Inactive [InActive] PC being slowly locked down

Having just spent a solid 4 hours trying to find help in one form or another, i have finally found my way here.

My PC appears to be getting slowly locked down, I'll give a brief list of all the problems I have seen so far, then hope that someone here might have an idea as to what to do about this.

- System clock appears to have "VIRUS ALERT!" tacked onto the end of it.
- Control Panel no longer appears on start menu.
- Only option when logging out is to now shut down computer.
- Google now redirects me to various bogus antivirus pages instead of what i am looking for.
- Several websites, most notably those related to Microsoft or any kind of virus scanner are now inaccessable.
- Several black icons appear on my desktop advertising AV programs and are replaced almost as quickly as they are deleted.
- HiJackThis worked a single time before it too was 'neutralized'. (log from that single session posed below)
- Audio drivers appear to have been deleted.
- CD drive reads all CDs as blank.
- PC appears to have slowed dramatically, a good exaple is the need to wait 20-30 secs for Firefox to load.


[FONT= "Arial Black"]HiJackThis Log[/FONT]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:39:44 AM, on 12/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Common Files\Logitech\QCDriver\LVCOMS.EXE
C:\WINDOWS\CameraFixer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
C:\WINDOWS\System32\alg.exe
C:\Utils\HJT\HiJackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: (no name) - {D73F49B6-B51B-4d32-A3B7-BD04B8342F53} - C:\Program Files\MorpheusBar\SrchAstt\1.bin\MBSRCAS.DLL
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\ntos.exe,
O2 - BHO: QXK Olive - {D393614C-357A-4E4F-8D67-3761F35452B1} - C:\WINDOWS\xdsfqroepox.dll
O3 - Toolbar: Morpheus Toolbar - {3F3714A9-89A4-46be-8AF3-D0C9D1FB03F9} - C:\Program Files\MorpheusBar\bar\1.bin\MORPHBAR.DLL
O3 - Toolbar: mstoanrd - {3A74A614-1657-4533-B1FE-DCFBA2895828} - C:\WINDOWS\mstoanrd.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [itype] "C:\Program Files\Microsoft IntelliType Pro\itype.exe "
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe "
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver\LVCOMS.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime Alternative\qttask.exe" -atboottime
O4 - HKLM\..\Run: [CameraFixer] C:\WINDOWS\CameraFixer.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe "
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe "
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1173958438765
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~4\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: karna.dat
O20 - Winlogon Notify: iifcDSml - iifcDSml.dll (file missing)
O21 - SSODL: mqxvbdwk - {BF37D1C9-1327-41DC-A5C7-C253F93D99B7} - C:\WINDOWS\mqxvbdwk.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

--

 

Welcome to WindowsBBS stitchentyme

Your symptoms suggest a nasty rootkit, in addition to the other undesirable pests evident in your log. Lets see if you can download a tool.

Download ComboFix by sUBs from here, saving the file to your desktop.


Please disable realtime protection applications as they sometimes interfere with the tool. Check this link for your applicable programs.

• Close all open programs and windows
• Double click ComboFix.exe and follow the prompts.
• It may reboot your computer and resume running when you logon. Wait for it to complete. When finished, it will open a log for you. Post that log and a new HijackThis log in your next reply.

Note: Do not mouseclick combofix's window while its running. That may cause it to stall

 

I was unable to download the tool you linked or visit the website, both giving me a page load error.

Since I last posted, I have managed to recover my sound drivers and my control panel.
The programs I have been able to get access to are Max Registry Cleaner, HiJackThis and Malwarebyte's Anti-Malware. Here is a newer posting from HJT since so much has been done to my system since then.

 

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:55:34 PM, on 12/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Common Files\Logitech\QCDriver\LVCOMS.EXE
C:\WINDOWS\CameraFixer.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
C:\Utils\HJT\HJT.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: (no name) - {D73F49B6-B51B-4d32-A3B7-BD04B8342F53} - C:\Program Files\MorpheusBar\SrchAstt\1.bin\MBSRCAS.DLL
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\ntos.exe,
O2 - BHO: QXK Olive - {D393614C-357A-4E4F-8D67-3761F35452B1} - C:\WINDOWS\xdsfqroepox.dll
O3 - Toolbar: Morpheus Toolbar - {3F3714A9-89A4-46be-8AF3-D0C9D1FB03F9} - C:\Program Files\MorpheusBar\bar\1.bin\MORPHBAR.DLL
O3 - Toolbar: mstoanrd - {3A74A614-1657-4533-B1FE-DCFBA2895828} - C:\WINDOWS\mstoanrd.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [itype] "C:\Program Files\Microsoft IntelliType Pro\itype.exe "
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe "
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver\LVCOMS.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime Alternative\qttask.exe" -atboottime
O4 - HKLM\..\Run: [CameraFixer] C:\WINDOWS\CameraFixer.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe "
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe "
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1173958438765
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~4\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: karna.dat
O20 - Winlogon Notify: iifcDSml - iifcDSml.dll (file missing)
O21 - SSODL: mqxvbdwk - {BF37D1C9-1327-41DC-A5C7-C253F93D99B7} - C:\WINDOWS\mqxvbdwk.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

 

Open MBAM and select the Logs tab.
Select the most recent log then click View.
Post it's contents here.

 

Managed to get hold of and (eventually) run Combofix. here is the log.

ComboFix 08-11-11.01 - Main User 2008-11-13 0:15:17.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.774 [GMT 11:00]

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\LocalService\Application Data\wsnpoem
c:\documents and settings\LocalService\Application Data\wsnpoem\audio.dll
c:\documents and settings\NetworkService\Application Data\wsnpoem
c:\documents and settings\NetworkService\Application Data\wsnpoem\audio.dll
c:\program files\MorpheusBar\bar\1.bin\M0PLUGIN.DLL
c:\program files\MorpheusBar\bar\1.bin\M0POPSWT.DLL
c:\program files\MorpheusBar\bar\1.bin\NPMORPBR.DLL
c:\program files\MorpheusBar\SrchAstt\1.bin\MBSRCAS.DLL
c:\program files\Mozilla Firefox\plugins\NPMorpBr.dll
c:\windows\brastk.exe
c:\windows\evdm.exe
c:\windows\IE4 Error Log.txt
c:\windows\karna.dat
c:\windows\system32\apiddoha.dll
c:\windows\system32\av.dat
c:\windows\system32\aytbsqbg.dll
c:\windows\system32\brastk.exe
c:\windows\system32\bsn32.dll
c:\windows\system32\cctdam.dll
c:\windows\system32\csm.txt
c:\windows\system32\DelSelf.bat
c:\windows\system32\dllcache\beep.sys
c:\windows\system32\drivers\TDSSmaxt.sys
c:\windows\system32\gotlcapo.dll
c:\windows\system32\hgGwtUoL.dll
c:\windows\system32\iddimk.dll
c:\windows\system32\jdrxluel.dll
c:\windows\system32\jyoviw.dll
c:\windows\system32\karna.dat
c:\windows\system32\kriwnnky.ini
c:\windows\system32\lukpev.dll
c:\windows\system32\mvkohvhp.dll
c:\windows\system32\ntos.exe
c:\windows\system32\nugefh.dll
c:\windows\system32\pmnnMefc.dll
c:\windows\system32\qoMeEVmK.dll
c:\windows\system32\rghayp.dll
c:\windows\system32\sjmhuajt.ini
c:\windows\system32\swpygsnq.ini
c:\windows\system32\TDSScfub.dll
c:\windows\system32\TDSSfpmp.dll
c:\windows\system32\TDSSnmxh.log
c:\windows\system32\TDSSnrsr.dll
c:\windows\system32\TDSSoeqh.dll
c:\windows\system32\TDSSosvd.dat
c:\windows\system32\TDSSrhym.log
c:\windows\system32\TDSSriqp.dll
c:\windows\system32\TDSSsbhc.dll
c:\windows\system32\TDSStkdv.log
c:\windows\system32\tyytgxww.dll
c:\windows\system32\ucmrmdrs.dll
c:\windows\system32\wini10807.exe
c:\windows\system32\wsnpoem
c:\windows\system32\wsnpoem\audio.dll
c:\windows\system32\wsnpoem\video.dll


.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_TDSSSERV.SYS
-------\Legacy_TDSSSERV.SYS


((((((((((((((((((((((((( Files Created from 2008-10-12 to 2008-11-12 )))))))))))))))))))))))))))))))
.

2008-11-12 15:23 . 2007-11-14 15:18 553 --a------ c:\windows\USetup.iss
2008-11-12 15:22 . 2007-11-20 18:15 1,826,816 --a------ c:\windows\SkyTel.exe
2008-11-12 15:22 . 2008-08-05 20:10 1,684,736 --a------ c:\windows\system32\drivers\Ambfilt.sys
2008-11-12 15:22 . 2006-01-04 15:41 1,389,056 --a------ c:\windows\system32\drivers\Monfilt.sys
2008-11-12 15:22 . 2008-10-27 18:12 34,816 --a------ c:\windows\system32\RtkCoInstXP.dll
2008-11-12 13:45 . 2008-11-12 13:45 <DIR> d-------- c:\documents and settings\Administrator
2008-11-12 13:35 . 2008-11-12 13:35 <DIR> d-------- c:\windows\E80F62FF5D3C4A1984099721F2928206.TMP
2008-11-09 16:38 . 2008-11-12 23:59 65,024 --a------ c:\windows\system32\sac32.dll
2008-11-09 14:37 . 2008-11-09 14:37 <DIR> d-------- c:\documents and settings\All Users\Application Data\Avg8
2008-11-09 03:33 . 2008-11-09 03:33 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-11-09 03:33 . 2008-11-09 03:33 <DIR> d-------- c:\documents and settings\Main User\Application Data\Malwarebytes
2008-11-09 03:33 . 2008-11-09 03:33 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2008-11-09 03:33 . 2008-10-22 16:10 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-11-09 03:33 . 2008-10-22 16:10 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-11-08 07:35 . 2008-11-08 07:35 116,224 --a------ c:\windows\system32\pmpfteby.dll
2008-11-08 01:05 . 2008-11-07 16:47 393,216 --a------ c:\windows\xdsfqroepox.dll
2008-11-08 01:05 . 2008-11-07 16:47 282,624 --a------ c:\windows\mqxvbdwk.dll
2008-11-08 01:05 . 2008-11-07 16:47 217,088 --a------ c:\windows\mstoanrd.dll
2008-11-08 01:05 . 2008-11-07 16:47 139,264 --a------ c:\windows\nefstqdr.exe
2008-11-08 00:57 . 2008-11-08 01:25 <DIR> d-------- C:\DumpSite
2008-11-08 00:51 . 2008-11-08 00:51 <DIR> d-------- c:\program files\Web Dumper
2008-11-08 00:51 . 2008-11-08 00:51 <DIR> d-------- c:\documents and settings\Main User\Application Data\Maxprog
2008-10-17 22:52 . 2008-10-17 22:52 <DIR> d-------- c:\program files\Firaxis Games
2008-10-17 15:10 . 2008-10-17 15:10 <DIR> d-------- C:\ProgramData
2008-10-17 15:09 . 2008-10-17 15:09 1,216 --a------ c:\windows\system32\ealregsnapshot1.reg
2008-10-17 14:57 . 2008-10-17 15:10 <DIR> d-------- c:\program files\Electronic Arts
2008-10-15 05:26 . 2008-10-15 05:26 <DIR> d-------- c:\documents and settings\All Users\Application Data\Blizzard

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-12 13:07 --------- d-----w c:\program files\Mozilla Firefox 3 Beta 5
2008-11-12 04:52 --------- d-----w c:\program files\Morpheus
2008-11-12 04:32 --------- d-----w c:\program files\Common Files\Real
2008-11-12 04:30 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-12 04:22 --------- d-----w c:\program files\Realtek
2008-11-12 04:03 --------- d-----w c:\documents and settings\Main User\Application Data\uTorrent
2008-11-12 02:41 --------- d-----w c:\program files\Common Files\Symantec Shared
2008-11-12 02:35 --------- d-----w c:\program files\Symantec
2008-11-12 02:35 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec
2008-11-11 07:34 --------- d-----w c:\documents and settings\Main User\Application Data\skypePM
2008-11-11 07:34 --------- d-----w c:\documents and settings\Main User\Application Data\Skype
2008-11-09 10:12 --------- d-----w c:\program files\Trillian
2008-10-31 00:38 4,942,336 ----a-w c:\windows\system32\drivers\RtkHDAud.sys
2008-10-28 06:18 17,331,200 ----a-w c:\windows\RTHDCPL.EXE
2008-10-19 13:15 --------- d-----w c:\documents and settings\Main User\Application Data\SPORE
2008-10-10 04:27 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2008-10-10 03:27 --------- d-----w c:\documents and settings\Main User\Application Data\blg
2008-10-10 03:27 --------- d-----w c:\documents and settings\All Users\Application Data\blg
2008-10-10 03:21 --------- d-----w c:\program files\bfgclient
2008-10-09 02:51 --------- d-----w c:\program files\Plant Tycoon
2008-10-09 02:33 --------- d-----w c:\program files\Master of Defense
2008-10-09 02:27 0 ----a-w c:\program files\temp01
2008-10-09 02:27 --------- d-----w c:\program files\Ice Cream Dee Lites
2008-10-09 02:27 --------- d-----w c:\documents and settings\All Users\Application Data\BigFishGamesCache
2008-10-09 01:46 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2008-10-09 01:40 32 ----a-w c:\documents and settings\All Users\Application Data\ezsid.dat
2008-10-09 01:32 --------- d-----w c:\program files\Skype
2008-10-09 01:32 --------- d-----w c:\program files\Common Files\Skype
2008-10-09 01:32 --------- d-----w c:\documents and settings\All Users\Application Data\Skype
2008-09-30 05:38 2,168,320 ----a-w c:\windows\MicCal.exe
2008-09-28 05:10 --------- d-----w c:\program files\Random House Software
2008-09-24 16:14 --------- d-----w c:\documents and settings\Main User\Application Data\AVSMedia
2008-09-24 16:14 --------- d-----w c:\documents and settings\All Users\Application Data\AVS4YOU
2008-09-24 16:13 --------- d-----w c:\program files\Common Files\AVSMedia
2008-09-24 16:12 --------- d-----w c:\program files\AVSMedia
2008-09-24 16:11 --------- d-----w c:\program files\Common Files\Download Manager
2008-09-23 10:50 --------- d-----w c:\documents and settings\Main User\Application Data\Media Player Classic
2008-09-19 06:48 1,200,128 ----a-w c:\windows\RtlUpd.exe
2008-09-14 07:08 --------- d--h--r c:\documents and settings\Main User\Application Data\SecuROM
2008-09-14 06:58 --------- d-----w c:\program files\Max Registry Cleaner
2008-08-25 05:17 528,384 ----a-w c:\windows\RtlExUpd.dll
2008-08-19 02:26 77,824 ----a-w c:\windows\SOUNDMAN.EXE
2007-08-09 08:14 32 ----a-r c:\documents and settings\All Users\hash.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D393614C-357A-4E4F-8D67-3761F35452B1}]
2008-11-07 16:47 393216 --a------ c:\windows\xdsfqroepox.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3A74A614-1657-4533-B1FE-DCFBA2895828} "= "c:\windows\mstoanrd.dll" [2008-11-07 217088]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE "= "c:\windows\system32\ctfmon.exe" [2006-02-28 15360]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} "= "c:\program files\Common Files\Ahead\lib\NMBgMonitor.exe" [2006-03-01 90112]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon "= "c:\windows\system32\NvCpl.dll" [2006-06-01 7618560]
"itype "= "c:\program files\Microsoft IntelliType Pro\itype.exe" [2006-07-08 576320]
"NeroFilterCheck "= "c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"GrooveMonitor "= "c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 31016]
"LVCOMS "= "c:\program files\Common Files\Logitech\QCDriver\LVCOMS.EXE" [2001-08-15 94208]
"QuickTime Task "= "c:\program files\QuickTime Alternative\qttask.exe" [2007-04-27 282624]
"CameraFixer "= "c:\windows\CameraFixer.exe" [2005-09-28 20480]
"IMJPMIG8.1 "= "c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2006-02-28 208952]
"IMEKRMIG6.1 "= "c:\windows\ime\imkr6_1\IMEKRMIG.EXE" [2001-10-04 44032]
"MSPY2002 "= "c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2006-02-28 59392]
"PHIME2002ASync "= "c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2006-02-28 455168]
"PHIME2002A "= "c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2006-02-28 455168]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"nwiz "= "nwiz.exe" [2006-06-01 c:\windows\system32\nwiz.exe]
"NvMediaCenter "= "NvMCTray.dll" [2006-06-01 c:\windows\system32\nvmctray.dll]
"RTHDCPL "= "RTHDCPL.EXE" [2008-10-28 c:\windows\RTHDCPL.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE "= "c:\windows\system32\CTFMON.EXE" [2006-02-28 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"mqxvbdwk "= {BF37D1C9-1327-41DC-A5C7-C253F93D99B7} - c:\windows\mqxvbdwk.dll [2008-11-07 282624]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.divxa32 "= msaud32_divx.acm

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify "=dword:00000001
"UpdatesDisableNotify "=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall "= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"c:\\Program Files\\uTorrent\\uTorrent.exe "=

R0 iteraid;ITERAID_Service_Install;c:\windows\system32\DRIVERS\iteraid.sys [2004-10-29 25067]
S3 CIF USB CAMERA Service;CIF USB CAMERA;c:\windows\system32\DRIVERS\pfc027.sys [ ]
.
- - - - ORPHANS REMOVED - - - -

URLSearchHooks-{D73F49B6-B51B-4d32-A3B7-BD04B8342F53} - c:\program files\MorpheusBar\SrchAstt\1.bin\MBSRCAS.DLL
HKU-Default-Run-brastk - c:\windows\system32\brastk.exe
ShellExecuteHooks-{1EEBF144-58E5-445A-AEEC-93057287226E} - (no file)
Notify-iifcDSml - iifcDSml.dll


.
------- Supplementary Scan -------
.
FireFox -: Profile - c:\documents and settings\Main User\Application Data\Mozilla\Firefox\Profiles\wemjb8xj.default\
FF -: plugin - c:\program files\DivX\DivX Content Uploader\npUpload.dll
FF -: plugin - c:\program files\Mozilla Firefox 3 Beta 5\plugins\npnul32.dll
FF -: plugin - c:\program files\Mozilla Firefox 3 Beta 5\plugins\npOGAPlugin.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-13 00:23:31
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Symantec\LiveUpdate\AluSchedulerSvc.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\nvsvc32.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2008-11-13 0:32:44 - machine was rebooted
ComboFix-quarantined-files.txt 2008-11-12 13:32:41

Pre-Run: 39,458,672,640 bytes free
Post-Run: 40,834,998,272 bytes free

 

Great! Recommend you run it once more. Also recommend allowing the Recovery Console to be installed when prompted. Post the new log here.

 

ComboFix 08-11-11.01 - Main User 2008-11-13 4:19:24.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.614 [GMT 11:00]
Running from: c:\documents and settings\Main User\Desktop\CombFix.exe
.

((((((((((((((((((((((((( Files Created from 2008-10-12 to 2008-11-12 )))))))))))))))))))))))))))))))
.

2008-11-12 15:23 . 2007-11-14 15:18 553 --a------ c:\windows\USetup.iss
2008-11-12 15:22 . 2007-11-20 18:15 1,826,816 --a------ c:\windows\SkyTel.exe
2008-11-12 15:22 . 2008-08-05 20:10 1,684,736 --a------ c:\windows\system32\drivers\Ambfilt.sys
2008-11-12 15:22 . 2006-01-04 15:41 1,389,056 --a------ c:\windows\system32\drivers\Monfilt.sys
2008-11-12 15:22 . 2008-10-27 18:12 34,816 --a------ c:\windows\system32\RtkCoInstXP.dll
2008-11-12 13:45 . 2008-11-12 13:45 <DIR> d-------- c:\documents and settings\Administrator
2008-11-12 13:35 . 2008-11-12 13:35 <DIR> d-------- c:\windows\E80F62FF5D3C4A1984099721F2928206.TMP
2008-11-09 16:38 . 2008-11-12 23:59 65,024 --a------ c:\windows\system32\sac32.dll
2008-11-09 14:37 . 2008-11-09 14:37 <DIR> d-------- c:\documents and settings\All Users\Application Data\Avg8
2008-11-09 03:33 . 2008-11-09 03:33 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-11-09 03:33 . 2008-11-09 03:33 <DIR> d-------- c:\documents and settings\Main User\Application Data\Malwarebytes
2008-11-09 03:33 . 2008-11-09 03:33 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2008-11-09 03:33 . 2008-10-22 16:10 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-11-09 03:33 . 2008-10-22 16:10 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-11-08 07:35 . 2008-11-08 07:35 116,224 --a------ c:\windows\system32\pmpfteby.dll
2008-11-08 01:05 . 2008-11-07 16:47 393,216 --a------ c:\windows\xdsfqroepox.dll
2008-11-08 01:05 . 2008-11-07 16:47 282,624 --a------ c:\windows\mqxvbdwk.dll
2008-11-08 01:05 . 2008-11-07 16:47 217,088 --a------ c:\windows\mstoanrd.dll
2008-11-08 01:05 . 2008-11-07 16:47 139,264 --a------ c:\windows\nefstqdr.exe
2008-11-08 00:57 . 2008-11-08 01:25 <DIR> d-------- C:\DumpSite
2008-11-08 00:51 . 2008-11-08 00:51 <DIR> d-------- c:\program files\Web Dumper
2008-11-08 00:51 . 2008-11-08 00:51 <DIR> d-------- c:\documents and settings\Main User\Application Data\Maxprog
2008-10-17 22:52 . 2008-10-17 22:52 <DIR> d-------- c:\program files\Firaxis Games
2008-10-17 15:10 . 2008-10-17 15:10 <DIR> d-------- C:\ProgramData
2008-10-17 15:09 . 2008-10-17 15:09 1,216 --a------ c:\windows\system32\ealregsnapshot1.reg
2008-10-17 14:57 . 2008-10-17 15:10 <DIR> d-------- c:\program files\Electronic Arts
2008-10-15 05:26 . 2008-10-15 05:26 <DIR> d-------- c:\documents and settings\All Users\Application Data\Blizzard

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-12 16:34 --------- d-----w c:\documents and settings\Main User\Application Data\uTorrent
2008-11-12 16:27 --------- d-----w c:\program files\Mozilla Firefox 3 Beta 5
2008-11-12 04:52 --------- d-----w c:\program files\Morpheus
2008-11-12 04:32 --------- d-----w c:\program files\Common Files\Real
2008-11-12 04:30 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-12 04:22 --------- d-----w c:\program files\Realtek
2008-11-12 02:41 --------- d-----w c:\program files\Common Files\Symantec Shared
2008-11-12 02:35 --------- d-----w c:\program files\Symantec
2008-11-12 02:35 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec
2008-11-11 07:34 --------- d-----w c:\documents and settings\Main User\Application Data\skypePM
2008-11-11 07:34 --------- d-----w c:\documents and settings\Main User\Application Data\Skype
2008-11-09 10:12 --------- d-----w c:\program files\Trillian
2008-10-31 00:38 4,942,336 ----a-w c:\windows\system32\drivers\RtkHDAud.sys
2008-10-28 06:18 17,331,200 ----a-w c:\windows\RTHDCPL.EXE
2008-10-19 13:15 --------- d-----w c:\documents and settings\Main User\Application Data\SPORE
2008-10-10 04:27 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2008-10-10 03:27 --------- d-----w c:\documents and settings\Main User\Application Data\blg
2008-10-10 03:27 --------- d-----w c:\documents and settings\All Users\Application Data\blg
2008-10-10 03:21 --------- d-----w c:\program files\bfgclient
2008-10-09 02:51 --------- d-----w c:\program files\Plant Tycoon
2008-10-09 02:33 --------- d-----w c:\program files\Master of Defense
2008-10-09 02:27 0 ----a-w c:\program files\temp01
2008-10-09 02:27 --------- d-----w c:\program files\Ice Cream Dee Lites
2008-10-09 02:27 --------- d-----w c:\documents and settings\All Users\Application Data\BigFishGamesCache
2008-10-09 01:46 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2008-10-09 01:40 32 ----a-w c:\documents and settings\All Users\Application Data\ezsid.dat
2008-10-09 01:32 --------- d-----w c:\program files\Skype
2008-10-09 01:32 --------- d-----w c:\program files\Common Files\Skype
2008-10-09 01:32 --------- d-----w c:\documents and settings\All Users\Application Data\Skype
2008-09-30 05:38 2,168,320 ----a-w c:\windows\MicCal.exe
2008-09-28 05:10 --------- d-----w c:\program files\Random House Software
2008-09-24 16:14 --------- d-----w c:\documents and settings\Main User\Application Data\AVSMedia
2008-09-24 16:14 --------- d-----w c:\documents and settings\All Users\Application Data\AVS4YOU
2008-09-24 16:13 --------- d-----w c:\program files\Common Files\AVSMedia
2008-09-24 16:12 --------- d-----w c:\program files\AVSMedia
2008-09-24 16:11 --------- d-----w c:\program files\Common Files\Download Manager
2008-09-23 10:50 --------- d-----w c:\documents and settings\Main User\Application Data\Media Player Classic
2008-09-19 06:48 1,200,128 ----a-w c:\windows\RtlUpd.exe
2008-09-14 07:08 107,888 ----a-w c:\windows\system32\CmdLineExt.dll
2008-09-14 07:08 --------- d--h--r c:\documents and settings\Main User\Application Data\SecuROM
2008-09-14 06:58 --------- d-----w c:\program files\Max Registry Cleaner
2008-08-25 05:17 528,384 ----a-w c:\windows\RtlExUpd.dll
2008-08-19 02:26 77,824 ----a-w c:\windows\SOUNDMAN.EXE
2007-08-09 08:14 32 ----a-r c:\documents and settings\All Users\hash.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D393614C-357A-4E4F-8D67-3761F35452B1}]
2008-11-07 16:47 393216 --a------ c:\windows\xdsfqroepox.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3A74A614-1657-4533-B1FE-DCFBA2895828} "= "c:\windows\mstoanrd.dll" [2008-11-07 217088]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE "= "c:\windows\system32\ctfmon.exe" [2006-02-28 15360]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} "= "c:\program files\Common Files\Ahead\lib\NMBgMonitor.exe" [2006-03-01 90112]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon "= "c:\windows\system32\NvCpl.dll" [2006-06-01 7618560]
"itype "= "c:\program files\Microsoft IntelliType Pro\itype.exe" [2006-07-08 576320]
"NeroFilterCheck "= "c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"GrooveMonitor "= "c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 31016]
"LVCOMS "= "c:\program files\Common Files\Logitech\QCDriver\LVCOMS.EXE" [2001-08-15 94208]
"QuickTime Task "= "c:\program files\QuickTime Alternative\qttask.exe" [2007-04-27 282624]
"CameraFixer "= "c:\windows\CameraFixer.exe" [2005-09-28 20480]
"IMJPMIG8.1 "= "c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2006-02-28 208952]
"IMEKRMIG6.1 "= "c:\windows\ime\imkr6_1\IMEKRMIG.EXE" [2001-10-04 44032]
"MSPY2002 "= "c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2006-02-28 59392]
"PHIME2002ASync "= "c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2006-02-28 455168]
"PHIME2002A "= "c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2006-02-28 455168]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"nwiz "= "nwiz.exe" [2006-06-01 c:\windows\system32\nwiz.exe]
"NvMediaCenter "= "NvMCTray.dll" [2006-06-01 c:\windows\system32\nvmctray.dll]
"RTHDCPL "= "RTHDCPL.EXE" [2008-10-28 c:\windows\RTHDCPL.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE "= "c:\windows\system32\CTFMON.EXE" [2006-02-28 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"mqxvbdwk "= {BF37D1C9-1327-41DC-A5C7-C253F93D99B7} - c:\windows\mqxvbdwk.dll [2008-11-07 282624]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.divxa32 "= msaud32_divx.acm

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify "=dword:00000001
"UpdatesDisableNotify "=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall "= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"c:\\Program Files\\uTorrent\\uTorrent.exe "=

R0 iteraid;ITERAID_Service_Install;c:\windows\system32\DRIVERS\iteraid.sys [2004-10-29 25067]
S3 CIF USB CAMERA Service;CIF USB CAMERA;c:\windows\system32\DRIVERS\pfc027.sys [ ]
.
.
------- Supplementary Scan -------
.
FireFox -: Profile - c:\documents and settings\Main User\Application Data\Mozilla\Firefox\Profiles\wemjb8xj.default\
FF -: plugin - c:\program files\DivX\DivX Content Uploader\npUpload.dll
FF -: plugin - c:\program files\Mozilla Firefox 3 Beta 5\plugins\npnul32.dll
FF -: plugin - c:\program files\Mozilla Firefox 3 Beta 5\plugins\npOGAPlugin.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-13 04:20:44
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-11-13 4:22:57
ComboFix-quarantined-files.txt 2008-11-12 17:22:06
ComboFix2.txt 2008-11-12 13:32:45

Pre-Run: 40,807,833,600 bytes free
Post-Run: 40,798,916,608 bytes free

153 --- E O F --- 2008-04-11 17:05:54

 

Once again, please disable any realtime protection applications. Highlight and copy the contents of the code box below and paste it into a blank notepad, then save it to your desktop as;

Filename: CFScript.txt
Save As Type: All Files (*.*)

Code:

File::
c:\windows\system32\sac32.dll
c:\windows\system32\pmpfteby.dll
c:\windows\xdsfqroepox.dll
c:\windows\mqxvbdwk.dll
c:\windows\mstoanrd.dll
c:\windows\nefstqdr.exe
Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D393614C-357A-4E4F-8D67-3761F35452B1}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
 "{3A74A614-1657-4533-B1FE-DCFBA2895828} "=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
 "mqxvbdwk "=-

Close all other windows and programs. Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button. Combofix should run and may reboot the computer when it's done. A log will open when it's complete. Post the contents of that log and give me a machine status update.

Please do not click on the ComboFix window while it is running a scan. This can cause it to stall.

**NOTE - Allow ComboFix to update if prompted.

 

ComboFix 08-11-11.01 - Main User 2008-11-13 18:34:08.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.574 [GMT 11:00]
Running from: c:\documents and settings\Main User\Desktop\CombFix.exe
Command switches used :: c:\documents and settings\Main User\My Documents\CFScript.txt

FILE ::
c:\windows\mqxvbdwk.dll
c:\windows\mstoanrd.dll
c:\windows\nefstqdr.exe
c:\windows\system32\pmpfteby.dll
c:\windows\system32\sac32.dll
c:\windows\xdsfqroepox.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\mqxvbdwk.dll
c:\windows\mstoanrd.dll
c:\windows\nefstqdr.exe
c:\windows\system32\pmpfteby.dll
c:\windows\system32\sac32.dll
c:\windows\xdsfqroepox.dll

.
((((((((((((((((((((((((( Files Created from 2008-10-13 to 2008-11-13 )))))))))))))))))))))))))))))))
.

2008-11-13 11:47 . 2008-11-13 11:47 <DIR> d-------- c:\windows\LastGood
2008-11-13 06:09 . 2008-11-13 18:27 <DIR> d--h----- C:\$AVG8.VAULT$
2008-11-13 05:23 . 2008-11-13 13:36 <DIR> d-------- c:\windows\system32\drivers\Avg
2008-11-13 05:23 . 2008-11-13 05:23 97,928 --a------ c:\windows\system32\drivers\avgldx86.sys
2008-11-13 05:23 . 2008-11-13 05:23 10,520 --a------ c:\windows\system32\avgrsstx.dll
2008-11-13 05:22 . 2008-11-13 05:22 <DIR> d-------- c:\program files\AVG
2008-11-12 15:23 . 2007-11-14 15:18 553 --a------ c:\windows\USetup.iss
2008-11-12 15:22 . 2007-11-20 18:15 1,826,816 --a------ c:\windows\SkyTel.exe
2008-11-12 15:22 . 2008-08-05 20:10 1,684,736 --a------ c:\windows\system32\drivers\Ambfilt.sys
2008-11-12 15:22 . 2006-01-04 15:41 1,389,056 --a------ c:\windows\system32\drivers\Monfilt.sys
2008-11-12 15:22 . 2008-10-27 18:12 34,816 --a------ c:\windows\system32\RtkCoInstXP.dll
2008-11-12 13:45 . 2008-11-12 13:45 <DIR> d-------- c:\documents and settings\Administrator
2008-11-12 13:35 . 2008-11-12 13:35 <DIR> d-------- c:\windows\E80F62FF5D3C4A1984099721F2928206.TMP
2008-11-09 14:37 . 2008-11-13 09:38 <DIR> d-------- c:\documents and settings\All Users\Application Data\Avg8
2008-11-09 03:33 . 2008-11-09 03:33 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-11-09 03:33 . 2008-11-09 03:33 <DIR> d-------- c:\documents and settings\Main User\Application Data\Malwarebytes
2008-11-09 03:33 . 2008-11-09 03:33 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2008-11-09 03:33 . 2008-10-22 16:10 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-11-09 03:33 . 2008-10-22 16:10 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-11-08 00:51 . 2008-11-08 00:51 <DIR> d-------- c:\program files\Web Dumper
2008-11-08 00:51 . 2008-11-08 00:51 <DIR> d-------- c:\documents and settings\Main User\Application Data\Maxprog
2008-10-17 22:52 . 2008-10-17 22:52 <DIR> d-------- c:\program files\Firaxis Games
2008-10-17 15:10 . 2008-10-17 15:10 <DIR> d-------- C:\ProgramData
2008-10-17 15:09 . 2008-10-17 15:09 1,216 --a------ c:\windows\system32\ealregsnapshot1.reg
2008-10-17 14:57 . 2008-10-17 15:10 <DIR> d-------- c:\program files\Electronic Arts
2008-10-15 05:26 . 2008-10-15 05:26 <DIR> d-------- c:\documents and settings\All Users\Application Data\Blizzard

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-13 07:31 --------- d-----w c:\program files\Mozilla Firefox 3 Beta 5
2008-11-13 07:09 --------- d-----w c:\documents and settings\Main User\Application Data\Winamp
2008-11-12 16:34 --------- d-----w c:\documents and settings\Main User\Application Data\uTorrent
2008-11-12 04:52 --------- d-----w c:\program files\Morpheus
2008-11-12 04:32 --------- d-----w c:\program files\Common Files\Real
2008-11-12 04:30 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-12 04:22 --------- d-----w c:\program files\Realtek
2008-11-12 02:41 --------- d-----w c:\program files\Common Files\Symantec Shared
2008-11-12 02:35 --------- d-----w c:\program files\Symantec
2008-11-12 02:35 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec
2008-11-11 07:34 --------- d-----w c:\documents and settings\Main User\Application Data\skypePM
2008-11-11 07:34 --------- d-----w c:\documents and settings\Main User\Application Data\Skype
2008-11-09 10:12 --------- d-----w c:\program files\Trillian
2008-10-31 00:38 4,942,336 ----a-w c:\windows\system32\drivers\RtkHDAud.sys
2008-10-28 06:18 17,331,200 ----a-w c:\windows\RTHDCPL.EXE
2008-10-19 13:15 --------- d-----w c:\documents and settings\Main User\Application Data\SPORE
2008-10-10 04:27 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2008-10-10 03:27 --------- d-----w c:\documents and settings\Main User\Application Data\blg
2008-10-10 03:27 --------- d-----w c:\documents and settings\All Users\Application Data\blg
2008-10-10 03:21 --------- d-----w c:\program files\bfgclient
2008-10-09 02:51 --------- d-----w c:\program files\Plant Tycoon
2008-10-09 02:33 --------- d-----w c:\program files\Master of Defense
2008-10-09 02:27 0 ----a-w c:\program files\temp01
2008-10-09 02:27 --------- d-----w c:\program files\Ice Cream Dee Lites
2008-10-09 02:27 --------- d-----w c:\documents and settings\All Users\Application Data\BigFishGamesCache
2008-10-09 01:46 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2008-10-09 01:40 32 ----a-w c:\documents and settings\All Users\Application Data\ezsid.dat
2008-10-09 01:32 --------- d-----w c:\program files\Skype
2008-10-09 01:32 --------- d-----w c:\program files\Common Files\Skype
2008-10-09 01:32 --------- d-----w c:\documents and settings\All Users\Application Data\Skype
2008-09-30 05:38 2,168,320 ----a-w c:\windows\MicCal.exe
2008-09-28 05:10 --------- d-----w c:\program files\Random House Software
2008-09-24 16:14 --------- d-----w c:\documents and settings\Main User\Application Data\AVSMedia
2008-09-24 16:14 --------- d-----w c:\documents and settings\All Users\Application Data\AVS4YOU
2008-09-24 16:13 --------- d-----w c:\program files\Common Files\AVSMedia
2008-09-24 16:12 --------- d-----w c:\program files\AVSMedia
2008-09-24 16:11 --------- d-----w c:\program files\Common Files\Download Manager
2008-09-23 10:50 --------- d-----w c:\documents and settings\Main User\Application Data\Media Player Classic
2008-09-19 06:48 1,200,128 ----a-w c:\windows\RtlUpd.exe
2008-09-14 07:08 107,888 ----a-w c:\windows\system32\CmdLineExt.dll
2008-09-14 07:08 --------- d--h--r c:\documents and settings\Main User\Application Data\SecuROM
2008-09-14 06:58 --------- d-----w c:\program files\Max Registry Cleaner
2008-08-25 05:17 528,384 ----a-w c:\windows\RtlExUpd.dll
2008-08-19 02:26 77,824 ----a-w c:\windows\SOUNDMAN.EXE
2007-08-09 08:14 32 ----a-r c:\documents and settings\All Users\hash.dat
.

((((((((((((((((((((((((((((( snapshot@2008-11-13_ 0.32.21.18 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-11-12 18:23:11 26,824 ----a-w c:\windows\system32\drivers\avgmfx86.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE "= "c:\windows\system32\ctfmon.exe" [2006-02-28 15360]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} "= "c:\program files\Common Files\Ahead\lib\NMBgMonitor.exe" [2006-03-01 90112]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon "= "c:\windows\system32\NvCpl.dll" [2006-06-01 7618560]
"itype "= "c:\program files\Microsoft IntelliType Pro\itype.exe" [2006-07-08 576320]
"NeroFilterCheck "= "c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"GrooveMonitor "= "c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 31016]
"LVCOMS "= "c:\program files\Common Files\Logitech\QCDriver\LVCOMS.EXE" [2001-08-15 94208]
"QuickTime Task "= "c:\program files\QuickTime Alternative\qttask.exe" [2007-04-27 282624]
"CameraFixer "= "c:\windows\CameraFixer.exe" [2005-09-28 20480]
"IMJPMIG8.1 "= "c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2006-02-28 208952]
"IMEKRMIG6.1 "= "c:\windows\ime\imkr6_1\IMEKRMIG.EXE" [2001-10-04 44032]
"MSPY2002 "= "c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2006-02-28 59392]
"PHIME2002ASync "= "c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2006-02-28 455168]
"PHIME2002A "= "c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2006-02-28 455168]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"AVG8_TRAY "= "c:\progra~1\AVG\AVG8\avgtray.exe" [2008-11-13 1234712]
"nwiz "= "nwiz.exe" [2006-06-01 c:\windows\system32\nwiz.exe]
"NvMediaCenter "= "NvMCTray.dll" [2006-06-01 c:\windows\system32\nvmctray.dll]
"RTHDCPL "= "RTHDCPL.EXE" [2008-10-28 c:\windows\RTHDCPL.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE "= "c:\windows\system32\CTFMON.EXE" [2006-02-28 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls "=avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.divxa32 "= msaud32_divx.acm

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify "=dword:00000001
"UpdatesDisableNotify "=dword:00000001
"AntiVirusOverride "=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"c:\\Program Files\\uTorrent\\uTorrent.exe "=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe "=

R0 iteraid;ITERAID_Service_Install;c:\windows\system32\DRIVERS\iteraid.sys [2004-10-29 25067]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2008-11-13 97928]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-11-13 231704]
S3 CIF USB CAMERA Service;CIF USB CAMERA;c:\windows\system32\DRIVERS\pfc027.sys [ ]

*Newly Created Service* - AVG8WD
*Newly Created Service* - AVGLDX86
*Newly Created Service* - AVGMFX86
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-13 18:38:11
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


**************************************************************************
.
Completion time: 2008-11-13 18:41:39
ComboFix-quarantined-files.txt 2008-11-13 07:40:36
ComboFix2.txt 2008-11-12 17:22:58
ComboFix3.txt 2008-11-12 13:32:45

Pre-Run: 41,689,669,632 bytes free
Post-Run: 41,677,668,352 bytes free

 

This seems to have cleared up essentially all of my original problems, however something new started popping up just after this. At first appearance, it was an installer for MS Office 2007, a version of which i am already running. any ideas what that could have been?

 

Any chance you were doing, or have recently done, something that required a component of Office that is not installed? Oftentimes not all components are installed, so when attempting an action that requires one of those components, the installer will start then prompt for the Office cd. In all likelyhood, the installer is legit, but lets do an online scan before allowing it to run.

Please do an online scan with Kaspersky Online Scanner

Click Accept, when prompted to download and install the program files and database of malware definitions.

• Click Run at the Security prompt.
• The program will then begin downloading and installing and will also update the database.
• Please be patient as this can take several minutes.
• Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
• Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
• Click View scan report at the bottom.
• Click the Save Report As... button.
• Click the Save as Text button to save the file to your desktop so that you may post it in your next reply.

**Note**

To optimize scanning time and produce a more sensible report for review:

• Close any open programs.
• Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.

Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.


Post the Kaspersky log and one more fresh RSIT log.