHO: (no name) - {c4ca6559-2cf1-48b6-96b2-8340a06fd129} - (no file)
    O2 - BHO: (no name) - {d8efadf1-9009-11d6-8c73-608c5dc19089} - (no file)
    O2 - BHO: (no name) - {e9147a0a-a866-4214-b47c-da821891240f} - (no file)
    O2 - BHO: (no name) - {e9306072-417e-43e3-81d5-369490beef7c} - (no file)
    O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
    O4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [RegistryMechanic] C:\Program Files\Registry Mechanic\RegMech.exe /QS
    O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe "
    O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe "
    O4 - HKLM\..\Run: [AWMON] "C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe "
    O4 - HKLM\..\Run: [smgr] mgrs.exe
    O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AdobeUpdateManager.exe" AcPro7_0_7 -reboot 1
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab
    O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://download.divx.com/player/DivXBrowserPlugin.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{2F1CD6DD-59BB-4AE3-96BA-FF4E6F305B5E}: NameServer = 192.168.0.1
    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: Portable Media Serial Number Service WmdmPmSNRoxUPnPRenderer (WmdmPmSNRoxUPnPRenderer) - Unknown owner - C:\WINDOWS\system32\adsndsj.exe

    --
    End of file - 6711 bytes
     
    Last edited: 2007/10/22
    wirekid29,
    #2


  3. to hide this advert.

  4. 2007/10/22
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Welcome to WindowsBBS wirekid29 :)

    Download SmitfraudFix by S!Ri, saving it to the desktop.

    • Restart the computer in Safe Mode by tapping the F8 key upon startup and selecting Safe Mode from the Advanced Startup Menu. Logon to your account.
    • Double-click SmitfraudFix.exe to start the tool and press 2, then hit Enter.
    • You will be prompted 'Do you want to clean the registry?' answer Y (yes) and hit Enter.
    • If prompted to replace the infected wininet.dll file (if found), answer Y (yes) and hit Enter to restore a clean file.
    • Reboot to normal mode when the tool completes.

    Post the contents of C:\rapport.txt and a fresh HijackThis log. Let me know the status of your computer.
     
    noahdfear,
    #3
  5. 2007/10/23
    wirekid29

    wirekid29 Inactive Thread Starter

    Joined:
    2007/10/22
    Messages:
    12
    Likes Received:
    0
    Results

    Hey noahdfear...

    Thanks a lot for your assistance and quick response. About the results... my computer has become faster and now has a plain blue background instead of the WARNING background. I still cannot change the desktop wallpaper nor access the internet. No error message shows up anymore though when I attempt to access the display properties.

    When I was using the Smitfraudfix software, it did not find the wininet.dll file. After I accepted to clean the registry, the rapport file appeared and the software ended.

    Here are is the rapport file and hijackthis log:

    Rapport

    SmitFraudFix v2.240

    Scan done at 14:48:35.20, 23/10/2007
    Run from C:\Documents and Settings\TMS\Desktop\SmitfraudFix
    OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
    The filesystem type is NTFS
    Fix run in safe mode

    »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
    !!!Attention, following keys are not inevitably infected!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll

    »»»»»»»»»»»»»»»»»»»»»»»» Killing process


    »»»»»»»»»»»»»»»»»»»»»»»» hosts


    127.0.0.1 localhost



    66.98.148.65 auto.search.msn.com
    66.98.148.65 auto.search.msn.es
    127.0.0.1 bin.errorprotector.com ## added by CiD
    127.0.0.1 br.errorsafe.com ## added by CiD
    127.0.0.1 br.winantivirus.com ## added by CiD
    127.0.0.1 br.winfixer.com ## added by CiD
    127.0.0.1 cdn.drivecleaner.com ## added by CiD
    127.0.0.1 cdn.errorsafe.com ## added by CiD
    127.0.0.1 cdn.winsoftware.com ## added by CiD
    127.0.0.1 de.errorsafe.com ## added by CiD
    127.0.0.1 de.winantivirus.com ## added by CiD
    127.0.0.1 download.cdn.drivecleaner.com ## added by CiD
    127.0.0.1 download.cdn.errorsafe.com ## added by CiD
    127.0.0.1 download.cdn.winsoftware.com ## added by CiD
    127.0.0.1 download.errorsafe.com ## added by CiD
    127.0.0.1 download.systemdoctor.com ## added by CiD
    127.0.0.1 download.winantispyware.com ## added by CiD
    127.0.0.1 download.windrivecleaner.com ## added by CiD
    127.0.0.1 download.winfixer.com ## added by CiD
    127.0.0.1 drivecleaner.com ## added by CiD
    127.0.0.1 dynamique.drivecleaner.com ## added by CiD
    127.0.0.1 errorprotector.com ## added by CiD
    127.0.0.1 errorsafe.com ## added by CiD
    127.0.0.1 es.winantivirus.com ## added by CiD
    127.0.0.1 fr.winantivirus.com ## added by CiD
    127.0.0.1 fr.winfixer.com ## added by CiD
    127.0.0.1 go.drivecleaner.com ## added by CiD
    127.0.0.1 go.errorsafe.com ## added by CiD
    127.0.0.1 go.winantispyware.com ## added by CiD
    127.0.0.1 go.winantivirus.com ## added by CiD
    127.0.0.1 hk.winantivirus.com ## added by CiD
    127.0.0.1 instlog.errorsafe.com ## added by CiD
    127.0.0.1 instlog.winantivirus.com ## added by CiD
    127.0.0.1 instlog.winfixer.com ## added by CiD
    127.0.0.1 jsp.drivecleaner.com ## added by CiD
    127.0.0.1 kb.errorsafe.com ## added by CiD
    127.0.0.1 kb.winantivirus.com ## added by CiD
    127.0.0.1 nl.errorsafe.com ## added by CiD
    127.0.0.1 se.errorsafe.com ## added by CiD
    127.0.0.1 secure.drivecleaner.com ## added by CiD
    127.0.0.1 secure.errorsafe.com ## added by CiD
    127.0.0.1 secure.winantispam.com ## added by CiD
    127.0.0.1 secure.winantispy.com ## added by CiD
    127.0.0.1 secure.winantivirus.com ## added by CiD
    127.0.0.1 support.winantivirus.com ## added by CiD
    127.0.0.1 trial.updates.winsoftware.com ## added by CiD
    127.0.0.1 ulog.winantivirus.com ## added by CiD
    127.0.0.1 utils.errorsafe.com ## added by CiD
    127.0.0.1 utils.winantivirus.com ## added by CiD
    127.0.0.1 utils.winfixer.com ## added by CiD
    127.0.0.1 winantispyware.com ## added by CiD
    127.0.0.1 winantivirus.com ## added by CiD
    127.0.0.1 winfixer.com ## added by CiD
    127.0.0.1 winfixer2006.com ## added by CiD
    127.0.0.1 winsoftware.com ## added by CiD
    127.0.0.1 www.drivecleaner.com ## added by CiD
    127.0.0.1 www.errorprotector.com ## added by CiD
    127.0.0.1 www.errorsafe.com ## added by CiD
    127.0.0.1 www.systemdoctor.com ## added by CiD
    127.0.0.1 www.utils.winfixer.com ## added by CiD
    127.0.0.1 www.win-anti-virus-pro.com ## added by CiD
    127.0.0.1 www.win-virus-pro.com ## added by CiD
    127.0.0.1 www.winantispam.com ## added by CiD
    127.0.0.1 www.winantispy.com ## added by CiD
    127.0.0.1 www.winantispyware.com ## added by CiD
    127.0.0.1 www.winantivirus.com ## added by CiD
    127.0.0.1 www.winantiviruspro.com ## added by CiD
    127.0.0.1 www.windrivecleaner.com ## added by CiD
    127.0.0.1 www.windrivesafe.com ## added by CiD
    127.0.0.1 www.winfixer.com ## added by CiD
    127.0.0.1 www.winfixer2006.com ## added by CiD
    127.0.0.1 www.winsoftware.com ## added by CiD

    »»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

    S!Ri's WS2Fix: LSP not Found.


    »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

    GenericRenosFix by S!Ri


    »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files


    »»»»»»»»»»»»»»»»»»»»»»»» DNS

    HKLM\SYSTEM\CCS\Services\Tcpip\..\{2F1CD6DD-59BB-4AE3-96BA-FF4E6F305B5E}: NameServer=192.168.0.1
    HKLM\SYSTEM\CS1\Services\Tcpip\..\{2F1CD6DD-59BB-4AE3-96BA-FF4E6F305B5E}: NameServer=192.168.0.1
    HKLM\SYSTEM\CS2\Services\Tcpip\..\{2F1CD6DD-59BB-4AE3-96BA-FF4E6F305B5E}: NameServer=192.168.0.1


    »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


    »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
    !!!Attention, following keys are not inevitably infected!!!

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
    "System "=" "


    »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

    Registry Cleaning done.

    »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
    !!!Attention, following keys are not inevitably infected!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll


    »»»»»»»»»»»»»»»»»»»»»»»» End


    and the HijackThis Log:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 2:51:32 PM, on 23/10/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\CTHELPER.EXE
    C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
    C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
    C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    O1 - Hosts: 66.98.148.65 auto.search.msn.com
    O1 - Hosts: 66.98.148.65 auto.search.msn.es
    O2 - BHO: (no name) - {029e02f0-a0e5-4b19-b958-7bf2db29fb13} - (no file)
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {2d7cb618-cc1c-4126-a7e3-f5b12d3bcf71} - (no file)
    O2 - BHO: (no name) - {51641ef3-8a7a-4d84-8659-b0911e947cc8} - (no file)
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: (no name) - {54645654-2225-4455-44A1-9F4543D34546} - (no file)
    O2 - BHO: (no name) - {6abc861a-31e7-4d91-b43b-d3c98f22a5c0} - (no file)
    O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
    O2 - BHO: (no name) - {a4a435cf-3583-11d4-91bd-0048546a1450} - (no file)
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
    O2 - BHO: (no name) - {c2680e10-1655-4a0e-87f8-4259325a84b7} - (no file)
    O2 - BHO: (no name) - {c4ca6559-2cf1-48b6-96b2-8340a06fd129} - (no file)
    O2 - BHO: (no name) - {d8efadf1-9009-11d6-8c73-608c5dc19089} - (no file)
    O2 - BHO: (no name) - {e9147a0a-a866-4214-b47c-da821891240f} - (no file)
    O2 - BHO: (no name) - {e9306072-417e-43e3-81d5-369490beef7c} - (no file)
    O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
    O4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe "
    O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe "
    O4 - HKLM\..\Run: [AWMON] "C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe "
    O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
    O4 - HKLM\..\Run: [smgr] mgrs.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AdobeUpdateManager.exe" AcPro7_0_7 -reboot 1
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab
    O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://download.divx.com/player/DivXBrowserPlugin.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{2F1CD6DD-59BB-4AE3-96BA-FF4E6F305B5E}: NameServer = 192.168.0.1
    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: Portable Media Serial Number Service WmdmPmSNRoxUPnPRenderer (WmdmPmSNRoxUPnPRenderer) - Unknown owner - C:\WINDOWS\system32\adsndsj.exe

    --
    End of file - 6497 bytes
     
    wirekid29,
    #4
  6. 2007/10/23
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Download Winsock XP Fix and copy it to the desktop.

    Scan again with HijackThis, place a check next to the following entries, then click Fix Checked.

    O1 - Hosts: 66.98.148.65 auto.search.msn.com
    O1 - Hosts: 66.98.148.65 auto.search.msn.es
    O2 - BHO: (no name) - {029e02f0-a0e5-4b19-b958-7bf2db29fb13} - (no file)
    O2 - BHO: (no name) - {2d7cb618-cc1c-4126-a7e3-f5b12d3bcf71} - (no file)
    O2 - BHO: (no name) - {51641ef3-8a7a-4d84-8659-b0911e947cc8} - (no file)
    O2 - BHO: (no name) - {54645654-2225-4455-44A1-9F4543D34546} - (no file)
    O2 - BHO: (no name) - {6abc861a-31e7-4d91-b43b-d3c98f22a5c0} - (no file)
    O2 - BHO: (no name) - {a4a435cf-3583-11d4-91bd-0048546a1450} - (no file)
    O2 - BHO: (no name) - {c2680e10-1655-4a0e-87f8-4259325a84b7} - (no file)
    O2 - BHO: (no name) - {c4ca6559-2cf1-48b6-96b2-8340a06fd129} - (no file)
    O2 - BHO: (no name) - {d8efadf1-9009-11d6-8c73-608c5dc19089} - (no file)
    O2 - BHO: (no name) - {e9147a0a-a866-4214-b47c-da821891240f} - (no file)
    O2 - BHO: (no name) - {e9306072-417e-43e3-81d5-369490beef7c} - (no file)
    O4 - HKLM\..\Run: [smgr] mgrs.exe

    Close HijackThis.

    Close all open programs and connections. Run winsock XP Fix and select Fix.

    Reboot.

    Create and post a new HijackThis log. Let me know if you can connect now.

    What exactly prevents you from setting the desktop background, eg; missing tab, cannot select wallpaper, can select but cannot apply wallpaper, etc.?
     
    noahdfear,
    #5
  7. 2007/10/25
    wirekid29

    wirekid29 Inactive Thread Starter

    Joined:
    2007/10/22
    Messages:
    12
    Likes Received:
    0
    Results!

    Good morning noahdfear,

    Thank you again for your help with my computer situation. As it stands right now, I fixed those items you listed on hijackthis and ran the winsock xp fix software. My internet connection is back up and so is my network access. Overall, my computer is back to normal: no viruses, no spyware, no adware.

    There is still an issue though with my display properties. Well, just the option to choose the desktop wallpaper. I still cannot choose any wallpapers. What happens is that it shows the options to choose (the wallpapers I can apply) but they cannot be selected. Theres a light grey shadow around them and they cannot be clicked on. The "run dll as an app" error message has appeared again and it exits display properties as soon as I click "send "or "dont send. "

    Could you please help me with this last thing noahdfear.

    Thank you for everything,

    wirekid29
     
    wirekid29,
    #6
  8. 2007/10/25
    wirekid29

    wirekid29 Inactive Thread Starter

    Joined:
    2007/10/22
    Messages:
    12
    Likes Received:
    0
    Log!

    Ah! I almost forgot. Here is the updated HijackThis Log:


    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 8:39:08 AM, on 25/10/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\CTHELPER.EXE
    C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
    C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
    C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\wscntfy.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tmsmolds.com/
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
    O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
    O4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe "
    O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe "
    O4 - HKLM\..\Run: [AWMON] "C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe "
    O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AdobeUpdateManager.exe" AcPro7_0_7 -reboot 1
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab
    O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://download.divx.com/player/DivXBrowserPlugin.cab
    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: Portable Media Serial Number Service WmdmPmSNRoxUPnPRenderer (WmdmPmSNRoxUPnPRenderer) - Unknown owner - C:\WINDOWS\system32\adsndsj.exe (file missing)

    --
    End of file - 5725 bytes
     
    wirekid29,
    #7
  9. 2007/10/25
    wirekid29

    wirekid29 Inactive Thread Starter

    Joined:
    2007/10/22
    Messages:
    12
    Likes Received:
    0
    New Problem

    After I had thought that everything was back to normal, I keep getting an error message stating that Windows Explorer has encountered a problem and three options follow: Debug, Send and Dont Send. What ever I click causes the same problem: everything is exited, the screen refreshes and the error message appears again and again. :confused:

    I don't know what I did wrong! It's worst then before! Ahh!
     
    wirekid29,
    #8
  10. 2007/10/25
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Note: You must be logged onto an account with administrator privileges to complete the following.​

    Download Deckard's System Scanner (dss.exe) to your desktop.
    • Close all applications and windows.
    • Double click on dss.exe to run it and follow the prompts.
    • When the scan is complete, two text files will open; main.txt, which will be maximized and extra.txt, which will be minimized.
    Post the contents of main.txt only for now.
     
    noahdfear,
    #9
  11. 2007/10/27
    wirekid29

    wirekid29 Inactive Thread Starter

    Joined:
    2007/10/22
    Messages:
    12
    Likes Received:
    0
    Main Text

    Sorry for the delay, here is the main log:

    Deckard's System Scanner v20071014.68
    Run by TMS on 2007-10-27 10:39:37
    Computer is in Normal Mode.
    --------------------------------------------------------------------------------

    -- System Restore --------------------------------------------------------------

    System Restore is disabled; attempting to re-enable...success.


    -- Last 1 Restore Point(s) --
    1: 2007-10-27 14:39:42 UTC - RP1 - System Checkpoint


    Backed up registry hives.
    Performed disk cleanup.



    -- HijackThis (run as TMS.exe) -------------------------------------------------

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 10:41:35 AM, on 27/10/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\CTHELPER.EXE
    C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
    C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
    C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\explorer.exe
    C:\Documents and Settings\TMS\Desktop\dss.exe
    C:\PROGRA~1\TRENDM~1\HIJACK~1\TMS.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tmsmolds.com/
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
    O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
    O4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe "
    O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe "
    O4 - HKLM\..\Run: [AWMON] "C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe "
    O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AdobeUpdateManager.exe" AcPro7_0_7 -reboot 1
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab
    O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://download.divx.com/player/DivXBrowserPlugin.cab
    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: Portable Media Serial Number Service WmdmPmSNRoxUPnPRenderer (WmdmPmSNRoxUPnPRenderer) - Unknown owner - C:\WINDOWS\system32\adsndsj.exe (file missing)

    --
    End of file - 5756 bytes

    -- HijackThis Fixed Entries (C:\PROGRA~1\TRENDM~1\HIJACK~1\backups\) -----------

    backup-20071025-081112-126 O2 - BHO: (no name) - {51641ef3-8a7a-4d84-8659-b0911e947cc8} - (no file)
    backup-20071025-081112-133 O2 - BHO: (no name) - {c4ca6559-2cf1-48b6-96b2-8340a06fd129} - (no file)
    backup-20071025-081112-304 O2 - BHO: (no name) - {2d7cb618-cc1c-4126-a7e3-f5b12d3bcf71} - (no file)
    backup-20071025-081112-314 O1 - Hosts: 66.98.148.65 auto.search.msn.es
    backup-20071025-081112-340 O4 - HKLM\..\Run: [smgr] mgrs.exe
    backup-20071025-081112-379 O2 - BHO: (no name) - {c2680e10-1655-4a0e-87f8-4259325a84b7} - (no file)
    backup-20071025-081112-386 O2 - BHO: (no name) - {a4a435cf-3583-11d4-91bd-0048546a1450} - (no file)
    backup-20071025-081112-393 O2 - BHO: (no name) - {54645654-2225-4455-44A1-9F4543D34546} - (no file)
    backup-20071025-081112-394 O2 - BHO: (no name) - {e9147a0a-a866-4214-b47c-da821891240f} - (no file)
    backup-20071025-081112-397 O1 - Hosts: 66.98.148.65 auto.search.msn.com
    backup-20071025-081112-489 O2 - BHO: (no name) - {029e02f0-a0e5-4b19-b958-7bf2db29fb13} - (no file)
    backup-20071025-081112-717 O2 - BHO: (no name) - {6abc861a-31e7-4d91-b43b-d3c98f22a5c0} - (no file)
    backup-20071025-081112-824 O2 - BHO: (no name) - {e9306072-417e-43e3-81d5-369490beef7c} - (no file)
    backup-20071025-081112-870 O2 - BHO: (no name) - {d8efadf1-9009-11d6-8c73-608c5dc19089} - (no file)
    backup-20071025-083542-139 O4 - HKLM\..\Run: [smgr] mgrs.exe

    -- File Associations -----------------------------------------------------------

    .scr - AutoCADScriptFile - shell\open\command - "C:\WINDOWS\system32\NOTEPAD.EXE" "%1 "


    -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

    R3 vaxscsi - c:\windows\system32\drivers\vaxscsi.sys

    S2 BDRSDRV - c:\program files\softwin\bitdefender10\bdrsdrv.sys (file missing)
    S3 bdfdll - c:\program files\softwin\bitdefender10\bdfdll.sys (file missing)
    S3 BDFSDRV - c:\program files\softwin\bitdefender10\bdfsdrv.sys (file missing)
    S3 NAL (Nal Service ) - c:\windows\system32\drivers\iqvw32.sys <Not Verified; Intel Corporation; Intel(R) iQVW32.SYS>


    -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

    S2 WmdmPmSNRoxUPnPRenderer (Portable Media Serial Number Service WmdmPmSNRoxUPnPRenderer) - c:\windows\system32\adsndsj.exe srv (file missing)
    S4 dkab_device - c:\windows\system32\dkabcoms.exe -service <Not Verified; Dell; Dell Communication System>
    S4 VSSERV (BitDefender Virus Shield) - "c:\program files\softwin\bitdefender10\vsserv.exe" /service (file missing)


    -- Device Manager: Disabled ----------------------------------------------------

    No disabled devices found.


    -- Files created between 2007-09-27 and 2007-10-27 -----------------------------

    2007-10-25 08:19:24 3144 --a------ C:\WINDOWS\system32\SProxy.dll
    2007-10-25 08:19:22 1596416 --a------ C:\WINDOWS\system32\HtBt.dll
    2007-10-25 08:19:03 89088 --a------ C:\WINDOWS\system32\rtnka.dll
    2007-10-25 08:19:03 1592320 --a------ C:\WINDOWS\system32\rtnka.dat
    2007-10-23 14:30:55 2204 --a------ C:\WINDOWS\system32\tmp.reg
    2007-10-23 14:30:36 25600 --a------ C:\WINDOWS\system32\WS2Fix.exe
    2007-10-23 14:30:36 289144 --a------ C:\WINDOWS\system32\VCCLSID.exe <Not Verified; S!Ri; >
    2007-10-23 14:30:36 288417 --a------ C:\WINDOWS\system32\SrchSTS.exe <Not Verified; S!Ri; SrchSTS>
    2007-10-23 14:30:36 53248 --a------ C:\WINDOWS\system32\Process.exe <Not Verified; http://www.beyondlogic.org; Command Line Process Utility>
    2007-10-23 14:30:36 51200 --a------ C:\WINDOWS\system32\dumphive.exe
    2007-10-22 10:19:09 0 d-------- C:\Program Files\Trend Micro
    2007-10-22 08:46:33 0 dr-h----- C:\$VAULT$.AVG
    2007-10-22 08:41:58 0 d-------- C:\Documents and Settings\TMS\Application Data\AVG7
    2007-10-22 08:41:54 0 d-------- C:\Documents and Settings\LocalService\Application Data\AVG7
    2007-10-22 08:41:45 0 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
    2007-10-22 08:41:45 0 d-------- C:\Documents and Settings\All Users\Application Data\avg7
    2007-10-15 10:17:03 0 d-------- C:\Documents and Settings\TMS\Application Data\Lavasoft
    2007-10-15 10:16:01 0 d-------- C:\Program Files\Lavasoft
    2007-10-15 09:17:42 0 d-------- C:\Program Files\AVPersonal
    2007-10-13 09:56:44 27904 --a------ C:\WINDOWS\eventlowg.dll
    2007-10-13 09:56:43 27904 --a------ C:\WINDOWS\liqui-Uninstaller.exe
    2007-10-13 09:56:43 21248 --a------ C:\WINDOWS\liqui.exe
    2007-10-13 09:56:43 25088 --a------ C:\WINDOWS\fhfmm.exe
    2007-10-13 09:56:43 16384 --a------ C:\WINDOWS\daxtime.dll
    2007-10-13 09:56:42 29952 --a------ C:\WINDOWS\xadbrk_.exe
    2007-10-13 09:56:42 11008 --a------ C:\WINDOWS\xadbrk.exe
    2007-10-13 09:56:42 22784 --a------ C:\WINDOWS\fhfmm-Uninstaller.exe
    2007-10-13 09:56:41 22016 --a------ C:\WINDOWS\liqad.exe
    2007-10-13 09:56:41 17408 --a------ C:\WINDOWS\liqad$.exe
    2007-10-13 09:56:41 13056 --a------ C:\WINDOWS\kkcomp.exe
    2007-10-13 09:56:41 18944 --a------ C:\WINDOWS\kkcomp$.exe
    2007-10-13 09:56:40 16896 --a------ C:\WINDOWS\spredirect.dll
    2007-10-13 09:56:40 19456 --a------ C:\WINDOWS\jd2002.dll
    2007-10-13 09:56:40 22016 --a------ C:\WINDOWS\cbinst$.exe
    2007-10-13 09:56:40 10240 --a------ C:\WINDOWS\adbar.dll
    2007-10-13 09:56:39 11008 --a------ C:\WINDOWS\system32\ESHOPEE.exe
    2007-10-13 09:56:39 0 d-------- C:\Program Files\amsys
    2007-10-13 09:56:38 0 d-------- C:\WINDOWS\system32\acespy
    2007-10-13 09:56:38 15872 --a------ C:\WINDOWS\ie_32.exe
    2007-10-13 09:56:38 23808 --a------ C:\WINDOWS\aconti.exe
    2007-10-13 09:56:37 26624 --a------ C:\WINDOWS\xxxvideo.exe
    2007-10-13 09:56:37 21504 --a------ C:\WINDOWS\ngd.dll
    2007-10-13 09:56:37 16384 --a------ C:\WINDOWS\hotporn.exe
    2007-10-13 09:56:37 31488 --a------ C:\WINDOWS\dp0.dll
    2007-10-13 09:56:35 10496 --a------ C:\WINDOWS\vxddsk.exe
    2007-10-13 09:56:35 0 d-------- C:\Program Files\akl
    2007-10-13 09:50:19 12 --a------ C:\WINDOWS\system32\gtv_sd.bin
    2007-10-13 09:37:36 8704 --a------ C:\WINDOWS\system32\sporder.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
    2007-10-13 09:37:30 0 d-------- C:\Program Files\SoftPortal
    2007-10-13 09:37:02 76800 --a------ C:\WINDOWS\system32\unrar.dll
    2007-10-13 09:19:21 63489 --a------ C:\WINDOWS\system32\SoUI.dll
    2007-10-13 09:18:57 109 --ahs---- C:\WINDOWS\system32\605379345.dat
    2007-10-01 14:45:33 0 d-------- C:\Program Files\BitLord


    -- Find3M Report ---------------------------------------------------------------

    2007-10-25 10:14:04 288 --a------ C:\WINDOWS\system32\DVCStateBkp-{00000003-00000000-0000000D-00001102-00000004-10031102}.dat
    2007-10-25 10:14:04 288 --a------ C:\WINDOWS\system32\DVCState-{00000003-00000000-0000000D-00001102-00000004-10031102}.dat
    2007-10-15 09:09:47 0 d-------- C:\Program Files\DivX
    2007-10-09 15:25:47 0 d-------- C:\Program Files\Common Files\Adobe
    2007-10-01 14:45:52 0 d-------- C:\Program Files\BitTorrent
    2007-10-01 14:45:40 0 d-------- C:\Documents and Settings\TMS\Application Data\BitTorrent
    2007-09-08 10:12:32 184320 --a------ C:\WINDOWS\system32\J76MH4El.dll <Not Verified; ; WebAssist>
    2007-09-08 08:10:54 184320 --a------ C:\WINDOWS\system32\gF71N4vw.dll <Not Verified; ; WebAssist>
    2007-09-08 08:04:06 184320 --a------ C:\WINDOWS\system32\s06IN5d8.dll <Not Verified; ; WebAssist>
    2007-09-08 08:04:02 184320 --a------ C:\WINDOWS\system32\MdQ5LS12.dll <Not Verified; ; WebAssist>
    2007-09-08 08:03:47 184320 --a------ C:\WINDOWS\system32\b33r06hF.dll <Not Verified; ; WebAssist>
    2007-09-08 08:01:42 184320 --a------ C:\WINDOWS\system32\tOgc374C.dll <Not Verified; ; WebAssist>
    2007-09-08 08:01:42 184320 --a------ C:\WINDOWS\system32\nA734b84.dll <Not Verified; ; WebAssist>
    2007-09-08 08:01:37 184320 --a------ C:\WINDOWS\system32\03Q41aBp.dll <Not Verified; ; WebAssist>
    2007-09-06 08:17:10 184320 --a------ C:\WINDOWS\system32\xqU3VSNr.dll <Not Verified; ; WebAssist>


    -- Registry Dump ---------------------------------------------------------------

    *Note* empty entries & legit default entries are not shown


    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTHelper "= "CTHELPER.EXE" [20/02/2003 06:45 PM C:\WINDOWS\system32\CTHELPER.EXE]
    "AsioReg "= "REGSVR32.exe" [04/08/2004 12:56 AM C:\WINDOWS\system32\regsvr32.exe]
    "NvCplDaemon "= "C:\WINDOWS\system32\NvCpl.dll" [13/07/2005 04:33 PM]
    "nwiz "= "nwiz.exe" [13/07/2005 04:33 PM C:\WINDOWS\system32\nwiz.exe]
    "NvMediaCenter "= "C:\WINDOWS\system32\NvMcTray.dll" [13/07/2005 04:33 PM]
    "Acrobat Assistant 7.0 "= "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [12/01/2006 08:52 PM]
    "@ "=" " []
    "GrooveMonitor "= "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [27/10/2006 12:47 AM]
    "AWMON "= "C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe" [16/09/2004 04:15 PM]
    "UpdReg "= "C:\WINDOWS\UpdReg.EXE" []

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE "= "C:\WINDOWS\system32\ctfmon.exe" [04/08/2004 12:56 AM]
    "updateMgr "= "C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AdobeUpdateManager.exe" [24/10/2005 04:53 PM]
    "swg "= "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [17/08/2007 12:56 PM]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
    "NoSetActiveDesktop "=1 (0x1)
    "NoActiveDesktopChanges "=1

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
    "NoSetActiveDesktop "=1 (0x1)
    "NoActiveDesktopChanges "=0

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "appinit_dlls "=sockspy.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk]
    backup=C:\WINDOWS\pss\Adobe Acrobat Speed Launcher.lnkCommon Startup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^InterVideo WinCinema Manager.lnk]
    backup=C:\WINDOWS\pss\InterVideo WinCinema Manager.lnkCommon Startup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 7.0]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDAgent]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDMCon]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitComet]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxioDragToDisc]
    "C:\Program Files\Roxio\Easy Media Creator 8\Drag to Disc\DrgToDsc.exe "

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxWatchTray]
    "C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatchTray.exe "

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "iPod Service "=3 (0x3)
    "RoxWatch "=2 (0x2)
    "RoxUpnpServer "=2 (0x2)
    "RoxUPnPRenderer "=3 (0x3)
    "RoxMediaDB "=3 (0x3)
    "RoxLiveShare "=2 (0x2)
    "ose "=3 (0x3)
    "odserv "=3 (0x3)
    "NVSvc "=2 (0x2)
    "gusvc "=3 (0x3)
    "Autodesk Licensing Service "=3 (0x3)
    "Adobe LM Service "=3 (0x3)
    "WMPNetworkSvc "=3 (0x3)
    "XCOMM "=2 (0x2)
    "VSSERV "=2 (0x2)
    "MDM "=2 (0x2)
    "LIVESRV "=2 (0x2)
    "IDriverT "=3 (0x3)
    "dkab_device "=3 (0x3)
    "bdss "=2 (0x2)




    -- End of Deckard's System Scanner: finished at 2007-10-27 10:43:01 ------------
     
    wirekid29,
    #10
  12. 2007/10/27
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Download ComboFix by sUBs from here, saving the file to your desktop.

    Highlight and copy the contents of the code box below and paste it into a blank notepad, then save it to your desktop as;

    Filename: CFScript.txt
    Save As Type: All Files (*.*)

    Code:
    File::
C:\WINDOWS\system32\SProxy.dll
C:\WINDOWS\system32\HtBt.dll
C:\WINDOWS\system32\rtnka.dll
C:\WINDOWS\system32\rtnka.dat
C:\WINDOWS\system32\tmp.reg
C:\WINDOWS\system32\WS2Fix.exe
C:\WINDOWS\system32\VCCLSID.exe
C:\WINDOWS\system32\SrchSTS.exe
C:\WINDOWS\system32\Process.exe
C:\WINDOWS\system32\dumphive.exe
C:\WINDOWS\eventlowg.dll
C:\WINDOWS\liqui-Uninstaller.exe
C:\WINDOWS\liqui.exe
C:\WINDOWS\fhfmm.exe
C:\WINDOWS\daxtime.dll
C:\WINDOWS\xadbrk_.exe
C:\WINDOWS\xadbrk.exe
C:\WINDOWS\fhfmm-Uninstaller.exe
C:\WINDOWS\liqad.exe
C:\WINDOWS\liqad$.exe
C:\WINDOWS\kkcomp.exe
C:\WINDOWS\kkcomp$.exe
C:\WINDOWS\spredirect.dll
C:\WINDOWS\jd2002.dll
C:\WINDOWS\cbinst$.exe
C:\WINDOWS\adbar.dll
C:\WINDOWS\system32\ESHOPEE.exe
C:\WINDOWS\ie_32.exe
C:\WINDOWS\aconti.exe
C:\WINDOWS\xxxvideo.exe
C:\WINDOWS\ngd.dll
C:\WINDOWS\hotporn.exe
C:\WINDOWS\dp0.dll
C:\WINDOWS\vxddsk.exe
C:\WINDOWS\system32\gtv_sd.bin
C:\WINDOWS\system32\unrar.dll
C:\WINDOWS\system32\SoUI.dll
C:\WINDOWS\system32\605379345.dat
C:\WINDOWS\system32\DVCStateBkp-{00000003-00000000-0000000D-00001102-00000004-10031102}.dat
C:\WINDOWS\system32\DVCState-{00000003-00000000-0000000D-00001102-00000004-10031102}.dat
C:\WINDOWS\system32\J76MH4El.dll
C:\WINDOWS\system32\gF71N4vw.dll
C:\WINDOWS\system32\s06IN5d8.dll
C:\WINDOWS\system32\MdQ5LS12.dll
C:\WINDOWS\system32\b33r06hF.dll
C:\WINDOWS\system32\tOgc374C.dll
C:\WINDOWS\system32\nA734b84.dll
C:\WINDOWS\system32\03Q41aBp.dll
C:\WINDOWS\system32\xqU3VSNr.dll <Not Verified; ; WebAssist>
Folder::
C:\Program Files\amsys
C:\WINDOWS\system32\acespy
C:\Program Files\akl
C:\Program Files\SoftPortal
Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows\[COLOR="Black"]currentversion[/COLOR]\policies\explorer]
 "NoSetActiveDesktop "=dword:00000000
 "NoActiveDesktopChanges "=dword:00000000
[HKEY_CURRENT_USER\software\microsoft\windows\[COLOR="black"]currentversion[/COLOR]\policies\explorer]
 "NoSetActiveDesktop "=dword:00000000
    Close all other windows and programs. Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button. Combofix should run and may reboot the computer when it's done. A log will open when it's complete. Post the contents of that log and a fresh HijackThis log.

    Please do not click on the ComboFix window while it is running a scan. This can cause it to stall.
     
    noahdfear,
    #11
  13. 2007/10/29
    wirekid29

    wirekid29 Inactive Thread Starter

    Joined:
    2007/10/22
    Messages:
    12
    Likes Received:
    0
    There are no more error messages, my network and internet are back up. I deactivated the internet for the future. There is still one problem, we cannot change the wall paper. It is still inaccessable and a semi transparent colour.

    Here is the ComboFix Log:

    ComboFix 07-10-29.1 - TMS 2007-10-29 10:49:27.2 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1617 [GMT -5:00]
    Running from: C:\Documents and Settings\TMS\Desktop\ComboFix.exe
    .

    ((((((((((((((((((((((((( Files Created from 2007-09-28 to 2007-10-29 )))))))))))))))))))))))))))))))
    .

    2007-10-29 10:41 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Lavasoft
    2007-10-29 10:41 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\AVG7
    2007-10-29 10:39 2,192 --a------ C:\WINDOWS\system32\tmp.reg
    2007-10-29 10:11 <DIR> d-------- C:\WINDOWS\system32\NtmsData
    2007-10-29 07:56 <DIR> d--h----- C:\WINDOWS\system32\GroupPolicy
    2007-10-29 07:56 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\nView_Profiles
    2007-10-29 07:22 288 --a------ C:\WINDOWS\system32\DVCStateBkp-{00000003-00000000-0000000D-00001102-00000004-10031102}.dat
    2007-10-29 07:22 288 --a------ C:\WINDOWS\system32\DVCState-{00000003-00000000-0000000D-00001102-00000004-10031102}.dat
    2007-10-29 07:12 51,200 --a------ C:\WINDOWS\NirCmd.exe
    2007-10-27 09:39 <DIR> d-------- C:\Deckard
    2007-10-22 09:19 <DIR> d-------- C:\Program Files\Trend Micro
    2007-10-22 07:41 <DIR> d-------- C:\Documents and Settings\TMS\Application Data\AVG7
    2007-10-22 07:41 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\AVG7
    2007-10-22 07:41 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
    2007-10-22 07:41 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg7
    2007-10-15 09:17 <DIR> d-------- C:\Documents and Settings\TMS\Application Data\Lavasoft
    2007-10-15 09:16 <DIR> d-------- C:\Program Files\Lavasoft
    2007-10-15 08:17 <DIR> d-------- C:\Program Files\AVPersonal
    2007-10-13 08:37 8,704 --a------ C:\WINDOWS\system32\sporder.dll
    2007-10-01 11:57 7,552 --a------ C:\WINDOWS\system32\drivers\SONYPVU1.SYS
    2007-10-01 11:57 7,552 --a--c--- C:\WINDOWS\system32\dllcache\sonypvu1.sys

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2007-10-29 13:53 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
    2007-10-29 13:47 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
    2007-10-29 13:37 --------- d-----w C:\Documents and Settings\TMS\Application Data\Apple Computer
    2007-10-29 13:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
    2007-10-29 12:50 --------- d-----w C:\Program Files\Google
    2007-10-15 13:09 --------- d-----w C:\Program Files\DivX
    2007-10-09 19:25 --------- d-----w C:\Program Files\Common Files\Adobe
    2007-09-06 12:17 184,320 ----a-w C:\WINDOWS\system32\xqU3VSNr.dll
    .

    ((((((((((((((((((((((((((((( snapshot@2007-10-29_ 7.15.40.64 )))))))))))))))))))))))))))))))))))))))))
    .
    - 2007-10-29 12:02:11 57,266 ----a-w C:\WINDOWS\system32\perfc009.dat
    + 2007-10-29 13:46:08 57,266 ----a-w C:\WINDOWS\system32\perfc009.dat
    - 2007-10-29 12:02:11 389,354 ----a-w C:\WINDOWS\system32\perfh009.dat
    + 2007-10-29 13:46:08 389,354 ----a-w C:\WINDOWS\system32\perfh009.dat
    - 2006-01-09 14:36:06 40,960 ----a-w C:\WINDOWS\system32\swsc.exe
    + 2006-11-29 22:21:29 370,688 ----a-w C:\WINDOWS\system32\swsc.exe
    - 2006-12-01 10:20:32 79,360 ----a-w C:\WINDOWS\system32\swxcacls.exe
    + 2006-12-01 10:20:32 212,480 ----a-w C:\WINDOWS\system32\swxcacls.exe
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "AsioReg "= "REGSVR32.exe" [2004-08-03 23:56 C:\WINDOWS\system32\regsvr32.exe]
    "NvCplDaemon "= "C:\WINDOWS\system32\NvCpl.dll" [2005-07-13 15:33]
    "nwiz "= "nwiz.exe" [2005-07-13 15:33 C:\WINDOWS\system32\nwiz.exe]
    "NvMediaCenter "= "C:\WINDOWS\system32\NvMcTray.dll" [2005-07-13 15:33]
    "AWMON "= "C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe" [2004-09-16 15:15]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
    "NoSetActiveDesktop "=0 (0x0)

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
    "NoSetActiveDesktop "=0 (0x0)

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs "=sockspy.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk]
    backup=C:\WINDOWS\pss\Adobe Acrobat Speed Launcher.lnkCommon Startup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^InterVideo WinCinema Manager.lnk]
    backup=C:\WINDOWS\pss\InterVideo WinCinema Manager.lnkCommon Startup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 7.0]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDAgent]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDMCon]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitComet]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxioDragToDisc]
    "C:\Program Files\Roxio\Easy Media Creator 8\Drag to Disc\DrgToDsc.exe "

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxWatchTray]
    "C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatchTray.exe "

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "iPod Service "=3 (0x3)
    "RoxWatch "=2 (0x2)
    "RoxUpnpServer "=2 (0x2)
    "RoxUPnPRenderer "=3 (0x3)
    "RoxMediaDB "=3 (0x3)
    "RoxLiveShare "=2 (0x2)
    "ose "=3 (0x3)
    "odserv "=3 (0x3)
    "NVSvc "=2 (0x2)
    "gusvc "=3 (0x3)
    "Autodesk Licensing Service "=3 (0x3)
    "Adobe LM Service "=3 (0x3)
    "WMPNetworkSvc "=3 (0x3)
    "XCOMM "=2 (0x2)
    "VSSERV "=2 (0x2)
    "MDM "=2 (0x2)
    "LIVESRV "=2 (0x2)
    "IDriverT "=3 (0x3)
    "dkab_device "=3 (0x3)
    "bdss "=2 (0x2)

    S2 WmdmPmSNRoxUPnPRenderer;Portable Media Serial Number Service WmdmPmSNRoxUPnPRenderer;C:\WINDOWS\system32\adsndsj.exe srv
    S3 NAL;Nal Service ;\??\C:\WINDOWS\system32\Drivers\iqvw32.sys
    S4 dkab_device;dkab_device;C:\WINDOWS\system32\DKabcoms.exe -service

    *Newly Created Service* - DMADMIN
    *Newly Created Service* - NTMSSVC
    *Newly Created Service* - SYSMONLOG
    .
    **************************************************************************

    catchme 0.3.1239 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2007-10-29 10:50:07
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2007-10-29 10:50:27
    C:\ComboFix2.txt ... 2007-10-29 07:16
    .
    --- E O F ---



    Here is the HijackThis Log:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 10:43:48 AM, on 29/10/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\CTHELPER.EXE
    C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
    C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tmsmolds.com/
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
    O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
    O4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe "
    O4 - HKLM\..\Run: [AWMON] "C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe "
    O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
    O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe "
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AdobeUpdateManager.exe" AcPro7_0_7 -reboot 1
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - (no file)
    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - (no file)
    O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    O23 - Service: Portable Media Serial Number Service WmdmPmSNRoxUPnPRenderer (WmdmPmSNRoxUPnPRenderer) - Unknown owner - C:\WINDOWS\system32\adsndsj.exe (file missing)

    --
    End of file - 4777 bytes
     
    wirekid29,
    #12
  14. 2007/10/29
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    You ran ComboFix twice and posted the second log. Please post the first run log, which is now named C:\ComboFix2.txt
     
    noahdfear,
    #13
  15. 2007/10/30
    wirekid29

    wirekid29 Inactive Thread Starter

    Joined:
    2007/10/22
    Messages:
    12
    Likes Received:
    0
    Resolved!

    Hey noad, thanks for all your help man. My computer is all back to normal now, I found out what was affecting my desktop properties. The virus that attacked my computer changed and locked my wall paper setting in the registry.

    Thanks again for everything, my problem is resolved:)
     
    wirekid29,
    #14
  16. 2007/10/30
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    While you may feel like things are resolved, I can see at least 1 rogue file still remaining on your system in the last log you posted. Recommend you continue to follow up with requested logs. ;)
     
    noahdfear,
    #15

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...