Solved Need to make sure all trojans and malware are off of my computer

broni · 2010/01/24

Combofix has been pulled due to some issues.
I'll be testing my copy of Combofix to see, if it has same problem.
Please, stand by.

NEVER download Combofix from any un-authorized sites.

panda24 · 2010/01/24

thanks

broni · 2010/01/25

Unfortunately, my copy of Combofix is affected by the bug, so we can't use it.
Let's see, if updated version will come out by tomorrow.
If not, we'll use some other tools.

broni · 2010/01/25

Combofix is back, so you can download it now.

panda24 · 2010/01/25

Thanks. I'll download in the morning and post what you need.

broni · 2010/01/25

Sounds good

panda24 · 2010/01/26

so, I'm running combofix now and it has been stuck on trying to restore a system file that was infected for the last 15 minutes now...is that normal?? And I didn't click on anything on the screen either... ok, nevermind, it finally finished....i think.

broni · 2010/01/26

Give it another 15 minutes and keep me posted.

panda24 · 2010/01/26

Combofix log report - yay! it finished!

ComboFix 10-01-26.02 - Amanda 01/26/2010 17:17:02.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.1.1252.1.1033.18.1279.911 [GMT -7:00]
Running from: c:\documents and settings\Amanda\Desktop\ComboFix.exe
AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
AV: AVG Anti-Virus Free *On-access scanning enabled* (Outdated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\Downloaded Program Files\popcaploader.inf
c:\windows\system32\150735316384231507337393217163842315073371638423.exe
c:\windows\system32\157288916384231507337393217163842315073371638423.exe
c:\windows\system32\1769507229377385197419660922937738519742293773.exe
c:\windows\system32\1835043229377385197419660922937738519742293773.exe
c:\windows\system32\203165223593151245190196609235931512451902359315.exe
c:\windows\system32\209718823593151245190196609235931512451902359315.exe
c:\windows\system32\21627423538965137626065537353896513762603538965.exe
c:\windows\system32\22282783538965137626065537353896513762603538965.exe
c:\windows\system32\340789615728851376265393217157288513762651572885.exe
c:\windows\system32\347343215728851376265393217157288513762651572885.exe
c:\windows\system32\flags.ini
c:\windows\system32\kbdsock.dll
c:\windows\system32\mshlps.dll
c:\windows\system32\uses32.dat

c:\windows\system32\qmgr.dll . . . is infected!! . . .Failed to restore. Attempting to replace on reboot

Infected copy of c:\windows\system32\qmgr.dll was found and disinfected
Restored copy from - c:\system volume information\_restore{F812528C-C033-4929-8CC2-78A711D9062F}\RP12\A0000676.dll
.
((((((((((((((((((((((((( Files Created from 2009-12-27 to 2010-01-27 )))))))))))))))))))))))))))))))
.

2010-01-25 02:18 . 2010-01-25 02:18 -------- d-----w- c:\program files\Trend Micro
2010-01-19 21:42 . 2010-01-19 21:42 -------- d-----w- c:\program files\CCleaner
2010-01-15 04:34 . 2010-01-15 04:40 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-01-15 04:34 . 2010-01-15 04:39 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-01-15 01:12 . 2002-08-29 12:00 6656 -c--a-w- c:\windows\system32\dllcache\migregdb.exe
2010-01-15 01:11 . 2002-08-29 12:00 19456 -c--a-w- c:\windows\system32\dllcache\agt0804.dll
2010-01-15 01:09 . 2002-08-29 12:00 106562 -c--a-w- c:\windows\system32\dllcache\srchctls.dll
2010-01-15 01:08 . 2002-08-29 12:00 77824 -c--a-w- c:\windows\system32\dllcache\isign32.dll
2010-01-15 01:07 . 2002-08-29 12:00 272896 -c--a-w- c:\windows\system32\dllcache\pinball.exe
2010-01-15 01:05 . 2001-08-17 20:59 50048 ----a-w- c:\windows\system32\drivers\DMusic.sys
2010-01-15 01:05 . 2002-08-29 08:32 5888 ----a-w- c:\windows\system32\drivers\splitter.sys
2010-01-15 01:03 . 2002-08-29 08:27 56576 ----a-w- c:\windows\system32\drivers\redbook.sys
2010-01-15 00:58 . 2001-08-18 05:36 4096 ----a-w- c:\windows\system32\ksuser.dll
2010-01-15 00:49 . 2002-08-29 10:46 38024 ----a-w- c:\windows\system32\drivers\termdd.sys
2010-01-15 00:45 . 2010-01-15 00:45 -------- d-s---w- c:\windows\system32\config\systemprofile\History
2010-01-12 20:45 . 2010-01-12 20:45 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-01-12 20:37 . 2010-01-12 20:37 -------- d-----w- c:\documents and settings\David\Application Data\Malwarebytes
2010-01-12 05:07 . 2010-01-15 01:27 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2010-01-12 05:07 . 2009-03-30 16:33 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2010-01-12 05:07 . 2009-02-13 18:29 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2010-01-12 05:07 . 2009-02-13 18:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2010-01-12 05:07 . 2010-01-12 05:07 -------- d-----w- c:\program files\Avira
2010-01-12 05:07 . 2010-01-12 05:07 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2010-01-10 18:45 . 2010-01-10 18:45 30784 ----a-w- c:\windows\system32\drivers\jrkxhufd.sys
2010-01-10 18:44 . 2010-01-10 18:44 30784 ----a-w- c:\windows\system32\drivers\qubrhphz.sys
2010-01-10 18:43 . 2010-01-10 18:43 30784 ----a-w- c:\windows\system32\drivers\haoiemly.sys
2010-01-10 01:23 . 2010-01-10 01:23 30784 ----a-w- c:\windows\system32\drivers\vyjtsnny.sys
2010-01-10 00:03 . 2010-01-10 00:03 -------- d-----w- c:\program files\Common Files\PersonalSecUninstall
2010-01-09 21:34 . 2010-01-09 21:34 -------- d-----w- c:\windows\system32\config\systemprofile\Application Data\Yahoo!
2010-01-09 21:34 . 2010-01-09 21:34 -------- d-sh--w- c:\windows\system32\config\systemprofile\PrivacIE
2010-01-09 03:37 . 1997-06-23 04:06 407312 ----a-w- c:\windows\system32\MsRepl35.dll
2010-01-09 03:37 . 1997-06-23 04:06 252176 ----a-w- c:\windows\system32\MSRD2x35.dll
2010-01-09 03:37 . 1997-07-21 11:30 1045776 ----a-w- c:\windows\system32\MSJet35.dll
2010-01-09 03:37 . 1997-06-23 04:06 24848 ----a-w- c:\windows\system32\MSJtEr35.dll
2010-01-09 03:37 . 1997-06-23 04:06 123664 ----a-w- c:\windows\system32\MSJInt35.dll
2010-01-09 03:37 . 2010-01-09 04:12 -------- d-----w- c:\program files\Simply Media
2010-01-05 01:55 . 2009-11-03 03:42 195456 ------w- c:\windows\system32\MpSigStub.exe
2010-01-05 01:37 . 2010-01-05 01:37 4096 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\QS1Cu.dll
2010-01-04 22:39 . 2010-01-04 22:39 4096 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\5PDdr.dll
2010-01-04 22:24 . 2010-01-04 22:24 4096 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\np4ng.dll
2010-01-04 21:54 . 2010-01-04 21:54 4096 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\WKP2j.dll
2010-01-04 21:49 . 2010-01-04 21:49 4096 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\rcjhc.dll
2010-01-04 21:29 . 2010-01-04 21:29 4096 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\RdkHj.dll
2010-01-04 21:26 . 2010-01-04 21:26 4096 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\P0UOh.dll
2010-01-04 21:21 . 2010-01-04 21:21 4096 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\bqika.dll
2010-01-04 20:24 . 2010-01-04 20:24 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2010-01-04 16:24 . 2010-01-04 16:24 4096 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\xO70q.dll
2010-01-04 03:24 . 2010-01-04 03:24 4096 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\0dheI.dll
2010-01-03 23:19 . 2010-01-03 23:19 4096 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\SHdiv.dll
2010-01-03 07:28 . 2010-01-03 07:28 4096 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\S4xYZ.dll
2010-01-03 07:08 . 2010-01-03 07:08 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2010-01-03 07:05 . 2010-01-03 07:05 4096 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\yxb03.dll
2010-01-03 07:04 . 2010-01-03 07:04 4096 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\mkEpa.dll
2010-01-03 07:02 . 2010-01-03 07:02 4096 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\iieI7.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-27 00:04 . 2009-06-26 04:25 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar
2010-01-27 00:04 . 2009-11-13 04:33 -------- d-----w- c:\documents and settings\Amanda\Application Data\AVGTOOLBAR
2010-01-20 04:21 . 2009-04-14 21:02 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-01-15 05:20 . 2006-01-06 04:47 -------- d-----w- c:\program files\Free Offers from Freeze.com
2010-01-15 01:10 . 2010-01-15 01:10 2678 ----a-w- c:\windows\java\Packages\Data\U8ENXVVH.DAT
2010-01-15 01:10 . 2010-01-15 01:10 2678 ----a-w- c:\windows\java\Packages\Data\5J1BFZV7.DAT
2010-01-15 01:10 . 2010-01-15 01:10 2678 ----a-w- c:\windows\java\Packages\Data\X3VHZ97B.DAT
2010-01-15 01:10 . 2010-01-15 01:10 2678 ----a-w- c:\windows\java\Packages\Data\ETVLN9R1.DAT
2010-01-15 01:10 . 2010-01-15 01:10 2678 ----a-w- c:\windows\java\Packages\Data\33HR1ZRD.DAT
2010-01-15 01:08 . 2005-09-20 04:24 23348 -c--a-w- c:\windows\system32\emptyregdb.dat
2010-01-12 20:41 . 2008-05-10 17:52 -------- d-----w- c:\program files\AVG
2010-01-12 07:39 . 2005-09-26 21:55 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-01-12 07:39 . 2007-01-01 04:18 -------- d-----w- c:\documents and settings\Amanda\Application Data\Fisher-Price
2010-01-10 18:45 . 2010-01-10 18:45 96512 ------w- c:\windows\system32\drivers\atapi.sys6AA74E4A
2010-01-10 18:44 . 2010-01-10 18:44 96512 ------w- c:\windows\system32\drivers\atapi.sysF5812507
2010-01-10 18:43 . 2010-01-10 18:43 96512 ----a-w- c:\windows\system32\drivers\atapi.sys0D557C46
2010-01-09 21:31 . 2010-01-09 21:31 40960 ----a-w- c:\windows\system32\info.tmp
2010-01-04 03:52 . 2009-11-11 02:03 -------- d-----w- c:\documents and settings\All Users\Application Data\avg9
2010-01-04 03:52 . 2009-11-13 04:33 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
2010-01-03 07:05 . 2005-09-30 12:26 62824 -c--a-w- c:\documents and settings\David\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-12-03 20:04 . 2009-12-03 20:04 -------- d-----w- c:\documents and settings\Amanda\Application Data\EPSON
2009-12-01 01:24 . 2009-12-01 01:24 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee Security Scan
2009-11-24 04:31 . 2009-11-24 04:31 60416 ----a-w- c:\windows\ALCFDRTM.EXE
2009-11-22 01:45 . 2009-11-22 01:45 45004 ---ha-w- c:\windows\system32\mlfcache.dat
2009-11-08 03:28 . 2009-11-08 03:28 247296 ----a-w- c:\documents and settings\Amanda\Application Data\SystemRequirementsLab\SRLProxy_srl_4_0_10_0_d_ind.dll
2009-11-08 03:28 . 2009-11-08 03:28 247296 ----a-w- c:\documents and settings\Amanda\Application Data\SystemRequirementsLab\SRLProxy_srl_4_0_10_0_c_ind.dll
2009-11-08 03:28 . 2009-11-08 03:28 247296 ----a-w- c:\documents and settings\Amanda\Application Data\SystemRequirementsLab\SRLProxy_srl_4_0_10_0_b_ind.dll
2009-11-08 03:28 . 2009-11-08 03:28 247296 ----a-w- c:\documents and settings\Amanda\Application Data\SystemRequirementsLab\SRLProxy_srl_4_0_10_0_a_ind.dll
2009-11-07 19:48 . 2009-11-07 19:48 79144 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe
2005-12-28 16:42 . 2005-12-28 16:42 774144 -c--a-w- c:\program files\RngInterstitial.dll
.

------- Sigcheck -------

Cryptography Services Error !!
.
((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2005-08-18 18:49 . 2005-08-18 18:49 307200 c:\program files\Adobe\Acrobat 7.0\Reader\bak\AdobeUpdateManager.exe

2007-08-29 18:55 . 2007-08-29 18:55 1347584 c:\program files\AWS\WeatherBug\bak\Weather.exe

2002-07-09 04:45 . 2002-07-09 04:45 28672 c:\program files\Common Files\Microsoft Shared\Works Shared\bak\WkUFind.exe

2006-08-10 19:10 . 2006-08-10 19:10 221184 c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\bak\RoxWatchTray9.exe

2005-12-28 16:42 . 2007-10-19 01:31 1838592 c:\program files\Google\Google Desktop Search\bak\GoogleDesktop.exe

2008-01-15 10:22 . 2008-01-15 10:22 267048 c:\program files\iTunes\bak\iTunesHelper.exe
2009-10-29 03:21 . 2009-10-29 03:21 141600 c:\program files\iTunes\iTunesHelper.exe

2008-02-08 22:41 . 2007-09-25 08:11 132496 c:\program files\Java\jre1.6.0_03\bin\bak\jusched.exe

2006-09-11 23:36 . 1999-05-13 03:01 20545 c:\program files\Microsoft Hardware\Game Controllers\Common\bak\swtrayv4.exe

2008-01-10 22:27 . 2008-01-10 22:27 385024 c:\program files\QuickTime\bak\qttask.exe
2009-09-05 07:54 . 2009-09-05 07:54 417792 c:\program files\QuickTime\QTTask.exe

2006-07-31 16:00 . 2006-07-31 16:00 1116920 c:\program files\Roxio\Drag-to-Disc\bak\DrgToDsc.exe

2006-08-14 08:07 . 2006-08-14 08:07 102400 c:\program files\Roxio\Media Experience\bak\DMXLauncher.exe

2005-09-20 05:29 . 2005-08-20 02:34 3084288 c:\program files\Yahoo!\Messenger\bak\ypager.exe

2002-08-29 12:00 . 2004-08-04 07:56 15360 c:\windows\system32\bak\ctfmon.exe
2002-08-29 12:00 . 2002-08-29 12:00 13312 c:\windows\system32\ctfmon.exe

.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"EasyLinkAdvisor "= "c:\program files\Linksys EasyLink Advisor\LinksysAgent.exe" [2007-03-16 454784]
"swg "= "c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-07-21 39408]
"SpybotSD TeaTimer "= "c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NVIDIA nForce APU1 Utilities "= "NVATray.exe" [2001-11-28 45056]
"Dit "= "Dit.exe" [2002-08-28 73728]
"NvCplDaemon "= "c:\windows\system32\NvCpl.dll" [2006-10-22 7700480]
"nwiz "= "nwiz.exe" [2006-10-22 1622016]
"AppleSyncNotifier "= "c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-08-13 177440]
"NvMediaCenter "= "c:\windows\system32\NvMcTray.dll" [2006-10-22 86016]
"fssui "= "c:\program files\Windows Live\Family Safety\fsui.exe" [2009-02-07 454000]
"QuickTime Task "= "c:\program files\QuickTime\qttask.exe" [2009-09-05 417792]
"iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2009-10-29 141600]
"Easy Dock "=" " [N/A]
"avgnt "= "c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"SoundMan "= "SOUNDMAN.EXE" [2005-11-11 90112]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM "= "c:\program files\MySpace\IM\MySpaceIM.exe" [N/A]

c:\documents and settings\Amanda\Start Menu\Programs\Startup\
RCA Detective.lnk - c:\documents and settings\Amanda\My Documents\RCA Detective\RCADetective.exe [2009-12-25 942592]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
backup=c:\windows\pss\Kodak EasyShare software.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
2009-08-13 21:51 177440 ----a-w- c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2009-10-29 03:21 141600 ----a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 00:12 1695232 --sh--w- c:\program files\Messenger\msmsgs.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe "=
"c:\\Program Files\\Messenger\\msmsgs.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe "=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe "=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe "=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe "=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe "=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe "=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
"c:\\Program Files\\iTunes\\iTunes.exe "=

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [1/11/2010 10:07 PM 108289]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [5/15/2009 8:31 PM 55152]
S2 fsssvc;Windows Live Family Safety;c:\program files\Windows Live\Family Safety\fsssvc.exe [2/6/2009 5:08 PM 533360]
.
Contents of the 'Scheduled Tasks' folder

2010-01-22 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 18:34]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/ig
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = iexplore
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Search - ?p=ZJxdm128YYUS
IE: {{c95fe080-8f5d-11d2-a20b-00aa003c157a} - %SystemRoot%\web\related.htm
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} - hxxp://a19.g.akamai.net/7/19/7125/4056/ftp.coupons.com/r3302/cpbrkpie.cab
FF - ProfilePath - c:\documents and settings\Amanda\Application Data\Mozilla\Firefox\Profiles\jbp8iwfp.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig
FF - component: c:\documents and settings\Amanda\Application Data\Mozilla\Firefox\Profiles\jbp8iwfp.default\extensions\{463F6CA5-EE3C-4be1-B7E6-7FEE11953374}\platform\WINNT\components\FoxyTunes.dll
FF - component: c:\documents and settings\Amanda\Application Data\Mozilla\Firefox\Profiles\jbp8iwfp.default\extensions\kodak-companion@mozilla.com\platform\WINNT_x86-msvc\components\mozFotofox.dll
FF - plugin: c:\documents and settings\All Users\Application Data\RealArcade\npraclient.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npImgCtl.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npraclient.dll
FF - plugin: c:\program files\Real\RealArcade\Plugins\Mozilla\npracplug.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHANS REMOVED - - - -

URLSearchHooks-{EEE6C35D-6118-11DC-9C72-001320C79847} - (no file)
BHO-{6551001F-A07B-40B1-8F55-B44BF35A42A6} - (no file)
WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - (no file)
Notify-avgrsstarter - avgrsstx.dll

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-26 18:00
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977 "=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,71,fb,c9,19,11,95,c0,45,b5,69,19,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81 "=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,71,fb,c9,19,11,95,c0,45,b5,69,19,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(556)
c:\windows\System32\ODBC32.dll
c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
c:\windows\System32\msctfime.ime

- - - - - - - > 'lsass.exe'(620)
c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
c:\windows\System32\dssenh.dll

- - - - - - - > 'explorer.exe'(2652)
c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
c:\windows\System32\msctfime.ime
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\System32\msi.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\Command Software\dvpapi.exe
c:\program files\Common Files\EPSON\EBAPI\eEBSVC.exe
c:\program files\Common Files\EPSON\EBAPI\SAgent2.exe
c:\windows\system32\pctspk.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\windows\Dit.exe
c:\windows\DitExp.exe
c:\windows\SOUNDMAN.EXE
.
**************************************************************************
.
Completion time: 2010-01-26 18:09:01 - machine was rebooted
ComboFix-quarantined-files.txt 2010-01-27 01:08

Pre-Run: 44,445,327,360 bytes free
Post-Run: 45,058,945,024 bytes free

winxpsp1_en_hom_bf.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT= "Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS= "Microsoft Windows XP Home Edition" /fastdetect /noexecute=optin

- - End Of File - - 96665B7A3BED0CF8BA0C22E4C07329D5

panda24 · 2010/01/26

hijackthis log after combo fix

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:13:59 PM, on 1/26/2010
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Command Software\dvpapi.exe
C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\WINDOWS\system32\pctspk.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Dit.exe
C:\WINDOWS\DitExp.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Documents and Settings\Amanda\My Documents\RCA Detective\RCADetective.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: Windows Live Family Safety Browser Helper - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NVIDIA nForce APU1 Utilities] NVATray.exe
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [fssui] "C:\Program Files\Windows Live\Family Safety\fsui.exe" -autorun
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKCU\..\Run: [EasyLinkAdvisor] "C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" /startup
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe "
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O4 - Startup: RCA Detective.lnk = C:\Documents and Settings\Amanda\My Documents\RCA Detective\RCADetective.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Search - ?p=ZJxdm128YYUS
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1127253496125
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1131427458859
O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://www.kodakgallery.com/downloads/BUM/BUM_WIN_IE_1/axofupld.cab
O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} - http://a19.g.akamai.net/7/19/7125/4056/ftp.coupons.com/r3302/cpbrkpie.cab
O16 - DPF: {9BFC2253-B9D9-477E-9488-CA450232620D} (BinAg1 Class) - https://fastconnectkitsetup.cox.net/wizlet/CoxNA/static/controls/WebflowActiveX.CAB
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - http://download.games.yahoo.com/games/web_games/popcap/bejeweled2/popcaploader_v6.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file)
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - C:\Program Files\Common Files\Command Software\dvpapi.exe
O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
O23 - Service: Roxio UPnP Renderer 9 - Unknown owner - C:\Program Files\Common Files\Sonic Shared\RoxioUPnPRenderer9.exe (file missing)
O23 - Service: Roxio Upnp Server 9 - Unknown owner - C:\Program Files\Common Files\Sonic Shared\RoxioUpnpService9.exe (file missing)
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Unknown owner - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe (file missing)
O23 - Service: RoxMediaDB9 - Unknown owner - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe (file missing)
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Unknown owner - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe (file missing)
O23 - Service: stllssvr - Unknown owner - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe (file missing)

--
End of file - 11076 bytes

broni · 2010/01/26

1. Please open Notepad

Click Start , then Run
Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

Code:

File::
c:\windows\system32\drivers\jrkxhufd.sys
c:\windows\system32\drivers\qubrhphz.sys
c:\windows\system32\drivers\haoiemly.sys
c:\windows\system32\drivers\vyjtsnny.sys
c:\windows\system32\Spool\prtprocs\w32x86\iieI7.dll
c:\windows\system32\Spool\prtprocs\w32x86\mkEpa.dll
c:\windows\system32\Spool\prtprocs\w32x86\yxb03.dll
c:\windows\system32\Spool\prtprocs\w32x86\S4xYZ.dll
c:\windows\system32\Spool\prtprocs\w32x86\SHdiv.dll
c:\windows\system32\Spool\prtprocs\w32x86\0dheI.dll
c:\windows\system32\Spool\prtprocs\w32x86\xO70q.dll
c:\windows\system32\Spool\prtprocs\w32x86\bqika.dll
c:\windows\system32\Spool\prtprocs\w32x86\P0UOh.dll
c:\windows\system32\Spool\prtprocs\w32x86\RdkHj.dll
c:\windows\system32\Spool\prtprocs\w32x86\rcjhc.dll
c:\windows\system32\Spool\prtprocs\w32x86\WKP2j.dll
c:\windows\system32\Spool\prtprocs\w32x86\np4ng.dll
c:\windows\system32\Spool\prtprocs\w32x86\5PDdr.dll
c:\windows\system32\Spool\prtprocs\w32x86\QS1Cu.dll
c:\windows\java\Packages\Data\U8ENXVVH.DAT
c:\windows\java\Packages\Data\5J1BFZV7.DAT
c:\windows\java\Packages\Data\X3VHZ97B.DAT
c:\windows\java\Packages\Data\ETVLN9R1.DAT
c:\windows\java\Packages\Data\33HR1ZRD.DAT
c:\windows\system32\drivers\atapi.sys6AA74E4A
c:\windows\system32\drivers\atapi.sysF5812507
c:\windows\system32\drivers\atapi.sys0D557C46


Folder::
c:\documents and settings\All Users\Application Data\AVG Security Toolbar
c:\documents and settings\Amanda\Application Data\AVGTOOLBAR
c:\program files\AVG
c:\documents and settings\All Users\Application Data\avg9
c:\documents and settings\All Users\Application Data\avg8


Driver::

AWF::
c:\program files\iTunes\bak\iTunesHelper.exe
c:\program files\QuickTime\bak\qttask.exe
c:\windows\system32\bak\ctfmon.exe


Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
 "SoundMan "=-


RegLockDel::

3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

[IMG]

5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

Combofix.txt
A new HijackThis log.

panda24 · 2010/01/26

combofix log 2

ComboFix 10-01-26.02 - Amanda 01/26/2010 19:02:18.2.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.1.1252.1.1033.18.1279.930 [GMT -7:00]
Running from: c:\documents and settings\Amanda\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Amanda\Desktop\CFScript.txt
AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
AV: AVG Anti-Virus Free *On-access scanning enabled* (Outdated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

FILE ::
"c:\windows\java\Packages\Data\33HR1ZRD.DAT "
"c:\windows\java\Packages\Data\5J1BFZV7.DAT "
"c:\windows\java\Packages\Data\ETVLN9R1.DAT "
"c:\windows\java\Packages\Data\U8ENXVVH.DAT "
"c:\windows\java\Packages\Data\X3VHZ97B.DAT "
"c:\windows\system32\drivers\atapi.sys0D557C46 "
"c:\windows\system32\drivers\atapi.sys6AA74E4A "
"c:\windows\system32\drivers\atapi.sysF5812507 "
"c:\windows\system32\drivers\haoiemly.sys "
"c:\windows\system32\drivers\jrkxhufd.sys "
"c:\windows\system32\drivers\qubrhphz.sys "
"c:\windows\system32\drivers\vyjtsnny.sys "
"c:\windows\system32\Spool\prtprocs\w32x86\0dheI.dll "
"c:\windows\system32\Spool\prtprocs\w32x86\5PDdr.dll "
"c:\windows\system32\Spool\prtprocs\w32x86\bqika.dll "
"c:\windows\system32\Spool\prtprocs\w32x86\iieI7.dll "
"c:\windows\system32\Spool\prtprocs\w32x86\mkEpa.dll "
"c:\windows\system32\Spool\prtprocs\w32x86\np4ng.dll "
"c:\windows\system32\Spool\prtprocs\w32x86\P0UOh.dll "
"c:\windows\system32\Spool\prtprocs\w32x86\QS1Cu.dll "
"c:\windows\system32\Spool\prtprocs\w32x86\rcjhc.dll "
"c:\windows\system32\Spool\prtprocs\w32x86\RdkHj.dll "
"c:\windows\system32\Spool\prtprocs\w32x86\S4xYZ.dll "
"c:\windows\system32\Spool\prtprocs\w32x86\SHdiv.dll "
"c:\windows\system32\Spool\prtprocs\w32x86\WKP2j.dll "
"c:\windows\system32\Spool\prtprocs\w32x86\xO70q.dll "
"c:\windows\system32\Spool\prtprocs\w32x86\yxb03.dll "
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\AVG Security Toolbar
c:\documents and settings\All Users\Application Data\AVG Security Toolbar\cache\cu_1050bb9b5bc6347c.cache
c:\documents and settings\All Users\Application Data\AVG Security Toolbar\cache\cu_15c380c13317547c.cache
c:\documents and settings\All Users\Application Data\AVG Security Toolbar\cache\cu_183ce5a586f4947c.cache
c:\documents and settings\All Users\Application Data\AVG Security Toolbar\cache\cu_26fd0754e35db47c.cache
c:\documents and settings\All Users\Application Data\AVG Security Toolbar\cache\cu_2a33dd598051347c.cache
c:\documents and settings\All Users\Application Data\AVG Security Toolbar\cache\cu_2d94fbd53db6b47c.cache
c:\documents and settings\All Users\Application Data\AVG Security Toolbar\cache\cu_30085d62cdf6f47c.cache
c:\documents and settings\All Users\Application Data\AVG Security Toolbar\cache\cu_3081d23fcfc9947c.cache
c:\documents and settings\All Users\Application Data\AVG Security Toolbar\cache\cu_37b1ca0cc28df47c.cache
c:\documents and settings\All Users\Application Data\AVG Security Toolbar\cache\cu_39ffe02efc52147c.cache
c:\documents and settings\All Users\Application Data\AVG Security Toolbar\cache\cu_3a219fdc5aa3947c.cache
c:\documents and settings\All Users\Application Data\AVG Security Toolbar\cache\cu_3b4af57811dfb47c.cache
c:\documents and settings\All Users\Application Data\AVG Security Toolbar\cache\cu_4218dce59905947c.cache
c:\documents and settings\All Users\Application Data\AVG Security Toolbar\cache\cu_451852b43216947c.cache
c:\documents and settings\All Users\Application Data\AVG Security Toolbar\cache\cu_4ba99360d610147c.cache
c:\documents and settings\All Users\Application Data\AVG Security Toolbar\cache\cu_56bd6965fc63147c.cache
c:\documents and settings\All Users\Application Data\AVG Security Toolbar\cache\cu_58baa1e35c01d47c.cache
c:\documents and settings\All Users\Application Data\AVG Security Toolbar\cache\cu_5f8125be658f347c.cache
c:\documents and settings\All Users\Application Data\AVG Security Toolbar\cache\cu_69c90a593c3c147c.cache
c:\documents and settings\All Users\Application Data\AVG Security Toolbar\cache\cu_74d232a3c4add47c.cache
c:\documents and settings\All Users\Application Data\AVG Security Toolbar\cache\cu_75d2b4d99e37747c.cache
c:\documents and settings\All Users\Application Data\AVG Security Toolbar\cache\cu_7a1ce7c339d2147c.cache
c:\documents and settings\All Users\Application Data\AVG Security Toolbar\cache\cu_7be2093a2500347c.cache
c:\documents and settings\All Users\Application Data\AVG Security Toolbar\cache\cu_7d915e84c002d47c.cache
c:\documents and settings\All Users\Application Data\AVG Security Toolbar\cache\cu_7ee2f4fd9078147c.cache
c:\documents and settings\All Users\Application Data\AVG Security Toolbar\cache\cu_86da21989710d47c.cache
c:\documents and settings\All Users\Application Data\AVG Security Toolbar\cache\cu_8f7ee80acd1eb47c.cache
c:\documents and settings\All Users\Application Data\AVG Security Toolbar\cache\cu_97ec188e3c93b47c.cache
c:\documents and settings\All Users\Application Data\AVG Security Toolbar\cache\cu_a7f8fc756738d47c.cache
c:\documents and settings\All Users\Application Data\AVG Security Toolbar\cache\cu_ae2c3d8646bcb47c.cache
c:\documents and settings\All Users\Application Data\AVG Security Toolbar\cache\cu_ae91b1954041b47c.cache
c:\documents and settings\All Users\Application Data\AVG Security Toolbar\cache\cu_b2d9a4b28b4e347c.cache
c:\documents and settings\All Users\Application Data\AVG Security Toolbar\cache\cu_b7d459bd9491747c.cache
c:\documents and settings\All Users\Application Data\AVG Security Toolbar\cache\cu_c2a696ce9bf8d47c.cache
c:\documents and settings\All Users\Application Data\AVG Security Toolbar\cache\cu_ca0d927c1e3fd47c.cache
c:\documents and settings\All Users\Application Data\AVG Security Toolbar\cache\cu_ca1e06b93cdf47c.cache
c:\documents and settings\All Users\Application Data\AVG Security Toolbar\cache\cu_cd189943ee7147c.cache
c:\documents and settings\All Users\Application Data\AVG Security Toolbar\cache\cu_d0c0aabbad9a147c.cache
c:\documents and settings\All Users\Application Data\AVG Security Toolbar\cache\cu_d0e2e80bbb69b47c.cache
c:\documents and settings\All Users\Application Data\AVG Security Toolbar\cache\cu_d3e276c1b693b47c.cache
c:\documents and settings\All Users\Application Data\AVG Security Toolbar\cache\cu_d4a6becea71e147c.cache
c:\documents and settings\All Users\Application Data\AVG Security Toolbar\cache\cu_d4c925bde11eb47c.cache
c:\documents and settings\All Users\Application Data\AVG Security Toolbar\cache\cu_d7b8af161291d47c.cache
c:\documents and settings\All Users\Application Data\AVG Security Toolbar\cache\cu_d7f2ba0a3210d47c.cache
c:\documents and settings\All Users\Application Data\AVG Security Toolbar\cache\cu_de62899194d9947c.cache
c:\documents and settings\All Users\Application Data\AVG Security Toolbar\cache\cu_e22237b8dd0db47c.cache
c:\documents and settings\All Users\Application Data\AVG Security Toolbar\cache\cu_e4143e4f6777947c.cache
c:\documents and settings\All Users\Application Data\AVG Security Toolbar\cache\cu_e7bf4753aa76f47c.cache
c:\documents and settings\All Users\Application Data\AVG Security Toolbar\cache\cu_e99cf9a25607147c.cache
c:\documents and settings\All Users\Application Data\AVG Security Toolbar\cache\cu_eb5f222e93ee147c.cache
c:\documents and settings\All Users\Application Data\AVG Security Toolbar\cache\cu_ee7b9f84dc6547c.cache
c:\documents and settings\All Users\Application Data\AVG Security Toolbar\cache\cu_f43715c76e16947c.cache
c:\documents and settings\All Users\Application Data\AVG Security Toolbar\cache\cu_f56f3a7d681947c.cache
c:\documents and settings\All Users\Application Data\AVG Security Toolbar\cache\cu_f6a67bc6ad5347c.cache
c:\documents and settings\All Users\Application Data\AVG Security Toolbar\cache\cu_f94401a68a24347c.cache
c:\documents and settings\All Users\Application Data\AVG Security Toolbar\cache\cu_fa14aad86754d47c.cache
c:\documents and settings\All Users\Application Data\AVG Security Toolbar\cache\cu_fb7e20f665b5b47c.cache
c:\documents and settings\All Users\Application Data\avg8
c:\documents and settings\All Users\Application Data\avg8\Cfg\erd.cfg
c:\documents and settings\All Users\Application Data\avg8\Cfg\krnl.cfg
c:\documents and settings\All Users\Application Data\avg8\Cfg\mail.cfg
c:\documents and settings\All Users\Application Data\avg8\Cfg\scan.cfg
c:\documents and settings\All Users\Application Data\avg8\Cfg\sched.cfg
c:\documents and settings\All Users\Application Data\avg8\Cfg\setup.cfg
c:\documents and settings\All Users\Application Data\avg8\Cfg\update.cfg
c:\documents and settings\All Users\Application Data\avg8\Cfg\updatecomps.cfg
c:\documents and settings\All Users\Application Data\avg8\Cfg\user.cfg
c:\documents and settings\All Users\Application Data\avg8\cfgall\changecfgreg.cfg
c:\documents and settings\All Users\Application Data\avg8\cfgall\updateall.cfg
c:\documents and settings\All Users\Application Data\avg8\cfgall\userall.cfg
c:\documents and settings\All Users\Application Data\avg8\Log\avgcfg.log
c:\documents and settings\All Users\Application Data\avg8\Log\avgcfg.log.lock
c:\documents and settings\All Users\Application Data\avg8\Log\avgldr.log
c:\documents and settings\All Users\Application Data\avg8\Log\avgldr.log.lock
c:\documents and settings\All Users\Application Data\avg8\Log\avgrs.log
c:\documents and settings\All Users\Application Data\avg8\Log\avgrs.log.1
c:\documents and settings\All Users\Application Data\avg8\Log\avgrs.log.10
c:\documents and settings\All Users\Application Data\avg8\Log\avgrs.log.2
c:\documents and settings\All Users\Application Data\avg8\Log\avgrs.log.3
c:\documents and settings\All Users\Application Data\avg8\Log\avgrs.log.4
c:\documents and settings\All Users\Application Data\avg8\Log\avgrs.log.5
c:\documents and settings\All Users\Application Data\avg8\Log\avgrs.log.6
c:\documents and settings\All Users\Application Data\avg8\Log\avgrs.log.7
c:\documents and settings\All Users\Application Data\avg8\Log\avgrs.log.8
c:\documents and settings\All Users\Application Data\avg8\Log\avgrs.log.9
c:\documents and settings\All Users\Application Data\avg8\Log\avgrs.log.lock
c:\documents and settings\All Users\Application Data\avg8\Log\avguilog.cfg
c:\documents and settings\All Users\Application Data\avg8\Log\avgwd.log
c:\documents and settings\All Users\Application Data\avg8\Log\avgwd.log.lock
c:\documents and settings\All Users\Application Data\avg8\Log\avgwdsvc.log
c:\documents and settings\All Users\Application Data\avg8\Log\avgwdsvc.log.lock
c:\documents and settings\All Users\Application Data\avg8\Log\cfgexlog.cfg
c:\documents and settings\All Users\Application Data\avg8\Log\cfglog.cfg
c:\documents and settings\All Users\Application Data\avg8\Log\commonpub.log
c:\documents and settings\All Users\Application Data\avg8\Log\commonpub.log.lock
c:\documents and settings\All Users\Application Data\avg8\Log\corelog.cfg
c:\documents and settings\All Users\Application Data\avg8\Log\ldrlog.cfg
c:\documents and settings\All Users\Application Data\avg8\Log\lnglog.cfg
c:\documents and settings\All Users\Application Data\avg8\Log\nslog.cfg
c:\documents and settings\All Users\Application Data\avg8\Log\privlog.cfg
c:\documents and settings\All Users\Application Data\avg8\Log\publog.cfg
c:\documents and settings\All Users\Application Data\avg8\Log\rslog.cfg
c:\documents and settings\All Users\Application Data\avg8\Log\scanlog.cfg
c:\documents and settings\All Users\Application Data\avg8\Log\schedlog.cfg
c:\documents and settings\All Users\Application Data\avg8\Log\srmlog.cfg
c:\documents and settings\All Users\Application Data\avg8\Log\updlog.cfg
c:\documents and settings\All Users\Application Data\avg8\Log\vaultlog.cfg
c:\documents and settings\All Users\Application Data\avg8\Log\wdlog.cfg
c:\documents and settings\All Users\Application Data\avg8\Log\wdsvclog.cfg
c:\documents and settings\All Users\Application Data\avg9
c:\documents and settings\All Users\Application Data\avg9\Cfg\setup.cfg
c:\documents and settings\All Users\Application Data\avg9\Cfg\updatecomps.cfg
c:\documents and settings\All Users\Application Data\avg9\Chjw\cm-0-p.dat
c:\documents and settings\All Users\Application Data\avg9\Chjw\cm-1-p.dat
c:\documents and settings\All Users\Application Data\avg9\Chjw\cm-2-i.dat
c:\documents and settings\All Users\Application Data\avg9\Chjw\cm-2-p.dat
c:\documents and settings\All Users\Application Data\avg9\Log\avgcfg.log.lock
c:\documents and settings\All Users\Application Data\avg9\Log\avgchjw.log.lock
c:\documents and settings\All Users\Application Data\avg9\Log\avgchjwsrv.log.lock
c:\documents and settings\All Users\Application Data\avg9\Log\avgcore.log.1
c:\documents and settings\All Users\Application Data\avg9\Log\avgcore.log.2
c:\documents and settings\All Users\Application Data\avg9\Log\avgcore.log.lock
c:\documents and settings\All Users\Application Data\avg9\Log\avgfrw.log.lock
c:\documents and settings\All Users\Application Data\avg9\Log\avgldr.log.lock
c:\documents and settings\All Users\Application Data\avg9\Log\avglng.log.lock
c:\documents and settings\All Users\Application Data\avg9\Log\avgns.log.lock
c:\documents and settings\All Users\Application Data\avg9\Log\avgrs.log.lock
c:\documents and settings\All Users\Application Data\avg9\Log\avgscan.log.lock
c:\documents and settings\All Users\Application Data\avg9\Log\avgsched.log.1
c:\documents and settings\All Users\Application Data\avg9\Log\avgsched.log.2
c:\documents and settings\All Users\Application Data\avg9\Log\avgsched.log.lock
c:\documents and settings\All Users\Application Data\avg9\Log\avgsrm.log.lock
c:\documents and settings\All Users\Application Data\avg9\Log\avgsrmacstat.log.lock
c:\documents and settings\All Users\Application Data\avg9\Log\avgtdi.log.lock
c:\documents and settings\All Users\Application Data\avg9\Log\avgui.log.lock
c:\documents and settings\All Users\Application Data\avg9\Log\avgupd.log.lock
c:\documents and settings\All Users\Application Data\avg9\Log\avgwd.log.1
c:\documents and settings\All Users\Application Data\avg9\Log\avgwd.log.lock
c:\documents and settings\All Users\Application Data\avg9\Log\avgwdsvc.log.lock
c:\documents and settings\All Users\Application Data\avg9\Log\fixcfg.log.lock
c:\documents and settings\All Users\Application Data\avg9\Log\vault.log.lock
c:\documents and settings\All Users\Application Data\avg9\Lsdb\Prev\prvcache.dat
c:\documents and settings\All Users\Application Data\avg9\Lsdb\Prev\prvglbl.dat
c:\documents and settings\All Users\Application Data\avg9\scanlogs\srm.idx
c:\documents and settings\All Users\Application Data\avg9\Temp\687e2a8b-a749-43f0-ba0d-35c85c68e1ce-490-oopp.tmp
c:\documents and settings\All Users\Application Data\avg9\Temp\c4f64072-9a14-40a1-84b5-432ab19bcd15-488-oopp.tmp
c:\documents and settings\All Users\Application Data\avg9\Temp\fd419c43-957e-4a6e-a74f-0cacb97875fd-478-oopp.tmp
c:\documents and settings\All Users\Application Data\avg9\Temp\file9514.tmp
c:\documents and settings\All Users\Application Data\avg9\update\download\avg9infoavi.ctf
c:\documents and settings\All Users\Application Data\avg9\update\download\avg9infowin.ctf
c:\documents and settings\All Users\Application Data\avg9\update\download\u7avi1767u17053g.bin
c:\documents and settings\All Users\Application Data\avg9\update\download\u7iavi2496u2495nl.bin
c:\documents and settings\All Users\Application Data\avg9\update\download\u7iavi2499u24943h.bin
c:\documents and settings\All Users\Application Data\avg9\update\download\x8xplsb_97d96x1.bin
c:\documents and settings\All Users\Application Data\avg9\update\download\x8xplsb_98d97k0.bin
c:\documents and settings\All Users\Application Data\avg9\update\download\x8xplsb2_116x1.bin
c:\documents and settings\All Users\Application Data\avg9\update\download\x8xplsc_146d144fz.bin
c:\documents and settings\All Users\Application Data\avg9\update\download\x8xplsc_147d146s0.bin
c:\documents and settings\Amanda\Application Data\AVGTOOLBAR
c:\program files\AVG
c:\program files\AVG\AVG8\avg7api.dll
c:\program files\AVG\AVG8\avgamnot.dll
c:\program files\AVG\AVG8\avgapix.dll
c:\program files\AVG\AVG8\avgcclix.dll
c:\program files\AVG\AVG8\avgcfgx.dll
c:\program files\AVG\AVG8\avgclitx.dll
c:\program files\AVG\AVG8\avgcorex.dll
c:\program files\AVG\AVG8\avgcrlpx.dll
c:\program files\AVG\AVG8\avgcsrvx.exe
c:\program files\AVG\AVG8\avglngx.dll
c:\program files\AVG\AVG8\avglogx.dll
c:\program files\AVG\AVG8\avglvex.dll
c:\program files\AVG\AVG8\avgmvflx.dll
c:\program files\AVG\AVG8\avgnsx.exe
c:\program files\AVG\AVG8\avgrsx.exe
c:\program files\AVG\AVG8\avgscanx.dll
c:\program files\AVG\AVG8\avgsched.dll
c:\program files\AVG\AVG8\avgsrmax.exe
c:\program files\AVG\AVG8\avgupd.dll
c:\program files\AVG\AVG8\avgvvx.dll
c:\program files\AVG\AVG8\avgwd.dll
c:\program files\AVG\AVG8\avgwdsvc.exe
c:\program files\AVG\AVG8\avgwdwsc.dll
c:\program files\AVG\AVG8\avgxpl.dll
c:\program files\AVG\AVG8\Firefox\chrome.manifest
c:\program files\AVG\AVG8\Firefox\Components\avgssff.dll
c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\ch_23\chrome\content\Languages\en.ini
c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\ch_39\chrome\content\Languages\en.ini
c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\ch_40\chrome\content\Languages\en.ini
c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\ch_48\chrome\content\Languages\en.ini
c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\chrome.manifest
c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\chrome\content\Languages\en.ini
c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\chrome\content\Languages\languages.cfg
c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\chrome\icons\default\htmlwindow.ico
c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\chrome\skin\logo.ico
c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\chrome\skin\settings_icon.ico
c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\chrome\skin\toolbarprotector_icon.ico
c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils2.dll
c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll
c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll
c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\xpavgtbapi.dll
c:\program files\AVG\AVG8\Toolbar\IE8Lib.dll
c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll
c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll.dmp
c:\program files\AVG\AVG8\Toolbar\ToolbarBroker.exe
c:\windows\java\Packages\Data\33HR1ZRD.DAT
c:\windows\java\Packages\Data\5J1BFZV7.DAT
c:\windows\java\Packages\Data\ETVLN9R1.DAT
c:\windows\java\Packages\Data\U8ENXVVH.DAT
c:\windows\java\Packages\Data\X3VHZ97B.DAT
c:\windows\system32\drivers\atapi.sys0D557C46
c:\windows\system32\drivers\atapi.sys6AA74E4A
c:\windows\system32\drivers\atapi.sysF5812507
c:\windows\system32\drivers\haoiemly.sys
c:\windows\system32\drivers\jrkxhufd.sys
c:\windows\system32\drivers\qubrhphz.sys
c:\windows\system32\drivers\vyjtsnny.sys
c:\windows\system32\Spool\prtprocs\w32x86\0dheI.dll
c:\windows\system32\Spool\prtprocs\w32x86\5PDdr.dll
c:\windows\system32\Spool\prtprocs\w32x86\bqika.dll
c:\windows\system32\Spool\prtprocs\w32x86\iieI7.dll
c:\windows\system32\Spool\prtprocs\w32x86\mkEpa.dll
c:\windows\system32\Spool\prtprocs\w32x86\np4ng.dll
c:\windows\system32\Spool\prtprocs\w32x86\P0UOh.dll
c:\windows\system32\Spool\prtprocs\w32x86\QS1Cu.dll
c:\windows\system32\Spool\prtprocs\w32x86\rcjhc.dll
c:\windows\system32\Spool\prtprocs\w32x86\RdkHj.dll
c:\windows\system32\Spool\prtprocs\w32x86\S4xYZ.dll
c:\windows\system32\Spool\prtprocs\w32x86\SHdiv.dll
c:\windows\system32\Spool\prtprocs\w32x86\WKP2j.dll
c:\windows\system32\Spool\prtprocs\w32x86\xO70q.dll
c:\windows\system32\Spool\prtprocs\w32x86\yxb03.dll

c:\windows\system32\qmgr.dll . . . is infected!! . . .Failed to restore. Attempting to replace on reboot

Infected copy of c:\windows\system32\qmgr.dll was found and disinfected
Restored copy from - c:\system volume information\_restore{F812528C-C033-4929-8CC2-78A711D9062F}\RP12\A0000676.dll
.
((((((((((((((((((((((((( Files Created from 2009-12-27 to 2010-01-27 )))))))))))))))))))))))))))))))
.

2010-01-25 02:18 . 2010-01-25 02:18 -------- d-----w- c:\program files\Trend Micro
2010-01-19 21:42 . 2010-01-19 21:42 -------- d-----w- c:\program files\CCleaner
2010-01-15 04:34 . 2010-01-15 04:40 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-01-15 04:34 . 2010-01-15 04:39 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-01-15 01:12 . 2002-08-29 12:00 6656 -c--a-w- c:\windows\system32\dllcache\migregdb.exe
2010-01-15 01:11 . 2002-08-29 12:00 19456 -c--a-w- c:\windows\system32\dllcache\agt0804.dll
2010-01-15 01:09 . 2002-08-29 12:00 106562 -c--a-w- c:\windows\system32\dllcache\srchctls.dll
2010-01-15 01:08 . 2002-08-29 12:00 77824 -c--a-w- c:\windows\system32\dllcache\isign32.dll
2010-01-15 01:07 . 2002-08-29 12:00 272896 -c--a-w- c:\windows\system32\dllcache\pinball.exe
2010-01-15 01:05 . 2001-08-17 20:59 50048 ----a-w- c:\windows\system32\drivers\DMusic.sys
2010-01-15 01:05 . 2002-08-29 08:32 5888 ----a-w- c:\windows\system32\drivers\splitter.sys
2010-01-15 01:03 . 2002-08-29 08:27 56576 ----a-w- c:\windows\system32\drivers\redbook.sys
2010-01-15 00:58 . 2001-08-18 05:36 4096 ----a-w- c:\windows\system32\ksuser.dll
2010-01-15 00:49 . 2002-08-29 10:46 38024 ----a-w- c:\windows\system32\drivers\termdd.sys
2010-01-15 00:45 . 2010-01-15 00:45 -------- d-s---w- c:\windows\system32\config\systemprofile\History
2010-01-12 20:45 . 2010-01-12 20:45 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-01-12 20:37 . 2010-01-12 20:37 -------- d-----w- c:\documents and settings\David\Application Data\Malwarebytes
2010-01-12 05:07 . 2010-01-15 01:27 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2010-01-12 05:07 . 2009-03-30 16:33 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2010-01-12 05:07 . 2009-02-13 18:29 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2010-01-12 05:07 . 2009-02-13 18:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2010-01-12 05:07 . 2010-01-12 05:07 -------- d-----w- c:\program files\Avira
2010-01-12 05:07 . 2010-01-12 05:07 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2010-01-10 00:03 . 2010-01-10 00:03 -------- d-----w- c:\program files\Common Files\PersonalSecUninstall
2010-01-09 21:34 . 2010-01-09 21:34 -------- d-----w- c:\windows\system32\config\systemprofile\Application Data\Yahoo!
2010-01-09 21:34 . 2010-01-09 21:34 -------- d-sh--w- c:\windows\system32\config\systemprofile\PrivacIE
2010-01-09 03:37 . 1997-06-23 04:06 407312 ----a-w- c:\windows\system32\MsRepl35.dll
2010-01-09 03:37 . 1997-06-23 04:06 252176 ----a-w- c:\windows\system32\MSRD2x35.dll
2010-01-09 03:37 . 1997-07-21 11:30 1045776 ----a-w- c:\windows\system32\MSJet35.dll
2010-01-09 03:37 . 1997-06-23 04:06 24848 ----a-w- c:\windows\system32\MSJtEr35.dll
2010-01-09 03:37 . 1997-06-23 04:06 123664 ----a-w- c:\windows\system32\MSJInt35.dll
2010-01-09 03:37 . 2010-01-09 04:12 -------- d-----w- c:\program files\Simply Media
2010-01-05 01:55 . 2009-11-03 03:42 195456 ------w- c:\windows\system32\MpSigStub.exe
2010-01-04 20:24 . 2010-01-04 20:24 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2010-01-03 07:08 . 2010-01-03 07:08 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-20 04:21 . 2009-04-14 21:02 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-01-15 05:20 . 2006-01-06 04:47 -------- d-----w- c:\program files\Free Offers from Freeze.com
2010-01-15 01:08 . 2005-09-20 04:24 23348 -c--a-w- c:\windows\system32\emptyregdb.dat
2010-01-12 07:39 . 2005-09-26 21:55 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-01-12 07:39 . 2007-01-01 04:18 -------- d-----w- c:\documents and settings\Amanda\Application Data\Fisher-Price
2010-01-09 21:31 . 2010-01-09 21:31 40960 ----a-w- c:\windows\system32\info.tmp
2010-01-03 07:05 . 2005-09-30 12:26 62824 -c--a-w- c:\documents and settings\David\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-12-03 20:04 . 2009-12-03 20:04 -------- d-----w- c:\documents and settings\Amanda\Application Data\EPSON
2009-12-01 01:24 . 2009-12-01 01:24 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee Security Scan
2009-11-24 04:31 . 2009-11-24 04:31 60416 ----a-w- c:\windows\ALCFDRTM.EXE
2009-11-22 01:45 . 2009-11-22 01:45 45004 ---ha-w- c:\windows\system32\mlfcache.dat
2009-11-08 03:28 . 2009-11-08 03:28 247296 ----a-w- c:\documents and settings\Amanda\Application Data\SystemRequirementsLab\SRLProxy_srl_4_0_10_0_d_ind.dll
2009-11-08 03:28 . 2009-11-08 03:28 247296 ----a-w- c:\documents and settings\Amanda\Application Data\SystemRequirementsLab\SRLProxy_srl_4_0_10_0_c_ind.dll
2009-11-08 03:28 . 2009-11-08 03:28 247296 ----a-w- c:\documents and settings\Amanda\Application Data\SystemRequirementsLab\SRLProxy_srl_4_0_10_0_b_ind.dll
2009-11-08 03:28 . 2009-11-08 03:28 247296 ----a-w- c:\documents and settings\Amanda\Application Data\SystemRequirementsLab\SRLProxy_srl_4_0_10_0_a_ind.dll
2009-11-07 19:48 . 2009-11-07 19:48 79144 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe
2005-12-28 16:42 . 2005-12-28 16:42 774144 -c--a-w- c:\program files\RngInterstitial.dll
.

------- Sigcheck -------

Cryptography Services Error !!
.
((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2005-08-18 18:49 . 2005-08-18 18:49 307200 c:\program files\Adobe\Acrobat 7.0\Reader\bak\AdobeUpdateManager.exe

2007-08-29 18:55 . 2007-08-29 18:55 1347584 c:\program files\AWS\WeatherBug\bak\Weather.exe

2002-07-09 04:45 . 2002-07-09 04:45 28672 c:\program files\Common Files\Microsoft Shared\Works Shared\bak\WkUFind.exe

2006-08-10 19:10 . 2006-08-10 19:10 221184 c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\bak\RoxWatchTray9.exe

2005-12-28 16:42 . 2007-10-19 01:31 1838592 c:\program files\Google\Google Desktop Search\bak\GoogleDesktop.exe

2008-01-15 10:22 . 2008-01-15 10:22 267048 c:\program files\iTunes\bak\iTunesHelper.exe
2009-10-29 03:21 . 2009-10-29 03:21 141600 c:\program files\iTunes\iTunesHelper.exe

2008-02-08 22:41 . 2007-09-25 08:11 132496 c:\program files\Java\jre1.6.0_03\bin\bak\jusched.exe

2006-09-11 23:36 . 1999-05-13 03:01 20545 c:\program files\Microsoft Hardware\Game Controllers\Common\bak\swtrayv4.exe

2008-01-10 22:27 . 2008-01-10 22:27 385024 c:\program files\QuickTime\bak\qttask.exe
2009-09-05 07:54 . 2009-09-05 07:54 417792 c:\program files\QuickTime\QTTask.exe

2006-07-31 16:00 . 2006-07-31 16:00 1116920 c:\program files\Roxio\Drag-to-Disc\bak\DrgToDsc.exe

2006-08-14 08:07 . 2006-08-14 08:07 102400 c:\program files\Roxio\Media Experience\bak\DMXLauncher.exe

2005-09-20 05:29 . 2005-08-20 02:34 3084288 c:\program files\Yahoo!\Messenger\bak\ypager.exe

.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"EasyLinkAdvisor "= "c:\program files\Linksys EasyLink Advisor\LinksysAgent.exe" [2007-03-16 454784]
"swg "= "c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-07-21 39408]
"SpybotSD TeaTimer "= "c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NVIDIA nForce APU1 Utilities "= "NVATray.exe" [2001-11-28 45056]
"Dit "= "Dit.exe" [2002-08-28 73728]
"NvCplDaemon "= "c:\windows\system32\NvCpl.dll" [2006-10-22 7700480]
"nwiz "= "nwiz.exe" [2006-10-22 1622016]
"AppleSyncNotifier "= "c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-08-13 177440]
"NvMediaCenter "= "c:\windows\system32\NvMcTray.dll" [2006-10-22 86016]
"fssui "= "c:\program files\Windows Live\Family Safety\fsui.exe" [2009-02-07 454000]
"QuickTime Task "= "c:\program files\QuickTime\qttask.exe" [2009-09-05 417792]
"iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2009-10-29 141600]
"Easy Dock "=" " [N/A]
"avgnt "= "c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM "= "c:\program files\MySpace\IM\MySpaceIM.exe" [N/A]

c:\documents and settings\Amanda\Start Menu\Programs\Startup\
RCA Detective.lnk - c:\documents and settings\Amanda\My Documents\RCA Detective\RCADetective.exe [2009-12-25 942592]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
backup=c:\windows\pss\Kodak EasyShare software.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
2009-08-13 21:51 177440 ----a-w- c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2009-10-29 03:21 141600 ----a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 00:12 1695232 --sh--w- c:\program files\Messenger\msmsgs.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe "=
"c:\\Program Files\\Messenger\\msmsgs.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe "=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe "=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe "=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe "=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe "=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe "=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
"c:\\Program Files\\iTunes\\iTunes.exe "=

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [1/11/2010 10:07 PM 108289]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [5/15/2009 8:31 PM 55152]
S2 fsssvc;Windows Live Family Safety;c:\program files\Windows Live\Family Safety\fsssvc.exe [2/6/2009 5:08 PM 533360]
.
Contents of the 'Scheduled Tasks' folder

2010-01-22 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 18:34]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/ig
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = iexplore
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Search - ?p=ZJxdm128YYUS
IE: {{c95fe080-8f5d-11d2-a20b-00aa003c157a} - %SystemRoot%\web\related.htm
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} - hxxp://a19.g.akamai.net/7/19/7125/4056/ftp.coupons.com/r3302/cpbrkpie.cab
FF - ProfilePath - c:\documents and settings\Amanda\Application Data\Mozilla\Firefox\Profiles\jbp8iwfp.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig
FF - component: c:\documents and settings\Amanda\Application Data\Mozilla\Firefox\Profiles\jbp8iwfp.default\extensions\{463F6CA5-EE3C-4be1-B7E6-7FEE11953374}\platform\WINNT\components\FoxyTunes.dll
FF - component: c:\documents and settings\Amanda\Application Data\Mozilla\Firefox\Profiles\jbp8iwfp.default\extensions\kodak-companion@mozilla.com\platform\WINNT_x86-msvc\components\mozFotofox.dll
FF - plugin: c:\documents and settings\All Users\Application Data\RealArcade\npraclient.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npImgCtl.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npraclient.dll
FF - plugin: c:\program files\Real\RealArcade\Plugins\Mozilla\npracplug.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-26 19:52
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977 "=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,71,fb,c9,19,11,95,c0,45,b5,69,19,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81 "=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,71,fb,c9,19,11,95,c0,45,b5,69,19,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(560)
c:\windows\System32\ODBC32.dll
c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
c:\windows\System32\msctfime.ime

- - - - - - - > 'lsass.exe'(616)
c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
c:\windows\System32\dssenh.dll

- - - - - - - > 'explorer.exe'(4068)
c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
c:\windows\System32\msctfime.ime
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\System32\msi.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\Command Software\dvpapi.exe
c:\program files\Common Files\EPSON\EBAPI\eEBSVC.exe
c:\program files\Common Files\EPSON\EBAPI\SAgent2.exe
c:\windows\system32\pctspk.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\windows\Dit.exe
c:\windows\DitExp.exe
.
**************************************************************************
.
Completion time: 2010-01-26 19:59:31 - machine was rebooted
ComboFix-quarantined-files.txt 2010-01-27 02:58
ComboFix2.txt 2010-01-27 01:09

Pre-Run: 45,070,594,048 bytes free
Post-Run: 45,025,456,128 bytes free

- - End Of File - - 1E3EF3670C0B2572F500536C7E9D792B

panda24 · 2010/01/26

Hijackthis log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:03:16 PM, on 1/26/2010
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Command Software\dvpapi.exe
C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\WINDOWS\system32\pctspk.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Dit.exe
C:\WINDOWS\DitExp.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Documents and Settings\Amanda\My Documents\RCA Detective\RCADetective.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\SoftwareDistribution\Download\ad9c4c2a779933f83b51a49a2c88838d\update\update.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: Windows Live Family Safety Browser Helper - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NVIDIA nForce APU1 Utilities] NVATray.exe
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [fssui] "C:\Program Files\Windows Live\Family Safety\fsui.exe" -autorun
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [EasyLinkAdvisor] "C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" /startup
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe "
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O4 - Startup: RCA Detective.lnk = C:\Documents and Settings\Amanda\My Documents\RCA Detective\RCADetective.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Search - ?p=ZJxdm128YYUS
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1127253496125
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1131427458859
O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://www.kodakgallery.com/downloads/BUM/BUM_WIN_IE_1/axofupld.cab
O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} - http://a19.g.akamai.net/7/19/7125/4056/ftp.coupons.com/r3302/cpbrkpie.cab
O16 - DPF: {9BFC2253-B9D9-477E-9488-CA450232620D} (BinAg1 Class) - https://fastconnectkitsetup.cox.net/wizlet/CoxNA/static/controls/WebflowActiveX.CAB
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - http://download.games.yahoo.com/games/web_games/popcap/bejeweled2/popcaploader_v6.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file)
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - C:\Program Files\Common Files\Command Software\dvpapi.exe
O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
O23 - Service: Roxio UPnP Renderer 9 - Unknown owner - C:\Program Files\Common Files\Sonic Shared\RoxioUPnPRenderer9.exe (file missing)
O23 - Service: Roxio Upnp Server 9 - Unknown owner - C:\Program Files\Common Files\Sonic Shared\RoxioUpnpService9.exe (file missing)
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Unknown owner - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe (file missing)
O23 - Service: RoxMediaDB9 - Unknown owner - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe (file missing)
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Unknown owner - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe (file missing)
O23 - Service: stllssvr - Unknown owner - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe (file missing)

--
End of file - 11101 bytes

broni · 2010/01/26

That looks much better.

Uninstall Combofix:
Go Start > Run [Vista users, go Start> "Start search"]
Type in:
Combofix /Uninstall
Note the space between the "Combofix" and the "/Uninstall "
Restart computer.

================================================================

Now, Combofix reports Cryptography Services Error.
Run scans listed below and at the same time read about the above error here: http://www.updatexp.com/cryptographic-service.html

================================================================

Print these instructions out.

NOTE. If any of the programs listed below refuse to run, try renaming executive file to something else; for instance, rename hijackthis.exe to scanner.exe

***VERY IMPORTANT! Make sure, you update Superantispyware, and Malwarebytes before running the scans.***

STEP 1. Download SUPERAntiSpyware Free for Home Users:
http://www.superantispyware.com/

* Double-click SUPERAntiSpyware.exe and use the default settings for installation.
* An icon will be created on your desktop. Double-click that icon to launch the program.
* If asked to update the program definitions, click "Yes ". If not, update the definitions before scanning by selecting "Check for Updates ". (If you encounter any problems while downloading the updates, manually download and unzip them from here: http://www.superantispyware.com/definitions.html.)
* Close SUPERAntiSpyware.

PHYSICALLY DISCONNECT FROM THE INTERNET

Restart computer in Safe Mode.
To enter Safe Mode, restart computer, and keep tapping F8 key, until menu appears; select Safe Mode; you'll see "Safe Mode" in all four corners of your screen

* Open SUPERAntiSpyware.
* Click Scan your Computer... button.
* Click Scanning Preferences/Control Center... button.
* Under General and Startup tab, make sure, Start SUPERAntiSpyware when Windows starts option is UN-checked.
* Click the Scanning Control tab.
* Under Scanner Options make sure the following are checked (leave all others unchecked):
- Close browsers before scanning.
- Terminate memory threats before quarantining.
* Click the Close button to leave the control center screen.
* On the left, make sure you check C:\Fixed Drive.
* On the right, choose Perform Complete Scan.
* Click Next to start the scan. Please be patient while it scans your computer.
* After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click OK.
* Make sure everything has a checkmark next to it and click Next.
* A notification will appear that Quarantine and Removal is Complete. Click OK and then click the Finish button to return to the main menu.
* If asked if you want to reboot, click Yes.
* To retrieve the removal information after reboot, launch SUPERAntispyware again.
- Click Preferences, then click the Statistics/Logs tab.
- Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
- If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
- Please copy and paste the Scan Log results in your next reply.
* Click Close to exit the program.
Post SUPERAntiSpyware log.

RECONNECT TO THE INTERNET

RESTART COMPUTER!

STEP 2. Download Malwarebytes' Anti-Malware: http://www.malwarebytes.org/mbam.php to your desktop.
(Malwarebytes is free to use as a manual scanner. Payment is only required if you wish to have it run and update automatically which is not necessary for our purposes)

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.

The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

RESTART COMPUTER!

STEP 3.
Post fresh HijackThis log.
NOTE. If you're using Vista, right click on HijackThis, and click Run as Administrator
Do NOT attempt to "fix" anything!

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

panda24 · 2010/01/26

still getting error 1904. Module C:\Program Files\SUPERAntiSpyware\SASWINLO.dll failed to register. HRESULT -214024769. Contact your support personnel.

broni · 2010/01/26

Try Malwarebytes first.
Eventually, uninstall, reinstall Super.

panda24 · 2010/01/26

Error
Runtime Error (at -1:0):
Cannot Import dll:C:\DOCUME~1\Amanda\LOCALS~1\Temp\is-EOOA1.tmp\mbam.dll

This was for trying to run the .exe for malwarebytes.

broni · 2010/01/26

Try to reinstall MBAM as well.
Combofix dealt with a bunch of files. Maybe something went amiss.

panda24 · 2010/01/26

I have tried several times...I also tried restarting my computer and I am getting a lot of pop up error windows when my desktop loads...a lot of entry points not found and still one from avgnt.exe...did I miss something???

broni · 2010/01/26

Please run a free online scan with the ESET Online Scanner

Tick the box next to YES, I accept the Terms of Use

Click Start

When asked, allow the ActiveX control to install

Click Start

Make sure that the options Remove found threats and the option Scan unwanted applications is checked

Click Scan (This scan can take several hours, so please be patient)

Once the scan is completed, you may close the window

Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt

Copy and paste that log as a reply to this topic

Log in or Sign up

Solved Need to make sure all trojans and malware are off of my computer

broni Moderator Malware Analyst

panda24 Inactive Thread Starter

broni Moderator Malware Analyst

broni Moderator Malware Analyst

panda24 Inactive Thread Starter

broni Moderator Malware Analyst

panda24 Inactive Thread Starter

broni Moderator Malware Analyst

panda24 Inactive Thread Starter

panda24 Inactive Thread Starter

broni Moderator Malware Analyst

panda24 Inactive Thread Starter

panda24 Inactive Thread Starter

broni Moderator Malware Analyst

panda24 Inactive Thread Starter

broni Moderator Malware Analyst

panda24 Inactive Thread Starter

broni Moderator Malware Analyst

panda24 Inactive Thread Starter

broni Moderator Malware Analyst

Share This Page

Log in or Sign up

Solved Need to make sure all trojans and malware are off of my computer

broni Moderator Malware Analyst

panda24 Inactive Thread Starter

broni Moderator Malware Analyst

broni Moderator Malware Analyst

panda24 Inactive Thread Starter

broni Moderator Malware Analyst

panda24 Inactive Thread Starter

broni Moderator Malware Analyst

panda24 Inactive Thread Starter

panda24 Inactive Thread Starter

broni Moderator Malware Analyst

panda24 Inactive Thread Starter

panda24 Inactive Thread Starter

broni Moderator Malware Analyst

panda24 Inactive Thread Starter

broni Moderator Malware Analyst

panda24 Inactive Thread Starter

broni Moderator Malware Analyst

panda24 Inactive Thread Starter

broni Moderator Malware Analyst

Share This Page

Useful Searches