1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Active Got trojan, antivirus blocked possibly still infected

Discussion in 'Malware and Virus Removal Archive' started by JusticeNY, 2009/07/27.

  1. 2009/07/27
    JusticeNY

    JusticeNY Well-Known Member Thread Starter

    Joined:
    2008/12/14
    Messages:
    160
    Likes Received:
    0
    [Active] Got trojan, antivirus blocked possibly still infected

    well ive been here before and i got infected the same way you guys were so helpful .. after u guys helped me clean my cpu i looked in your prevention thread got everything i got eset a few months ago. i was on a perfectly safe site and im guessing a pdf tried to come up but eset blocked it and i saw about 15-20 blocked trojans/virus indicators so im glad eset actually works... but being as im still paranoid i often look in task manager proccesses too see if there are any exe's i dont recognize well there was one i didnt it was a long string of numbers but it started with 1.. so for example 12324.exe plus i think i spooted a few extra svchosts.exe but im not sure so i immediatly came here downloaded malware bytes ran a scan found a few minor things but also some serious things.. so i was hoping u guys would check my logs to make sure i didnt miss anything...

    Malwarebytes' Anti-Malware 1.39
    Database version: 2510
    Windows 5.1.2600 Service Pack 3

    2009-07-27 2:07:13 AM
    mbam-log-2009-07-27 (02-07-13).txt

    Scan type: Quick Scan
    Objects scanned: 90602
    Time elapsed: 8 minute(s), 30 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 48
    Registry Values Infected: 1
    Registry Data Items Infected: 1
    Folders Infected: 4
    Files Infected: 5

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    HKEY_CLASSES_ROOT\Interface\{067c6a37-72ea-4437-863a-5be20c246f3c} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{1230cf51-6bc4-4a23-b3f1-c7cf0afed619} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{1985fce1-4043-4346-ae70-d0a0cd90bdd3} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{1a2af056-1fe1-47ca-993d-5d09d18e674e} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{2b81f920-6660-4f76-93bf-b1c67bf5d1a0} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{2e623b96-b166-4c70-8169-820761794299} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{2e9937fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{34e29700-0d13-46aa-b9a5-ace68e21a091} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{3661af2d-c27b-499c-9bcf-66c8502a3806} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{3f0915b8-b238-4c2d-ad1e-60db1e14d27a} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{49155dae-c471-40fa-98ee-b2b3cad115ce} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{4d783385-0dda-4188-a529-c97dc3d67cbd} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{4e8b851b-05b0-4baf-b24d-d0dfe88dded3} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{50c3e2b3-4fd7-4cb9-91f9-641a6e6b3689} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{62b0b239-f9ac-4a5b-bfae-62c7a23f7627} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{6e10479b-31e8-4a3b-81b1-ddaf39097f19} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{726f0ab9-b842-4ae4-90c7-230e233e6a99} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{741de825-a6f0-4497-9aa6-8023cf9b0fff} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{99123ac9-7dda-4c82-b252-44c2804bf392} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{a916af3c-976d-4358-8736-95bea0b5fd2c} (Adware.WhenUSave) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{b247f5bf-bd9d-4ecd-8fc1-365f36a1fda1} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{b9cc2b92-5611-453f-8381-8b6f72d9c0b8} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{bbbfb891-98ae-4678-86f3-bd5a2eed86c9} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{be45f056-e005-437b-be88-23acf70b0b6a} (Adware.WhenUSave) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{c4543e64-1498-410d-8e72-4744eea99ab9} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{e420a65f-9984-4b8c-9fa9-1ed69d3b0a13} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{ea58c2ea-be26-49dd-9b9a-c8e4e5ca7791} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{fca28ac5-c1e1-4d67-a5ae-c44d6c374d9f} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1e5b2693-d348-4ca7-8364-4f5e51bf9c6d} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{54a3f8b7-228e-4ed8-895b-de832b2c3959} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{bfc08cff-c737-4433-bd5a-0ee7efcfee54} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6fd31ed6-7c94-4bbc-8e95-f927f4d3a949} (Adware.180Solutions) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{1e5b2693-d348-4ca7-8364-4f5e51bf9c6d} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{2e54ac53-efa4-4831-a3f6-b47b1a1937cf} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{54a3f8b7-228e-4ed8-895b-de832b2c3959} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{bd937ffe-0352-4fde-88f2-c30d1a9b25cf} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{bd937ffe-0352-4fde-88f2-c30d1a9b25cf} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Installer\Features\9ee2330ae5f4470cac801baac83818c9 (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\The Weather Channel (Adware.Hotbar) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\AppID\ZangoSA_df.exe (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\cs41275 (Malware.Trace) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\ErrorSmart (Rogue.ErrorSmart) -> Quarantined and deleted successfully.

    Registry Values Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\16609844 (Rogue.Multiple.H) -> Quarantined and deleted successfully.

    Registry Data Items Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

    Folders Infected:
    C:\Documents and Settings\All Users\Application Data\16609844 (Rogue.Multiple.H) -> Quarantined and deleted successfully.
    C:\Documents and Settings\family\Application Data\ErrorSmart (Rogue.ErrorSmart) -> Quarantined and deleted successfully.
    c:\documents and settings\family\application data\errorsmart\Log (Rogue.ErrorSmart) -> Quarantined and deleted successfully.
    c:\documents and settings\family\application data\errorsmart\Registry Backups (Rogue.ErrorSmart) -> Quarantined and deleted successfully.

    Files Infected:
    c:\documents and settings\all users\application data\16609844\16609844 (Rogue.Multiple.H) -> Quarantined and deleted successfully.
    c:\documents and settings\all users\application data\16609844\16609844.exe (Rogue.Multiple.H) -> Quarantined and deleted successfully.
    c:\documents and settings\family\local settings\temp\0.6394492700990586.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
    c:\documents and settings\family\application data\errorsmart\Log\2008 Jun 09 - 09_56_49 AM_093.log (Rogue.ErrorSmart) -> Quarantined and deleted successfully.
    c:\documents and settings\family\application data\errorsmart\registry backups\2008-06-03_01-46-28.reg (Rogue.ErrorSmart) -> Quarantined and deleted successfully.
     
    JusticeNY,
    #1
  2. 2009/07/27
    JusticeNY

    JusticeNY Well-Known Member Thread Starter

    Joined:
    2008/12/14
    Messages:
    160
    Likes Received:
    0
    Note: got a whole lot of these avira antivirs so many it was causing me to be over the character limit of 55 thousand so i left it out unless u need it

    AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {89C81054-FFA4-00EF-0D24-347CA8A3377C}
    FW: ESET Personal firewall *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}

    ============== Running Processes ===============

    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
    svchost.exe
    svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\ESET\ESET Smart Security\egui.exe
    C:\Program Files\ESET\ESET Smart Security\ekrn.exe
    C:\WINDOWS\system32\svchost.exe -k imgsvc
    C:\Program Files\Viewpoint\Common\ViewpointService.exe
    C:\WINDOWS\system32\svchost.exe -k netsvcs
    C:\Program Files\AIM6\aim6.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\Program Files\AIM6\aolsoftware.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\Program Files\MZILLA\firefox.exe
    C:\Documents and Settings\family\Desktop\iexplore.exe
    C:\Documents and Settings\family\Desktop\dds.scr

    ============== Pseudo HJT Report ===============

    uInternet Connection Wizard,ShellNext = iexplore
    uInternet Settings,ProxyOverride = *.local
    uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
    BHO: : {206e52e0-d52e-11d4-ad54-0000e86c26f6} - c:\progra~1\freshd~1\freshd~1\fdcatch.dll
    BHO: Verizon Broadband Toolbar: {4e7bd74f-2b8d-469e-8cb0-ab60bb9aae22} - c:\progra~1\vol_to~1\VOL_TO~1.DLL
    BHO: Nick Aracde Toolbar: {4e7bd74f-2b8d-469e-9eb4-fe6fa694b13e} - c:\progra~1\nickar~1\NICKAR~1.DLL
    BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
    BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_07\bin\ssv.dll
    BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
    BHO: Viewpoint Toolbar BHO: {a7327c09-b521-4edb-8509-7d2660c9ec98} - c:\program files\viewpoint\viewpoint toolbar\3.8.0\ViewBarBHO.dll
    BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\googletoolbar1.dll
    BHO: Ask.com Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
    BHO: XBTBPos00 Class: {fcbccb87-9224-4b8d-b117-f56d924beb18} - c:\progra~1\softom~1\toolba~1\bin\tbcore3U.dll
    TB: {4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7D} - No File
    TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
    TB: Verizon Broadband Toolbar: {4e7bd74f-2b8d-469e-8cb0-ab60bb9aae22} - c:\progra~1\vol_to~1\VOL_TO~1.DLL
    TB: Ask.com Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
    TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar1.dll
    TB: {C70E30C7-140A-4166-A2E8-43557E62B41A} - No File
    TB: {724D43A0-0D85-11D4-9908-00400523E39A} - No File
    TB: {55FAF0F2-44D4-425F-B5F5-6B275B621EAB} - No File
    TB: {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - No File
    TB: {8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - No File
    uRun: [Aim] "c:\program files\aim6\aim.exe" /d locale=en-US
    uRun: [Aim6]
    uRunOnce: [Shockwave Updater] c:\windows\system32\adobe\shockw~1\SWHELP~1.EXE -Update -1100465 - "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 2.0.50727; InfoPath.1; AskTB5.3)" - "http://www.neopets.com/games/dgs/play_shockwave.phtml?va=&game_id=313&nc_referer=&age=1&hiscore=45&sp=0&questionSet=&r=5476927&width=520&height=560&quality=high "
    mRun: [egui] "c:\program files\eset\eset smart security\egui.exe" /hide /waitservice
    mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe "
    mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe "
    mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
    mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
    dRunOnce: [RunNarrator] Narrator.exe
    IE: {9819CC0E-9669-4D01-9CD7-2C66DA43AC6C}
    IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE}
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_07\bin\ssv.dll
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office11\REFIEBAR.DLL
    DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
    DPF: {01113300-3E00-11D2-8470-0060089874ED} - hxxps://activatemyfios.verizon.net/sdcCommon/download/FIOS/Verizon%20FiOS%20Installer.cab
    DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/FacebookPhotoUploader5.cab
    DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab
    DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/9/b/d/9bdc68ef-6a9f-4505-8fb8-d0d2d160e512/LegitCheckControl.cab
    DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab
    DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} - hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.4.1.cab
    DPF: {48DD0448-9209-4F81-9F6D-D83562940134} - hxxp://lads.myspace.com/upload/MySpaceUploader1006.cab
    DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - hxxp://download.divx.com/player/DivXBrowserPlugin.cab
    DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} - hxxp://verizon.exent.com/vzfamily/classes/ExentCtl.ocx
    DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} - hxxp://www.nick.com/common/groove/gx/GrooveAX27.cab
    DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} - hxxp://www.worldwinner.com/games/shared/wwlaunch.cab
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
    DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
    DPF: {A7EA8AD2-287F-11D3-B120-006008C39542} - hxxp://offers.e-centives.com/cif/download/bin/actxcab.cab
    DPF: {B49C4597-8721-4789-9250-315DFBD9F525} - hxxp://cdn.digitalcity.com/radio/ampx/ampx2.6.1.11_en_dl.cab
    DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - hxxp://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab
    DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
    DPF: {CF969D51-F764-4FBF-9E90-475248601C8A} - hxxp://www.worldwinner.com/games/v47/familyfeud/familyfeud.cab
    DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    Notify: AtiExtEvent - Ati2evxx.dll
    Notify: igfxcui - igfxsrvc.dll
    SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

    ================= FIREFOX ===================

    FF - ProfilePath - c:\docume~1\family\applic~1\mozilla\firefox\profiles\0iyqlche.default\
    FF - prefs.js: browser.search.selectedEngine - DAEMON Search
    FF - prefs.js: browser.startup.homepage - hxxp://cmonwealth.com/
    FF - component: c:\documents and settings\family\application data\mozilla\firefox\profiles\0iyqlche.default\extensions\{1a001dcf-d681-4c09-be1a-e0ad95d3a5b6}\components\FFAlert.dll
    FF - plugin: c:\documents and settings\all users\application data\nexonus\ngm\npNxGameUS.dll
    FF - plugin: c:\program files\k-lite codec pack\real\browser\plugins\nppl3260.dll
    FF - plugin: c:\program files\k-lite codec pack\real\browser\plugins\nprpjplug.dll
    FF - plugin: c:\program files\mzilla\plugins\npCouponPrinter.dll
    FF - plugin: c:\program files\mzilla\plugins\npGoogleGadgetPluginFirefoxWin.dll
    FF - plugin: c:\program files\mzilla\plugins\npqtplugin8.dll
    FF - plugin: c:\program files\mzilla\plugins\npViewpoint.dll
    FF - plugin: c:\program files\opera 10 beta\program\plugins\npdsplay.dll
    FF - plugin: c:\program files\opera 10 beta\program\plugins\NPOFFICE.DLL
    FF - plugin: c:\program files\opera 10 beta\program\plugins\npqtplugin.dll
    FF - plugin: c:\program files\opera 10 beta\program\plugins\npqtplugin2.dll
    FF - plugin: c:\program files\opera 10 beta\program\plugins\npqtplugin3.dll
    FF - plugin: c:\program files\opera 10 beta\program\plugins\npqtplugin4.dll
    FF - plugin: c:\program files\opera 10 beta\program\plugins\npqtplugin5.dll
    FF - plugin: c:\program files\opera 10 beta\program\plugins\npqtplugin6.dll
    FF - plugin: c:\program files\opera 10 beta\program\plugins\npqtplugin7.dll
    FF - plugin: c:\program files\opera 10 beta\program\plugins\npqtplugin8.dll
    FF - plugin: c:\program files\opera 10 beta\program\plugins\npwmsdrm.dll
    FF - plugin: c:\program files\opera\program\plugins\npdivx32.dll
    FF - plugin: c:\program files\quicktime\plugins\npqtplugin8.dll
    FF - plugin: c:\program files\viewpoint\viewpoint media player\npViewpoint.dll
    FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
    FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mzilla\extensions\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA}
    FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mzilla\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}

    ---- FIREFOX POLICIES ----
    FF - user.js: network.http.max-persistent-connections-per-server - 4
    FF - user.js: content.max.tokenizing.time - 200000
    FF - user.js: content.notify.interval - 100000
    FF - user.js: content.switch.threshold - 650000
    FF - user.js: nglayout.initialpaint.delay - 300

    ============= SERVICES / DRIVERS ===============

    R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2009-3-19 107256]
    R2 CAMTHWDM;WebcamMax, WDM Video Capture;c:\windows\system32\drivers\CAMTHWDM.sys [2009-6-13 941784]
    R2 ekrn;ESET Service;c:\program files\eset\eset smart security\ekrn.exe [2009-3-19 731840]
    R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2009-5-31 24652]
    R3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\drivers\ManyCam.sys [2008-1-14 21632]
    R3 pelmouse;Mouse Suite Driver;c:\windows\system32\drivers\PELMOUSE.SYS [2004-11-29 27088]
    R3 pelusblf;USB Mouse Low Filter Driver;c:\windows\system32\drivers\pelusblf.sys [2004-11-29 12816]
    S1 rxp;rxp; [x]
    S2 sbbotdi;sbbotdi; [x]
    S3 hamachi_oem;PlayLinc Adapter;c:\windows\system32\drivers\gan_adapter.sys [2006-10-19 10664]
    S3 NTProcDrv;Process creation detector for NT.; [x]
    S3 PortTalk;PortTalk;c:\windows\system32\drivers\PortTalk.sys [2007-7-4 3567]
    S3 Radialpoint Security Services;Radialpoint Security Services;c:\windows\system32\dllhost.exe [2004-8-4 5120]
    S3 scsiprnt;Microsoft SCSI/1394 Generic Printer Class;c:\windows\system32\drivers\scsiprnt.sys [2004-11-30 11648]

    =============== Created Last 30 ================

    2009-07-27 01:46 <DIR> --d----- c:\docume~1\family\applic~1\Malwarebytes
    2009-07-27 01:45 38,160 a------- c:\windows\system32\drivers\mbamswissarmy.sys
    2009-07-27 01:45 19,096 a------- c:\windows\system32\drivers\mbam.sys
    2009-07-27 01:45 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
    2009-07-27 01:45 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
    2009-07-18 23:39 138,752 a------- c:\windows\system32\sndvol32.exe
    2009-07-18 23:39 138,752 a------- c:\windows\system32\dllcache\sndvol32.exe
    2009-07-18 23:19 9,522 a------- c:\windows\Zapotec.bmp
    2009-07-18 23:19 65,832 a------- c:\windows\Santa Fe Stucco.bmp
    2009-07-18 23:19 26,680 a------- c:\windows\River Sumida.bmp
    2009-07-18 23:19 17,362 a------- c:\windows\Rhododendron.bmp
    2009-07-18 23:19 65,954 a------- c:\windows\Prairie Wind.bmp
    2009-07-18 23:18 26,582 a------- c:\windows\Greenstone.bmp
    2009-07-18 02:25 159,744 a------- c:\windows\system32\igfxres.dll
    2009-07-10 15:30 <DIR> --d----- c:\program files\iPod
    2009-07-10 15:30 <DIR> --d----- c:\program files\iTunes
    2009-07-10 15:30 <DIR> --d----- c:\docume~1\alluse~1\applic~1\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
    2009-07-01 02:57 <DIR> --d----- c:\program files\USArmy
    2009-07-01 02:25 <DIR> --d----- c:\docume~1\alluse~1\applic~1\AA3DeployClient

    ==================== Find3M ====================

    2009-07-02 21:14 137,888 a------- c:\windows\system32\drivers\PnkBstrK.sys
    2009-07-02 21:14 189,288 a------- c:\windows\system32\PnkBstrB.exe
    2009-07-02 21:04 139,152 a------- c:\docume~1\family\applic~1\PnkBstrK.sys
    2009-07-02 21:03 75,064 a------- c:\windows\system32\PnkBstrA.exe
    2009-07-02 21:03 3,273,512 a------- c:\windows\system32\pbsvc.exe
    2009-06-25 23:20 86,016 a------- c:\windows\system32\OpenAL32.dll
    2009-06-16 10:36 119,808 a------- c:\windows\system32\t2embed.dll
    2009-06-16 10:36 81,920 a------- c:\windows\system32\fontsub.dll
    2009-06-16 10:36 119,808 -------- c:\windows\system32\dllcache\t2embed.dll
    2009-06-16 10:36 81,920 -------- c:\windows\system32\dllcache\fontsub.dll
    2009-06-03 15:09 1,291,264 a------- c:\windows\system32\quartz.dll
    2009-06-03 15:09 1,291,264 -------- c:\windows\system32\dllcache\quartz.dll
    2009-05-12 01:11 102,912 -------- c:\windows\system32\dllcache\iecompat.dll
    2009-05-07 11:32 345,600 a------- c:\windows\system32\localspl.dll
    2009-05-07 11:32 345,600 -------- c:\windows\system32\dllcache\localspl.dll
    2009-05-05 18:31 2,402,304 a------- c:\windows\system32\x264vfw.dll
    2009-04-30 17:22 12,800 -------- c:\windows\system32\dllcache\xpshims.dll
    2009-04-30 17:22 246,272 -------- c:\windows\system32\dllcache\ieproxy.dll
    2009-04-29 00:56 827,392 a------- c:\windows\system32\wininet.dll
    2009-04-29 00:56 827,392 a------- c:\windows\system32\dllcache\wininet.dll
    2009-04-29 00:56 233,472 a------- c:\windows\system32\dllcache\webcheck.dll
    2009-04-29 00:56 1,159,680 a------- c:\windows\system32\dllcache\urlmon.dll
    2009-04-29 00:56 671,232 a------- c:\windows\system32\dllcache\mstime.dll
    2009-04-29 00:56 105,984 a------- c:\windows\system32\dllcache\url.dll
    2009-04-29 00:56 102,912 a------- c:\windows\system32\dllcache\occache.dll
    2009-04-29 00:56 44,544 a------- c:\windows\system32\dllcache\pngfilt.dll
    2009-04-29 00:56 3,596,288 a------- c:\windows\system32\dllcache\mshtml.dll
    2009-04-29 00:56 477,696 a------- c:\windows\system32\dllcache\mshtmled.dll
    2009-04-29 00:56 193,024 a------- c:\windows\system32\dllcache\msrating.dll
    2009-04-28 05:05 70,656 a------- c:\windows\system32\dllcache\ie4uinit.exe
    2009-04-28 05:05 13,824 a------- c:\windows\system32\dllcache\ieudinit.exe
    2007-06-27 23:12 389,120 a------- c:\documents and settings\family\GoToAssist_phone__268_en.exe
    2007-01-24 12:06 439,296 a------- c:\documents and settings\family\GoToAssist_phone__317_en.exe
    2006-12-26 13:35 774,144 a------- c:\program files\RngInterstitial.dll
    2006-11-14 23:20 439,296 a------- c:\documents and settings\family\remote.exe
    2005-11-04 15:34 518 a------- c:\program files\Shortcut to Internet Explorer.lnk
    2005-10-24 17:59 939,682 a------- c:\documents and settings\family\slsk157test5.exe
    2008-09-02 00:10 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008090220080903\index.dat

    ============= FINISH: 2:20:22.32 ===============
     
    JusticeNY,
    #2


  3. to hide this advert.

  4. 2009/07/27
    JusticeNY

    JusticeNY Well-Known Member Thread Starter

    Joined:
    2008/12/14
    Messages:
    160
    Likes Received:
    0
    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT

    DDS (Ver_09-06-26.01)

    Microsoft Windows XP Professional
    Boot Device: \Device\HarddiskVolume2
    Install Date: 2004-11-22 8:27:35 PM
    System Uptime: 2009-07-27 2:09:03 AM (0 hours ago)

    Motherboard: Dell Inc. | | 0M3918
    Processor: Intel(R) Pentium(R) 4 CPU 3.00GHz | Microprocessor | 2992/800mhz

    ==== Disk Partitions =========================

    A: is Removable
    C: is FIXED (NTFS) - 71 GiB total, 3.521 GiB free.
    D: is CDROM ()
    G: is Removable

    ==== Disabled Device Manager Items =============

    Class GUID: {4658EE7E-F050-11D1-B6BD-00C04FA372A7}
    Description: Generic Printer
    Device ID: USBPRINT\DELLDELL_PHOTO_AIO_942\7&44CC761&0&USB001
    Manufacturer: Printer Vendor
    Name: Generic Printer
    PNP Device ID: USBPRINT\DELLDELL_PHOTO_AIO_942\7&44CC761&0&USB001
    Service: scsiprnt

    Class GUID: {4D36E96C-E325-11CE-BFC1-08002BE10318}
    Description: Unimodem Half-Duplex Audio Device
    Device ID: MODEMWAVE\0\{214BC608-66E4-48C3-9575-5F2B5E90A128}
    Manufacturer: Microsoft
    Name: Unimodem Half-Duplex Audio Device
    PNP Device ID: MODEMWAVE\0\{214BC608-66E4-48C3-9575-5F2B5E90A128}
    Service: MODEMCSA

    ==== System Restore Points ===================

    RP1527: 2009-07-04 10:21:58 AM - System Checkpoint
    RP1528: 2009-07-06 10:49:34 AM - System Checkpoint
    RP1529: 2009-07-07 11:46:36 AM - System Checkpoint
    RP1530: 2009-07-08 1:11:16 PM - System Checkpoint
    RP1531: 2009-07-12 9:38:11 AM - System Checkpoint
    RP1532: 2009-07-14 5:52:25 PM - Software Distribution Service 3.0
    RP1533: 2009-07-15 6:02:27 AM - Software Distribution Service 3.0
    RP1534: 2009-07-16 9:08:34 PM - System Checkpoint
    RP1535: 2009-07-19 6:06:19 PM - System Checkpoint
    RP1536: 2009-07-20 9:21:45 PM - System Checkpoint
    RP1537: 2009-07-22 11:28:07 AM - System Checkpoint
    RP1538: 2009-07-23 3:46:49 PM - System Checkpoint
    RP1539: 2009-07-24 6:59:17 PM - System Checkpoint
    RP1540: 2009-07-26 7:06:52 PM - System Checkpoint

    ==== Installed Programs ======================

    3D Groove Playback Engine
    7-Zip 4.65
    AA3Deploy
    Acrobat.com
    Ad Muncher
    Adobe AIR
    Adobe Anchor Service CS3
    Adobe Asset Services CS3
    Adobe Bridge CS3
    Adobe Bridge Start Meeting
    Adobe Camera Raw 4.0
    Adobe CMaps
    Adobe Color - Photoshop Specific
    Adobe Color Common Settings
    Adobe Color EU Extra Settings
    Adobe Color JA Extra Settings
    Adobe Color NA Recommended Settings
    Adobe Default Language CS3
    Adobe Device Central CS3
    Adobe Dreamweaver CS3
    Adobe ExtendScript Toolkit 2
    Adobe Extension Manager CS3
    Adobe Flash Player 10 ActiveX
    Adobe Flash Player 10 Plugin
    Adobe Fonts All
    Adobe Help Viewer CS3
    Adobe Linguistics CS3
    Adobe PDF Library Files
    Adobe Photoshop CS3
    Adobe Reader 9.1
    Adobe Setup
    Adobe Shockwave Player
    Adobe Stock Photos CS3
    Adobe Type Support
    Adobe Update Manager CS3
    Adobe Version Cue CS3 Client
    Adobe WinSoft Linguistics Plugin
    Adobe XMP Panels CS3
    AIM 6
    Aim Plugin for QQ Games
    Any Video Converter 2.7.4
    AOL Uninstaller (Choose which Products to Remove)
    Apple Mobile Device Support
    Apple Software Update
    Ashampoo Burning Studio 6 FREE
    Ask Toolbar
    ATI - Software Uninstall Utility
    ATI AVIVO Codecs
    ATI Catalyst Control Center
    ATI Display Driver
    Audacity 1.2.6
    Authentium AntiVirus SDK - 2
    Avidemux 2.4
    Bonjour
    Call of Duty(R) 4 - Modern Warfare(TM) 1.1 Patch
    Call of Duty(R) 4 - Modern Warfare(TM) 1.3 Patch
    Call of Duty(R) 4 - Modern Warfare(TM) 1.4 Patch
    Call of Duty(R) 4 - Modern Warfare(TM) 1.5 Multiplayer Patch
    Call of Duty(R) 4 - Modern Warfare(TM) 1.6 Patch
    Call of Duty(R) 4 - Modern Warfare(TM) 1.7 Patch
    Camtasia Studio 6
    Catalyst Control Center - Branding
    Catalyst Control Center Core Implementation
    Catalyst Control Center Graphics Full Existing
    Catalyst Control Center Graphics Full New
    Catalyst Control Center Graphics Light
    Catalyst Control Center Graphics Previews Common
    Catalyst Control Center HydraVision Full
    ccc-core-preinstall
    ccc-core-static
    ccc-utility
    CCC Help English
    Choice Guard
    Conexant D850 56K V.9x DFVc Modem
    Coupon Printer for Windows
    Critical Update for Windows Media Player 11 (KB959772)
    Default
    Dell Digital Jukebox Driver
    Dell Driver Reset Tool
    Dell Photo AIO Printer 942
    Dell ResourceCD
    Dell Support 5.0.0 (630)
    Digital Line Detect
    DIGOpt
    DIGReqEx
    EarthLink MDAC
    EarthLink TAR
    EasyCleaner
    ebgcInfra
    ebgcRes
    ebgcSDK
    ESET Smart Security
    Garmin Communicator Plugin
    Garmin USB Drivers
    GIMP 2.4.5
    Google Toolbar for Internet Explorer
    GTactix
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
    Hotfix for Windows Internet Explorer 7 (KB947864)
    Hotfix for Windows Media Format 11 SDK (KB929399)
    Hotfix for Windows Media Player 11 (KB939683)
    Hotfix for Windows XP (KB952287)
    Hotfix for Windows XP (KB954550-v5)
    Hotfix for Windows XP (KB961118)
    Image Grabber II.NET
    Intel RSX 3D
    Intel(R) Graphics Media Accelerator Driver
    Intel(R) PRO Network Adapters and Drivers
    Intel(R) PROSet for Wired Connections
    Internet Explorer Default Page
    iTunes
    Java(TM) 6 Update 7
    Java(TM) SE Runtime Environment 6
    K-Lite Mega Codec Pack 4.8.5
    Macromedia Extension Manager
    Macromedia Flash 8 Video Encoder
    Malwarebytes' Anti-Malware
    Managed DirectX (0901)
    ManyCam 2.4 (remove only)
    MathPlayer
    McAfee Shredder
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1 Hotfix (KB928366)
    Microsoft .NET Framework 2.0 Service Pack 2
    Microsoft .NET Framework 3.0 Service Pack 2
    Microsoft .NET Framework 3.5 SP1
    Microsoft Application Error Reporting
    Microsoft Compression Client Pack 1.0 for Windows XP
    Microsoft Internationalized Domain Names Mitigation APIs
    Microsoft National Language Support Downlevel APIs
    Microsoft Office Professional Edition 2003
    Microsoft Plus! Digital Media Edition Installer
    Microsoft Plus! Photo Story 2 LE
    Microsoft User-Mode Driver Framework Feature Pack 1.0
    Microsoft VC9 runtime libraries
    Microsoft Visual C++ 2005 Redistributable
    Microsoft XML Parser
    mIRC
    Mouse Suite
    Move Networks Media Player for Internet Explorer
    Mozilla ActiveX Control v1.7.12
    Mozilla Firefox (3.0.10)
    MSN
    MSN Encarta Plus Support Files
    MSN Music Assistant
    MSSoap
    MSVCRT
    MSXML 4.0 SP2 (KB927978)
    MSXML 4.0 SP2 (KB936181)
    MSXML 4.0 SP2 (KB954430)
    MSXML 4.0 SP2 Parser and SDK
    MSXML4 Parser
    NetWaiting
    Nvu 1.0
    Opera 10.00
    PDF Settings
    PPSDKRedistributables
    PunkBuster Services
    QQ BlackJack
    QQ Bubble Arena
    QQ Games
    QQ Gold Sweeper
    QQ Hearts
    QQ Mah-jong
    QQ Match Master
    QQ Pool
    QQ Puzzle
    QQ Puzzle Dasher
    QQ Robo
    QQ Texas Hold'em
    QQ Treasure Hunter
    QuickTime
    Radialpoint Security Services
    Recover Files 2.1
    Rosetta Stone V3
    Screen Recorder Gold
    Security Update for CAPICOM (KB931906)
    Security Update for Step By Step Interactive Training (KB898458)
    Security Update for Step By Step Interactive Training (KB923723)
    Security Update for Windows Internet Explorer 7 (KB942615)
    Security Update for Windows Internet Explorer 7 (KB944533)
    Security Update for Windows Internet Explorer 7 (KB950759)
    Security Update for Windows Internet Explorer 7 (KB953838)
    Security Update for Windows Internet Explorer 7 (KB956390)
    Security Update for Windows Internet Explorer 7 (KB958215)
    Security Update for Windows Internet Explorer 7 (KB960714)
    Security Update for Windows Internet Explorer 7 (KB961260)
    Security Update for Windows Internet Explorer 7 (KB963027)
    Security Update for Windows Internet Explorer 7 (KB969897)
    Security Update for Windows Media Player (KB911564)
    Security Update for Windows Media Player (KB952069)
    Security Update for Windows Media Player 10 (KB911565)
    Security Update for Windows Media Player 11 (KB936782)
    Security Update for Windows Media Player 11 (KB954154)
    Security Update for Windows Media Player 6.4 (KB925398)
    Security Update for Windows XP (KB923561)
    Security Update for Windows XP (KB938464)
    Security Update for Windows XP (KB941569)
    Security Update for Windows XP (KB946648)
    Security Update for Windows XP (KB950760)
    Security Update for Windows XP (KB950762)
    Security Update for Windows XP (KB950974)
    Security Update for Windows XP (KB951066)
    Security Update for Windows XP (KB951376-v2)
    Security Update for Windows XP (KB951376)
    Security Update for Windows XP (KB951698)
    Security Update for Windows XP (KB951748)
    Security Update for Windows XP (KB952004)
    Security Update for Windows XP (KB952954)
    Security Update for Windows XP (KB953839)
    Security Update for Windows XP (KB954211)
    Security Update for Windows XP (KB954459)
    Security Update for Windows XP (KB954600)
    Security Update for Windows XP (KB955069)
    Security Update for Windows XP (KB956391)
    Security Update for Windows XP (KB956572)
    Security Update for Windows XP (KB956802)
    Security Update for Windows XP (KB956803)
    Security Update for Windows XP (KB956841)
    Security Update for Windows XP (KB957095)
    Security Update for Windows XP (KB957097)
    Security Update for Windows XP (KB958644)
    Security Update for Windows XP (KB958687)
    Security Update for Windows XP (KB958690)
    Security Update for Windows XP (KB959426)
    Security Update for Windows XP (KB960225)
    Security Update for Windows XP (KB960715)
    Security Update for Windows XP (KB960803)
    Security Update for Windows XP (KB961371)
    Security Update for Windows XP (KB961373)
    Security Update for Windows XP (KB961501)
    Security Update for Windows XP (KB968537)
    Security Update for Windows XP (KB969898)
    Security Update for Windows XP (KB970238)
    Security Update for Windows XP (KB971633)
    Security Update for Windows XP (KB973346)
    Segoe UI
    Skins
    System Requirements Lab
    Tweak UI
    Ulead GIF Animator
    Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
    Update for Windows XP (KB951072-v2)
    Update for Windows XP (KB951978)
    Update for Windows XP (KB955839)
    Update for Windows XP (KB961503)
    Update for Windows XP (KB967715)
    VC 9.0 Runtime
    VDownloader 0.74
    Verizon Broadband Toolbar
    Verizon Online Help and Support
    Verizon PC Security Checkup
    Video Thumbnails Maker by Scorp (remove only)
    Video to iPod MP4 PSP 3GP Converter
    VideoAvatar
    Viewpoint Media Player
    Viewpoint Toolbar
    Virtual Villagers 3 The Secret City
    VirtualDub Filter Pack 1.1
    Vista Anthracite Pack - UltraLite 1.31
    VLC media player 0.9.8a
    WebcamMax
    WebFldrs XP
    Windows Defender Signatures
    Windows Genuine Advantage Notifications (KB905474)
    Windows Imaging Component
    Windows Internet Explorer 7
    Windows Live Call
    Windows Live Communications Platform
    Windows Live Essentials
    Windows Live Messenger
    Windows Live Sign-in Assistant
    Windows Live Upload Tool
    Windows Media Format 11 runtime
    Windows Media Player 10
    Windows Media Player 11
    Windows Resource Kit Tools - SubInAcl.exe
    Windows XP Service Pack 3
    WinRAR archiver
    WinZip 11.2
    WordPerfect Office 12
    XML Paper Specification Shared Components Pack 1.0
    Yahoo! Messenger
    Zilla Data Nuker 2.0.0.0

    ==== Event Viewer Messages From Past Week ========

    2009-07-27 2:10:06 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: abp480n5 adpu160m agp440 agpCPQ Aha154x aic78u2 aic78xx AliIde alim1541 amdagp amsint asc asc3350p asc3550 cbidf cd20xrnt CmdIde Cpqarray dac2w2k dac960nt dpti2o hpn i2omp ini910u IntelIde mraid35x perc2 perc2hib ql1080 Ql10wnt ql12160 ql1240 ql1280 rxp sisagp Sparrow symc810 symc8xx sym_hi sym_u3 TosIde ultra viaagp ViaIde
    2009-07-27 1:38:52 AM, error: Service Control Manager [7034] - The WebClient service terminated unexpectedly. It has done this 1 time(s).
    2009-07-25 5:46:41 PM, error: Service Control Manager [7034] - The TCP/IP NetBIOS Helper service terminated unexpectedly. It has done this 1 time(s).
    2009-07-25 5:46:41 PM, error: Service Control Manager [7031] - The Remote Registry service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 1000 milliseconds: Restart the service.
    2009-07-25 4:49:52 AM, error: Service Control Manager [7034] - The Machine Debug Manager service terminated unexpectedly. It has done this 4 time(s).
    2009-07-24 3:49:01 PM, error: Service Control Manager [7031] - The Print Spooler service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
    2009-07-23 5:00:58 AM, error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 6 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
    2009-07-23 4:24:47 AM, error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 5 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
    2009-07-23 4:19:04 AM, error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 4 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
    2009-07-23 3:30:37 PM, error: Dhcp [1002] - The IP address lease 192.168.0.2 for the Network Card with network address 0011115E3115 has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message).
    2009-07-22 5:53:39 PM, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service upnphost with arguments " " in order to run the server: {204810B9-73B2-11D4-BF42-00B0D0118B56}
    2009-07-22 5:43:36 PM, error: Service Control Manager [7034] - The PnkBstrA service terminated unexpectedly. It has done this 1 time(s).
    2009-07-22 5:43:34 PM, error: Service Control Manager [7034] - The Viewpoint Manager Service service terminated unexpectedly. It has done this 1 time(s).
    2009-07-22 5:43:31 PM, error: Service Control Manager [7034] - The dvpapi service terminated unexpectedly. It has done this 1 time(s).
    2009-07-22 5:43:29 PM, error: Service Control Manager [7034] - The Machine Debug Manager service terminated unexpectedly. It has done this 1 time(s).
    2009-07-22 5:43:22 PM, error: Service Control Manager [7034] - The Ati HotKey Poller service terminated unexpectedly. It has done this 1 time(s).
    2009-07-22 5:43:20 PM, error: Service Control Manager [7034] - The dlbu_device service terminated unexpectedly. It has done this 1 time(s).
    2009-07-22 5:43:15 PM, error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
    2009-07-22 5:43:13 PM, error: Service Control Manager [7034] - The Bonjour Service service terminated unexpectedly. It has done this 1 time(s).
    2009-07-22 5:43:11 PM, error: Service Control Manager [7034] - The PnkBstrB service terminated unexpectedly. It has done this 1 time(s).
    2009-07-22 5:43:05 PM, error: Service Control Manager [7034] - The iPod Service service terminated unexpectedly. It has done this 1 time(s).
    2009-07-22 5:43:00 PM, error: Service Control Manager [7031] - The Windows CardSpace service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
    2009-07-22 2:27:37 AM, error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
    2009-07-22 11:12:13 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: rxp
    2009-07-22 11:12:13 AM, error: Service Control Manager [7000] - The X4HSX32 service failed to start due to the following error: The system cannot find the path specified.
    2009-07-20 9:58:20 PM, error: Service Control Manager [7034] - The LexBce Server service terminated unexpectedly. It has done this 2 time(s).
    2009-07-20 9:58:12 PM, error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 3 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
    2009-07-20 8:53:19 PM, error: Service Control Manager [7034] - The Machine Debug Manager service terminated unexpectedly. It has done this 2 time(s).
    2009-07-20 4:15:18 PM, error: Service Control Manager [7034] - The LexBce Server service terminated unexpectedly. It has done this 1 time(s).
    2009-07-20 11:58:52 PM, error: Service Control Manager [7034] - The Windows Image Acquisition (WIA) service terminated unexpectedly. It has done this 1 time(s).
    2009-07-20 1:12:01 AM, error: Service Control Manager [7034] - The Machine Debug Manager service terminated unexpectedly. It has done this 3 time(s).

    ==== End Of File ===========================
     
    JusticeNY,
    #3
  5. 2009/07/27
    JusticeNY

    JusticeNY Well-Known Member Thread Starter

    Joined:
    2008/12/14
    Messages:
    160
    Likes Received:
    0
    all the terminated unexpectedly were done by me i usually close all the programs i dont need
     
    JusticeNY,
    #4
  6. 2009/07/27
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Please download ComboFix from [color= "Red"]Here[/color] or [color= "#FF0000"]Here[/color] to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    1. Please, never rename Combofix unless instructed.
    2. Close any open browsers.
    3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
      • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results ".
      • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
      • Close any open browsers.
      • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
      • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
      • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
    4. Double click on combofix.exe & follow the prompts.
    5. When finished, it will produce a report for you.
    6. Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.
    **Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

    Make sure, you re-enable your security programs, when you're done with Combofix.
     
    broni,
    #5
  7. 2009/07/27
    JusticeNY

    JusticeNY Well-Known Member Thread Starter

    Joined:
    2008/12/14
    Messages:
    160
    Likes Received:
    0
    ComboFix 09-07-27.02 - Family 2009-07-27 20:08.3.2 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1534.1016 [GMT -4:00]
    Running from: c:\documents and settings\family\Desktop\ComboFix.exe
    AV: Avira AntiVir PersonalEdition Classic *On-access scanning disabled* (Updated) {815F7464-FFA4-00DE-0D24-347CA8A3377C}
    AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8A1757F4-FFA4-00EF-0D24-347CA8A3377C}
    AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8A17C51C-FFA4-00EF-0D24-347CA8A3377C}
    AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8A24A9D4-FFA4-00EF-0D24-347CA8A3377C}
    AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8A2624B4-FFA4-00EF-0D24-347CA8A3377C}
    AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {BADB0D00-FFA4-00EF-0D24-347CA8A3377C}
    AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FFFFFFFF-FFA4-00EF-0D24-347CA8A3377C}
    AV: ESET Smart Security 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
    FW: ESET Personal firewall *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\windows\COUPON~1.OCX
    c:\windows\CouponPrinter.ocx
    c:\windows\Installer\11f5bc8.msi
    c:\windows\Installer\11f5bc9.msp
    c:\windows\Installer\11f5bca.msp
    c:\windows\Installer\11f5bcb.msp
    c:\windows\Installer\11f5bcc.msp
    c:\windows\Installer\11f5bcd.msp
    c:\windows\Installer\11f5bce.msp
    c:\windows\Installer\11f5bcf.msp
    c:\windows\Installer\11f5bd0.msp
    c:\windows\Installer\11f5bd1.msp
    c:\windows\Installer\11f5bd2.msp
    c:\windows\Installer\22917c.msp
    c:\windows\Installer\42ec4f1.msi
    c:\windows\Installer\WMEncoder.msi
    c:\windows\system32\BSTIEPrintCtl1.dll
    c:\windows\system32\Plugins
    c:\windows\system32\Plugins\NPLeechGet.dll

    .
    ((((((((((((((((((((((((( Files Created from 2009-06-28 to 2009-07-28 )))))))))))))))))))))))))))))))
    .

    2009-07-27 05:46 . 2009-07-27 05:46 -------- d-----w- c:\documents and settings\family\Application Data\Malwarebytes
    2009-07-27 05:45 . 2009-07-13 17:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2009-07-27 05:45 . 2009-07-27 05:45 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
    2009-07-27 05:45 . 2009-07-13 17:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
    2009-07-27 05:45 . 2009-07-27 05:46 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2009-07-27 05:33 . 2009-07-27 05:33 -------- d-----w- c:\documents and settings\family\Local Settings\Application Data\ESET
    2009-07-25 21:23 . 2009-07-25 21:23 -------- d-----w- c:\documents and settings\family\Local Settings\Application Data\WorldWinner.com
    2009-07-19 03:39 . 2004-08-04 03:00 138752 ----a-w- c:\windows\system32\sndvol32.exe
    2009-07-19 03:39 . 2004-08-04 03:00 138752 ----a-w- c:\windows\system32\dllcache\sndvol32.exe
    2009-07-18 06:25 . 2004-05-06 21:47 159744 ----a-w- c:\windows\system32\igfxres.dll
    2009-07-16 02:58 . 2009-07-16 02:58 -------- d-----w- c:\documents and settings\family\Local Settings\Application Data\Yahoo
    2009-07-16 02:52 . 2009-07-16 02:58 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo!
    2009-07-16 02:52 . 2009-05-26 23:50 607472 ----a-w- c:\documents and settings\All Users\Application Data\Yahoo!\YUpdater\yupdater.exe
    2009-07-10 19:30 . 2009-07-10 19:30 -------- d-----w- c:\program files\iPod
    2009-07-10 19:30 . 2009-07-10 19:30 -------- d-----w- c:\program files\iTunes
    2009-07-10 19:30 . 2009-07-10 19:30 -------- d-----w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
    2009-07-10 19:18 . 2009-07-10 19:18 75048 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.2.0.23\SetupAdmin.exe
    2009-07-01 06:57 . 2009-07-01 06:57 -------- d-----w- c:\program files\USArmy
    2009-07-01 06:25 . 2009-07-03 01:31 -------- d-----w- c:\documents and settings\family\Local Settings\Application Data\AA3DeployClient
    2009-07-01 06:25 . 2009-07-03 00:52 -------- d-----w- c:\documents and settings\All Users\Application Data\AA3DeployClient

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-07-27 22:16 . 2008-05-21 17:54 -------- d-----w- c:\program files\MZILLA
    2009-07-23 06:52 . 2009-05-12 06:32 -------- d-----w- c:\program files\Avidemux 2.4
    2009-07-22 21:51 . 2009-05-12 06:33 -------- d-----w- c:\documents and settings\family\Application Data\avidemux
    2009-07-22 06:39 . 2009-06-27 01:09 -------- d-----w- c:\program files\ManyCam 2.4
    2009-07-17 02:00 . 2008-12-18 10:03 -------- d-----w- c:\documents and settings\family\Application Data\dvdcss
    2009-07-16 02:52 . 2006-12-28 18:22 -------- d-----w- c:\program files\Yahoo!
    2009-07-12 08:58 . 2008-12-18 03:38 -------- d-----w- c:\documents and settings\family\Application Data\vlc
    2009-07-10 19:30 . 2007-07-06 19:15 -------- d-----w- c:\program files\Common Files\Apple
    2009-07-10 19:26 . 2007-07-24 18:26 -------- d-----w- c:\program files\Bonjour
    2009-07-10 19:26 . 2004-11-18 04:32 -------- d-----w- c:\program files\QuickTime
    2009-07-04 16:43 . 2005-12-29 18:38 -------- d-----w- c:\program files\Google
    2009-07-03 06:14 . 2009-05-20 08:26 -------- d-----w- c:\documents and settings\family\Application Data\Any Video Converter
    2009-07-03 01:14 . 2007-03-16 04:28 137888 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
    2009-07-03 01:14 . 2007-03-16 04:28 189288 ----a-w- c:\windows\system32\PnkBstrB.exe
    2009-07-03 01:04 . 2007-11-16 20:01 139152 ----a-w- c:\documents and settings\family\Application Data\PnkBstrK.sys
    2009-07-03 01:04 . 2007-11-16 20:01 139152 ----a-w- c:\documents and settings\family\Application Data\PnkBstrK.sys
    2009-07-03 01:03 . 2007-03-16 04:28 75064 ----a-w- c:\windows\system32\PnkBstrA.exe
    2009-07-03 01:03 . 2008-10-29 04:46 3273512 ----a-w- c:\windows\system32\pbsvc.exe
    2009-07-03 00:04 . 2008-12-11 03:11 -------- d-----w- c:\documents and settings\All Users\Application Data\Rosetta Stone
    2009-07-01 08:22 . 2008-10-23 19:17 -------- d-----w- c:\documents and settings\All Users\Application Data\America's Army Deploy Client
    2009-07-01 01:48 . 2004-11-23 01:29 175168 ----a-w- c:\documents and settings\family\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
    2009-06-27 01:10 . 2009-06-27 01:10 -------- d-----w- c:\program files\Ask.com
    2009-06-26 21:40 . 2009-06-26 21:40 -------- d-----w- c:\program files\VD Filter Pack
    2009-06-26 04:58 . 2009-06-14 03:39 -------- d-----w- c:\documents and settings\All Users\Application Data\WebcamMax
    2009-06-26 03:28 . 2004-11-18 04:29 -------- d--h--w- c:\program files\InstallShield Installation Information
    2009-06-26 03:27 . 2009-06-26 03:20 -------- d-----w- c:\program files\Jahshaka
    2009-06-26 03:26 . 2009-06-26 03:20 -------- d-----w- c:\program files\OpenLibraries
    2009-06-26 03:20 . 2006-12-24 04:41 86016 ----a-w- c:\windows\system32\OpenAL32.dll
    2009-06-26 02:36 . 2005-11-11 22:02 -------- d-----w- c:\program files\Microsoft Works
    2009-06-26 02:33 . 2009-06-26 02:33 -------- d-----w- c:\program files\Microsoft CAPICOM 2.1.0.2
    2009-06-25 02:42 . 2009-06-25 02:42 -------- d-----w- c:\program files\Microsoft
    2009-06-25 02:42 . 2009-06-25 02:41 -------- d-----w- c:\program files\Windows Live
    2009-06-25 02:42 . 2009-06-25 02:42 -------- d-----w- c:\program files\Windows Live SkyDrive
    2009-06-25 02:37 . 2009-06-25 02:37 -------- d-----w- c:\program files\Common Files\Windows Live
    2009-06-22 09:03 . 2009-05-12 06:19 -------- d-----w- c:\documents and settings\family\Application Data\gtk-2.0
    2009-06-16 14:36 . 2004-08-04 11:00 81920 ----a-w- c:\windows\system32\fontsub.dll
    2009-06-16 14:36 . 2004-08-04 11:00 119808 ----a-w- c:\windows\system32\t2embed.dll
    2009-06-14 03:39 . 2009-06-14 03:37 -------- d-----w- c:\documents and settings\family\Application Data\Webcammax
    2009-06-14 03:37 . 2009-06-14 03:36 -------- d-----w- c:\program files\WebcamMax
    2009-06-10 07:24 . 2009-05-20 08:26 -------- d-----w- c:\program files\Any Video Converter
    2009-06-08 23:21 . 2009-06-08 23:21 -------- d-----w- c:\program files\Opera 10 Beta
    2009-06-08 02:59 . 2009-06-08 02:56 -------- d-----w- c:\program files\Ad Muncher
    2009-06-07 21:02 . 2009-06-07 21:02 -------- d-----w- c:\documents and settings\family\Application Data\Xilisoft Corporation
    2009-06-03 19:09 . 2004-08-04 11:00 1291264 ----a-w- c:\windows\system32\quartz.dll
    2009-05-31 21:43 . 2009-05-31 21:42 -------- d-----w- c:\program files\AIM6
    2009-05-31 21:38 . 2004-11-18 04:32 -------- d-----w- c:\program files\Viewpoint
    2009-05-31 21:28 . 2009-05-31 21:28 -------- d-----w- c:\documents and settings\All Users\Application Data\AIM
    2009-05-31 21:27 . 2004-11-18 04:31 -------- d-----w- c:\documents and settings\All Users\Application Data\AOL
    2009-05-24 02:44 . 2009-05-02 04:34 17542 ----a-r- c:\documents and settings\family\Application Data\Microsoft\Installer\{F343FA04-CFC0-487C-A617-A5E8CF4D7B10}\_96E62DE38A7F692104A23B.exe
    2009-05-24 02:44 . 2009-05-02 04:34 17542 ----a-r- c:\documents and settings\family\Application Data\Microsoft\Installer\{F343FA04-CFC0-487C-A617-A5E8CF4D7B10}\_640ECEF665E5906E76DC9D.exe
    2009-05-16 16:17 . 2009-05-16 16:17 10557936 ----a-w- c:\documents and settings\All Users\Application Data\Tencent\QQ Games\Download\QQTexas.exe
    2009-05-07 15:32 . 2004-08-04 11:00 345600 ----a-w- c:\windows\system32\localspl.dll
    2009-05-05 22:31 . 2009-05-21 01:29 2402304 ----a-w- c:\windows\system32\x264vfw.dll
    2009-04-30 23:39 . 2009-04-30 23:39 2268376 ----a-w- c:\documents and settings\All Users\Application Data\Tencent\QQ Games\Download\GoldSweeper.exe
    2009-04-29 04:56 . 2004-08-04 11:00 827392 ----a-w- c:\windows\system32\wininet.dll
    2009-04-29 04:55 . 2009-04-29 04:55 78336 ----a-w- c:\windows\system32\ieencode.dll
    2006-12-26 17:35 . 2006-12-26 17:36 774144 ----a-w- c:\program files\RngInterstitial.dll
    2005-11-04 19:34 . 2005-11-04 19:34 518 ----a-w- c:\program files\Shortcut to Internet Explorer.lnk
    2008-05-12 19:59 . 2008-05-21 17:32 134144 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
    2008-04-07 06:59 . 2008-05-21 17:52 67696 ----a-w- c:\program files\mozilla firefox\components\jar50.dll
    2008-04-07 06:59 . 2008-05-21 17:52 54376 ----a-w- c:\program files\mozilla firefox\components\jsd3250.dll
    2008-04-07 06:59 . 2008-05-21 17:52 34952 ----a-w- c:\program files\mozilla firefox\components\myspell.dll
    2008-04-07 06:59 . 2008-05-21 17:52 46720 ----a-w- c:\program files\mozilla firefox\components\spellchk.dll
    2008-04-07 06:59 . 2008-05-21 17:52 172144 ----a-w- c:\program files\mozilla firefox\components\xpinstal.dll
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
    2009-02-26 15:25 809864 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    "{D4027C7F-154A-4066-A1AD-4243D8127440} "= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-02-26 809864]

    [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
    [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
    [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
    [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
    "{D4027C7F-154A-4066-A1AD-4243D8127440} "= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-02-26 809864]

    [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
    [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
    [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
    [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "egui "= "c:\program files\ESET\ESET Smart Security\egui.exe" [2009-03-19 2029640]
    "Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
    "QuickTime Task "= "c:\program files\QuickTime\qttask.exe" [2009-05-26 413696]
    "iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2009-06-05 292136]
    "IgfxTray "= "c:\windows\system32\igfxtray.exe" [2004-05-06 155648]
    "HotKeysCmds "= "c:\windows\system32\hkcmd.exe" [2004-05-06 118784]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    "RunNarrator "= "Narrator.exe" - c:\windows\SYSTEM32\narrator.exe [2008-04-14 53760]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "iPod Service "=3 (0x3)

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
    "DisableMonitoring "=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall "= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "c:\\Program Files\\AIM\\aim.exe "=
    "c:\\WINDOWS\\SYSTEM32\\Lexpps.exe "=
    "c:\\Program Files\\Mozilla Firefox\\firefox.exe "=
    "c:\\WINDOWS\\SYSTEM32\\DPVSETUP.EXE "=
    "c:\\Black III\\uSED\\mIRC\\mirc.exe "=
    "c:\\Program Files\\Windows Media Player\\wmplayer.exe "=
    "c:\\Program Files\\MSN\\MSNCoreFiles\\msn.exe "=
    "c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe "=
    "c:\\Program Files\\Common Files\\AOL\\1154459043\\ee\\aolsoftware.exe "=
    "c:\\Program Files\\Common Files\\AOL\\1154459043\\ee\\aim6.exe "=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe "=
    "c:\\Program Files\\AIM6\\aim6.exe "=
    "c:\\WINDOWS\\SYSTEM32\\PnkBstrA.exe "=
    "c:\\WINDOWS\\SYSTEM32\\PnkBstrB.exe "=
    "c:\\Program Files\\MZILLA\\firefox.exe "=
    "c:\\Program Files\\Java\\jre1.6.0_07\\bin\\javaw.exe "=
    "c:\\Documents and Settings\\All Users\\Application Data\\NexonUS\\NGM\\NGM.exe "=
    "%windir%\\system32\\sessmgr.exe "=
    "c:\\Program Files\\Rosetta Stone\\Rosetta Stone V3\\RosettaStoneVersion3.exe "=
    "c:\\Program Files\\Rosetta Stone\\Rosetta Stone V3\\support\\bin\\RosettaStoneLtdServices.exe "=
    "c:\\Program Files\\Tencent\\QQ Games\\QQGames.exe "=
    "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe "=
    "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
    "c:\\Program Files\\Bonjour\\mDNSResponder.exe "=
    "c:\\Program Files\\iTunes\\iTunes.exe "=
    "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe "=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "1716:TCP "= 1716:TCP:America's Army
    "1717:TCP "= 1717:TCP:Gamequery
    "1718:TCP "= 1718:TCP:Master Server
    "8777:TCP "= 8777:TCP:Standard Ut
    "27900:TCP "= 27900:TCP:GameSpy
    "14200:UDP "= 14200:UDP:authorization server and MBS browser
    "20048:UDP "= 20048:UDP:DCDS
    "7463:TCP "= 7463:TCP:BitComet 7463 TCP
    "7463:UDP "= 7463:UDP:BitComet 7463 UDP
    "60704:TCP "= 60704:TCP:emule
    "29305:UDP "= 29305:UDP:emule
    "<NO NAME> "=

    R1 ehdrv;ehdrv;c:\windows\SYSTEM32\DRIVERS\ehdrv.sys [2009-03-19 107256]
    R2 CAMTHWDM;WebcamMax, WDM Video Capture;c:\windows\SYSTEM32\DRIVERS\CAMTHWDM.sys [2009-06-13 941784]
    R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [2009-03-19 731840]
    R3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\SYSTEM32\DRIVERS\ManyCam.sys [2008-01-14 6:06 AM 21632]
    R3 pelmouse;Mouse Suite Driver;c:\windows\SYSTEM32\DRIVERS\PELMOUSE.SYS [2004-11-29 27088]
    R3 pelusblf;USB Mouse Low Filter Driver;c:\windows\SYSTEM32\DRIVERS\pelusblf.sys [2004-11-29 12816]
    S1 rxp;rxp; [x]
    S2 sbbotdi;sbbotdi; [x]
    S2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2009-05-31 5:38 PM 24652]
    S3 hamachi_oem;PlayLinc Adapter;c:\windows\SYSTEM32\DRIVERS\gan_adapter.sys [2006-10-19 10664]
    S3 NTProcDrv;Process creation detector for NT.; [x]
    S3 PortTalk;PortTalk;c:\windows\SYSTEM32\DRIVERS\PortTalk.sys [2007-07-04 2:14 PM 3567]
    S3 Radialpoint Security Services;Radialpoint Security Services;c:\windows\SYSTEM32\dllhost.exe [2004-08-04 7:00 AM 5120]
    S3 scsiprnt;Microsoft SCSI/1394 Generic Printer Class;c:\windows\SYSTEM32\DRIVERS\scsiprnt.sys [2004-11-30 7:28 PM 11648]
    .
    Contents of the 'Scheduled Tasks' folder

    2009-06-15 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 16:34]

    2009-07-28 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
    - c:\program files\Ask.com\UpdateTask.exe [2009-02-26 15:25]
    .
    - - - - ORPHANS REMOVED - - - -

    WebBrowser-{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)
    HKCU-Run-Aim - c:\program files\AIM6\aim.exe
    HKCU-Run-Aim6 - (no file)


    .
    ------- Supplementary Scan -------
    .
    uInternet Connection Wizard,ShellNext = iexplore
    uInternet Settings,ProxyOverride = *.local
    uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
    DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
    FF - ProfilePath - c:\documents and settings\family\Application Data\Mozilla\Firefox\Profiles\0iyqlche.default\
    FF - prefs.js: browser.search.selectedEngine - DAEMON Search
    FF - prefs.js: browser.startup.homepage - hxxp://cmonwealth.com/
    FF - component: c:\documents and settings\family\Application Data\Mozilla\Firefox\Profiles\0iyqlche.default\extensions\{1a001dcf-d681-4c09-be1a-e0ad95d3a5b6}\components\FFAlert.dll
    FF - plugin: c:\documents and settings\All Users\Application Data\NexonUS\NGM\npNxGameUS.dll
    FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
    FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
    FF - plugin: c:\program files\MZILLA\plugins\npCouponPrinter.dll
    FF - plugin: c:\program files\MZILLA\plugins\npGoogleGadgetPluginFirefoxWin.dll
    FF - plugin: c:\program files\MZILLA\plugins\npqtplugin8.dll
    FF - plugin: c:\program files\MZILLA\plugins\npViewpoint.dll
    FF - plugin: c:\program files\Opera 10 Beta\program\plugins\npdsplay.dll
    FF - plugin: c:\program files\Opera 10 Beta\program\plugins\NPOFFICE.DLL
    FF - plugin: c:\program files\Opera 10 Beta\program\plugins\npqtplugin.dll
    FF - plugin: c:\program files\Opera 10 Beta\program\plugins\npqtplugin2.dll
    FF - plugin: c:\program files\Opera 10 Beta\program\plugins\npqtplugin3.dll
    FF - plugin: c:\program files\Opera 10 Beta\program\plugins\npqtplugin4.dll
    FF - plugin: c:\program files\Opera 10 Beta\program\plugins\npqtplugin5.dll
    FF - plugin: c:\program files\Opera 10 Beta\program\plugins\npqtplugin6.dll
    FF - plugin: c:\program files\Opera 10 Beta\program\plugins\npqtplugin7.dll
    FF - plugin: c:\program files\Opera 10 Beta\program\plugins\npqtplugin8.dll
    FF - plugin: c:\program files\Opera 10 Beta\program\plugins\npwmsdrm.dll
    FF - plugin: c:\program files\Opera\program\plugins\npdivx32.dll
    FF - plugin: c:\program files\QuickTime\Plugins\npqtplugin8.dll
    FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
    FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

    ---- FIREFOX POLICIES ----
    FF - user.js: network.http.max-persistent-connections-per-server - 4
    FF - user.js: content.max.tokenizing.time - 200000
    FF - user.js: content.notify.interval - 100000
    FF - user.js: content.switch.threshold - 650000
    FF - user.js: nglayout.initialpaint.delay - 300
    .

    **************************************************************************

    driver loading error catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-07-27 20:16
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...


    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------

    [HKEY_USERS\S-1-5-21-2271019165-553755714-499774489-1005\¬ ³*]
    @Allowed: (Read) (RestrictedCode)
    "verticalChoices "= "weatherV "
    "firstLaunch "= "false "
    DUMPHIVE0.003 (REGF)
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'winlogon.exe'(1524)
    c:\windows\system32\Ati2evxx.dll
    .
    Completion time: 2009-07-28 20:20
    ComboFix-quarantined-files.txt 2009-07-28 00:19

    Pre-Run: 3,538,935,808 bytes free
    Post-Run: 4,461,060,096 bytes free

    1391 --- E O F --- 2009-07-15 10:07
     
    JusticeNY,
    #6
  8. 2009/07/27
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    You're running two antivirus programs: Avira, and Eset
    One of them has to go. What's the story here?


    1. Please open Notepad
    • Click Start , then Run
    • Type notepad .exe in the Run Box.

    2. Now copy/paste the entire content of the codebox below into the Notepad window:

    Code:
    File::
c:\windows\SYSTEM32\dllhost.exe


Folder::

Driver::
rxp
Radialpoint Security Services

Registry::

RegLockDel::

    3. Save the above as CFScript.txt

    4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

    [​IMG]


    5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
    • Combofix.txt
    • A new HijackThis log.


    Download HijackThis:
    http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download
    by clicking on Download HijackThis Installer
    Install, and run it.
    Post HijackTHis log.
    Do NOT attempt to fix anything!

    NOTE. If you're using Vista, right click on HijackThis, and click Run as Administrator
     
    broni,
    #7
  9. 2009/07/27
    JusticeNY

    JusticeNY Well-Known Member Thread Starter

    Joined:
    2008/12/14
    Messages:
    160
    Likes Received:
    0
    i deleted anti vir months ago idk why its still showing up
     
    JusticeNY,
    #8
  10. 2009/07/27
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    It's OK, if you say so.
    There may be some minor registry leftovers.
    Please, carry on.
     
    broni,
    #9
  11. 2009/07/27
    JusticeNY

    JusticeNY Well-Known Member Thread Starter

    Joined:
    2008/12/14
    Messages:
    160
    Likes Received:
    0
    ComboFix 09-07-27.02 - Family 2009-07-27 21:58.4.2 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1534.988 [GMT -4:00]
    Running from: c:\documents and settings\family\Desktop\ComboFix.exe
    Command switches used :: c:\documents and settings\family\Desktop\CFScript.txt
    AV: Avira AntiVir PersonalEdition Classic *On-access scanning disabled* (Updated) {815F7464-FFA4-00DE-0D24-347CA8A3377C}
    AV: Avira AntiVir PersonalEdition Classic *On-access scanning disabled* (Updated) {81704054-FFA4-00DE-0D24-347CA8A3377C}
    AV: Avira AntiVir PersonalEdition Classic *On-access scanning disabled* (Updated) {893108C4-FFA4-00EF-0D24-347CA8A3377C}
    AV: Avira AntiVir PersonalEdition Classic *On-access scanning disabled* (Updated) {8974B054-FFA4-00DE-0D24-347CA8A3377C}
    AV: Avira AntiVir PersonalEdition Classic *On-access scanning disabled* (Updated) {89C7B744-FFA4-00EF-0D24-347CA8A3377C}
    AV: Avira AntiVir PersonalEdition Classic *On-access scanning disabled* (Updated) {89D737CC-FFA4-00EF-0D24-347CA8A3377C}
    AV: Avira AntiVir PersonalEdition Classic *On-access scanning disabled* (Updated) {BADB0D00-FFA4-00DE-0D24-347CA8A3377C}
    AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {00000000-0000-0000-0000-000000000000}
    AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {00000246-FFA4-00EF-0D24-347CA8A3377C}
    AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {804DCA0D-FFA4-00EF-0D24-347CA8A3377C}
    AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8140ADDC-FFA4-00DE-0D24-347CA8A3377C}
    AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {81636AA4-FFA4-00DE-0D24-347CA8A3377C}
    AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {816A433C-FFA4-00DE-0D24-347CA8A3377C}
    AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {816B4A0C-FFA4-00DE-0D24-347CA8A3377C}
    AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {816C3054-FFA4-00EF-0D24-347CA8A3377C}
    AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {816C4224-FFA4-00DE-0D24-347CA8A3377C}
    AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {816E3674-FFA4-00DE-0D24-347CA8A3377C}
    AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {816EAB64-FFA4-00DE-0D24-347CA8A3377C}
    AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {816F1A84-FFA4-00DE-0D24-347CA8A3377C}
    AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {817322AC-FFA4-00DE-0D24-347CA8A3377C}
    AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {819449F4-FFA4-00DE-0D24-347CA8A3377C}
    AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {81CF04EC-FFA4-00EF-0D24-347CA8A3377C}
    AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {81D285BC-FFA4-00EF-0D24-347CA8A3377C}
    AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {81D3053C-FFA4-00DE-0D24-347CA8A3377C}
    AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {81D34824-FFA4-00DE-0D24-347CA8A3377C}
    AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {81D6026C-FFA4-00DE-0D24-347CA8A3377C}
    AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {81DAD8D4-FFA4-00DE-0D24-347CA8A3377C}
    AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {81DBC3F4-FFA4-00EF-0D24-347CA8A3377C}
    AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {81DBE8BC-FFA4-00EF-0D24-347CA8A3377C}
    AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {81E037E4-FFA4-00DE-0D24-347CA8A3377C}
    AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {81E12B64-FFA4-00DE-0D24-347CA8A3377C}
    AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {81E24580-FFA4-00EF-0D24-347CA8A3377C}
    AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {81E3AB4C-FFA4-00EF-0D24-347CA8A3377C}
    AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {81E3D054-FFA4-00DE-0D24-347CA8A3377C}
    AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {81E70824-FFA4-00DE-0D24-347CA8A3377C}
    AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {81E85594-FFA4-00EF-0D24-347CA8A3377C}
    AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {81E8CDDC-FFA4-00DE-0D24-347CA8A3377C}
    AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {81E9020C-FFA4-00EF-0D24-347CA8A3377C}
    AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {81E9C9B4-FFA4-00EF-0D24-347CA8A3377C}
    AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {81EB8754-FFA4-00DE-0D24-347CA8A3377C}
    AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {81EBF8EC-FFA4-00DE-0D24-347CA8A3377C}
    AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {81EDD864-FFA4-00DE-0D24-347CA8A3377C}
    AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {81EE2D58-FFA4-00DE-0D24-347CA8A3377C}
    AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {81EE9824-FFA4-00DE-0D24-347CA8A3377C}

    AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8A2624B4-FFA4-00EF-0D24-347CA8A3377C}
    AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {BADB0D00-FFA4-00EF-0D24-347CA8A3377C}
    AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FFFFFFFF-FFA4-00EF-0D24-347CA8A3377C}
    AV: ESET Smart Security 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
    FW: ESET Personal firewall *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}

    FILE ::
    "c:\windows\SYSTEM32\dllhost.exe "
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\windows\SYSTEM32\dllhost.exe

    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    -------\Legacy_RXP
    -------\Service_Radialpoint Security Services
    -------\Service_rxp


    ((((((((((((((((((((((((( Files Created from 2009-06-28 to 2009-07-28 )))))))))))))))))))))))))))))))
    .

    2009-07-28 01:53 . 2009-07-28 01:53 -------- d-----w- c:\documents and settings\family\Local Settings\Application Data\Google
    2009-07-27 05:46 . 2009-07-27 05:46 -------- d-----w- c:\documents and settings\family\Application Data\Malwarebytes
    2009-07-27 05:45 . 2009-07-13 17:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2009-07-27 05:45 . 2009-07-27 05:45 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
    2009-07-27 05:45 . 2009-07-13 17:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
    2009-07-27 05:45 . 2009-07-27 05:46 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2009-07-27 05:33 . 2009-07-27 05:33 -------- d-----w- c:\documents and settings\family\Local Settings\Application Data\ESET
    2009-07-25 21:23 . 2009-07-25 21:23 -------- d-----w- c:\documents and settings\family\Local Settings\Application Data\WorldWinner.com
    2009-07-19 03:39 . 2004-08-04 03:00 138752 ----a-w- c:\windows\system32\sndvol32.exe
    2009-07-19 03:39 . 2004-08-04 03:00 138752 ----a-w- c:\windows\system32\dllcache\sndvol32.exe
    2009-07-18 06:25 . 2004-05-06 21:47 159744 ----a-w- c:\windows\system32\igfxres.dll
    2009-07-16 02:58 . 2009-07-16 02:58 -------- d-----w- c:\documents and settings\family\Local Settings\Application Data\Yahoo
    2009-07-16 02:52 . 2009-07-16 02:58 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo!
    2009-07-16 02:52 . 2009-05-26 23:50 607472 ----a-w- c:\documents and settings\All Users\Application Data\Yahoo!\YUpdater\yupdater.exe
    2009-07-10 19:30 . 2009-07-10 19:30 -------- d-----w- c:\program files\iPod
    2009-07-10 19:30 . 2009-07-10 19:30 -------- d-----w- c:\program files\iTunes
    2009-07-10 19:30 . 2009-07-10 19:30 -------- d-----w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
    2009-07-10 19:18 . 2009-07-10 19:18 75048 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.2.0.23\SetupAdmin.exe
    2009-07-01 06:57 . 2009-07-01 06:57 -------- d-----w- c:\program files\USArmy
    2009-07-01 06:25 . 2009-07-03 01:31 -------- d-----w- c:\documents and settings\family\Local Settings\Application Data\AA3DeployClient
    2009-07-01 06:25 . 2009-07-03 00:52 -------- d-----w- c:\documents and settings\All Users\Application Data\AA3DeployClient

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-07-28 02:07 . 2005-12-29 18:38 -------- d-----w- c:\program files\Google
    2009-07-28 01:56 . 2008-12-15 03:35 -------- d-----w- c:\program files\trend micro
    2009-07-28 01:53 . 2008-05-21 17:54 -------- d-----w- c:\program files\MZILLA
    2009-07-28 01:52 . 2007-07-24 18:26 -------- d-----w- c:\program files\Bonjour
    2009-07-23 06:52 . 2009-05-12 06:32 -------- d-----w- c:\program files\Avidemux 2.4
    2009-07-22 21:51 . 2009-05-12 06:33 -------- d-----w- c:\documents and settings\family\Application Data\avidemux
    2009-07-22 06:39 . 2009-06-27 01:09 -------- d-----w- c:\program files\ManyCam 2.4
    2009-07-17 02:00 . 2008-12-18 10:03 -------- d-----w- c:\documents and settings\family\Application Data\dvdcss
    2009-07-16 02:52 . 2006-12-28 18:22 -------- d-----w- c:\program files\Yahoo!
    2009-07-12 08:58 . 2008-12-18 03:38 -------- d-----w- c:\documents and settings\family\Application Data\vlc
    2009-07-10 19:30 . 2007-07-06 19:15 -------- d-----w- c:\program files\Common Files\Apple
    2009-07-10 19:26 . 2004-11-18 04:32 -------- d-----w- c:\program files\QuickTime
    2009-07-03 06:14 . 2009-05-20 08:26 -------- d-----w- c:\documents and settings\family\Application Data\Any Video Converter
    2009-07-03 01:14 . 2007-03-16 04:28 137888 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
    2009-07-03 01:14 . 2007-03-16 04:28 189288 ----a-w- c:\windows\system32\PnkBstrB.exe
    2009-07-03 01:04 . 2007-11-16 20:01 139152 ----a-w- c:\documents and settings\family\Application Data\PnkBstrK.sys
    2009-07-03 01:04 . 2007-11-16 20:01 139152 ----a-w- c:\documents and settings\family\Application Data\PnkBstrK.sys
    2009-07-03 01:03 . 2007-03-16 04:28 75064 ----a-w- c:\windows\system32\PnkBstrA.exe
    2009-07-03 01:03 . 2008-10-29 04:46 3273512 ----a-w- c:\windows\system32\pbsvc.exe
    2009-07-03 00:04 . 2008-12-11 03:11 -------- d-----w- c:\documents and settings\All Users\Application Data\Rosetta Stone
    2009-07-01 08:22 . 2008-10-23 19:17 -------- d-----w- c:\documents and settings\All Users\Application Data\America's Army Deploy Client
    2009-07-01 01:48 . 2004-11-23 01:29 175168 ----a-w- c:\documents and settings\family\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
    2009-06-26 21:40 . 2009-06-26 21:40 -------- d-----w- c:\program files\VD Filter Pack
    2009-06-26 04:58 . 2009-06-14 03:39 -------- d-----w- c:\documents and settings\All Users\Application Data\WebcamMax
    2009-06-26 03:28 . 2004-11-18 04:29 -------- d--h--w- c:\program files\InstallShield Installation Information
    2009-06-26 03:27 . 2009-06-26 03:20 -------- d-----w- c:\program files\Jahshaka
    2009-06-26 03:26 . 2009-06-26 03:20 -------- d-----w- c:\program files\OpenLibraries
    2009-06-26 03:20 . 2006-12-24 04:41 86016 ----a-w- c:\windows\system32\OpenAL32.dll
    2009-06-26 02:36 . 2005-11-11 22:02 -------- d-----w- c:\program files\Microsoft Works
    2009-06-26 02:33 . 2009-06-26 02:33 -------- d-----w- c:\program files\Microsoft CAPICOM 2.1.0.2
    2009-06-25 02:42 . 2009-06-25 02:42 -------- d-----w- c:\program files\Microsoft
    2009-06-25 02:42 . 2009-06-25 02:41 -------- d-----w- c:\program files\Windows Live
    2009-06-25 02:42 . 2009-06-25 02:42 -------- d-----w- c:\program files\Windows Live SkyDrive
    2009-06-25 02:37 . 2009-06-25 02:37 -------- d-----w- c:\program files\Common Files\Windows Live
    2009-06-22 09:03 . 2009-05-12 06:19 -------- d-----w- c:\documents and settings\family\Application Data\gtk-2.0
    2009-06-16 14:36 . 2004-08-04 11:00 81920 ----a-w- c:\windows\system32\fontsub.dll
    2009-06-16 14:36 . 2004-08-04 11:00 119808 ----a-w- c:\windows\system32\t2embed.dll
    2009-06-14 03:39 . 2009-06-14 03:37 -------- d-----w- c:\documents and settings\family\Application Data\Webcammax
    2009-06-14 03:37 . 2009-06-14 03:36 -------- d-----w- c:\program files\WebcamMax
    2009-06-10 07:24 . 2009-05-20 08:26 -------- d-----w- c:\program files\Any Video Converter
    2009-06-08 23:21 . 2009-06-08 23:21 -------- d-----w- c:\program files\Opera 10 Beta
    2009-06-08 02:59 . 2009-06-08 02:56 -------- d-----w- c:\program files\Ad Muncher
    2009-06-07 21:02 . 2009-06-07 21:02 -------- d-----w- c:\documents and settings\family\Application Data\Xilisoft Corporation
    2009-06-03 19:09 . 2004-08-04 11:00 1291264 ----a-w- c:\windows\system32\quartz.dll
    2009-05-31 21:43 . 2009-05-31 21:42 -------- d-----w- c:\program files\AIM6
    2009-05-31 21:38 . 2004-11-18 04:32 -------- d-----w- c:\program files\Viewpoint
    2009-05-31 21:28 . 2009-05-31 21:28 -------- d-----w- c:\documents and settings\All Users\Application Data\AIM
    2009-05-31 21:27 . 2004-11-18 04:31 -------- d-----w- c:\documents and settings\All Users\Application Data\AOL
    2009-05-24 02:44 . 2009-05-02 04:34 17542 ----a-r- c:\documents and settings\family\Application Data\Microsoft\Installer\{F343FA04-CFC0-487C-A617-A5E8CF4D7B10}\_96E62DE38A7F692104A23B.exe
    2009-05-24 02:44 . 2009-05-02 04:34 17542 ----a-r- c:\documents and settings\family\Application Data\Microsoft\Installer\{F343FA04-CFC0-487C-A617-A5E8CF4D7B10}\_640ECEF665E5906E76DC9D.exe
    2009-05-16 16:17 . 2009-05-16 16:17 10557936 ----a-w- c:\documents and settings\All Users\Application Data\Tencent\QQ Games\Download\QQTexas.exe
    2009-05-07 15:32 . 2004-08-04 11:00 345600 ----a-w- c:\windows\system32\localspl.dll
    2009-05-05 22:31 . 2009-05-21 01:29 2402304 ----a-w- c:\windows\system32\x264vfw.dll
    2009-04-30 23:39 . 2009-04-30 23:39 2268376 ----a-w- c:\documents and settings\All Users\Application Data\Tencent\QQ Games\Download\GoldSweeper.exe
    2009-04-29 04:56 . 2004-08-04 11:00 827392 ----a-w- c:\windows\system32\wininet.dll
    2009-04-29 04:55 . 2009-04-29 04:55 78336 ----a-w- c:\windows\system32\ieencode.dll
    2006-12-26 17:35 . 2006-12-26 17:36 774144 ----a-w- c:\program files\RngInterstitial.dll
    2005-11-04 19:34 . 2005-11-04 19:34 518 ----a-w- c:\program files\Shortcut to Internet Explorer.lnk
    2008-05-12 19:59 . 2008-05-21 17:32 134144 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
    2008-04-07 06:59 . 2008-05-21 17:52 67696 ----a-w- c:\program files\mozilla firefox\components\jar50.dll
    2008-04-07 06:59 . 2008-05-21 17:52 54376 ----a-w- c:\program files\mozilla firefox\components\jsd3250.dll
    2008-04-07 06:59 . 2008-05-21 17:52 34952 ----a-w- c:\program files\mozilla firefox\components\myspell.dll
    2008-04-07 06:59 . 2008-05-21 17:52 46720 ----a-w- c:\program files\mozilla firefox\components\spellchk.dll
    2008-04-07 06:59 . 2008-05-21 17:52 172144 ----a-w- c:\program files\mozilla firefox\components\xpinstal.dll
    .

    ((((((((((((((((((((((((((((( SnapShot@2009-07-28_00.16.18 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2004-08-04 11:00 . 2008-04-14 00:12 5120 c:\windows\SYSTEM32\DLLCACHE\dllhost.exe
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "egui "= "c:\program files\ESET\ESET Smart Security\egui.exe" [2009-03-19 2029640]
    "Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
    "QuickTime Task "= "c:\program files\QuickTime\qttask.exe" [2009-05-26 413696]
    "iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2009-06-05 292136]
    "IgfxTray "= "c:\windows\system32\igfxtray.exe" [2004-05-06 155648]
    "HotKeysCmds "= "c:\windows\system32\hkcmd.exe" [2004-05-06 118784]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    "RunNarrator "= "Narrator.exe" - c:\windows\SYSTEM32\narrator.exe [2008-04-14 53760]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "iPod Service "=3 (0x3)

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
    "DisableMonitoring "=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall "= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "c:\\Program Files\\AIM\\aim.exe "=
    "c:\\WINDOWS\\SYSTEM32\\Lexpps.exe "=
    "c:\\Program Files\\Mozilla Firefox\\firefox.exe "=
    "c:\\WINDOWS\\SYSTEM32\\DPVSETUP.EXE "=
    "c:\\Black III\\uSED\\mIRC\\mirc.exe "=
    "c:\\Program Files\\Windows Media Player\\wmplayer.exe "=
    "c:\\Program Files\\MSN\\MSNCoreFiles\\msn.exe "=
    "c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe "=
    "c:\\Program Files\\Common Files\\AOL\\1154459043\\ee\\aolsoftware.exe "=
    "c:\\Program Files\\Common Files\\AOL\\1154459043\\ee\\aim6.exe "=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe "=
    "c:\\Program Files\\AIM6\\aim6.exe "=
    "c:\\WINDOWS\\SYSTEM32\\PnkBstrA.exe "=
    "c:\\WINDOWS\\SYSTEM32\\PnkBstrB.exe "=
    "c:\\Program Files\\MZILLA\\firefox.exe "=
    "c:\\Program Files\\Java\\jre1.6.0_07\\bin\\javaw.exe "=
    "c:\\Documents and Settings\\All Users\\Application Data\\NexonUS\\NGM\\NGM.exe "=
    "%windir%\\system32\\sessmgr.exe "=
    "c:\\Program Files\\Rosetta Stone\\Rosetta Stone V3\\RosettaStoneVersion3.exe "=
    "c:\\Program Files\\Rosetta Stone\\Rosetta Stone V3\\support\\bin\\RosettaStoneLtdServices.exe "=
    "c:\\Program Files\\Tencent\\QQ Games\\QQGames.exe "=
    "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe "=
    "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
    "c:\\Program Files\\Bonjour\\mDNSResponder.exe "=
    "c:\\Program Files\\iTunes\\iTunes.exe "=
    "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe "=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "1716:TCP "= 1716:TCP:America's Army
    "1717:TCP "= 1717:TCP:Gamequery
    "1718:TCP "= 1718:TCP:Master Server
    "8777:TCP "= 8777:TCP:Standard Ut
    "27900:TCP "= 27900:TCP:GameSpy
    "14200:UDP "= 14200:UDP:authorization server and MBS browser
    "20048:UDP "= 20048:UDP:DCDS
    "7463:TCP "= 7463:TCP:BitComet 7463 TCP
    "7463:UDP "= 7463:UDP:BitComet 7463 UDP
    "60704:TCP "= 60704:TCP:emule
    "29305:UDP "= 29305:UDP:emule
    "<NO NAME> "=

    R1 ehdrv;ehdrv;c:\windows\SYSTEM32\DRIVERS\ehdrv.sys [2009-03-19 107256]
    R2 CAMTHWDM;WebcamMax, WDM Video Capture;c:\windows\SYSTEM32\DRIVERS\CAMTHWDM.sys [2009-06-13 941784]
    R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [2009-03-19 731840]
    R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2009-05-31 5:38 PM 24652]
    R3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\SYSTEM32\DRIVERS\ManyCam.sys [2008-01-14 6:06 AM 21632]
    R3 pelmouse;Mouse Suite Driver;c:\windows\SYSTEM32\DRIVERS\PELMOUSE.SYS [2004-11-29 27088]
    R3 pelusblf;USB Mouse Low Filter Driver;c:\windows\SYSTEM32\DRIVERS\pelusblf.sys [2004-11-29 12816]
    S2 sbbotdi;sbbotdi; [x]
    S3 hamachi_oem;PlayLinc Adapter;c:\windows\SYSTEM32\DRIVERS\gan_adapter.sys [2006-10-19 10664]
    S3 NTProcDrv;Process creation detector for NT.; [x]
    S3 PortTalk;PortTalk;c:\windows\SYSTEM32\DRIVERS\PortTalk.sys [2007-07-04 2:14 PM 3567]
    S3 scsiprnt;Microsoft SCSI/1394 Generic Printer Class;c:\windows\SYSTEM32\DRIVERS\scsiprnt.sys [2004-11-30 7:28 PM 11648]
    .
    Contents of the 'Scheduled Tasks' folder

    2009-06-15 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 16:34]
    .
    - - - - ORPHANS REMOVED - - - -

    WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)


    .
    ------- Supplementary Scan -------
    .
    uInternet Connection Wizard,ShellNext = iexplore
    uInternet Settings,ProxyOverride = *.local
    uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
    DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
    FF - ProfilePath - c:\documents and settings\family\Application Data\Mozilla\Firefox\Profiles\0iyqlche.default\
    FF - prefs.js: browser.search.selectedEngine - DAEMON Search
    FF - prefs.js: browser.startup.homepage - hxxp://cmonwealth.com/
    FF - component: c:\documents and settings\family\Application Data\Mozilla\Firefox\Profiles\0iyqlche.default\extensions\{1a001dcf-d681-4c09-be1a-e0ad95d3a5b6}\components\FFAlert.dll
    FF - plugin: c:\documents and settings\All Users\Application Data\NexonUS\NGM\npNxGameUS.dll
    FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
    FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
    FF - plugin: c:\program files\MZILLA\plugins\npCouponPrinter.dll
    FF - plugin: c:\program files\MZILLA\plugins\npGoogleGadgetPluginFirefoxWin.dll
    FF - plugin: c:\program files\MZILLA\plugins\npqtplugin8.dll
    FF - plugin: c:\program files\MZILLA\plugins\npViewpoint.dll
    FF - plugin: c:\program files\Opera 10 Beta\program\plugins\npdsplay.dll
    FF - plugin: c:\program files\Opera 10 Beta\program\plugins\NPOFFICE.DLL
    FF - plugin: c:\program files\Opera 10 Beta\program\plugins\npqtplugin.dll
    FF - plugin: c:\program files\Opera 10 Beta\program\plugins\npqtplugin2.dll
    FF - plugin: c:\program files\Opera 10 Beta\program\plugins\npqtplugin3.dll
    FF - plugin: c:\program files\Opera 10 Beta\program\plugins\npqtplugin4.dll
    FF - plugin: c:\program files\Opera 10 Beta\program\plugins\npqtplugin5.dll
    FF - plugin: c:\program files\Opera 10 Beta\program\plugins\npqtplugin6.dll
    FF - plugin: c:\program files\Opera 10 Beta\program\plugins\npqtplugin7.dll
    FF - plugin: c:\program files\Opera 10 Beta\program\plugins\npqtplugin8.dll
    FF - plugin: c:\program files\Opera 10 Beta\program\plugins\npwmsdrm.dll
    FF - plugin: c:\program files\QuickTime\Plugins\npqtplugin8.dll
    FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
    FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

    ---- FIREFOX POLICIES ----
    FF - user.js: network.http.max-persistent-connections-per-server - 4
    FF - user.js: content.max.tokenizing.time - 200000
    FF - user.js: content.notify.interval - 100000
    FF - user.js: content.switch.threshold - 650000
    FF - user.js: nglayout.initialpaint.delay - 300
    .

    **************************************************************************

    driver loading error catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-07-27 22:08
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------

    [HKEY_USERS\S-1-5-21-2271019165-553755714-499774489-1005\¬ ³*]
    @Allowed: (Read) (RestrictedCode)
    "verticalChoices "= "weatherV "
    "firstLaunch "= "false "
    DUMPHIVE0.003 (REGF)
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'winlogon.exe'(1560)
    c:\windows\system32\Ati2evxx.dll

    - - - - - - - > 'explorer.exe'(488)
    c:\progra~1\WINDOW~2\wmpband.dll
    c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\MSVCR80.dll
    c:\windows\system32\WPDShServiceObj.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\windows\SYSTEM32\ati2evxx.exe
    c:\windows\SYSTEM32\ati2evxx.exe
    c:\windows\SYSTEM32\LexBceS.exe
    c:\windows\SYSTEM32\Lexpps.exe
    c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    c:\program files\Bonjour\mDNSResponder.exe
    c:\program files\Common Files\Authentium\AntiVirus\dvpapi.exe
    c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    c:\windows\SYSTEM32\PnkBstrA.exe
    c:\windows\SYSTEM32\PnkBstrB.exe
    c:\program files\iPod\bin\iPodService.exe
    c:\program files\AIM6\aim6.exe
    c:\program files\AIM6\aolsoftware.exe
    .
    **************************************************************************
    .
    Completion time: 2009-07-28 22:19 - machine was rebooted
    ComboFix-quarantined-files.txt 2009-07-28 02:19
    ComboFix2.txt 2009-07-28 00:20

    Pre-Run: 4,350,615,552 bytes free
    Post-Run: 4,310,003,712 bytes free

    1392 --- E O F --- 2009-07-15 10:07
     
    JusticeNY,
    #10
  12. 2009/07/27
    JusticeNY

    JusticeNY Well-Known Member Thread Starter

    Joined:
    2008/12/14
    Messages:
    160
    Likes Received:
    0
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 10:22:32 PM, on 2009-07-27
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16850)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\LEXBCES.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\LEXPPS.EXE
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe
    C:\Program Files\ESET\ESET Smart Security\ekrn.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\Program Files\ESET\ESET Smart Security\egui.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\WINDOWS\system32\PnkBstrB.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Viewpoint\Common\ViewpointService.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\AIM6\aim6.exe
    C:\Program Files\AIM6\aolsoftware.exe
    C:\WINDOWS\explorer.exe
    C:\WINDOWS\system32\notepad.exe
    C:\Program Files\MZILLA\firefox.exe
    C:\Program Files\trend micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    O2 - BHO: (no name) - {206E52E0-D52E-11D4-AD54-0000E86C26F6} - C:\PROGRA~1\FRESHD~1\FRESHD~1\fdcatch.dll (file missing)
    O2 - BHO: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-8CB0-AB60BB9AAE22} - C:\PROGRA~1\VOL_TO~1\VOL_TO~1.DLL (file missing)
    O2 - BHO: Nick Aracde Toolbar - {4E7BD74F-2B8D-469E-9EB4-FE6FA694B13E} - C:\PROGRA~1\NICKAR~1\NICKAR~1.DLL (file missing)
    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Viewpoint Toolbar BHO - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - C:\Program Files\Viewpoint\Viewpoint Toolbar\3.8.0\ViewBarBHO.dll (file missing)
    O2 - BHO: XBTBPos00 - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\PROGRA~1\SOFTOM~1\TOOLBA~1\bin\tbcore3U.dll (file missing)
    O3 - Toolbar: (no name) - {4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7D} - (no file)
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
    O3 - Toolbar: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-8CB0-AB60BB9AAE22} - C:\PROGRA~1\VOL_TO~1\VOL_TO~1.DLL (file missing)
    O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe "
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKCU\..\RunOnce: [Shockwave Updater] C:\WINDOWS\SYSTEM32\Adobe\SHOCKW~1\SWHELP~1.EXE -Update -1100465 - "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 2.0.50727; InfoPath.1; AskTB5.3)" - "http://www.neopets.com/games/dgs/play_shockwave.phtml?va=&game_id=313&nc_referer=&age=1&hiscore=45&sp=0&questionSet=&r=5476927&width=520&height=560&quality=high "
    O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {9819CC0E-9669-4D01-9CD7-2C66DA43AC6C} - (no file)
    O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
    O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
    O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - https://activatemyfios.verizon.net/sdcCommon/download/FIOS/Verizon FiOS Installer.cab
    O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
    O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.4.1.cab
    O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
    O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
    O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - http://verizon.exent.com/vzfamily/classes/ExentCtl.ocx
    O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab
    O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab
    O16 - DPF: {A52FBD2B-7AB3-4F6B-90E3-91C772C5D00F} (WoF Control) - http://www.worldwinner.com/games/v57/wof/wof.cab
    O16 - DPF: {B49C4597-8721-4789-9250-315DFBD9F525} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/radio/ampx/ampx2.6.1.11_en_dl.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab
    O16 - DPF: {CF969D51-F764-4FBF-9E90-475248601C8A} (FamilyFeud Control) - http://www.worldwinner.com/games/v47/familyfeud/familyfeud.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: COM+ System Application (COMSysApp) - Unknown owner - C:\WINDOWS\system32\dllhost.exe (file missing)
    O23 - Service: dlbu_device - Dell - C:\WINDOWS\system32\dlbucoms.exe
    O23 - Service: DvpApi (dvpapi) - Authentium, Inc. - C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe
    O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
    O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
    O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
    O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
    O23 - Service: Radialpoint Unicorn Update Service (RPSUpdaterR) - Radialpoint Inc. - C:\Program Files\Verizon\PC Security Checkup\rpsupdaterR.exe
    O23 - Service: MS Software Shadow Copy Provider (SwPrv) - Unknown owner - C:\WINDOWS\system32\dllhost.exe (file missing)
    O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

    --
    End of file - 9844 bytes
     
    JusticeNY,
    #11
  13. 2009/07/27
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Uninstall Combofix:
    Go Start > Run
    Type in:
    combofix /u
    Note the space between the "combofix" and the "/u "
    Restart computer.


    Download Dr.Web CureIt to the desktop:
    ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe
    • Doubleclick the drweb-cureit.exe file and click Scan to run express scan. Click OK in pop-up window to allow scan.
    • This will scan the files currently running in memory and when something is found, click the Yes button when it asks you if you want to cure it. This is only a short scan.
    • Once the short scan has finished, select Complete scan.
    • Click the green arrow [​IMG] at the right, and the scan will start.
    • Click Yes to all if it asks if you want to cure/move the file.
    • When the scan has finished, in the menu, click File and choose Save report list
    • Save the report to your desktop. The report will be called DrWeb.csv
    • Close Dr.Web Cureit.
    • Important! Reboot your computer because it could be possible that files in use will be moved/deleted during reboot.
    • Copy and paste that log in the next reply. You can use Notepad to open the DrWeb.cvs report.

    NOTE. During the scan, pop-up window will open asking for full version purchase. Simply close the window by clicking on X in upper right corner.


    Post fresh HijackThis log as well.
     
    broni,
    #12

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...