Drive Cleaner Problem

same problem

Hi, I believe that I am having the same problem. I am getting these banners where I won't beable to click my desktop icons as well.

I'm getting something of the sorts as this:

Would you like to install DriveCleaner to check your computer for free?(Recommended)


I downloaded Killbox and CombatFix.

Here is my ComboFix log:

Paul - 06-10-02 20:56:57.62 Service Pack 2
ComboFix 06.09.28 - Running from: "C:\Documents and Settings\TEMP "

(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\Program Files\Common Files\Yazzle1122OinUninstaller.exe
C:\Program Files\Common Files\{8C772AA2-0958-1033-1018-040305130001}

~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

Folders Quarantined:

C:\QooBox\Purity\Documents and Settings\TEMP\My Documents\SMBOLS~1
C:\QooBox\Purity\Documents and Settings\TEMP\My Documents\WNSXS~1
C:\QooBox\Purity\Documents and Settings\TEMP\My Documents\SMBOLS~1\userinit.exe
C:\QooBox\Purity\Documents and Settings\TEMP\My Documents\WNSXS~1\javaw.exe
C:\QooBox\Purity\Documents and Settings\TEMP\My Documents\WNSXS~1\W?nSxS
C:\QooBox\Purity\WINDOWS\SYSTEM32\SMANTE~1


((((((((((((((((((((((((((((((( Files Created from 2006-09-02 to 2006-10-02 ))))))))))))))))))))))))))))))))))


2006-10-02 19:00 967 --a------ C:\WINDOWS\ScUnin.pif
2006-10-02 19:00 94,208 --a------ C:\WINDOWS\ScUnin.exe
2006-10-02 18:00 5,248 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\d347prt.sys
2006-10-02 18:00 155,136 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\d347bus.sys
2006-10-01 10:13 126,976 --a------ C:\WINDOWS\SYSTEM32\jzbeady.dll
2006-09-30 17:09 94,208 --a------ C:\WINDOWS\SYSTEM32\HPZipt12.dll
2006-09-30 17:09 69,632 --a------ C:\WINDOWS\SYSTEM32\HPZipm12.exe
2006-09-30 17:09 61,440 --a------ C:\WINDOWS\SYSTEM32\HPZinw12.exe
2006-09-30 17:09 57,344 --a------ C:\WINDOWS\SYSTEM32\HPZisn12.dll
2006-09-30 17:09 278,584 --a------ C:\WINDOWS\SYSTEM32\HPZidr12.dll
2006-09-30 17:09 204,800 --a------ C:\WINDOWS\SYSTEM32\HPZipr12.dll
2006-09-30 17:05 51,120 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\HPZid412.sys
2006-09-30 17:05 21,744 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\HPZius12.sys
2006-09-30 17:05 16,496 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\HPZipr12.sys
2006-09-30 17:03 98,304 --a------ C:\WINDOWS\SYSTEM32\hpzjsn01.dll
2006-09-30 17:03 606,208 --a------ C:\WINDOWS\SYSTEM32\hpotscl.dll
2006-09-30 17:03 393,216 --a------ C:\WINDOWS\SYSTEM32\hpzcon12.dll
2006-09-30 17:03 278,528 --a------ C:\WINDOWS\SYSTEM32\hpgwiamd.dll
2006-09-30 17:03 274,432 --a------ C:\WINDOWS\SYSTEM32\HPZc3212.dll
2006-09-30 17:03 258,122 --a------ C:\WINDOWS\SYSTEM32\hpovst08.dll
2006-09-30 17:03 196,608 --a------ C:\WINDOWS\SYSTEM32\hpzcoi12.dll
2006-09-30 17:03 139,345 --a------ C:\WINDOWS\SYSTEM32\hpzlnt12.dll
2006-09-30 16:49 31,616 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\usbccgp.sys
2006-09-29 23:32 446,464 --a------ C:\WINDOWS\SYSTEM32\HHActiveX.dll
2006-09-29 23:32 24,576 --a------ C:\WINDOWS\SYSTEM32\msxml3a.dll
2006-09-29 23:31 9,488 --a------ C:\WINDOWS\SYSTEM32\sporder.dll
2006-09-18 00:00 180,224 --a-s---- C:\WINDOWS\SYSTEM32\archlib.dll
2006-09-17 23:54 356,864 C:\WINDOWSTrueCrypt Setup.exe


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2006-10-02 20:57 -------- d-------- C:\Program Files\Common Files
2006-10-02 19:57 -------- d-------- C:\Program Files\SlySoft
2006-10-02 19:57 -------- d-------- C:\Program Files\Mozilla Firefox
2006-10-02 19:56 -------- d-------- C:\Program Files\Lavasoft
2006-10-02 19:56 -------- d-------- C:\Documents and Settings\TEMP\Application Data\Lavasoft
2006-10-02 19:20 -------- d-------- C:\Program Files\Starcraft
2006-10-02 18:00 -------- d-------- C:\Program Files\D-Tools
2006-10-02 17:48 -------- d-------- C:\Program Files\Zone Labs
2006-10-02 17:48 -------- d-------- C:\Program Files\GRETECH
2006-10-02 06:56 0 --a------ C:\AUTOEXEC.BAT
2006-10-02 06:56 -------- d-------- C:\Program Files\Panda Software
2006-10-02 00:27 -------- d-------- C:\Documents and Settings\TEMP\Application Data\Windows Live Safety Center
2006-10-02 00:24 -------- d-------- C:\Program Files\Windows Live Safety Center
2006-10-01 23:15 -------- d--h----- C:\Program Files\InstallShield Installation Information
2006-10-01 23:14 -------- d-------- C:\Program Files\Common Files\Panda Software
2006-10-01 01:04 -------- d-------- C:\Program Files\SpywareBlaster
2006-09-30 17:19 -------- d-------- C:\Program Files\Common Files\Hewlett-Packard
2006-09-30 17:17 -------- d-------- C:\Documents and Settings\TEMP\Application Data\AdobeUM
2006-09-30 17:09 -------- d-------- C:\Program Files\HP
2006-09-30 10:31 -------- d-------- C:\Program Files\X3watch
2006-09-30 10:31 -------- d-------- C:\Program Files\Windows Media Player
2006-09-30 10:31 -------- d-------- C:\Program Files\Messenger
2006-09-30 10:20 -------- d-------- C:\Program Files\Microsoft AntiSpyware
2006-09-30 10:18 -------- d-------- C:\Program Files\Canon
2006-09-30 10:16 -------- d-------- C:\Program Files\Gabest
2006-09-30 10:15 -------- d-------- C:\Program Files\Microsoft ActiveSync
2006-09-30 10:14 -------- d-------- C:\Program Files\Rio
2006-09-30 10:14 -------- d-------- C:\Program Files\Musicmatch
2006-09-30 10:12 -------- d-------- C:\Program Files\hoonnet
2006-09-30 10:11 -------- d-------- C:\Program Files\HiDownload
2006-09-30 10:11 -------- d-------- C:\Program Files\FlashGet
2006-09-30 10:09 -------- d-------- C:\Program Files\Britannica
2006-09-29 23:30 -------- d-------- C:\Program Files\I8kfanGUI
2006-09-24 18:28 -------- d-------- C:\Program Files\Picasa2
2006-09-24 18:01 -------- d---s---- C:\Documents and Settings\TEMP\Application Data\Microsoft
2006-09-24 18:01 -------- d-------- C:\Program Files\Project64 1.6
2006-09-21 23:15 -------- d-------- C:\Program Files\iRiver
2006-09-20 15:26 -------- d-------- C:\Program Files\Comodo
2006-09-20 09:32 -------- d-------- C:\Documents and Settings\TEMP\Application Data\Comodo
2006-09-20 09:10 -------- d-------- C:\Program Files\Common Files\SWF Studio
2006-09-20 09:10 -------- d-------- C:\Program Files\AWS
2006-09-19 20:07 -------- d-------- C:\Documents and Settings\TEMP\Application Data\Tenebril
2006-09-19 20:00 -------- d-------- C:\Program Files\Common Files\iioz
2006-09-17 23:53 -------- d-------- C:\Program Files\CCleaner
2006-09-13 23:46 -------- d-------- C:\Program Files\AIM
2006-09-13 23:46 -------- d-------- C:\Documents and Settings\TEMP\Application Data\Aim
2006-08-21 08:21 16896 --a------ C:\WINDOWS\SYSTEM32\fltlib.dll
2006-08-21 05:14 23040 --a------ C:\WINDOWS\SYSTEM32\fltmc.exe
2006-08-21 05:14 128896 --------- C:\WINDOWS\SYSTEM32\DRIVERS\fltmgr.sys
2006-08-17 18:08 -------- d-------- C:\Documents and Settings\TEMP\Application Data\Sun
2006-08-10 17:26 -------- d-------- C:\Program Files\Internet Explorer
2006-08-07 17:15 -------- d-------- C:\Documents and Settings\TEMP\Application Data\MSN6
2006-07-27 09:24 679424 --a------ C:\WINDOWS\SYSTEM32\inetcomm.dll
2006-07-26 20:19 0 --a------ C:\WINDOWS\SYSTEM32\cmmgr32.exe
2006-07-26 20:19 0 --a------ C:\WINDOWS\ORUN32.EXE
2006-07-26 20:05 0 --a------ C:\Documents and Settings\TEMP\Application Data\internaldb41.dat
2006-07-26 20:02 1064 --a------ C:\WINDOWS\SYSTEM32\flo188b3.sys
2006-07-26 19:57 286 --a------ C:\WINDOWS\SYSTEM32\n.bat
2006-07-26 19:56 0 --a------ C:\WINDOWS\SYSTEM32\taskkill.exe
2006-07-21 04:24 72704 --a------ C:\WINDOWS\SYSTEM32\hlink.dll
2006-07-03 14:42 356864 --a------ C:\WINDOWS\TrueCrypt Setup.exe


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"i8kfangui "= "C:\\Program Files\\I8kfanGUI\\I8kfanGUI.exe /startup "
"MSMSGS "= "\ "C:\\Program Files\\Messenger\\msmsgs.exe\" /background "
"Aida "= "\ "C:\\DOCUME~1\\TEMP\\MYDOCU~1\\WNSXS~1\\javaw.exe\" -vt yazb "
"Sxnooz "= "C:\\Documents and Settings\\TEMP\\My Documents\\s?mbols\\userinit.exe "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"x3watch "= "C:\\Program Files\\X3watch\\x3watch.exe "
"iRiver Updater "= "\\Updater.exe "
"DAEMON Tools-1033 "= "\ "C:\\Program Files\\D-Tools\\daemon.exe\" -lang 1033 "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed "= "1 "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"Installed "= "1 "
"NoChange "= "1 "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed "= "1 "

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components]
"DeskHtmlVersion "=dword:00000110
"DeskHtmlMinorVersion "=dword:00000005
"Settings "=dword:00000001
"GeneralFlags "=dword:00000000

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\0]
"Source "= "C:\\Program Files\\Online Services\\kyzezeroq.html "
"SubscribedURL "=" "
"FriendlyName "=" "
"Flags "=dword:00002000
"Position "=hex:2c,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,00,00,e8,\
03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,14,00,00,00,14,00,00,00
"CurrentState "=dword:40000001
"OriginalStateInfo "=hex:18,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,\
00,00,01,00,00,00
"RestoredStateInfo "=hex:00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\1]
"Source "= "C:\\Program Files\\ComPlus Applications\\howyw.html "
"SubscribedURL "=" "
"FriendlyName "=" "
"Flags "=dword:00002000
"Position "=hex:2c,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,00,00,ea,\
03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,14,00,00,00,14,00,00,00
"CurrentState "=dword:40000001
"OriginalStateInfo "=hex:18,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,\
00,00,01,00,00,00
"RestoredStateInfo "=hex:00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\2]
"Source "= "About:Home "
"SubscribedURL "= "About:Home "
"FriendlyName "= "My Current Home Page "
"Flags "=dword:00000002
"Position "=hex:2c,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e4,02,00,00,ec,\
03,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState "=dword:40000004
"OriginalStateInfo "=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo "=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\
00,00,01,00,00,00

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun "=dword:00000000

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"dontdisplaylastusername "=dword:00000000
"legalnoticecaption "=" "
"legalnoticetext "=" "
"shutdownwithoutlogon "=dword:00000001
"undockwithoutlogon "=dword:00000001

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun "=dword:00000091
"CDRAutoRun "=dword:00000000

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun "=dword:00000091
"CDRAutoRun "=dword:00000000

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"PostBootReminder "= "{7849596a-48ea-486e-8937-a2a3009f31a9} "
"CDBurn "= "{fbeb8a05-beee-4442-804e-409d6c4515e9} "
"WebCheck "= "{E6FB5E20-DE35-11CF-9C87-00AA005127ED} "
"SysTray "= "{35CEC8A3-2BE6-11D2-8773-92E220524153} "

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avldr

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders
securityproviders REG_SZ msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll


Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\McAfee.com Update Check (DBWRW931-Owner).job
C:\WINDOWS\tasks\McAfee.com Update Check (PAUL-Paul).job
C:\WINDOWS\tasks\McAfee.com Update Check (RUNOFF-Paul).job
C:\WINDOWS\tasks\WebReg 20040829142653.job
C:\WINDOWS\tasks\WebReg 20040829142701.job

Completion time: Mon 10/02/2006 20:57:42.58
ComboFix.txt

 

Hi Jetbobo and welcome to the forums.

I have moved your post to it's own thread, because it's very difficult to diagnose two problems at one time. Especially if they may be different.

Downloading ComboFix and Killbox may be a start, but we first need you to run HijackThis! and post a log so we can se a larger picture.

HiJackThis v:1.99.1zip.
DL the zip file to your desktop, then create a new folder on your C drive, called 'HJT' or 'HijackThis'. Then unzip the files to the new folder. When you run HijackThis.exe from C:\HJT folder and have it "Fixed checked" it will create a backup file of modifications to use if restore is necessary which is easily accessible.

Run the program, and press Scan. You will notice the Scan button will turn into a "Save Log" button. Save the log and Post that log onto this topic. DO NOT DELETE or modify anything yet, as some of it is needed to keep your system in proper working order.

Also, please do not perform any other steps which you think need to be done. You've come here for help, let us help you and we'll get things sorted out in the proper order of which they need doing.

We do appreciate your initiative tho.

 

my apologies about the other operations.

I dl HJT and made a new folder, here's the log of it:

Logfile of HijackThis v1.99.1
Scan saved at 9:42:31 PM, on 10/2/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\X3watch\x3watch.exe
C:\Updater.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\I8kfanGUI\I8kfanGUI.exe
C:\Program Files\Messenger\msmsgs.exe
C:\DOCUME~1\TEMP\MYDOCU~1\WNSXS~1\javaw.exe
C:\WINDOWS\system32\cidaemon.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\HJT\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R3 - URLSearchHook: (no name) - {86A5B286-714F-04CE-1402-5FF00BB96EC4} - (no file)
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: (no name) - {9F1490D7-5C19-7599-14F7-75E2EA0727C7} - (no file)
R3 - URLSearchHook: (no name) - {83A5E980-2648-5B9C-1402-5FF00BB86C93} - C:\WINDOWS\system32\jzbeady.dll
F2 - REG:system.ini: UserInit=C:\WINDOWS\SYSTEM32\Userinit.exe,dexfddu.exe
O2 - BHO: (no name) - {0A87E45F-537A-40B4-B812-E2544C21A09F} - (no file)
O2 - BHO: (no name) - {83A5E980-2648-5B9C-1402-5FF00BB86C93} - C:\WINDOWS\system32\jzbeady.dll
O2 - BHO: (no name) - {86A5B286-714F-04CE-1402-5FF00BB96EC4} - (no file)
O2 - BHO: (no name) - {9F1490D7-5C19-7599-14F7-75E2EA0727C7} - (no file)
O4 - HKLM\..\Run: [x3watch] C:\Program Files\X3watch\x3watch.exe
O4 - HKLM\..\Run: [iRiver Updater] \Updater.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [i8kfangui] C:\Program Files\I8kfanGUI\I8kfanGUI.exe /startup
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Aida] "C:\DOCUME~1\TEMP\MYDOCU~1\WNSXS~1\javaw.exe" -vt yazb
O4 - HKCU\..\Run: [Sxnooz] C:\Documents and Settings\TEMP\My Documents\s?mbols\userinit.exe
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.safety.live.com/resource/download/scanner/wlscbase969.cab
O16 - DPF: {8A0DCBDB-6E20-489C-9041-C1E8A0352E75} - http://awbeta.net-nucleus.com/FIX/WinATS.cab
O20 - Winlogon Notify: avldr - avldr.dll (file missing)
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

 

Excellent, thanks for doing as we asked. What you have is a Vundo infection, and while ComboFix finds many files, it does not always delete them, so lets run the VundoFix tool.

Please download VundoFix.exe to your desktop.

• Double-click *VundoFix.exe* to run it.
• Click the *Scan for Vundo* button.
• Once it's done scanning, click the *Remove Vundo* button.
• You will receive a prompt asking if you want to remove the files, click *YES*
• Once you click yes, your desktop will go blank as it starts removing Vundo.
• When completed, it will prompt that it will reboot your computer, click *OK*.
• Please post the contents of C:\*vundofix.txt* and a new HiJackThis log.

Note: It is possible that VundoFix encountered a file it could not remove.
In this case, VundoFix will run on reboot, simply follow the above
instructions starting from "Click the *Scan for Vundo* button." when
VundoFix appears at reboot.

Once Vundo has done its thng you may then run ComboFix, then HJT and give me the 3 logs.

 

okay here are the three new logs:

----------
Scan started at 10:25:58 PM 10/2/2006

Listing files found while scanning....

No infected files were found.


Beginning removal...

VundoFix V6.1.6

Checking Java version...

Java version is 1.5.0.3

Scan started at 10:29:57 PM 10/2/2006

Listing files found while scanning....

No infected files were found.


Beginning removal...



------------
Paul - 06-10-02 22:38:52.25 Service Pack 2
ComboFix 06.09.28 - Running from: "C:\Documents and Settings\TEMP "

(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))



~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

Folders Quarantined:

C:\QooBox\Purity\Documents and Settings\TEMP\My Documents\SMBOLS~1
C:\QooBox\Purity\Documents and Settings\TEMP\My Documents\WNSXS~1
C:\QooBox\Purity\Documents and Settings\TEMP\My Documents\SMBOLS~1\userinit.exe
C:\QooBox\Purity\Documents and Settings\TEMP\My Documents\WNSXS~1\javaw.exe
C:\QooBox\Purity\Documents and Settings\TEMP\My Documents\WNSXS~1\W?nSxS
C:\QooBox\Purity\WINDOWS\SYSTEM32\SMANTE~1


((((((((((((((((((((((((((((((( Files Created from 2006-09-02 to 2006-10-02 ))))))))))))))))))))))))))))))))))


2006-10-02 19:00 967 --a------ C:\WINDOWS\ScUnin.pif
2006-10-02 19:00 94,208 --a------ C:\WINDOWS\ScUnin.exe
2006-10-02 18:00 5,248 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\d347prt.sys
2006-10-02 18:00 155,136 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\d347bus.sys
2006-10-01 10:13 126,976 --a------ C:\WINDOWS\SYSTEM32\jzbeady.dll
2006-09-30 17:09 94,208 --a------ C:\WINDOWS\SYSTEM32\HPZipt12.dll
2006-09-30 17:09 69,632 --a------ C:\WINDOWS\SYSTEM32\HPZipm12.exe
2006-09-30 17:09 61,440 --a------ C:\WINDOWS\SYSTEM32\HPZinw12.exe
2006-09-30 17:09 57,344 --a------ C:\WINDOWS\SYSTEM32\HPZisn12.dll
2006-09-30 17:09 278,584 --a------ C:\WINDOWS\SYSTEM32\HPZidr12.dll
2006-09-30 17:09 204,800 --a------ C:\WINDOWS\SYSTEM32\HPZipr12.dll
2006-09-30 17:05 51,120 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\HPZid412.sys
2006-09-30 17:05 21,744 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\HPZius12.sys
2006-09-30 17:05 16,496 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\HPZipr12.sys
2006-09-30 17:03 98,304 --a------ C:\WINDOWS\SYSTEM32\hpzjsn01.dll
2006-09-30 17:03 606,208 --a------ C:\WINDOWS\SYSTEM32\hpotscl.dll
2006-09-30 17:03 393,216 --a------ C:\WINDOWS\SYSTEM32\hpzcon12.dll
2006-09-30 17:03 278,528 --a------ C:\WINDOWS\SYSTEM32\hpgwiamd.dll
2006-09-30 17:03 274,432 --a------ C:\WINDOWS\SYSTEM32\HPZc3212.dll
2006-09-30 17:03 258,122 --a------ C:\WINDOWS\SYSTEM32\hpovst08.dll
2006-09-30 17:03 196,608 --a------ C:\WINDOWS\SYSTEM32\hpzcoi12.dll
2006-09-30 17:03 139,345 --a------ C:\WINDOWS\SYSTEM32\hpzlnt12.dll
2006-09-30 16:49 31,616 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\usbccgp.sys
2006-09-29 23:32 446,464 --a------ C:\WINDOWS\SYSTEM32\HHActiveX.dll
2006-09-29 23:32 24,576 --a------ C:\WINDOWS\SYSTEM32\msxml3a.dll
2006-09-29 23:31 9,488 --a------ C:\WINDOWS\SYSTEM32\sporder.dll
2006-09-18 00:00 180,224 --a-s---- C:\WINDOWS\SYSTEM32\archlib.dll
2006-09-17 23:54 356,864 C:\WINDOWSTrueCrypt Setup.exe


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2006-10-02 21:37 -------- d-------- C:\Program Files\Mozilla Firefox
2006-10-02 21:23 -------- d-------- C:\Program Files\Starcraft
2006-10-02 20:57 -------- d-------- C:\Program Files\Common Files
2006-10-02 19:57 -------- d-------- C:\Program Files\SlySoft
2006-10-02 19:56 -------- d-------- C:\Program Files\Lavasoft
2006-10-02 19:56 -------- d-------- C:\Documents and Settings\TEMP\Application Data\Lavasoft
2006-10-02 18:00 -------- d-------- C:\Program Files\D-Tools
2006-10-02 17:48 -------- d-------- C:\Program Files\Zone Labs
2006-10-02 17:48 -------- d-------- C:\Program Files\GRETECH
2006-10-02 06:56 0 --a------ C:\AUTOEXEC.BAT
2006-10-02 06:56 -------- d-------- C:\Program Files\Panda Software
2006-10-02 00:27 -------- d-------- C:\Documents and Settings\TEMP\Application Data\Windows Live Safety Center
2006-10-02 00:24 -------- d-------- C:\Program Files\Windows Live Safety Center
2006-10-01 23:15 -------- d--h----- C:\Program Files\InstallShield Installation Information
2006-10-01 23:14 -------- d-------- C:\Program Files\Common Files\Panda Software
2006-10-01 01:04 -------- d-------- C:\Program Files\SpywareBlaster
2006-09-30 17:19 -------- d-------- C:\Program Files\Common Files\Hewlett-Packard
2006-09-30 17:17 -------- d-------- C:\Documents and Settings\TEMP\Application Data\AdobeUM
2006-09-30 17:09 -------- d-------- C:\Program Files\HP
2006-09-30 10:31 -------- d-------- C:\Program Files\X3watch
2006-09-30 10:31 -------- d-------- C:\Program Files\Windows Media Player
2006-09-30 10:31 -------- d-------- C:\Program Files\Messenger
2006-09-30 10:20 -------- d-------- C:\Program Files\Microsoft AntiSpyware
2006-09-30 10:18 -------- d-------- C:\Program Files\Canon
2006-09-30 10:16 -------- d-------- C:\Program Files\Gabest
2006-09-30 10:15 -------- d-------- C:\Program Files\Microsoft ActiveSync
2006-09-30 10:14 -------- d-------- C:\Program Files\Rio
2006-09-30 10:14 -------- d-------- C:\Program Files\Musicmatch
2006-09-30 10:12 -------- d-------- C:\Program Files\hoonnet
2006-09-30 10:11 -------- d-------- C:\Program Files\HiDownload
2006-09-30 10:11 -------- d-------- C:\Program Files\FlashGet
2006-09-30 10:09 -------- d-------- C:\Program Files\Britannica
2006-09-29 23:30 -------- d-------- C:\Program Files\I8kfanGUI
2006-09-24 18:28 -------- d-------- C:\Program Files\Picasa2
2006-09-24 18:01 -------- d---s---- C:\Documents and Settings\TEMP\Application Data\Microsoft
2006-09-24 18:01 -------- d-------- C:\Program Files\Project64 1.6
2006-09-21 23:15 -------- d-------- C:\Program Files\iRiver
2006-09-20 15:26 -------- d-------- C:\Program Files\Comodo
2006-09-20 09:32 -------- d-------- C:\Documents and Settings\TEMP\Application Data\Comodo
2006-09-20 09:10 -------- d-------- C:\Program Files\Common Files\SWF Studio
2006-09-20 09:10 -------- d-------- C:\Program Files\AWS
2006-09-19 20:07 -------- d-------- C:\Documents and Settings\TEMP\Application Data\Tenebril
2006-09-19 20:00 -------- d-------- C:\Program Files\Common Files\iioz
2006-09-17 23:53 -------- d-------- C:\Program Files\CCleaner
2006-09-13 23:46 -------- d-------- C:\Program Files\AIM
2006-09-13 23:46 -------- d-------- C:\Documents and Settings\TEMP\Application Data\Aim
2006-08-21 08:21 16896 --a------ C:\WINDOWS\SYSTEM32\fltlib.dll
2006-08-21 05:14 23040 --a------ C:\WINDOWS\SYSTEM32\fltmc.exe
2006-08-21 05:14 128896 --------- C:\WINDOWS\SYSTEM32\DRIVERS\fltmgr.sys
2006-08-17 18:08 -------- d-------- C:\Documents and Settings\TEMP\Application Data\Sun
2006-08-10 17:26 -------- d-------- C:\Program Files\Internet Explorer
2006-08-07 17:15 -------- d-------- C:\Documents and Settings\TEMP\Application Data\MSN6
2006-07-27 09:24 679424 --a------ C:\WINDOWS\SYSTEM32\inetcomm.dll
2006-07-26 20:19 0 --a------ C:\WINDOWS\SYSTEM32\cmmgr32.exe
2006-07-26 20:19 0 --a------ C:\WINDOWS\ORUN32.EXE
2006-07-26 20:05 0 --a------ C:\Documents and Settings\TEMP\Application Data\internaldb41.dat
2006-07-26 20:02 1064 --a------ C:\WINDOWS\SYSTEM32\flo188b3.sys
2006-07-26 19:57 286 --a------ C:\WINDOWS\SYSTEM32\n.bat
2006-07-26 19:56 0 --a------ C:\WINDOWS\SYSTEM32\taskkill.exe
2006-07-21 04:24 72704 --a------ C:\WINDOWS\SYSTEM32\hlink.dll
2006-07-03 14:42 356864 --a------ C:\WINDOWS\TrueCrypt Setup.exe


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"i8kfangui "= "C:\\Program Files\\I8kfanGUI\\I8kfanGUI.exe /startup "
"MSMSGS "= "\ "C:\\Program Files\\Messenger\\msmsgs.exe\" /background "
"Aida "= "\ "C:\\DOCUME~1\\TEMP\\MYDOCU~1\\WNSXS~1\\javaw.exe\" -vt yazb "
"Sxnooz "= "C:\\Documents and Settings\\TEMP\\My Documents\\s?mbols\\userinit.exe "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"x3watch "= "C:\\Program Files\\X3watch\\x3watch.exe "
"iRiver Updater "= "\\Updater.exe "
"DAEMON Tools-1033 "= "\ "C:\\Program Files\\D-Tools\\daemon.exe\" -lang 1033 "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed "= "1 "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"Installed "= "1 "
"NoChange "= "1 "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed "= "1 "

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components]
"DeskHtmlVersion "=dword:00000110
"DeskHtmlMinorVersion "=dword:00000005
"Settings "=dword:00000001
"GeneralFlags "=dword:00000000

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\0]
"Source "= "C:\\Program Files\\Online Services\\kyzezeroq.html "
"SubscribedURL "=" "
"FriendlyName "=" "
"Flags "=dword:00002000
"Position "=hex:2c,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,00,00,e8,\
03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,14,00,00,00,14,00,00,00
"CurrentState "=dword:40000001
"OriginalStateInfo "=hex:18,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,\
00,00,01,00,00,00
"RestoredStateInfo "=hex:00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\1]
"Source "= "C:\\Program Files\\ComPlus Applications\\howyw.html "
"SubscribedURL "=" "
"FriendlyName "=" "
"Flags "=dword:00002000
"Position "=hex:2c,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,00,00,ea,\
03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,14,00,00,00,14,00,00,00
"CurrentState "=dword:40000001
"OriginalStateInfo "=hex:18,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,\
00,00,01,00,00,00
"RestoredStateInfo "=hex:00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\2]
"Source "= "About:Home "
"SubscribedURL "= "About:Home "
"FriendlyName "= "My Current Home Page "
"Flags "=dword:00000002
"Position "=hex:2c,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e4,02,00,00,ec,\
03,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState "=dword:40000004
"OriginalStateInfo "=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo "=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\
00,00,01,00,00,00

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun "=dword:00000000

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"dontdisplaylastusername "=dword:00000000
"legalnoticecaption "=" "
"legalnoticetext "=" "
"shutdownwithoutlogon "=dword:00000001
"undockwithoutlogon "=dword:00000001

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun "=dword:00000091
"CDRAutoRun "=dword:00000000

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun "=dword:00000091
"CDRAutoRun "=dword:00000000

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"PostBootReminder "= "{7849596a-48ea-486e-8937-a2a3009f31a9} "
"CDBurn "= "{fbeb8a05-beee-4442-804e-409d6c4515e9} "
"WebCheck "= "{E6FB5E20-DE35-11CF-9C87-00AA005127ED} "
"SysTray "= "{35CEC8A3-2BE6-11D2-8773-92E220524153} "

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avldr

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders
securityproviders REG_SZ msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll


Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\McAfee.com Update Check (DBWRW931-Owner).job
C:\WINDOWS\tasks\McAfee.com Update Check (PAUL-Paul).job
C:\WINDOWS\tasks\McAfee.com Update Check (RUNOFF-Paul).job
C:\WINDOWS\tasks\WebReg 20040829142653.job
C:\WINDOWS\tasks\WebReg 20040829142701.job

Completion time: Mon 10/02/2006 22:39:28.22
ComboFix.txt
ComboFix2.txt

-------------

Logfile of HijackThis v1.99.1
Scan saved at 10:37:43 PM, on 10/2/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\X3watch\x3watch.exe
C:\Updater.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\I8kfanGUI\I8kfanGUI.exe
C:\Program Files\Messenger\msmsgs.exe
C:\DOCUME~1\TEMP\MYDOCU~1\WNSXS~1\javaw.exe
C:\WINDOWS\system32\cidaemon.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\HJT\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R3 - URLSearchHook: (no name) - {86A5B286-714F-04CE-1402-5FF00BB96EC4} - (no file)
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: (no name) - {9F1490D7-5C19-7599-14F7-75E2EA0727C7} - (no file)
R3 - URLSearchHook: (no name) - {83A5E980-2648-5B9C-1402-5FF00BB86C93} - C:\WINDOWS\system32\jzbeady.dll
F2 - REG:system.ini: UserInit=C:\WINDOWS\SYSTEM32\Userinit.exe,dexfddu.exe
O2 - BHO: (no name) - {0A87E45F-537A-40B4-B812-E2544C21A09F} - (no file)
O2 - BHO: (no name) - {83A5E980-2648-5B9C-1402-5FF00BB86C93} - C:\WINDOWS\system32\jzbeady.dll
O2 - BHO: (no name) - {86A5B286-714F-04CE-1402-5FF00BB96EC4} - (no file)
O2 - BHO: (no name) - {9F1490D7-5C19-7599-14F7-75E2EA0727C7} - (no file)
O4 - HKLM\..\Run: [x3watch] C:\Program Files\X3watch\x3watch.exe
O4 - HKLM\..\Run: [iRiver Updater] \Updater.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [i8kfangui] C:\Program Files\I8kfanGUI\I8kfanGUI.exe /startup
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Aida] "C:\DOCUME~1\TEMP\MYDOCU~1\WNSXS~1\javaw.exe" -vt yazb
O4 - HKCU\..\Run: [Sxnooz] C:\Documents and Settings\TEMP\My Documents\s?mbols\userinit.exe
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.safety.live.com/resource/download/scanner/wlscbase969.cab
O16 - DPF: {8A0DCBDB-6E20-489C-9041-C1E8A0352E75} - http://awbeta.net-nucleus.com/FIX/WinATS.cab
O20 - Winlogon Notify: avldr - avldr.dll (file missing)
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

 

I meant to mention this before, but the log from HJT is awfully short, was it made in safe mode? If so please generate a fresh one in normal mode, so we can see all that starts up.

Sorry about that.

 

I believe I did a HJT log in normal mode, but I'll reboot and try it again. Thanks

 

okay here is the new HJT log:

Logfile of HijackThis v1.99.1
Scan saved at 11:30:40 PM, on 10/2/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\X3watch\x3watch.exe
C:\Updater.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\I8kfanGUI\I8kfanGUI.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\wuauclt.exe
C:\HJT\HijackThis.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R3 - URLSearchHook: (no name) - {86A5B286-714F-04CE-1402-5FF00BB96EC4} - (no file)
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: (no name) - {9F1490D7-5C19-7599-14F7-75E2EA0727C7} - (no file)
R3 - URLSearchHook: (no name) - {83A5E980-2648-5B9C-1402-5FF00BB86C93} - C:\WINDOWS\system32\jzbeady.dll
F2 - REG:system.ini: UserInit=C:\WINDOWS\SYSTEM32\Userinit.exe,dexfddu.exe
O2 - BHO: (no name) - {0A87E45F-537A-40B4-B812-E2544C21A09F} - (no file)
O2 - BHO: (no name) - {83A5E980-2648-5B9C-1402-5FF00BB86C93} - C:\WINDOWS\system32\jzbeady.dll
O2 - BHO: (no name) - {86A5B286-714F-04CE-1402-5FF00BB96EC4} - (no file)
O2 - BHO: (no name) - {9F1490D7-5C19-7599-14F7-75E2EA0727C7} - (no file)
O4 - HKLM\..\Run: [x3watch] C:\Program Files\X3watch\x3watch.exe
O4 - HKLM\..\Run: [iRiver Updater] \Updater.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [i8kfangui] C:\Program Files\I8kfanGUI\I8kfanGUI.exe /startup
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Aida] "C:\DOCUME~1\TEMP\MYDOCU~1\WNSXS~1\javaw.exe" -vt yazb
O4 - HKCU\..\Run: [Sxnooz] C:\Documents and Settings\TEMP\My Documents\s?mbols\userinit.exe
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.safety.live.com/resource/download/scanner/wlscbase969.cab
O16 - DPF: {8A0DCBDB-6E20-489C-9041-C1E8A0352E75} - http://awbeta.net-nucleus.com/FIX/WinATS.cab
O20 - Winlogon Notify: avldr - avldr.dll (file missing)
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

 

OK, well I guess you have a very trim machine with not much runnig, which is a good thing.

Ok, the Vundo tool didn't find anything, but it also appears that ComboFix nuetered QooLogic. Lets proceed with fixing.

Below you will find my results and recommendations. Please read ALL instructions carefully BEFORE proceeding.


Please hit Hit 'Ctrl' + 'Alt' + 'Delete' to bring up running processes and 'End Task' on the following process(es) if present:
C:\DOCUME~1\TEMP\MYDOCU~1\WNSXS~1\javaw.exe


Run Hijackthis and look over the following entries I have listed, check the boxes next to them and press the "Fix Checked" button with HijackThis. When you are doing this, make sure you have No IE windows, or other browsers open, including this one. Reboot if I have specified below, and post a fresh HijackThis log.


R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

R3 - URLSearchHook: (no name) - {86A5B286-714F-04CE-1402-5FF00BB96EC4} - (no file)

R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)

R3 - URLSearchHook: (no name) - {9F1490D7-5C19-7599-14F7-75E2EA0727C7} - (no file)

R3 - URLSearchHook: (no name) - {83A5E980-2648-5B9C-1402-5FF00BB86C93} - C:\WINDOWS\system32\jzbeady.dll

F2 - REG:system.ini: UserInit=C:\WINDOWS\SYSTEM32\Userinit.exe,dexfddu. exe


O2 - BHO: (no name) - {0A87E45F-537A-40B4-B812-E2544C21A09F} - (no file)

O2 - BHO: (no name) - {83A5E980-2648-5B9C-1402-5FF00BB86C93} - C:\WINDOWS\system32\jzbeady.dll

O2 - BHO: (no name) - {86A5B286-714F-04CE-1402-5FF00BB96EC4} - (no file)

O2 - BHO: (no name) - {9F1490D7-5C19-7599-14F7-75E2EA0727C7} - (no file)


O4 - HKCU\..\Run: [Aida] "C:\DOCUME~1\TEMP\MYDOCU~1\WNSXS~1\javaw.exe" -vt yazb

O4 - HKCU\..\Run: [Sxnooz] C:\Documents and Settings\TEMP\My Documents\s?mbols\userinit.exe

Reboot, into safe mode, this way:
Turn on the computer
Immediately begin tapping the <F8> key.
Use the arrow keys to highlight Safe Mode and press the <Enter> key.

Also, enable the 'Show Hidden Folders' option, like this:
Click Start.
Open My Computer.
Select the Tools menu and click Folder Options.
Select the View Tab. Under the Hidden files and folders heading select Show hidden files and folders.
Uncheck the Hide protected operating system files (recommended) option.
Click Yes to confirm.
Click OK.

And search for, then delete, if found, (some may not be present after previous steps) the following files/folders:
C:\WINDOWS\system32\jzbeady.dll<<<--this file
dexfddu. exe<<<--this file


To exit Safe Mode, click the Start button, click Turn Off Computer, click Restart.

Post a new HJT log back into this thread please.

 

okay here is the new HJT log:

Logfile of HijackThis v1.99.1
Scan saved at 7:19:37 PM, on 10/3/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\X3watch\x3watch.exe
C:\Updater.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\I8kfanGUI\I8kfanGUI.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\HJT\HijackThis.exe

O4 - HKLM\..\Run: [x3watch] C:\Program Files\X3watch\x3watch.exe
O4 - HKLM\..\Run: [iRiver Updater] \Updater.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [i8kfangui] C:\Program Files\I8kfanGUI\I8kfanGUI.exe /startup
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.safety.live.com/resource/download/scanner/wlscbase969.cab
O16 - DPF: {8A0DCBDB-6E20-489C-9041-C1E8A0352E75} - http://awbeta.net-nucleus.com/FIX/WinATS.cab
O20 - Winlogon Notify: avldr - avldr.dll (file missing)
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

 

Everything looks good, are you experiencing any more odd behaviour on the machine? Let us know.

We have 3 more things to do, to help ensure you have removed all the little 'leftovers' which may be hiding:

Empty the TIF (Temporary Internet Files)
Delete all the files in (and any subfolders of) the C:\Windows\Temp folder
The app below will help with temp files.
Index.dat Suite

Also, delete all your cookies, and empty your recycle bin. But remember, by deleting your cookies, you will have to re-enter any passwords and log-in info for any sites you are usually required to do so with.

This would also be a good time to set a new system restore point for your machine.
Set New System Restore Point. Do not do this unless there are no other user accounts to be diagnosed.

Also, as you are an XP user, if there are any other accounts on this machine, they too, must be cleaned with AdAware, Spybot S&D, then HJT. Not all infections are global, nor are all the HJT fixes global. You can post each user account here into this thread, but please, do only one at a time to avoid confusion.

Here is a link which describes how security apps work with WIN XP machines.
XP User Accts Security Apps Operation

To further prevent the installation of ad/mal/spyware, DL the apps below, which are just as good the fight against ad/mal/spyware as AdAware & Spybot S&D:

SpywareBlaster
With SpywareBlaster v3.5.1 , just DL, install and check for updates, enable Internet Explorer protection, and your done! I don't recommend using IE restricted sites protection as it's not a very large database. Use IE-SPYADs below.

To avoid known malware infested sites from loading in IE install IESPY ADS.
And MVPS Hosts File will accomplish a similar tactic and provide another layer of protection.

And to prevent unknown applications from being inserted to start up on your machine install WinPatrol v10.0.1.

Another thing I would suggest, is to install SiteAdvisor. It gives sites a few different 'ratings' and while not fool proof, a good additional layer of information about many sites.

Links for tutorials for all the apps I mentioned can be found on my site as well.

Confused about which apps are good or not? Read about Rogue/Approved Anti Security apps

And just because you have security apps installed, they are useless unless updated regularly. Keep track of updates for ALL your security needs here:
Calendar of Updates

Subscribe to update alerts for all the above security apps here.

You can also see my own ongoing security testing with all the above apps proving how securely you can safe with them installed.
TeMerc Test Box Forum

Happy surfing!!
Tom

 

Thank you so much for all your help! It looks like the banner isn't showing up anymore. I dl the links you provided! Thank you!

Oh one more thing. I got a free subscription to Panda 2006 for one whole year and also I have a zonealarm setup. Is it good to dl both of these onto my computer? I had both up awhile back and a few other spyware programs like AVG7 and spycatcher but for some reason somewhere I tried to get on the internet, but my internet was blocking. So I ended up uninstalling a lot of the programs and my internet worked again. So I guess I was just wondering if those two were okay to dl. Thanks again!

 

This all depends on what versions of the software you were running. You cannot run two anti-virus apps at once, they will conflict with one another. Not so with anti-spyware apps tho. You can run a couple, tho if both have a 'real time' monitor, they could cause a problem, depending on your system.

I ran several at once for a while with no troubles, other than multiple alerts whenever I made changes.

If you install some of the apps I listed above, you would really only need one of the real time apps, along with av and firewall. And same goes with firewalls, only one at a time, and be sure the Windows XP firewall is off.

 

Hi. The drive cleaner problem is coming back up again

 

Ok, lets see where it's running from, give me a new ComboFix log please and also give me a start up list from HJT.

Open HJT, click the 'None of the above, just start the program' button.
Then click the 'Config' button in the lower right hand of the program.
Then select the 'Misc Tools' button.
In the upper left hand side of the program tick the two boxes 'List also minor sections (full)' button and the 'List empty sections (complete)' button and select 'Yes' when promted by the dialog box. The resultant scan will produce a notepad log file, please paste that log file back here for me to review.

 

Paul - 06-10-04 22:20:45.10 Service Pack 2
ComboFix 06.09.28 - Running from: "C:\Documents and Settings\TEMP\Desktop\Setup "

(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))



~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

Folders Quarantined:

C:\QooBox\Purity\Documents and Settings\TEMP\My Documents\SMBOLS~1
C:\QooBox\Purity\Documents and Settings\TEMP\My Documents\WNSXS~1
C:\QooBox\Purity\Documents and Settings\TEMP\My Documents\SMBOLS~1\userinit.exe
C:\QooBox\Purity\Documents and Settings\TEMP\My Documents\WNSXS~1\javaw.exe
C:\QooBox\Purity\Documents and Settings\TEMP\My Documents\WNSXS~1\W?nSxS
C:\QooBox\Purity\WINDOWS\SYSTEM32\SMANTE~1


((((((((((((((((((((((((((((((( Files Created from 2006-09-04 to 2006-10-04 ))))))))))))))))))))))))))))))))))


2006-10-02 19:00 967 --a------ C:\WINDOWS\ScUnin.pif
2006-10-02 19:00 94,208 --a------ C:\WINDOWS\ScUnin.exe
2006-10-02 18:00 5,248 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\d347prt.sys
2006-10-02 18:00 155,136 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\d347bus.sys
2006-09-30 17:09 94,208 --a------ C:\WINDOWS\SYSTEM32\HPZipt12.dll
2006-09-30 17:09 69,632 --a------ C:\WINDOWS\SYSTEM32\HPZipm12.exe
2006-09-30 17:09 61,440 --a------ C:\WINDOWS\SYSTEM32\HPZinw12.exe
2006-09-30 17:09 57,344 --a------ C:\WINDOWS\SYSTEM32\HPZisn12.dll
2006-09-30 17:09 278,584 --a------ C:\WINDOWS\SYSTEM32\HPZidr12.dll
2006-09-30 17:09 204,800 --a------ C:\WINDOWS\SYSTEM32\HPZipr12.dll
2006-09-30 17:05 51,120 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\HPZid412.sys
2006-09-30 17:05 21,744 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\HPZius12.sys
2006-09-30 17:05 16,496 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\HPZipr12.sys
2006-09-30 17:03 98,304 --a------ C:\WINDOWS\SYSTEM32\hpzjsn01.dll
2006-09-30 17:03 606,208 --a------ C:\WINDOWS\SYSTEM32\hpotscl.dll
2006-09-30 17:03 393,216 --a------ C:\WINDOWS\SYSTEM32\hpzcon12.dll
2006-09-30 17:03 278,528 --a------ C:\WINDOWS\SYSTEM32\hpgwiamd.dll
2006-09-30 17:03 274,432 --a------ C:\WINDOWS\SYSTEM32\HPZc3212.dll
2006-09-30 17:03 258,122 --a------ C:\WINDOWS\SYSTEM32\hpovst08.dll
2006-09-30 17:03 196,608 --a------ C:\WINDOWS\SYSTEM32\hpzcoi12.dll
2006-09-30 17:03 139,345 --a------ C:\WINDOWS\SYSTEM32\hpzlnt12.dll
2006-09-30 16:49 31,616 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\usbccgp.sys
2006-09-29 23:32 446,464 --a------ C:\WINDOWS\SYSTEM32\HHActiveX.dll
2006-09-29 23:32 24,576 --a------ C:\WINDOWS\SYSTEM32\msxml3a.dll
2006-09-29 23:31 9,488 --a------ C:\WINDOWS\SYSTEM32\sporder.dll
2006-09-18 00:00 180,224 --a-s---- C:\WINDOWS\SYSTEM32\archlib.dll
2006-09-17 23:54 356,864 C:\WINDOWSTrueCrypt Setup.exe


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2006-10-04 22:12 -------- d-------- C:\Program Files\Mozilla Firefox
2006-10-03 23:00 -------- d-------- C:\Program Files\BillP Studios
2006-10-03 23:00 -------- d-------- C:\Documents and Settings\TEMP\Application Data\WinPatrol
2006-10-02 22:57 -------- d-------- C:\Program Files\Starcraft
2006-10-02 20:57 -------- d-------- C:\Program Files\Common Files
2006-10-02 19:57 -------- d-------- C:\Program Files\SlySoft
2006-10-02 19:56 -------- d-------- C:\Program Files\Lavasoft
2006-10-02 19:56 -------- d-------- C:\Documents and Settings\TEMP\Application Data\Lavasoft
2006-10-02 18:00 -------- d-------- C:\Program Files\D-Tools
2006-10-02 17:48 -------- d-------- C:\Program Files\Zone Labs
2006-10-02 17:48 -------- d-------- C:\Program Files\GRETECH
2006-10-02 06:56 0 --a------ C:\AUTOEXEC.BAT
2006-10-02 06:56 -------- d-------- C:\Program Files\Panda Software
2006-10-02 00:27 -------- d-------- C:\Documents and Settings\TEMP\Application Data\Windows Live Safety Center
2006-10-02 00:24 -------- d-------- C:\Program Files\Windows Live Safety Center
2006-10-01 23:15 -------- d--h----- C:\Program Files\InstallShield Installation Information
2006-10-01 23:14 -------- d-------- C:\Program Files\Common Files\Panda Software
2006-10-01 01:04 -------- d-------- C:\Program Files\SpywareBlaster
2006-09-30 17:19 -------- d-------- C:\Program Files\Common Files\Hewlett-Packard
2006-09-30 17:17 -------- d-------- C:\Documents and Settings\TEMP\Application Data\AdobeUM
2006-09-30 17:09 -------- d-------- C:\Program Files\HP
2006-09-30 10:31 -------- d-------- C:\Program Files\X3watch
2006-09-30 10:31 -------- d-------- C:\Program Files\Windows Media Player
2006-09-30 10:31 -------- d-------- C:\Program Files\Messenger
2006-09-30 10:20 -------- d-------- C:\Program Files\Microsoft AntiSpyware
2006-09-30 10:18 -------- d-------- C:\Program Files\Canon
2006-09-30 10:16 -------- d-------- C:\Program Files\Gabest
2006-09-30 10:15 -------- d-------- C:\Program Files\Microsoft ActiveSync
2006-09-30 10:14 -------- d-------- C:\Program Files\Rio
2006-09-30 10:14 -------- d-------- C:\Program Files\Musicmatch
2006-09-30 10:12 -------- d-------- C:\Program Files\hoonnet
2006-09-30 10:11 -------- d-------- C:\Program Files\HiDownload
2006-09-30 10:11 -------- d-------- C:\Program Files\FlashGet
2006-09-30 10:09 -------- d-------- C:\Program Files\Britannica
2006-09-29 23:30 -------- d-------- C:\Program Files\I8kfanGUI
2006-09-24 18:28 -------- d-------- C:\Program Files\Picasa2
2006-09-24 18:01 -------- d---s---- C:\Documents and Settings\TEMP\Application Data\Microsoft
2006-09-24 18:01 -------- d-------- C:\Program Files\Project64 1.6
2006-09-21 23:15 -------- d-------- C:\Program Files\iRiver
2006-09-20 15:26 -------- d-------- C:\Program Files\Comodo
2006-09-20 09:32 -------- d-------- C:\Documents and Settings\TEMP\Application Data\Comodo
2006-09-20 09:10 -------- d-------- C:\Program Files\Common Files\SWF Studio
2006-09-20 09:10 -------- d-------- C:\Program Files\AWS
2006-09-19 20:07 -------- d-------- C:\Documents and Settings\TEMP\Application Data\Tenebril
2006-09-19 20:00 -------- d-------- C:\Program Files\Common Files\iioz
2006-09-17 23:53 -------- d-------- C:\Program Files\CCleaner
2006-09-13 23:46 -------- d-------- C:\Program Files\AIM
2006-09-13 23:46 -------- d-------- C:\Documents and Settings\TEMP\Application Data\Aim
2006-08-21 08:21 16896 --a------ C:\WINDOWS\SYSTEM32\fltlib.dll
2006-08-21 05:14 23040 --a------ C:\WINDOWS\SYSTEM32\fltmc.exe
2006-08-21 05:14 128896 --------- C:\WINDOWS\SYSTEM32\DRIVERS\fltmgr.sys
2006-08-17 18:08 -------- d-------- C:\Documents and Settings\TEMP\Application Data\Sun
2006-08-10 17:26 -------- d-------- C:\Program Files\Internet Explorer
2006-08-07 17:15 -------- d-------- C:\Documents and Settings\TEMP\Application Data\MSN6
2006-07-27 09:24 679424 --a------ C:\WINDOWS\SYSTEM32\inetcomm.dll
2006-07-26 20:19 0 --a------ C:\WINDOWS\SYSTEM32\cmmgr32.exe
2006-07-26 20:19 0 --a------ C:\WINDOWS\ORUN32.EXE
2006-07-26 20:05 0 --a------ C:\Documents and Settings\TEMP\Application Data\internaldb41.dat
2006-07-26 20:02 1064 --a------ C:\WINDOWS\SYSTEM32\flo188b3.sys
2006-07-26 19:57 286 --a------ C:\WINDOWS\SYSTEM32\n.bat
2006-07-26 19:56 0 --a------ C:\WINDOWS\SYSTEM32\taskkill.exe
2006-07-21 04:24 72704 --a------ C:\WINDOWS\SYSTEM32\hlink.dll


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"i8kfangui "= "C:\\Program Files\\I8kfanGUI\\I8kfanGUI.exe /startup "
"MSMSGS "= "\ "C:\\Program Files\\Messenger\\msmsgs.exe\" /background "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"x3watch "= "C:\\Program Files\\X3watch\\x3watch.exe "
"iRiver Updater "= "\\Updater.exe "
"DAEMON Tools-1033 "= "\ "C:\\Program Files\\D-Tools\\daemon.exe\" -lang 1033 "
"WinPatrol "= "C:\\PROGRA~1\\BILLPS~1\\WINPAT~1\\winpatrol.exe "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed "= "1 "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"Installed "= "1 "
"NoChange "= "1 "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed "= "1 "

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components]
"DeskHtmlVersion "=dword:00000110
"DeskHtmlMinorVersion "=dword:00000005
"Settings "=dword:00000001
"GeneralFlags "=dword:00000000

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\0]
"Source "= "C:\\Program Files\\Online Services\\kyzezeroq.html "
"SubscribedURL "=" "
"FriendlyName "=" "
"Flags "=dword:00002000
"Position "=hex:2c,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,00,00,e8,\
03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,14,00,00,00,14,00,00,00
"CurrentState "=hex:01,00,00,40
"OriginalStateInfo "=hex:18,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,\
00,00,01,00,00,00
"RestoredStateInfo "=hex:00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\1]
"Source "= "C:\\Program Files\\ComPlus Applications\\howyw.html "
"SubscribedURL "=" "
"FriendlyName "=" "
"Flags "=dword:00002000
"Position "=hex:2c,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,00,00,ea,\
03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,14,00,00,00,14,00,00,00
"CurrentState "=hex:01,00,00,40
"OriginalStateInfo "=hex:18,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,\
00,00,01,00,00,00
"RestoredStateInfo "=hex:00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\2]
"Source "= "About:Home "
"SubscribedURL "= "About:Home "
"FriendlyName "= "My Current Home Page "
"Flags "=dword:00000002
"Position "=hex:2c,00,00,00,4e,00,00,00,00,00,00,00,b2,03,00,00,e4,02,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState "=hex:04,00,00,40
"OriginalStateInfo "=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo "=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\
00,00,01,00,00,00

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun "=dword:00000000

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"dontdisplaylastusername "=dword:00000000
"legalnoticecaption "=" "
"legalnoticetext "=" "
"shutdownwithoutlogon "=dword:00000001
"undockwithoutlogon "=dword:00000001

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun "=dword:00000091
"CDRAutoRun "=dword:00000000

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun "=dword:00000091
"CDRAutoRun "=dword:00000000

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"PostBootReminder "= "{7849596a-48ea-486e-8937-a2a3009f31a9} "
"CDBurn "= "{fbeb8a05-beee-4442-804e-409d6c4515e9} "
"WebCheck "= "{E6FB5E20-DE35-11CF-9C87-00AA005127ED} "
"SysTray "= "{35CEC8A3-2BE6-11D2-8773-92E220524153} "

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avldr

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders
securityproviders REG_SZ msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll


Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\McAfee.com Update Check (DBWRW931-Owner).job
C:\WINDOWS\tasks\McAfee.com Update Check (PAUL-Paul).job
C:\WINDOWS\tasks\McAfee.com Update Check (RUNOFF-Paul).job
C:\WINDOWS\tasks\WebReg 20040829142653.job
C:\WINDOWS\tasks\WebReg 20040829142701.job

Completion time: Wed 10/04/2006 22:21:33.44
ComboFix.txt
ComboFix2.txt
ComboFix3.txt

 

HJT log:

StartupList report, 10/4/2006, 10:24:12 PM
StartupList version: 1.52.2
Started from : C:\HJT\HijackThis.EXE
Detected: Windows XP SP2 (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 SP2 (6.00.2900.2180)
* Using default options
* Including empty and uninteresting sections
* Showing rarely important sections
==================================================

Running processes:

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\X3watch\x3watch.exe
C:\Updater.exe
C:\Program Files\D-Tools\daemon.exe
C:\PROGRA~1\BILLPS~1\WINPAT~1\winpatrol.exe
C:\Program Files\I8kfanGUI\I8kfanGUI.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\HJT\HijackThis.exe

--------------------------------------------------

Listing of startup folders:

Shell folders Startup:
[C:\Documents and Settings\TEMP\Start Menu\Programs\Startup]
*No files*

Shell folders AltStartup:
*Folder not found*

User shell folders Startup:
*Folder not found*

User shell folders AltStartup:
*Folder not found*

Shell folders Common Startup:
[C:\Documents and Settings\All Users\Start Menu\Programs\Startup]
*No files*

Shell folders Common AltStartup:
*Folder not found*

User shell folders Common Startup:
*Folder not found*

User shell folders Alternate Common Startup:
*Folder not found*

--------------------------------------------------

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\SYSTEM32\Userinit.exe,

[HKLM\Software\Microsoft\Windows\CurrentVersion\Winlogon]
*Registry key not found*

[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
*Registry value not found*

[HKCU\Software\Microsoft\Windows\CurrentVersion\Winlogon]
*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

x3watch = C:\Program Files\X3watch\x3watch.exe
iRiver Updater = \Updater.exe
DAEMON Tools-1033 = "C:\Program Files\D-Tools\daemon.exe" -lang 1033
WinPatrol = C:\PROGRA~1\BILLPS~1\WINPAT~1\winpatrol.exe

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

i8kfangui = C:\Program Files\I8kfanGUI\I8kfanGUI.exe /startup
MSMSGS = "C:\Program Files\Messenger\msmsgs.exe" /background

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run

*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

[OptionalComponents]
*No values found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run
*Registry key not found*

--------------------------------------------------

File association entry for .EXE:
HKEY_CLASSES_ROOT\exefile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .COM:
HKEY_CLASSES_ROOT\comfile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .BAT:
HKEY_CLASSES_ROOT\batfile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .PIF:
HKEY_CLASSES_ROOT\piffile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .SCR:
HKEY_CLASSES_ROOT\scrfile\shell\open\command

(Default) = "%1" /S

--------------------------------------------------

File association entry for .HTA:
HKEY_CLASSES_ROOT\htafile\shell\open\command

(Default) = C:\WINDOWS\System32\mshta.exe "%1" %*

--------------------------------------------------

File association entry for .TXT:
HKEY_CLASSES_ROOT\txtfile\shell\open\command

(Default) = %SystemRoot%\system32\NOTEPAD.EXE %1

--------------------------------------------------

Enumerating Active Setup stub paths:
HKLM\Software\Microsoft\Active Setup\Installed Components
(* = disabled by HKCU twin)

[>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
StubPath = C:\WINDOWS\inf\unregmp2.exe /ShowWMP

[>{26923b43-4d38-484f-9b9e-de460746276c}] *
StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE

[>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS] *
StubPath = RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP

[>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] *
StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

[{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] *
StubPath = %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

[{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] *
StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install

[{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT

[{4b218e3e-bc98-4770-93d3-2731b9329278}] *
StubPath = %SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection MarketplaceLinkInstall 896 %systemroot%\inf\ie.inf

[{5945c046-1e7d-11d1-bc44-00c04fd912be}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser

[{6BF52A52-394A-11d3-B153-00C04F79FAA6}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp10.inf,PerUserStub

[{7790769C-0471-11d2-AF11-00C04FA35D02}] *
StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install

[{89820200-ECBD-11cf-8B85-00AA005B4340}] *
StubPath = regsvr32.exe /s /n /i:U shell32.dll

[{89820200-ECBD-11cf-8B85-00AA005B4383}] *
StubPath = %SystemRoot%\system32\ie4uinit.exe

[{89B4C1CD-B018-4511-B0A1-5476DBF70820}] *
StubPath = C:\WINDOWS\System32\Rundll32.exe C:\WINDOWS\System32\mscories.dll,Install

--------------------------------------------------

Enumerating ICQ Agent Autostart apps:
HKCU\Software\Mirabilis\ICQ\Agent\Apps

*Registry key not found*

--------------------------------------------------

Load/Run keys from C:\WINDOWS\WIN.INI:

load=*INI section not found*
run=*INI section not found*

Load/Run keys from Registry:

HKLM\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKLM\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKLM\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKCU\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKCU\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\Windows: load=
HKCU\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs=

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=none
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry value not found*
HKLM\..\Policies: Shell=*Registry value not found*

--------------------------------------------------

Checking for EXPLORER.EXE instances:

C:\WINDOWS\Explorer.exe: PRESENT!

C:\Explorer.exe: not present
C:\WINDOWS\Explorer\Explorer.exe: not present
C:\WINDOWS\System\Explorer.exe: not present
C:\WINDOWS\System32\Explorer.exe: not present
C:\WINDOWS\Command\Explorer.exe: not present
C:\WINDOWS\Fonts\Explorer.exe: not present

--------------------------------------------------

Checking for superhidden extensions:

.lnk: HIDDEN! (arrow overlay: yes)
.pif: HIDDEN! (arrow overlay: yes)
.exe: not hidden
.com: not hidden
.bat: not hidden
.hta: not hidden
.scr: not hidden
.shs: HIDDEN!
.shb: HIDDEN!
.vbs: not hidden
.vbe: not hidden
.wsh: not hidden
.scf: HIDDEN! (arrow overlay: NO!)
.url: HIDDEN! (arrow overlay: yes)
.js: not hidden
.jse: not hidden

--------------------------------------------------

Verifying REGEDIT.EXE integrity:

- Regedit.exe found in C:\WINDOWS
- .reg open command is normal (regedit.exe %1)
- Company name OK: 'Microsoft Corporation'
- Original filename OK: 'REGEDIT.EXE'
- File description: 'Registry Editor'

Registry check passed

--------------------------------------------------

Enumerating Browser Helper Objects:

*No BHO's found*

--------------------------------------------------

Enumerating Task Scheduler jobs:

McAfee.com Update Check (DBWRW931-Owner).job
McAfee.com Update Check (PAUL-Paul).job
McAfee.com Update Check (RUNOFF-Paul).job
WebReg 20040829142653.job
WebReg 20040829142701.job

--------------------------------------------------

 

Enumerating Download Program Files:

[DirectAnimation Java Classes]
CODEBASE = file://C:\WINDOWS\Java\classes\dajava.cab
OSD = C:\WINDOWS\Downloaded Program Files\DirectAnimation Java Classes.osd

[Microsoft XML Parser for Java]
CODEBASE = file://C:\WINDOWS\Java\classes\xmldso.cab
OSD = C:\WINDOWS\Downloaded Program Files\Microsoft XML Parser for Java.osd

[{00000055-0000-0010-8000-00AA00389B71}]
CODEBASE = http://codecs.microsoft.com/codecs/i386/fhgax.CAB

[{00000055-9980-0010-8000-00AA00389B71}]
CODEBASE = http://codecs.microsoft.com/codecs/i386/fhg.CAB

[{00000161-9980-0010-8000-00AA00389B71}]
CODEBASE = http://codecs.microsoft.com/codecs/i386/msaud.cab

[{02BF25D5-8C17-4B23-BC80-D3488ABDDC6B}]
CODEBASE = http://www.apple.com/qtactivex/qtplugin.cab

[{33564D57-9980-0010-8000-00AA00389B71}]
CODEBASE = http://codecs.microsoft.com/codecs/i386/wmv9dmo.cab

[Windows Live Safety Center Base Module]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\wlscBase.dll
CODEBASE = http://cdn.scan.safety.live.com/resource/download/scanner/wlscbase969.cab

[{8A0DCBDB-6E20-489C-9041-C1E8A0352E75}]
CODEBASE = http://awbeta.net-nucleus.com/FIX/WinATS.cab

[Java Plug-in 1.5.0_03]
InProcServer32 = C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll
CODEBASE = http://java.sun.com/update/1.5.0/jinstall-1_5_0_03-windows-i586.cab

[Java Plug-in 1.4.1_04]
InProcServer32 = C:\Program Files\Java\j2re1.4.1_04\bin\npjpi141_04.dll
CODEBASE = http://java.sun.com/products/plugin/1.4/jinstall-14_04-windows-i586.cab

[Java Plug-in 1.5.0_03]
InProcServer32 = C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll
CODEBASE = http://java.sun.com/update/1.5.0/jinstall-1_5_0_03-windows-i586.cab

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\system32\macromed\flash\Flash.ocx
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

--------------------------------------------------

Enumerating Winsock LSP files:

NameSpace #1: C:\WINDOWS\System32\mswsock.dll
NameSpace #2: C:\WINDOWS\System32\winrnr.dll
NameSpace #3: C:\WINDOWS\System32\mswsock.dll
NameSpace #4: C:\WINDOWS\System32\nwprovau.dll
Protocol #1: C:\WINDOWS\system32\mswsock.dll
Protocol #2: C:\WINDOWS\system32\mswsock.dll
Protocol #3: C:\WINDOWS\system32\mswsock.dll
Protocol #4: C:\WINDOWS\system32\rsvpsp.dll
Protocol #5: C:\WINDOWS\system32\rsvpsp.dll
Protocol #6: C:\WINDOWS\system32\mswsock.dll
Protocol #7: C:\WINDOWS\system32\mswsock.dll
Protocol #8: C:\WINDOWS\system32\mswsock.dll
Protocol #9: C:\WINDOWS\system32\mswsock.dll
Protocol #10: C:\WINDOWS\system32\mswsock.dll
Protocol #11: C:\WINDOWS\system32\mswsock.dll
Protocol #12: C:\WINDOWS\system32\mswsock.dll
Protocol #13: C:\WINDOWS\system32\mswsock.dll
Protocol #14: C:\WINDOWS\system32\mswsock.dll
Protocol #15: C:\WINDOWS\system32\mswsock.dll
Protocol #16: C:\WINDOWS\system32\mswsock.dll
Protocol #17: C:\WINDOWS\system32\mswsock.dll
Protocol #18: C:\WINDOWS\system32\mswsock.dll
Protocol #19: C:\WINDOWS\system32\mswsock.dll
Protocol #20: C:\WINDOWS\system32\mswsock.dll
Protocol #21: C:\WINDOWS\system32\mswsock.dll
Protocol #22: C:\WINDOWS\system32\mswsock.dll
Protocol #23: C:\WINDOWS\system32\mswsock.dll
Protocol #24: C:\WINDOWS\system32\mswsock.dll
Protocol #25: C:\WINDOWS\system32\mswsock.dll
Protocol #26: C:\WINDOWS\system32\mswsock.dll
Protocol #27: C:\WINDOWS\system32\mswsock.dll
Protocol #28: C:\WINDOWS\system32\mswsock.dll
Protocol #29: C:\WINDOWS\system32\mswsock.dll
Protocol #30: C:\WINDOWS\system32\mswsock.dll
Protocol #31: C:\WINDOWS\system32\mswsock.dll
Protocol #32: C:\WINDOWS\system32\mswsock.dll
Protocol #33: C:\WINDOWS\system32\mswsock.dll
Protocol #34: C:\WINDOWS\system32\mswsock.dll
Protocol #35: C:\WINDOWS\system32\mswsock.dll
Protocol #36: C:\WINDOWS\system32\mswsock.dll
Protocol #37: C:\WINDOWS\system32\mswsock.dll
Protocol #38: C:\WINDOWS\system32\mswsock.dll
Protocol #39: C:\WINDOWS\system32\mswsock.dll
Protocol #40: C:\WINDOWS\system32\mswsock.dll
Protocol #41: C:\WINDOWS\system32\mswsock.dll
Protocol #42: C:\WINDOWS\system32\mswsock.dll
Protocol #43: C:\WINDOWS\system32\mswsock.dll
Protocol #44: C:\WINDOWS\system32\mswsock.dll
Protocol #45: C:\WINDOWS\system32\mswsock.dll
Protocol #46: C:\WINDOWS\system32\mswsock.dll
Protocol #47: C:\WINDOWS\system32\mswsock.dll

--------------------------------------------------

Enumerating Windows NT/2000/XP services

61883 Unit Device: System32\DRIVERS\61883.sys (manual start)
IPv6 Helper Service: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
abp480n5: \SystemRoot\System32\DRIVERS\ABP480N5.SYS (disabled)
Microsoft ACPI Driver: System32\DRIVERS\ACPI.sys (system)
adpu160m: \SystemRoot\System32\DRIVERS\adpu160m.sys (disabled)
Microsoft Kernel Acoustic Echo Canceller: system32\drivers\aec.sys (manual start)
AFD Networking Support Environment: \SystemRoot\System32\drivers\afd.sys (system)
Intel AGP Bus Filter: \SystemRoot\System32\DRIVERS\agp440.sys (system)
Compaq AGP Bus Filter: \SystemRoot\System32\DRIVERS\agpCPQ.sys (disabled)
Aha154x: \SystemRoot\System32\DRIVERS\aha154x.sys (disabled)
aic78u2: \SystemRoot\System32\DRIVERS\aic78u2.sys (disabled)
aic78xx: \SystemRoot\System32\DRIVERS\aic78xx.sys (disabled)
Alerter: %SystemRoot%\System32\svchost.exe -k LocalService (disabled)
Application Layer Gateway Service: %SystemRoot%\System32\alg.exe (manual start)
AliIde: \SystemRoot\System32\DRIVERS\aliide.sys (disabled)
ALI AGP Bus Filter: \SystemRoot\System32\DRIVERS\alim1541.sys (disabled)
AMD AGP Bus Filter Driver: \SystemRoot\System32\DRIVERS\amdagp.sys (disabled)
amsint: \SystemRoot\System32\DRIVERS\amsint.sys (disabled)
Application Management: %SystemRoot%\system32\svchost.exe -k netsvcs (disabled)
1394 ARP Client Protocol: System32\DRIVERS\arp1394.sys (manual start)
asc: \SystemRoot\System32\DRIVERS\asc.sys (disabled)
asc3350p: \SystemRoot\System32\DRIVERS\asc3350p.sys (disabled)
asc3550: \SystemRoot\System32\DRIVERS\asc3550.sys (disabled)
ASP.NET State Service: %SystemRoot%\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe (manual start)
RAS Asynchronous Media Driver: System32\DRIVERS\asyncmac.sys (manual start)
Standard IDE/ESDI Hard Disk Controller: System32\DRIVERS\atapi.sys (system)
Ati HotKey Poller: %SystemRoot%\System32\Ati2evxx.exe (autostart)
ati2mtag: System32\DRIVERS\ati2mtag.sys (manual start)
ATM ARP Client Protocol: System32\DRIVERS\atmarpc.sys (manual start)
ATWPKT2: \??\C:\Program Files\America Online 8.0\ATWPKT2.SYS (manual start)
Windows Audio: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Audio Stub Driver: System32\DRIVERS\audstub.sys (manual start)
AVC Device: System32\DRIVERS\avc.sys (manual start)
Wireless-G Notebook Adapter with SpeedBooster Driver: System32\DRIVERS\bcmwl5.sys (manual start)
Broadcom 440x 10/100 Integrated Controller XP Driver: System32\DRIVERS\bcm4sbxp.sys (manual start)
Background Intelligent Transfer Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Computer Browser: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
cbidf: \SystemRoot\System32\DRIVERS\cbidf2k.sys (disabled)
CBTNDIS5 NDIS Protocol Driver: \??\C:\WINDOWS\System32\CBTNDIS5.SYS (manual start)
Closed Caption Decoder: System32\DRIVERS\CCDECODE.sys (manual start)
cd20xrnt: \SystemRoot\System32\DRIVERS\cd20xrnt.sys (disabled)
CD-ROM Driver: System32\DRIVERS\cdrom.sys (system)
Indexing Service: %SystemRoot%\system32\cisvc.exe (autostart)
ClipBook: %SystemRoot%\system32\clipsrv.exe (disabled)
Microsoft ACPI Control Method Battery Driver: System32\DRIVERS\CmBatt.sys (manual start)
CmdIde: \SystemRoot\System32\DRIVERS\cmdide.sys (disabled)
Panda Anti-Dialer: \??\C:\WINDOWS\system32\DRIVERS\COMFiltr.sys (manual start)
Microsoft Composite Battery Driver: System32\DRIVERS\compbatt.sys (system)
COM+ System Application: C:\WINDOWS\System32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235} (manual start)
Cpqarray: \SystemRoot\System32\DRIVERS\cpqarray.sys (disabled)
Cryptographic Services: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
d347bus: system32\DRIVERS\d347bus.sys (system)
d347prt: System32\Drivers\d347prt.sys (system)
dac2w2k: \SystemRoot\System32\DRIVERS\dac2w2k.sys (disabled)
dac960nt: \SystemRoot\System32\DRIVERS\dac960nt.sys (disabled)
DCOM Server Process Launcher: %SystemRoot%\system32\svchost -k DcomLaunch (autostart)
DHCP Client: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Disk Driver: System32\DRIVERS\disk.sys (system)
D-Link AirPlus G Wireless Adapter: System32\DRIVERS\TNET1130.SYS (manual start)
Logical Disk Manager Administrative Service: %SystemRoot%\System32\dmadmin.exe /com (manual start)
dmboot: System32\drivers\dmboot.sys (disabled)
dmio: System32\drivers\dmio.sys (disabled)
dmload: System32\drivers\dmload.sys (disabled)
Logical Disk Manager: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Microsoft Kernel DLS Syntheiszer: system32\drivers\DMusic.sys (manual start)
DNS Client: %SystemRoot%\System32\svchost.exe -k NetworkService (autostart)
dpti2o: \SystemRoot\System32\DRIVERS\dpti2o.sys (disabled)
Microsoft Kernel DRM Audio Descrambler: system32\drivers\drmkaud.sys (manual start)
3Com EtherLink XL 90XB/C Adapter Driver: System32\DRIVERS\el90xbc5.sys (manual start)
Error Reporting Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Event Log: %SystemRoot%\system32\services.exe (autostart)
COM+ Event System: C:\WINDOWS\System32\svchost.exe -k netsvcs (manual start)
FanIO driver: \??\C:\WINDOWS\System32\drivers\fanio.sys (system)
Fast User Switching Compatibility: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)

 

Floppy Disk Controller Driver: System32\DRIVERS\fdc.sys (manual start)
Floppy Disk Driver: System32\DRIVERS\flpydisk.sys (manual start)
FltMgr: system32\drivers\fltmgr.sys (system)
Volume Manager Driver: System32\DRIVERS\ftdisk.sys (system)
Generic Packet Classifier: System32\DRIVERS\msgpc.sys (manual start)
Help and Support: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Human Interface Device Access: %SystemRoot%\System32\svchost.exe -k netsvcs (disabled)
Microsoft HID Class Driver: System32\DRIVERS\hidusb.sys (manual start)
hpn: \SystemRoot\System32\DRIVERS\hpn.sys (disabled)
IEEE-1284.4 Driver HPZid412: system32\DRIVERS\HPZid412.sys (manual start)
Print Class Driver for IEEE-1284.4 HPZipr12: system32\DRIVERS\HPZipr12.sys (manual start)
USB to IEEE-1284.4 Translation Driver HPZius12: system32\DRIVERS\HPZius12.sys (manual start)
HTTP: System32\Drivers\HTTP.sys (manual start)
HTTP SSL: %SystemRoot%\System32\svchost.exe -k HTTPFilter (manual start)
i2omp: \SystemRoot\System32\DRIVERS\i2omp.sys (disabled)
i8042 Keyboard and PS/2 Mouse Port Driver: System32\DRIVERS\i8042prt.sys (system)
i81x: System32\DRIVERS\i81xnt5.sys (manual start)
iAimFP0: System32\DRIVERS\wADV01nt.sys (manual start)
iAimFP1: System32\DRIVERS\wADV02NT.sys (manual start)
iAimFP2: System32\DRIVERS\wADV05NT.sys (manual start)
iAimFP3: System32\DRIVERS\wSiINTxx.sys (manual start)
iAimFP4: System32\DRIVERS\wVchNTxx.sys (manual start)
iAimTV0: System32\DRIVERS\wATV01nt.sys (manual start)
iAimTV1: System32\DRIVERS\wATV02NT.sys (manual start)
iAimTV2: System32\DRIVERS\wATV03nt.sys (manual start)
iAimTV3: System32\DRIVERS\wATV04nt.sys (manual start)
iAimTV4: System32\DRIVERS\wCh7xxNT.sys (manual start)
iriver Internet Audio Player IFP-300: System32\DRIVERS\ifp300.sys (system)
CD-Burning Filter Driver: System32\DRIVERS\imapi.sys (system)
IMAPI CD-Burning COM Service: C:\WINDOWS\System32\imapi.exe (manual start)
ini910u: \SystemRoot\System32\DRIVERS\ini910u.sys (disabled)
IntelIde: System32\DRIVERS\intelide.sys (system)
Intel Processor Driver: System32\DRIVERS\intelppm.sys (system)
IPv6 Windows Firewall Driver: system32\drivers\ip6fw.sys (manual start)
IP Traffic Filter Driver: System32\DRIVERS\ipfltdrv.sys (manual start)
IP in IP Tunnel Driver: System32\DRIVERS\ipinip.sys (manual start)
IP Network Address Translator: System32\DRIVERS\ipnat.sys (manual start)
IPSEC driver: System32\DRIVERS\ipsec.sys (system)
IR Enumerator Service: System32\DRIVERS\irenum.sys (manual start)
PnP ISA/EISA Bus Driver: System32\DRIVERS\isapnp.sys (system)
Keyboard Class Driver: System32\DRIVERS\kbdclass.sys (system)
Microsoft Kernel Wave Audio Mixer: system32\drivers\kmixer.sys (manual start)
Server: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Workstation: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
TCP/IP NetBIOS Helper: %SystemRoot%\System32\svchost.exe -k LocalService (autostart)
Messenger: %SystemRoot%\System32\svchost.exe -k netsvcs (disabled)
NetMeeting Remote Desktop Sharing: C:\WINDOWS\System32\mnmsrvc.exe (manual start)
Mouse Class Driver: System32\DRIVERS\mouclass.sys (system)
Mouse HID Driver: System32\DRIVERS\mouhid.sys (manual start)
mraid35x: \SystemRoot\System32\DRIVERS\mraid35x.sys (disabled)
WebDav Client Redirector: System32\DRIVERS\mrxdav.sys (manual start)
MRXSMB: System32\DRIVERS\mrxsmb.sys (system)
Distributed Transaction Coordinator: C:\WINDOWS\System32\msdtc.exe (manual start)
Microsoft DV Camera and VCR: System32\DRIVERS\msdv.sys (manual start)
Windows Installer: C:\WINDOWS\system32\msiexec.exe /V (manual start)
Microsoft Streaming Service Proxy: system32\drivers\MSKSSRV.sys (manual start)
Microsoft Streaming Clock Proxy: system32\drivers\MSPCLOCK.sys (manual start)
Microsoft Streaming Quality Manager Proxy: system32\drivers\MSPQM.sys (manual start)
Microsoft System Management BIOS Driver: System32\DRIVERS\mssmbios.sys (manual start)
Microsoft Streaming Tee/Sink-to-Sink Converter: system32\drivers\MSTEE.sys (manual start)
NABTS/FEC VBI Codec: System32\DRIVERS\NABTSFEC.sys (manual start)
Microsoft TV/Video Connection: System32\DRIVERS\NdisIP.sys (manual start)
Remote Access NDIS TAPI Driver: System32\DRIVERS\ndistapi.sys (manual start)
NDIS Usermode I/O Protocol: System32\DRIVERS\ndisuio.sys (manual start)
Remote Access NDIS WAN Driver: System32\DRIVERS\ndiswan.sys (manual start)
NetBIOS Interface: System32\DRIVERS\netbios.sys (system)
NetBios over Tcpip: System32\DRIVERS\netbt.sys (system)
Network DDE: %SystemRoot%\system32\netdde.exe (disabled)
Network DDE DSDM: %SystemRoot%\system32\netdde.exe (disabled)
Net Logon: %SystemRoot%\System32\lsass.exe (manual start)
Network Connections: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
1394 Net Driver: System32\DRIVERS\nic1394.sys (manual start)
Network Location Awareness (NLA): %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Network Monitor Driver: System32\DRIVERS\NMnt.sys (manual start)
NetGroup Packet Filter Driver: system32\drivers\npf.sys (manual start)
NT LM Security Support Provider: %SystemRoot%\System32\lsass.exe (manual start)
Removable Storage: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
nv: System32\DRIVERS\nv4_mini.sys (manual start)
IPX Traffic Filter Driver: System32\DRIVERS\nwlnkflt.sys (manual start)
IPX Traffic Forwarder Driver: System32\DRIVERS\nwlnkfwd.sys (manual start)
NWLink IPX/SPX/NetBIOS Compatible Transport Protocol: System32\DRIVERS\nwlnkipx.sys (autostart)
NWLink NetBIOS: System32\DRIVERS\nwlnknb.sys (autostart)
NWLink SPX/SPXII Protocol: System32\DRIVERS\nwlnkspx.sys (autostart)
SAP Agent: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Odyssey Network Services Miniport: System32\DRIVERS\odysseyIM3.sys (manual start)
Texas Instruments OHCI Compliant IEEE 1394 Host Controller: System32\DRIVERS\ohci1394.sys (system)
OMCI WDM Device Driver: System32\DRIVERS\omci.sys (system)
Intel PentiumIII Processor Driver: System32\DRIVERS\p3.sys (system)
Parallel port driver: System32\DRIVERS\parport.sys (manual start)
PavSRK.sys: \??\C:\WINDOWS\system32\PavSRK.sys (manual start)
PCI Bus Driver: System32\DRIVERS\pci.sys (system)
PCIIde: System32\DRIVERS\pciide.sys (system)
Pcmcia: System32\DRIVERS\pcmcia.sys (system)
perc2: \SystemRoot\System32\DRIVERS\perc2.sys (disabled)
perc2hib: \SystemRoot\System32\DRIVERS\perc2hib.sys (disabled)
Plug and Play: %SystemRoot%\system32\services.exe (autostart)
Pml Driver HPZ12: C:\WINDOWS\system32\HPZipm12.exe (autostart)
IPSEC Services: %SystemRoot%\System32\lsass.exe (autostart)
WAN Miniport (PPTP): System32\DRIVERS\raspptp.sys (manual start)
D-Link Wireless 802.11b/g Driver (USB): system32\DRIVERS\PRISMA02.sys (manual start)
Processor Driver: System32\DRIVERS\processr.sys (system)
Protected Storage: %SystemRoot%\system32\lsass.exe (autostart)
QoS Packet Scheduler: System32\DRIVERS\psched.sys (manual start)
Direct Parallel Link Driver: System32\DRIVERS\ptilink.sys (manual start)
W2K Pctel Serial Device Driver: System32\DRIVERS\ptserial.sys (manual start)
PxHelp20: system32\DRIVERS\PxHelp20.sys (system)
ql1080: \SystemRoot\System32\DRIVERS\ql1080.sys (disabled)
Ql10wnt: \SystemRoot\System32\DRIVERS\ql10wnt.sys (disabled)
ql12160: \SystemRoot\System32\DRIVERS\ql12160.sys (disabled)
ql1240: \SystemRoot\System32\DRIVERS\ql1240.sys (disabled)
ql1280: \SystemRoot\System32\DRIVERS\ql1280.sys (disabled)
Remote Access Auto Connection Driver: System32\DRIVERS\rasacd.sys (system)
Remote Access Auto Connection Manager: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
WAN Miniport (L2TP): System32\DRIVERS\rasl2tp.sys (manual start)
Remote Access Connection Manager: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Remote Access PPPOE Driver: System32\DRIVERS\raspppoe.sys (manual start)
Direct Parallel: System32\DRIVERS\raspti.sys (manual start)
Rdbss: System32\DRIVERS\rdbss.sys (system)
RDPCDD: System32\DRIVERS\RDPCDD.sys (system)
Terminal Server Device Redirector Driver: System32\DRIVERS\rdpdr.sys (manual start)
Remote Desktop Help Session Manager: C:\WINDOWS\system32\sessmgr.exe (manual start)
Digital CD Audio Playback Filter Driver: System32\DRIVERS\redbook.sys (system)
Routing and Remote Access: %SystemRoot%\System32\svchost.exe -k netsvcs (disabled)
Rio universal USB driver: System32\Drivers\RIOUNIV.sys (manual start)
Remote Packet Capture Protocol v.0 (experimental): "%ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini" (manual start)
Remote Procedure Call (RPC) Locator: %SystemRoot%\System32\locator.exe (manual start)
Remote Procedure Call (RPC): %SystemRoot%\system32\svchost -k rpcss (autostart)
QoS RSVP: %SystemRoot%\System32\rsvp.exe (manual start)
SABKUTIL: \??\C:\Program Files\SuperAdBlocker.com\Super Ad Blocker\SABKUTIL.sys (system)
SABProcEnum: \??\C:\Program Files\SuperAdBlocker.com\Super Ad Blocker\SABProcEnum.sys (manual start)
Security Accounts Manager: %SystemRoot%\system32\lsass.exe (autostart)
SBP-2 Transport/Protocol Bus Driver: System32\DRIVERS\sbp2port.sys (system)
Smart Card: %SystemRoot%\System32\SCardSvr.exe (manual start)
Task Scheduler: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Secdrv: System32\DRIVERS\secdrv.sys (autostart)
Secondary Logon: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
System Event Notification: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Serenum Filter Driver: System32\DRIVERS\serenum.sys (manual start)
Serial port driver: System32\DRIVERS\serial.sys (system)
High-Capacity Floppy Disk Drive: System32\DRIVERS\sfloppy.sys (manual start)
Windows Firewall/Internet Connection Sharing (ICS): %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Shell Hardware Detection: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
SIS AGP Bus Filter: \SystemRoot\System32\DRIVERS\sisagp.sys (disabled)
BDA Slip De-Framer: System32\DRIVERS\SLIP.sys (manual start)
Sony USB Filter Driver (SONYPVU1): System32\DRIVERS\SONYPVU1.SYS (manual start)
Sparrow: \SystemRoot\System32\DRIVERS\sparrow.sys (disabled)
Microsoft Kernel Audio Splitter: system32\drivers\splitter.sys (manual start)
Print Spooler: %SystemRoot%\system32\spoolsv.exe (autostart)
System Restore Filter Driver: System32\DRIVERS\sr.sys (system)
System Restore Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Srv: System32\DRIVERS\srv.sys (manual start)
SSDP Discovery Service: %SystemRoot%\System32\svchost.exe -k LocalService (manual start)
Audio Driver (WDM) - SigmaTel CODEC: system32\drivers\STAC97.sys (manual start)
Windows Image Acquisition (WIA): %SystemRoot%\System32\svchost.exe -k imgsvc (autostart)
BDA IPSink: System32\DRIVERS\StreamIP.sys (manual start)
Software Bus Driver: System32\DRIVERS\swenum.sys (manual start)
Microsoft Kernel GS Wavetable Synthesizer: system32\drivers\swmidi.sys (manual start)
MS Software Shadow Copy Provider: C:\WINDOWS\System32\dllhost.exe /Processid:{F79A1568-D6C5-4C69-A086-936CF52DBBE3} (manual start)
symc810: \SystemRoot\System32\DRIVERS\symc810.sys (disabled)
symc8xx: \SystemRoot\System32\DRIVERS\symc8xx.sys (disabled)
sym_hi: \SystemRoot\System32\DRIVERS\sym_hi.sys (disabled)
sym_u3: \SystemRoot\System32\DRIVERS\sym_u3.sys (disabled)
Synaptics TouchPad Driver: System32\DRIVERS\SynTP.sys (manual start)
Microsoft Kernel System Audio Device: system32\drivers\sysaudio.sys (manual start)
Performance Logs and Alerts: %SystemRoot%\system32\smlogsvc.exe (manual start)
Telephony: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
TCP/IP Protocol Driver: System32\DRIVERS\tcpip.sys (system)
Microsoft IPv6 Protocol Driver: System32\DRIVERS\tcpip6.sys (system)
Terminal Device Driver: System32\DRIVERS\termdd.sys (system)
Terminal Services: %SystemRoot%\System32\svchost -k DComLaunch (manual start)
Themes: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
TosIde: \SystemRoot\System32\DRIVERS\toside.sys (disabled)
Distributed Link Tracking Client: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Microsoft Tun Miniport Adapter Driver: system32\DRIVERS\tunmp.sys (manual start)
ultra: \SystemRoot\System32\DRIVERS\ultra.sys (disabled)
Windows User Mode Driver Framework: C:\WINDOWS\system32\wdfmgr.exe (autostart)
Microcode Update Driver: System32\DRIVERS\update.sys (manual start)
Universal Plug and Play Device Host: %SystemRoot%\System32\svchost.exe -k LocalService (manual start)
Uninterruptible Power Supply: %SystemRoot%\System32\ups.exe (manual start)
Microsoft USB Generic Parent Driver: System32\DRIVERS\usbccgp.sys (manual start)
Microsoft USB 2.0 Enhanced Host Controller Miniport Driver: System32\DRIVERS\usbehci.sys (manual start)
Microsoft USB Standard Hub Driver: System32\DRIVERS\usbhub.sys (manual start)
Microsoft USB PRINTER Class: System32\DRIVERS\usbprint.sys (manual start)
USB Scanner Driver: System32\DRIVERS\usbscan.sys (manual start)
USB Mass Storage Driver: System32\DRIVERS\USBSTOR.SYS (manual start)
Microsoft USB Universal Host Controller Miniport Driver: System32\DRIVERS\usbuhci.sys (manual start)
VGA Display Controller.: \SystemRoot\System32\drivers\vga.sys (system)
VIA AGP Bus Filter: \SystemRoot\System32\DRIVERS\viaagp.sys (disabled)
ViaIde: \SystemRoot\System32\DRIVERS\viaide.sys (disabled)
W2k Vmodem: System32\DRIVERS\vmodem.sys (system)
W2k Vpctcom: System32\DRIVERS\vpctcom.sys (system)
Volume Shadow Copy: %SystemRoot%\System32\vssvc.exe (manual start)
W2k Vvoice: System32\DRIVERS\vvoice.sys (system)
Windows Time: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
NETGEAR WG511v2 54 Mbps Wireless PC Card for Windows XP (8335): system32\DRIVERS\WG511v2.sys (manual start)
Remote Access IP ARP Driver: System32\DRIVERS\wanarp.sys (manual start)
WAN Miniport (ATW): System32\DRIVERS\wanatw4.sys (manual start)
Windows CE USB Serial Host Driver: System32\DRIVERS\wceusbsh.sys (manual start)
Microsoft WINMM WDM Audio Compatibility Driver: system32\drivers\wdmaud.sys (manual start)
WebClient: %SystemRoot%\System32\svchost.exe -k LocalService (autostart)
Windows Management Instrumentation: %systemroot%\system32\svchost.exe -k netsvcs (autostart)
Portable Media Serial Number Service: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
WMI Performance Adapter: C:\WINDOWS\System32\wbem\wmiapsrv.exe (manual start)
Wifi Monitor Filter Plugin: \??\C:\WINDOWS\system32\Drivers\WNMFLT.SYS (system)
Windows Socket 2.0 Non-IFS Service Provider Support Environment: \SystemRoot\System32\drivers\ws2ifsl.sys (disabled)
Security Center: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
World Standard Teletext Codec: System32\DRIVERS\WSTCODEC.SYS (manual start)
Automatic Updates: %systemroot%\system32\svchost.exe -k netsvcs (autostart)
Wireless Zero Configuration: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Network Provisioning Service: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)


--------------------------------------------------


Enumerating Windows NT logon/logoff scripts:
*No scripts set to run*

Windows NT checkdisk command:
BootExecute = *Registry value not found*

Windows NT 'Wininit.ini':
PendingFileRenameOperations: *Registry value not found*

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\System32\webcheck.dll
SysTray: C:\WINDOWS\System32\stobject.dll

--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

*No values found*

--------------------------------------------------

End of report, 40,339 bytes
Report generated in 0.110 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only

 

Grrr.......found a folder I didn't remove earlier, could be the culprit.

Be sure you have all files and folders to show just in case and delete the following:
C:\Program Files\Common Files\iioz<<<<---this folder

I'm going to look thru the log again, but let me know what happens once it is deleted and whether or not you get any more pop ups.


And give me another ComboFix log too.