Solved Nothing will open....trojan horse?

[Resolved] Nothing will open....trojan horse?

Hello...
I have been having problems with my computer for about a week now. I keep getting pop-ups with ads for spyware removing programs available for purchase. When these pop-ups are closed, about 10 minutes later they pop right back up.
I have AVG and I tried to run a system scan when it all started, however, the program ended up freezing and quitting. I am up to date on all my virus definitions so I'm not exactly sure what happened. I have tried to start the virus scan over and the program will not even load.
As a matter of fact, no program will load. When I try to open programs like AVG, RealPlayer or even the calculator, I get a popup that says it has moved or could not be found. I even downloaded HiJackThis and it will not open at all. Plus, the only internet browser that will open is Internet Explorer 7, Firefox will not open and, when I downloaded it a 2nd time and tried to install it, I got the same popup stating it was not found or could not open.
In an attempt to remove the virus, my friend instructed me to delete Internet Explorer. NOW, when I start my computer it just acts like it's loading and nothing comes up, almost like it's frozen. The only way to get it to load is to press F8 while it loads and start it with the last settings that worked.

Please help! I am having such a frustrating time getting this to work!

***********
Here is the DDS Log:


DDS (Ver_09-12-01.01) - NTFSx86
Run by Owner at 11:42:57.17 on Sun 02/28/2010
Internet Explorer: 7.0.5730.13
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.503.70 [GMT -8:00]

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated)

{17DDD097-36FF-435F-9E1B-52D74245D6BF}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Softex\OmniPass\Omniserv.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\Program Files\Softex\OmniPass\OPXPApp.exe
C:\WINDOWS\System32\ups.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft Office\Office12\EXCEL.EXE
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Program Files\MSN\Toolbar\3.0.0988.2\msntask.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
C:\Documents and Settings\Owner\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.ask.com?o=15549&l=dis
uSearch Page =
uWindow Title = Windows Internet Explorer provided by MySpace
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
uSearch Bar =
mDefault_Page_URL = hxxp://www.myspace.com/
mStart Page = hxxp://www.myspace.com/
uCustomizeSearch = c:\windows\search.htm
uURLSearchHooks: H - No File
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common

files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: {1D7E3B41-23CE-469B-BE1B-A64B877923E1} - No File
BHO: RealPlayer Download and Record Plugin for Internet Explorer:

{3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program

files\avg\avg8\avgssie.dll
BHO: MSN Toolbar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program

files\msn\toolbar\3.0.0988.2\msneshellx.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program

files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: MSN Toolbar: {1e61ed7c-7cb8-49d6-b9e9-ab4c880c8414} - c:\program

files\msn\toolbar\3.0.0988.2\msneshellx.dll
TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File
TB: {F5735C15-1FB2-41FE-BA12-242757E69DDE} - No File
TB: &SearchBar: {0494d0d9-f8e0-41ad-92a3-14154ece70ac} - c:\program

files\myway\mybar\1.bin\MYBAR.DLL
TB: {4982D40A-C53B-4615-B15B-B5B5E98D167C} - No File
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -
TB: {5CBE2611-C31B-401F-89BC-4CBB25E853D7} - No File
TB: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File
TB: {06E58E5E-F8CB-4049-991E-A41C03BD419E} - No File
TB: {90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} - No File
TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
EB: {4528BBE0-4E08-11D5-AD55-00010333D0AD} - No File
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
EB: WSEL Services: {c7a2084b-969c-439a-96e8-176bf9a93879} - c:\program

files\whistlesoftware\wselservices\webband.dll
uRun: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
uRun: [MsnMsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
uRun: [NSAgent] c:\documents and settings\owner\desktop\SaddamSetup09_np.exe
uRun: [uoltray] c:\program files\netzero\exec.exe regrun
uRun: [Weather] c:\program files\aws\weatherbug\Weather.EXE 1
uRun: [omuw] c:\progra~1\common~1\omuw\omuwm.exe
uRun: [hwvsRhMsX] atippcmp.exe
uRun: [PhotoShow Deluxe Media Manager] c:\progra~1\nero\data\xtras\mssysmgr.exe
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [DW6] "c:\program files\the weather channel fw\desktop\DesktopWeather.exe "
uRun: [TOY5KNQ8OC] c:\docume~1\owner\locals~1\temp\Npb.exe
uRun: [oiwjckum] c:\documents and settings\owner\local settings\application data\lgqqwa\nnbbsftav.exe
mRun: [hpsysdrv] c:\windows\system\hpsysdrv.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [KBD] c:\hp\kbd\KBD.EXE
mRun: [Recguard] c:\windows\sminst\RECGUARD.EXE
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
mRun: [PS2] c:\windows\system32\ps2.exe
mRun: [HPDJ Taskbar Utility] c:\windows\system32\spool\drivers\w32x86\3\hpztsb06.exe
mRun: [windows auto update] msblast.exe
mRun: [Microsoft Works Update Detection] c:\program files\common files\microsoft shared\works

shared\WkUFind.exe
mRun: [nsdriver] c:\windows\system32\nssys32.exe
mRun: [UpdateManager] "c:\program files\common files\sonic\update manager\sgtray.exe" /r
mRun: [nsjsxcv] c:\windows\nsjsxcv.exe
mRun: [ezcnqxwp] c:\windows\ezcnqxwp.exe
mRun: [WildTangent CDA] RUNDLL32.exe "c:\program

files\wildtangent\apps\cda\cdaEngine0400.dll ",cdaEngineMain
mRun: [qebwfbjjxtra] c:\windows\system32\rhmmcze.exe
mRun: [xxlgv] c:\program files\Befhozf.exe
mRun: [Jawa322] c:\windows\jawa32.exe
mRun: [oxl.exe] c:\docume~1\owner\locals~1\temp\oxl.exe
mRun: [4ZCIy8.exe] c:\docume~1\owner\locals~1\temp\4ZCIy8.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [AlcxMonitor] ALCXMNTR.EXE
mRun: [AutoLoaderw0v01bdeMQPL] "c:\windows\system32\actbjs.exe" /PC= "CP.CDT3"

/ShowLegalNote= "nonbranded" /UninstallName= "CtxPls"
mRun: [w74i3ng] actbjs.exe
mRun: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
mRun: [BJCFD] c:\program files\broadjump\client foundation\CFD.exe
mRun: [SemanticInsight] c:\program files\rxtoolbar\semantic insight\SemanticInsight.exe
mRun: [OmniPass] c:\program files\softex\omnipass\scureapp.exe
mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
mRun: [omreplc] c:\windows\system32\omreplc.exe
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe "
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [oiwjckum] c:\documents and settings\owner\local settings\application data\lgqqwa\nnbbsftav.exe
mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {220E39C3-B081-4719-AB1A-9A884DCBD05C} - {C7A2084B-969C-439A-96E8-176BF9A93879} -

c:\program files\whistlesoftware\wselservices\webband.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} -

c:\progra~1\micros~3\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} -

c:\progra~1\micros~3\office12\REFIEBAR.DLL
DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://www.apple.com/qtactivex/qtplugin.cab
DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} -

hxxp://download.microsoft.com/download/e/4/9/e494c802-dd90-4c6b-a074-469358f075a6/OGAControl.ca

b
DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} -

hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} -

hxxp://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei-4/ZwinkyInitialSetup1.0.1.1.cab
DPF: {48DD0448-9209-4F81-9F6D-D83562940134} -

hxxp://lads.myspace.com/upload/MySpaceUploader1006.cab
DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} -

hxxp://gfx2.hotmail.com/mail/w3/resources/MSNPUpld.cab
DPF: {54771E6F-A5A2-4413-8FB8-7B8F85398174} -

hxxp://dl.lygo.com/Sidesearch/en_US/Lycos/Sidesearch.cab
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} -

hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?978967456656
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} -

hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} -

hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {9AC54695-69A4-46F1-BE10-10C74F9520D5} -

hxxp://cabs.elitemediagroup.net/cabs/mediaview.cab
DPF: {9C23D886-43CB-43DE-B2DB-112A68D7E10A} -

hxxp://lads.myspace.com/upload/MySpaceUploader2.cab
DPF: {9E17A5F9-2B9C-4C66-A592-199A4BA1FBC8} -

hxxp://pictures05.aim.com/ygp/aol/plugin/upf/AOLUPF.en-US-AIM.9.5.1.8.cab
DPF: {CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA} -

hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_03-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} -

hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} -

hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} -

hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} -

hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {D4C15E81-E2F6-4013-B81D-6F796D2C78C5} -

hxxps://secure.stamps.com/download/us/registration/4_1_0_175/SdcWebSecurity.cab
DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} -

hxxp://zone.msn.com/bingame/dim2/default/popcaploader_v6.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} -

hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: NameServer = 93.188.164.210,93.188.166.48
TCP: {2786A5F2-1CE3-44CE-88C0-2AE2A6757D0B} = 93.188.164.210,93.188.166.48
TCP: {BD643CCE-F888-4F02-ABDA-44507E9ED9BC} = 93.188.164.210,93.188.166.48
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program

files\avg\avg8\avgpp.dll
Notify: avgrsstarter - avgrsstx.dll
Notify: igfxcui - igfxsrvc.dll
Notify: kbupdate - kbupdate.dll
Notify: OPXPGina - c:\program files\softex\omnipass\opxpgina.dll
Hosts: 64.12.152.18 search.netscape.com
Hosts: 207.68.176.250 auto.search.msn.com

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\owner\applic~1\mozilla\firefox\profiles\rdjeb382.default\
FF - prefs.js: browser.search.defaulturl -

hxxp://aim.search.aol.com/search/search?query={searchTerms}&invocationType=tb50-ff-aim-chromesbox-

en-us
FF - prefs.js: browser.startup.homepage - hxxp://www.ask.com?o=15549&l=dis
FF - prefs.js: keyword.URL -

hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
FF - component: c:\program

files\real\realplayer\browserrecord\firefox\ext\components\nprpffbrowserrecordext.dll
FF - plugin: c:\program files\mozilla firefox\plugins\nptgeqplugin.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\npaudio.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\npavi32.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\npdrmv2.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\npdsplay.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\NPMAsst32.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\npnul32.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\NPOFF12.DLL
FF - plugin: c:\program files\netscape\communicator\program\plugins\nppdf32.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\nppl3260.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\npqtplugin.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\npqtplugin2.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\npqtplugin3.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\npqtplugin4.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\npqtplugin5.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\npqtplugin6.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\npqtplugin7.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\nprfxins.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\nprjplug.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\nprpjplug.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\npstm32.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\npswf32.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\npwmsdrm.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\npwthost.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\npwtplug.dll

---- FIREFOX POLICIES ----
FF - user.js: network.protocol-handler.warn-external.dnupdate -

false);user_pref(network.protocol-handler.warn-external.dnupdate, falsec:\program files\mozilla

firefox\greprefs\security-prefs.js - pref( "security.ssl3.rsa_seed_sha ", true);

============= SERVICES / DRIVERS ===============

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-2-5

335240]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver

x86;c:\windows\system32\drivers\avgmfx86.sys [2009-2-5 27784]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-2-5 108552]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe [2009-2-5 908056]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-2-5 297752]
R3 NB762_XP;NB 802.11g XG762 1211B Driver;c:\windows\system32\drivers\WlanUZXP.sys [2009-8-8

437760]
S0 FOPN;FOPN;c:\windows\system32\drivers\fopn.sys --> c:\windows\system32\drivers\FOPN.sys [?]
S0 ulsqtlor;ulsqtlor; [x]
S3 sctdisk;sctdisk;c:\windows\system32\sctdisk.sys [2003-4-25 2304]

=============== Created Last 30 ================

2010-02-25 09:35:29 0 d-sh--w- C:\found.000
2010-02-24 04:38:32 0 d-----w- c:\program files\Trend Micro
2010-02-24 04:09:48 20 ----a-w- c:\windows\system32\crt.dat
2010-02-24 01:12:26 160768 ----a-w- c:\windows\msa.exe
2010-02-24 01:12:15 57344 ----a-w- c:\windows\system32\omreplc.exe
2010-02-24 01:12:08 57344 ----a-w- c:\windows\system32\actbjs.exe
2010-02-24 01:12:03 57344 ----a-w- c:\windows\jawa32.exe
2010-02-24 01:12:01 57344 ----a-w- c:\windows\system32\rhmmcze.exe
2010-02-24 01:11:59 57344 ----a-w- c:\windows\ezcnqxwp.exe
2010-02-24 01:11:57 57344 ----a-w- c:\windows\nsjsxcv.exe
2010-02-24 01:11:55 57344 ----a-w- c:\windows\system32\nssys32.exe
2010-02-24 01:11:23 97792 ----a-w- c:\windows\system32\kbdatat4.dll
2010-02-24 01:11:23 20992 ----a-w- c:\windows\system32\kbupdate.dll
2010-02-24 01:11:23 169984 ----a-w- c:\windows\system32\crt4.dll
2010-02-24 01:11:23 1591 ----a-w- c:\windows\system32\kboem32.dat
2010-02-24 01:11:06 8 ----a-w- c:\docume~1\alluse~1\applic~1\mswintmp.dat
2010-02-13 05:28:12 0 d-----w- c:\docume~1\owner\applic~1\Stamps.com Internet

Postage
2010-02-13 05:27:18 0 d-----w-

c:\docume~1\alluse~1\applic~1\{B0AFCE64-DF3F-4824-8985-B21DB0EEE07B}
2010-02-13 05:26:32 0 d-----w-

c:\docume~1\alluse~1\applic~1\{BFCD9266-8B97-4A73-8FDF-E2743DE8939E}
2010-02-13 05:25:39 36 ---ha-w- c:\windows\system32\f9t.dat
2010-02-13 05:25:39 0 d-----w- c:\program files\Stamps.com Internet Postage
2010-02-13 03:56:58 21504 -c--a-w- c:\windows\system32\dllcache\hidserv.dll
2010-02-13 03:56:58 21504 ----a-w- c:\windows\system32\hidserv.dll
2010-02-13 03:56:53 14592 -c--a-w- c:\windows\system32\dllcache\kbdhid.sys
2010-02-13 03:56:53 14592 ----a-w- c:\windows\system32\drivers\kbdhid.sys

==================== Find3M ====================

2010-02-24 01:12:06 57344 ----a-w- c:\windows\system32\igfxtray.exe
2010-02-24 01:11:51 57344 ----a-w- c:\windows\system32\ps2.exe
2010-02-24 01:11:45 57344 ----a-w- c:\windows\system32\hkcmd.exe
2009-12-31 16:50:03 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-16 18:43:27 343040 ----a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:08:23 33280 ----a-w- c:\windows\system32\csrsrv.dll
2009-12-08 19:26:15 2145280 ----a-w- c:\windows\system32\ntoskrnl.exe
2009-12-08 18:43:51 2023936 ----a-w- c:\windows\system32\ntkrnlpa.exe
2001-01-08 15:05:03 16708096 -c--a-w- c:\program files\IESetup701.msi
2009-01-09 14:39:19 32768 -csha-w- c:\windows\system32\config\systemprofile\local

settings\history\history.ie5\mshist012009010920090110\index.dat

============= FINISH: 11:44:14.15 ===============

 

Here is the file. Thank you.

*******************

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-12-01.01)

Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume2
Install Date: 6/22/2003 12:14:37 PM
System Uptime: 2/28/2010 7:12:55 AM (4 hours ago)

Motherboard: ASUSTeK Computer INC. | | 'P4SD-LA'
Processor: Intel(R) Pentium(R) 4 CPU 2.40GHz | CPU 1 | 2400/200mhz

==== Disk Partitions =========================

A: is Removable
C: is FIXED (NTFS) - 108 GiB total, 76.865 GiB free.
D: is FIXED (FAT32) - 4 GiB total, 0.693 GiB free.
E: is CDROM ()
F: is CDROM ()

==== Disabled Device Manager Items =============

==== System Restore Points ===================

No restore point in system.

==== Installed Programs ======================

µTorrent
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Illustrator 10
Adobe Reader 9.3
Apple Application Support
Apple Software Update
AVG Free 8.5
Avi2Dvd 0.4.5 beta
AviSynth 2.5
Bonjour
BroadJump Client Foundation
Business Cards
Compaq Connections
Dev-C++ 5 beta 9 release (4.9.9.2)
DVD Decrypter (Remove Only)
DVD Shrink 3.2
DVD Suite
Foxit Reader
GDR 4053 for SQL Server Database Services 2005 ENU (KB970892)
GDR 4053 for SQL Server Tools and Workstation Components 2005 ENU (KB970892)
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976098-v2)
hp instant support
hp print screen utility
HpSdpAppCoreApp
Intel(R) Extreme Graphics 2 Driver
IntelliMover Data Transfer Demo
J2SE Runtime Environment 5.0 Update 3
J2SE Runtime Environment 5.0 Update 6
Java(TM) 6 Update 15
KBD
Lame ACM MP3 Codec
Microsoft .NET Framework (English)
Microsoft .NET Framework (English) v1.0.3705
Microsoft .NET Framework 1.0 Hotfix (KB928367)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Application Error Reporting
Microsoft Data Access Components KB870669
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Excel MUI (English) 2007
Microsoft Office Home and Student 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Picture It! Express 7.0
Microsoft Software Update for Web Folders (English) 12
Microsoft SQL Server 2005
Microsoft SQL Server 2005 Express Edition (SQLEXPRESS)
Microsoft SQL Server 2005 Tools Express Edition
Microsoft SQL Server Native Client
Microsoft SQL Server Setup Support Files (English)
Microsoft SQL Server VSS Writer
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft VC9 runtime libraries
Microsoft XML Parser
Mozilla Firefox (3.5.8)
MP3 Rocket
MSN Toolbar
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 6.0 Parser
My Search Bar
neroxml
Netscape Navigator 4.08
NVIDIA Windows 2000/XP Display Drivers
OmniPass
PC-Doctor for Windows
PCFriendly
PowerProducer
PS2
Python 2.2 combined Win32 extensions
QuickTime
RealPlayer
S3Display
S3Gamma2
S3Info2
S3Overlay
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB973704)
Security Update for CAPICOM (KB931906)
Security Update for Microsoft Office Excel 2007 (KB973593)
Security Update for Microsoft Office PowerPoint 2007 (KB957789)
Security Update for Microsoft Office system 2007 (972581)
Security Update for Microsoft Office system 2007 (KB969613)
Security Update for Microsoft Office system 2007 (KB974234)
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
Security Update for Microsoft Office Word 2007 (KB969604)
Security Update for Step By Step Interactive Training (KB898458)
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Internet Explorer 7 (KB938127-v2)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 7 (KB969897)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 10 (KB936782)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 9 (KB911565)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB938464-v2)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977165)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978706)
Shockwave
Sonic Update Manager
Spinner
Stamps.com
Stamps.com Application Support for Microsoft Word 2000, 2002, 2003
Stamps.com support for Microsoft Word 2000-2007
SystemSecurity2009
upapp
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Office InfoPath 2007 (KB976416)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB955839)
Update for Windows XP (KB961503)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
WebFldrs XP
WildTangent Web Driver
Windows Internet Explorer 7
Windows Media Player 10
Windows Media Player 11
Windows XP Service Pack 3
Xvid 1.2.1 final uninstall

==== Event Viewer Messages From Past Week ========

2/28/2010 11:00:00 AM, error: Schedule [7901] - The At588.job command failed to start due to the following error: General access denied error
2/28/2010 10:00:00 AM, error: Schedule [7901] - The At587.job command failed to start due to the following error: General access denied error
2/27/2010 3:00:00 PM, error: Schedule [7901] - The At592.job command failed to start due to the following error: General access denied error
2/27/2010 2:00:00 PM, error: Schedule [7901] - The At591.job command failed to start due to the following error: General access denied error
2/25/2010 2:52:52 AM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the AudioSrv service.
2/25/2010 2:52:22 AM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the FastUserSwitchingCompatibility service.
2/25/2010 2:52:22 AM, error: Service Control Manager [7000] - The Fast User Switching Compatibility service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
2/25/2010 2:51:22 AM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the ShellHWDetection service.
2/25/2010 2:50:52 AM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the RasAuto service.
2/25/2010 2:50:52 AM, error: Service Control Manager [7000] - The Remote Access Auto Connection Manager service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
2/25/2010 12:02:00 AM, error: Schedule [7901] - The At1.job command failed to start due to the following error: %%2147942402
2/25/2010 10:24:22 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Windows CardSpace service to connect.
2/25/2010 10:24:22 AM, error: Service Control Manager [7000] - The Windows CardSpace service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
2/25/2010 1:00:00 AM, error: Schedule [7901] - The At2.job command failed to start due to the following error: %%2147942402
2/24/2010 9:00:00 PM, error: Schedule [7901] - The At22.job command failed to start due to the following error: %%2147942402
2/24/2010 9:00:00 AM, error: Schedule [7901] - The At10.job command failed to start due to the following error: %%2147942402
2/24/2010 8:00:00 PM, error: Schedule [7901] - The At21.job command failed to start due to the following error: %%2147942402
2/24/2010 8:00:00 AM, error: Schedule [7901] - The At9.job command failed to start due to the following error: %%2147942402
2/24/2010 7:00:00 PM, error: Schedule [7901] - The At20.job command failed to start due to the following error: %%2147942402
2/24/2010 7:00:00 AM, error: Schedule [7901] - The At8.job command failed to start due to the following error: %%2147942402
2/24/2010 6:00:00 PM, error: Schedule [7901] - The At19.job command failed to start due to the following error: %%2147942402
2/24/2010 6:00:00 AM, error: Schedule [7901] - The At7.job command failed to start due to the following error: %%2147942402
2/24/2010 5:00:02 PM, error: Schedule [7901] - The At18.job command failed to start due to the following error: %%2147942402
2/24/2010 5:00:00 AM, error: Schedule [7901] - The At6.job command failed to start due to the following error: %%2147942402
2/24/2010 4:00:00 PM, error: Schedule [7901] - The At17.job command failed to start due to the following error: %%2147942402
2/24/2010 4:00:00 AM, error: Schedule [7901] - The At5.job command failed to start due to the following error: %%2147942402
2/24/2010 3:00:00 PM, error: Schedule [7901] - The At16.job command failed to start due to the following error: %%2147942402
2/24/2010 3:00:00 AM, error: Schedule [7901] - The At4.job command failed to start due to the following error: %%2147942402
2/24/2010 2:00:01 AM, error: Schedule [7901] - The At3.job command failed to start due to the following error: %%2147942402
2/24/2010 2:00:00 PM, error: Schedule [7901] - The At15.job command failed to start due to the following error: %%2147942402
2/24/2010 12:00:00 PM, error: Schedule [7901] - The At13.job command failed to start due to the following error: %%2147942402
2/24/2010 11:00:00 PM, error: Schedule [7901] - The At24.job command failed to start due to the following error: %%2147942402
2/24/2010 11:00:00 AM, error: Schedule [7901] - The At12.job command failed to start due to the following error: %%2147942402
2/24/2010 10:00:00 PM, error: Schedule [7901] - The At23.job command failed to start due to the following error: %%2147942402
2/24/2010 10:00:00 AM, error: Schedule [7901] - The At11.job command failed to start due to the following error: %%2147942402
2/24/2010 1:00:00 PM, error: Schedule [7901] - The At14.job command failed to start due to the following error: %%2147942402
2/23/2010 8:58:22 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments " " in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
2/23/2010 8:54:25 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service wuauserv with arguments " " in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
2/23/2010 8:49:47 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments " " in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
2/23/2010 8:47:53 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD AvgLdx86 AvgMfx86 AvgTdiX Fips FOPN intelppm IPSec MRxSmb NetBIOS NetBT RasAcd Rdbss Tcpip WS2IFSL
2/23/2010 8:47:53 PM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD Networking Support Environment service which failed to start because of the following error: A device attached to the system is not functioning.
2/23/2010 8:47:53 PM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.
2/23/2010 8:47:53 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
2/23/2010 8:47:53 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBT service which failed to start because of the following error: A device attached to the system is not functioning.
2/23/2010 8:47:53 PM, error: Service Control Manager [7001] - The Bonjour Service service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
2/23/2010 8:47:36 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments " " in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
2/23/2010 8:33:27 PM, error: Dhcp [1001] - Your computer was not assigned an address from the network (by the DHCP Server) for the Network Card with network address 0019701A7CEB. The following error occurred: The operation was canceled by the user. . Your computer will continue to try and obtain an address on its own from the network address (DHCP) server.
2/23/2010 6:00:07 PM, error: Schedule [7901] - The At19.job command failed to start due to the following error: General access denied error
2/23/2010 5:12:44 PM, information: Windows File Protection [64001] - File replacement was attempted on the protected system file ctfmon.exe. This file was restored to the original version to maintain system stability. The file version of the bad file is 4.2.2700.5512, the version of the system file is 5.1.2600.5512.
2/23/2010 5:11:57 PM, error: Service Control Manager [7000] - The ATM ARP Client Protocol service failed to start due to the following error: A device attached to the system is not functioning.
2/23/2010 5:11:51 PM, error: Service Control Manager [7000] - The AMD K7 Processor Driver service failed to start due to the following error: Access is denied.
2/23/2010 5:11:49 PM, error: Service Control Manager [7000] - The Service for WDM 3D Audio Driver service failed to start due to the following error: Access is denied.
2/23/2010 5:11:47 PM, error: Service Control Manager [7000] - The Microsoft Kernel Acoustic Echo Canceller service failed to start due to the following error: Access is denied.
2/23/2010 10:23:24 PM, error: Ntfs [55] - The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume C:.
2/23/2010 10:21:30 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: FOPN
2/23/2010 10:20:26 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the WZCSVC service.

==== End Of File ===========================

 

I'm so sorry

I'm so sorry about that...here it is again - Thank you.

*************


DDS (Ver_09-12-01.01) - NTFSx86
Run by Owner at 11:42:57.17 on Sun 02/28/2010
Internet Explorer: 7.0.5730.13
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.503.70 [GMT -8:00]

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Softex\OmniPass\Omniserv.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\Program Files\Softex\OmniPass\OPXPApp.exe
C:\WINDOWS\System32\ups.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft Office\Office12\EXCEL.EXE
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Program Files\MSN\Toolbar\3.0.0988.2\msntask.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
C:\Documents and Settings\Owner\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.ask.com?o=15549&l=dis
uSearch Page =
uWindow Title = Windows Internet Explorer provided by MySpace
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
uSearch Bar =
mDefault_Page_URL = hxxp://www.myspace.com/
mStart Page = hxxp://www.myspace.com/
uCustomizeSearch = c:\windows\search.htm
uURLSearchHooks: H - No File
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: {1D7E3B41-23CE-469B-BE1B-A64B877923E1} - No File
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
BHO: MSN Toolbar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn\toolbar\3.0.0988.2\msneshellx.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: MSN Toolbar: {1e61ed7c-7cb8-49d6-b9e9-ab4c880c8414} - c:\program files\msn\toolbar\3.0.0988.2\msneshellx.dll
TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File
TB: {F5735C15-1FB2-41FE-BA12-242757E69DDE} - No File
TB: &SearchBar: {0494d0d9-f8e0-41ad-92a3-14154ece70ac} - c:\program files\myway\mybar\1.bin\MYBAR.DLL
TB: {4982D40A-C53B-4615-B15B-B5B5E98D167C} - No File
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -
TB: {5CBE2611-C31B-401F-89BC-4CBB25E853D7} - No File
TB: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File
TB: {06E58E5E-F8CB-4049-991E-A41C03BD419E} - No File
TB: {90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} - No File
TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
EB: {4528BBE0-4E08-11D5-AD55-00010333D0AD} - No File
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
EB: WSEL Services: {c7a2084b-969c-439a-96e8-176bf9a93879} - c:\program files\whistlesoftware\wselservices\webband.dll
uRun: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
uRun: [MsnMsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
uRun: [NSAgent] c:\documents and settings\owner\desktop\SaddamSetup09_np.exe
uRun: [uoltray] c:\program files\netzero\exec.exe regrun
uRun: [Weather] c:\program files\aws\weatherbug\Weather.EXE 1
uRun: [omuw] c:\progra~1\common~1\omuw\omuwm.exe
uRun: [hwvsRhMsX] atippcmp.exe
uRun: [PhotoShow Deluxe Media Manager] c:\progra~1\nero\data\xtras\mssysmgr.exe
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [DW6] "c:\program files\the weather channel fw\desktop\DesktopWeather.exe "
uRun: [TOY5KNQ8OC] c:\docume~1\owner\locals~1\temp\Npb.exe
uRun: [oiwjckum] c:\documents and settings\owner\local settings\application data\lgqqwa\nnbbsftav.exe
mRun: [hpsysdrv] c:\windows\system\hpsysdrv.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [KBD] c:\hp\kbd\KBD.EXE
mRun: [Recguard] c:\windows\sminst\RECGUARD.EXE
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
mRun: [PS2] c:\windows\system32\ps2.exe
mRun: [HPDJ Taskbar Utility] c:\windows\system32\spool\drivers\w32x86\3\hpztsb06.exe
mRun: [windows auto update] msblast.exe
mRun: [Microsoft Works Update Detection] c:\program files\common files\microsoft shared\works shared\WkUFind.exe
mRun: [nsdriver] c:\windows\system32\nssys32.exe
mRun: [UpdateManager] "c:\program files\common files\sonic\update manager\sgtray.exe" /r
mRun: [nsjsxcv] c:\windows\nsjsxcv.exe
mRun: [ezcnqxwp] c:\windows\ezcnqxwp.exe
mRun: [WildTangent CDA] RUNDLL32.exe "c:\program files\wildtangent\apps\cda\cdaEngine0400.dll ",cdaEngineMain
mRun: [qebwfbjjxtra] c:\windows\system32\rhmmcze.exe
mRun: [xxlgv] c:\program files\Befhozf.exe
mRun: [Jawa322] c:\windows\jawa32.exe
mRun: [oxl.exe] c:\docume~1\owner\locals~1\temp\oxl.exe
mRun: [4ZCIy8.exe] c:\docume~1\owner\locals~1\temp\4ZCIy8.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [AlcxMonitor] ALCXMNTR.EXE
mRun: [AutoLoaderw0v01bdeMQPL] "c:\windows\system32\actbjs.exe" /PC= "CP.CDT3" /ShowLegalNote= "nonbranded" /UninstallName= "CtxPls"
mRun: [w74i3ng] actbjs.exe
mRun: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
mRun: [BJCFD] c:\program files\broadjump\client foundation\CFD.exe
mRun: [SemanticInsight] c:\program files\rxtoolbar\semantic insight\SemanticInsight.exe
mRun: [OmniPass] c:\program files\softex\omnipass\scureapp.exe
mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
mRun: [omreplc] c:\windows\system32\omreplc.exe
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe "
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [oiwjckum] c:\documents and settings\owner\local settings\application data\lgqqwa\nnbbsftav.exe
mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {220E39C3-B081-4719-AB1A-9A884DCBD05C} - {C7A2084B-969C-439A-96E8-176BF9A93879} - c:\program files\whistlesoftware\wselservices\webband.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://www.apple.com/qtactivex/qtplugin.cab
DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://download.microsoft.com/download/e/4/9/e494c802-dd90-4c6b-a074-469358f075a6/OGAControl.cab
DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - hxxp://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei-4/ZwinkyInitialSetup1.0.1.1.cab
DPF: {48DD0448-9209-4F81-9F6D-D83562940134} - hxxp://lads.myspace.com/upload/MySpaceUploader1006.cab
DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://gfx2.hotmail.com/mail/w3/resources/MSNPUpld.cab
DPF: {54771E6F-A5A2-4413-8FB8-7B8F85398174} - hxxp://dl.lygo.com/Sidesearch/en_US/Lycos/Sidesearch.cab
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?978967456656
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {9AC54695-69A4-46F1-BE10-10C74F9520D5} - hxxp://cabs.elitemediagroup.net/cabs/mediaview.cab
DPF: {9C23D886-43CB-43DE-B2DB-112A68D7E10A} - hxxp://lads.myspace.com/upload/MySpaceUploader2.cab
DPF: {9E17A5F9-2B9C-4C66-A592-199A4BA1FBC8} - hxxp://pictures05.aim.com/ygp/aol/plugin/upf/AOLUPF.en-US-AIM.9.5.1.8.cab
DPF: {CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_03-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {D4C15E81-E2F6-4013-B81D-6F796D2C78C5} - hxxps://secure.stamps.com/download/us/registration/4_1_0_175/SdcWebSecurity.cab
DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - hxxp://zone.msn.com/bingame/dim2/default/popcaploader_v6.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: NameServer = 93.188.164.210,93.188.166.48
TCP: {2786A5F2-1CE3-44CE-88C0-2AE2A6757D0B} = 93.188.164.210,93.188.166.48
TCP: {BD643CCE-F888-4F02-ABDA-44507E9ED9BC} = 93.188.164.210,93.188.166.48
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
Notify: avgrsstarter - avgrsstx.dll
Notify: igfxcui - igfxsrvc.dll
Notify: kbupdate - kbupdate.dll
Notify: OPXPGina - c:\program files\softex\omnipass\opxpgina.dll
Hosts: 64.12.152.18 search.netscape.com
Hosts: 207.68.176.250 auto.search.msn.com

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\owner\applic~1\mozilla\firefox\profiles\rdjeb382.default\
FF - prefs.js: browser.search.defaulturl - hxxp://aim.search.aol.com/search/search?query={searchTerms}&invocationType=tb50-ff-aim-chromesbox-en-us
FF - prefs.js: browser.startup.homepage - hxxp://www.ask.com?o=15549&l=dis
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
FF - component: c:\program files\real\realplayer\browserrecord\firefox\ext\components\nprpffbrowserrecordext.dll
FF - plugin: c:\program files\mozilla firefox\plugins\nptgeqplugin.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\npaudio.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\npavi32.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\npdrmv2.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\npdsplay.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\NPMAsst32.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\npnul32.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\NPOFF12.DLL
FF - plugin: c:\program files\netscape\communicator\program\plugins\nppdf32.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\nppl3260.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\npqtplugin.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\npqtplugin2.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\npqtplugin3.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\npqtplugin4.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\npqtplugin5.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\npqtplugin6.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\npqtplugin7.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\nprfxins.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\nprjplug.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\nprpjplug.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\npstm32.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\npswf32.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\npwmsdrm.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\npwthost.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\npwtplug.dll

---- FIREFOX POLICIES ----
FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(network.protocol-handler.warn-external.dnupdate, falsec:\program files\mozilla firefox\greprefs\security-prefs.js - pref( "security.ssl3.rsa_seed_sha ", true);

============= SERVICES / DRIVERS ===============

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-2-5 335240]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-2-5 27784]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-2-5 108552]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe [2009-2-5 908056]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-2-5 297752]
R3 NB762_XP;NB 802.11g XG762 1211B Driver;c:\windows\system32\drivers\WlanUZXP.sys [2009-8-8 437760]
S0 FOPN;FOPN;c:\windows\system32\drivers\fopn.sys --> c:\windows\system32\drivers\FOPN.sys [?]
S0 ulsqtlor;ulsqtlor; [x]
S3 sctdisk;sctdisk;c:\windows\system32\sctdisk.sys [2003-4-25 2304]

=============== Created Last 30 ================

2010-02-25 09:35:29 0 d-sh--w- C:\found.000
2010-02-24 04:38:32 0 d-----w- c:\program files\Trend Micro
2010-02-24 04:09:48 20 ----a-w- c:\windows\system32\crt.dat
2010-02-24 01:12:26 160768 ----a-w- c:\windows\msa.exe
2010-02-24 01:12:15 57344 ----a-w- c:\windows\system32\omreplc.exe
2010-02-24 01:12:08 57344 ----a-w- c:\windows\system32\actbjs.exe
2010-02-24 01:12:03 57344 ----a-w- c:\windows\jawa32.exe
2010-02-24 01:12:01 57344 ----a-w- c:\windows\system32\rhmmcze.exe
2010-02-24 01:11:59 57344 ----a-w- c:\windows\ezcnqxwp.exe
2010-02-24 01:11:57 57344 ----a-w- c:\windows\nsjsxcv.exe
2010-02-24 01:11:55 57344 ----a-w- c:\windows\system32\nssys32.exe
2010-02-24 01:11:23 97792 ----a-w- c:\windows\system32\kbdatat4.dll
2010-02-24 01:11:23 20992 ----a-w- c:\windows\system32\kbupdate.dll
2010-02-24 01:11:23 169984 ----a-w- c:\windows\system32\crt4.dll
2010-02-24 01:11:23 1591 ----a-w- c:\windows\system32\kboem32.dat
2010-02-24 01:11:06 8 ----a-w- c:\docume~1\alluse~1\applic~1\mswintmp.dat
2010-02-13 05:28:12 0 d-----w- c:\docume~1\owner\applic~1\Stamps.com Internet Postage
2010-02-13 05:27:18 0 d-----w- c:\docume~1\alluse~1\applic~1\{B0AFCE64-DF3F-4824-8985-B21DB0EEE07B}
2010-02-13 05:26:32 0 d-----w- c:\docume~1\alluse~1\applic~1\{BFCD9266-8B97-4A73-8FDF-E2743DE8939E}
2010-02-13 05:25:39 36 ---ha-w- c:\windows\system32\f9t.dat
2010-02-13 05:25:39 0 d-----w- c:\program files\Stamps.com Internet Postage
2010-02-13 03:56:58 21504 -c--a-w- c:\windows\system32\dllcache\hidserv.dll
2010-02-13 03:56:58 21504 ----a-w- c:\windows\system32\hidserv.dll
2010-02-13 03:56:53 14592 -c--a-w- c:\windows\system32\dllcache\kbdhid.sys
2010-02-13 03:56:53 14592 ----a-w- c:\windows\system32\drivers\kbdhid.sys

==================== Find3M ====================

2010-02-24 01:12:06 57344 ----a-w- c:\windows\system32\igfxtray.exe
2010-02-24 01:11:51 57344 ----a-w- c:\windows\system32\ps2.exe
2010-02-24 01:11:45 57344 ----a-w- c:\windows\system32\hkcmd.exe
2009-12-31 16:50:03 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-16 18:43:27 343040 ----a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:08:23 33280 ----a-w- c:\windows\system32\csrsrv.dll
2009-12-08 19:26:15 2145280 ----a-w- c:\windows\system32\ntoskrnl.exe
2009-12-08 18:43:51 2023936 ----a-w- c:\windows\system32\ntkrnlpa.exe
2001-01-08 15:05:03 16708096 -c--a-w- c:\program files\IESetup701.msi
2009-01-09 14:39:19 32768 -csha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012009010920090110\index.dat

============= FINISH: 11:44:14.15 ===============

 

Attached is exehelperlog.txt and rkill.log

However, HiJackThis and ComboFix.exe would not run. I got the following message when I tried to start ComboFix (I also got the same message when I tried to run HiJackThis):

******
Windows cannot access the specified device, path, or file. You may not have the applications permission to access the item.
******

I cannot disable my antivirus either, as AVG is not showing as running on my computer at all anymore. I get the above message when I try to open it as well.


******
Here are the attached logs for your review:

-

This log file is located at C:\rkill.log.
Please post this only if requested to by the person helping you.
Otherwise you can close this log when you wish.
Ran as Owner on 03/01/2010 at 8:35:09.


Processes terminated by Rkill or while it was running:

Rkill completed on 03/01/2010 at 8:35:44.

-


exeHelper by Raktor
Build 20091220
Run at 08:36:04 on 03/01/10
Now searching...
Checking for numerical processes...
Checking for sysguard processes...
Checking for bad processes...
Checking for bad files...
Deleting file C:\WINDOWS\msa.exe
Checking for bad registry entries...
Resetting filetype association for .exe
Resetting filetype association for .com
Resetting userinit and shell values...
Resetting policies...
--Finished--

 

OK - here you go:

*******
ComboFix 10-02-28.04 - Owner 03/01/2010 9:59.1.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.503.245 [GMT -8:00]
Running from: c:\documents and settings\Owner\Desktop\Fixing Computer\ComboFix.com
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\mswintmp.dat
c:\documents and settings\NetworkService\Local Settings\Application Data\av.exe
c:\documents and settings\NetworkService\Local Settings\Application Data\MSASCui.exe
c:\documents and settings\Owner\Application Data\AntiSpywareDAT
c:\documents and settings\Owner\Application Data\AntiSpywareDAT\Scan_Log.txt
c:\documents and settings\Owner\err.log
c:\documents and settings\Owner\Local Settings\Application Data\av.exe
c:\documents and settings\Owner\Local Settings\Application Data\lgqqwa
c:\documents and settings\Owner\Local Settings\Application Data\lgqqwa\nnbbsftav.exe
c:\documents and settings\Owner\Local Settings\Temporary Internet Files\07pbb4.jpg
c:\documents and settings\Owner\Local Settings\Temporary Internet Files\0bmBA.jpg
c:\documents and settings\Owner\Local Settings\Temporary Internet Files\b5mm5O.jpg
c:\documents and settings\Owner\Local Settings\Temporary Internet Files\PMO37.jpg
c:\program files\Adobe\acrotray .exe
c:\program files\Common Files\companion wizard
c:\program files\Common Files\Companion Wizard\log.txt
c:\program files\Internet Explorer\js.mui
c:\recycler\NPROTECT
C:\WA6P
c:\windows\a3kebook.ini
c:\windows\akebook.ini
c:\windows\ANS2000.INI
c:\windows\bundles
c:\windows\bundles\bs5-vmk1.exe
c:\windows\Downloaded Program Files\popcaploader.dll
c:\windows\Downloaded Program Files\popcaploader.inf
c:\windows\system\hpsysdrv .exe
c:\windows\system32\6to4v32.dll
c:\windows\system32\certstore.dat
c:\windows\system32\crt.dat
c:\windows\system32\crt4.dll
c:\windows\system32\ctfmon .exe
c:\windows\system32\hkcmd .exe
c:\windows\system32\igfxtray .exe
c:\windows\system32\instsrv.exe
c:\windows\system32\kbdatat4.dll
c:\windows\system32\kboem32.dat
c:\windows\system32\kbupdate.dll
c:\windows\system32\msdhmd.dll
c:\windows\system32\Process.exe
c:\windows\system32\ps2 .exe
c:\windows\system32\ps2.bat
c:\windows\system32\reboot.txt
c:\windows\system32\skinboxer43.dll
c:\windows\system32\spool\prtprocs\w32x86\00003047.tmp
c:\windows\system32\SrchSTS.exe
c:\windows\system32\stera.job
c:\windows\system32\stera.log
c:\windows\system32\Thumbs.db
c:\windows\system32\VB6KO.DLL
c:\windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
c:\windows\Tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job
D:\Autorun.inf

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_6TO4
-------\Legacy_FOPN
-------\Legacy_RPCPATCH
-------\Legacy_RPCTFTPD
-------\Legacy_VSPF
-------\Legacy_VSPF_HK
-------\Service_6to4
-------\Service_FOPN


((((((((((((((((((((((((( Files Created from 2010-02-01 to 2010-03-01 )))))))))))))))))))))))))))))))
.

2010-02-25 09:35 . 2010-02-25 09:35 -------- d-----w- C:\found.000
2010-02-24 04:38 . 2010-02-24 04:38 -------- d-----w- c:\program files\Trend Micro
2010-02-24 02:47 . 2010-02-24 02:47 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2010-02-24 01:12 . 2010-02-24 01:12 57344 ----a-w- c:\windows\system32\omreplc.exe
2010-02-24 01:12 . 2010-02-24 01:12 57344 ----a-w- c:\windows\system32\actbjs.exe
2010-02-24 01:12 . 2010-02-24 01:12 57344 ----a-w- c:\windows\jawa32.exe
2010-02-24 01:12 . 2010-02-24 01:12 57344 ----a-w- c:\windows\system32\rhmmcze.exe
2010-02-24 01:11 . 2010-02-24 01:11 57344 ----a-w- c:\windows\ezcnqxwp.exe
2010-02-24 01:11 . 2010-02-24 01:11 57344 ----a-w- c:\windows\nsjsxcv.exe
2010-02-24 01:11 . 2010-02-24 01:11 57344 ----a-w- c:\windows\system32\nssys32.exe
2010-02-13 05:28 . 2010-02-13 05:35 -------- d-----w- c:\documents and settings\Owner\Application Data\Stamps.com Internet Postage
2010-02-13 05:27 . 2010-02-13 05:27 -------- d-----w- c:\documents and settings\All Users\Application Data\{B0AFCE64-DF3F-4824-8985-B21DB0EEE07B}
2010-02-13 05:26 . 2010-02-13 05:26 -------- d-----w- c:\documents and settings\All Users\Application Data\{BFCD9266-8B97-4A73-8FDF-E2743DE8939E}
2010-02-13 05:25 . 2010-02-13 05:28 36 ---ha-w- c:\windows\system32\f9t.dat
2010-02-13 05:25 . 2010-02-13 05:28 -------- d-----w- c:\program files\Stamps.com Internet Postage
2010-02-13 05:24 . 2010-02-13 05:24 -------- d-----w- c:\documents and settings\Owner\Local Settings\Application Data\Seven Zip
2010-02-13 03:56 . 2008-04-14 00:11 21504 -c--a-w- c:\windows\system32\dllcache\hidserv.dll
2010-02-13 03:56 . 2008-04-14 00:11 21504 ----a-w- c:\windows\system32\hidserv.dll
2010-02-13 03:56 . 2008-04-13 18:39 14592 -c--a-w- c:\windows\system32\dllcache\kbdhid.sys
2010-02-13 03:56 . 2008-04-13 18:39 14592 ----a-w- c:\windows\system32\drivers\kbdhid.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-01 16:46 . 2010-03-01 16:46 388096 ----a-r- c:\documents and settings\Owner\Application Data\Microsoft\Installer\{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}\HiJackThis.exe
2010-02-24 04:10 . 2009-02-06 00:39 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
2010-02-24 03:26 . 2000-02-11 23:46 -------- d-----w- c:\program files\Common Files\omuw
2010-02-24 02:37 . 2010-01-09 23:56 -------- d-----w- c:\program files\QuickTime
2010-02-24 01:12 . 2004-08-20 23:55 57344 ----a-w- c:\windows\system32\igfxtray.exe
2010-02-24 01:11 . 2003-04-10 10:42 57344 ----a-w- c:\windows\system32\ps2.exe
2010-02-24 01:11 . 2004-08-20 23:51 57344 ----a-w- c:\windows\system32\hkcmd.exe
2010-02-13 05:27 . 2010-02-13 05:27 2513557 ----a-w- c:\documents and settings\All Users\Application Data\{B0AFCE64-DF3F-4824-8985-B21DB0EEE07B}\MSW2KPIMstmp.exe
2010-01-27 09:26 . 2009-12-27 20:19 -------- d-----w- c:\documents and settings\Owner\Application Data\MP3Rocket
2010-01-25 18:24 . 2000-05-22 00:00 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2010-01-25 18:23 . 2010-01-09 23:52 -------- d-----w- c:\program files\Common Files\Apple
2010-01-25 18:23 . 2010-01-25 18:23 -------- d-----w- c:\program files\Apple Software Update
2010-01-21 14:59 . 2009-02-13 17:46 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2010-01-20 17:50 . 2010-01-20 17:48 -------- d-----w- c:\documents and settings\Owner\Application Data\Paltalk
2010-01-20 16:25 . 2003-04-10 10:58 -------- d-----w- c:\program files\Common Files\Adobe
2010-01-20 16:18 . 2010-01-20 16:18 86016 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\arh.exe
2010-01-10 18:53 . 2001-01-08 00:44 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-01-10 18:48 . 2003-04-10 10:48 -------- d-----w- c:\program files\InterVideo
2010-01-10 18:48 . 2003-04-10 10:28 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-01-10 18:42 . 2009-09-21 16:22 -------- d-----w- c:\program files\Aptana
2010-01-10 00:01 . 2000-06-25 19:44 -------- d-----w- c:\documents and settings\Owner\Application Data\Apple Computer
2010-01-09 23:59 . 2010-01-09 23:57 -------- d-----w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2009-12-31 16:50 . 2003-04-25 15:45 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-17 21:26 . 2010-02-13 05:27 321108 ----a-w- c:\documents and settings\All Users\Application Data\{B0AFCE64-DF3F-4824-8985-B21DB0EEE07B}\mia.dll
2009-12-17 21:26 . 2010-02-13 05:26 321108 ----a-w- c:\documents and settings\All Users\Application Data\{BFCD9266-8B97-4A73-8FDF-E2743DE8939E}\mia.dll
2009-12-17 21:26 . 2010-02-13 05:26 5121427 ----a-w- c:\documents and settings\All Users\Application Data\{BFCD9266-8B97-4A73-8FDF-E2743DE8939E}\stamps.exe
2009-12-16 18:43 . 2003-04-25 15:44 343040 ----a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:08 . 2003-04-25 16:23 33280 ----a-w- c:\windows\system32\csrsrv.dll
2009-12-08 19:26 . 2002-08-29 08:04 2145280 ----a-w- c:\windows\system32\ntoskrnl.exe
2009-12-08 18:43 . 2002-08-29 08:04 2023936 ----a-w- c:\windows\system32\ntkrnlpa.exe
2009-12-04 18:22 . 2003-04-25 16:24 455424 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2001-01-08 15:05 . 2001-01-08 15:05 16708096 -c--a-w- c:\program files\IESetup701.msi
.

Code:

<pre>
c:\program files\Adobe\Reader 9.0\Reader\reader_sl .exe
c:\program files\AVG\AVG8\avgtray .exe
c:\program files\BroadJump\Client Foundation\cfd .exe
c:\program files\Common Files\Adobe\ARM\1.0\adobearm .exe
c:\program files\Common Files\Microsoft Shared\Works Shared\wkufind .exe
c:\program files\Common Files\Real\Update_OB\realsched .exe
c:\program files\Common Files\Sonic\Update Manager\sgtray .exe
c:\program files\Java\jre6\bin\jusched .exe
c:\program files\QuickTime\qttask .exe
c:\program files\Softex\OmniPass\scureapp .exe
c:\windows\SMINST\recguard .exe
c:\windows\system32\spool\drivers\w32x86\3\hpztsb06 .exe
</pre>

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NVIEW "= "nview.dll" [2003-03-03 831557]
"MsnMsgr "= "c:\program files\Windows Live\Messenger\msnmsgr.exe" [N/A]
"NSAgent "= "c:\documents and settings\Owner\Desktop\SaddamSetup09_np.exe" [N/A]
"uoltray "= "c:\program files\NetZero\exec.exe" [N/A]
"Weather "= "c:\program files\AWS\WeatherBug\Weather.EXE" [N/A]
"omuw "= "c:\progra~1\COMMON~1\omuw\omuwm.exe" [N/A]
"hwvsRhMsX "= "atippcmp.exe" [N/A]
"PhotoShow Deluxe Media Manager "= "c:\progra~1\Nero\data\Xtras\mssysmgr.exe" [N/A]
"DW6 "= "c:\program files\The Weather Channel FW\Desktop\DesktopWeather.exe" [N/A]
"oiwjckum "= "c:\documents and settings\Owner\Local Settings\Application Data\lgqqwa\nnbbsftav.exe" [N/A]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv "= "c:\windows\system\hpsysdrv.exe" [2010-02-24 57344]
"HotKeysCmds "= "c:\windows\System32\hkcmd.exe" [2010-02-24 57344]
"KBD "= "c:\hp\KBD\KBD.EXE" [N/A]
"Recguard "= "c:\windows\SMINST\RECGUARD.EXE" [2010-02-24 57344]
"NvCplDaemon "= "c:\windows\System32\NvCpl.dll" [2003-03-03 4595712]
"nwiz "= "nwiz.exe" [2003-03-03 323584]
"PS2 "= "c:\windows\system32\ps2.exe" [2010-02-24 57344]
"HPDJ Taskbar Utility "= "c:\windows\system32\spool\drivers\w32x86\3\hpztsb06.exe" [2010-02-24 57344]
"windows auto update "= "msblast.exe" [N/A]
"Microsoft Works Update Detection "= "c:\program files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [N/A]
"nsdriver "= "c:\windows\System32\nssys32.exe" [2010-02-24 57344]
"UpdateManager "= "c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [N/A]
"nsjsxcv "= "c:\windows\nsjsxcv.exe" [2010-02-24 57344]
"ezcnqxwp "= "c:\windows\ezcnqxwp.exe" [2010-02-24 57344]
"WildTangent CDA "= "c:\program files\WildTangent\Apps\CDA\cdaEngine0400.dll" [N/A]
"qebwfbjjxtra "= "c:\windows\System32\rhmmcze.exe" [2010-02-24 57344]
"xxlgv "= "c:\program files\Befhozf.exe" [N/A]
"Jawa322 "= "c:\windows\jawa32.exe" [2010-02-24 57344]
"IgfxTray "= "c:\windows\System32\igfxtray.exe" [2010-02-24 57344]
"AlcxMonitor "= "ALCXMNTR.EXE" [2004-09-07 57344]
"AutoLoaderw0v01bdeMQPL "= "c:\windows\system32\actbjs.exe" [2010-02-24 57344]
"w74i3ng "= "actbjs.exe" [2010-02-24 57344]
"BJCFD "= "c:\program files\BroadJump\Client Foundation\CFD.exe" [N/A]
"OmniPass "= "c:\program files\Softex\OmniPass\scureapp.exe" [2010-02-24 57344]
"AVG8_TRAY "= "c:\progra~1\AVG\AVG8\avgtray.exe" [N/A]
"omreplc "= "c:\windows\system32\omreplc.exe" [2010-02-24 57344]
"TkBellExe "= "c:\program files\Common Files\Real\Update_OB\realsched.exe" [N/A]
"Adobe ARM "= "c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [N/A]
"QuickTime Task "= "c:\program files\QuickTime\QTTask.exe" [N/A]
"oiwjckum "= "c:\documents and settings\Owner\Local Settings\Application Data\lgqqwa\nnbbsftav.exe" [N/A]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-08-16 23:47 11952 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OPXPGina]
2003-02-21 10:50 40960 ----a-w- c:\program files\Softex\OmniPass\OPXPGina.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0stera

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride "=dword:00000001
"FirewallOverride "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall "= 0 (0x0)
"DisableNotifications "= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE "=
"c:\\Program Files\\uTorrent\\uTorrent.exe "=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe "=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe "=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe "=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe "=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe "=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe "=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP "= 3389:TCPxpsp2res.dll,-22009

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2/5/2009 4:40 PM 335240]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2/5/2009 4:40 PM 108552]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2/5/2009 4:39 PM 908056]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2/5/2009 4:39 PM 297752]
R3 NB762_XP;NB 802.11g XG762 1211B Driver;c:\windows\system32\drivers\WlanUZXP.sys [8/8/2009 3:46 PM 437760]
S0 ulsqtlor;ulsqtlor; [x]
S3 sctdisk;sctdisk;c:\windows\system32\sctdisk.sys [4/25/2003 8:24 AM 2304]
.
Contents of the 'Scheduled Tasks' folder

2010-03-01 c:\windows\Tasks\FRU Task 2002-06-04 23:12ewlett-Packardeskjet4E8BF07F6DE51996434C1696D032A924550.job
- c:\program files\Hewlett-Packard\upapp\hpqfruv.exe [2002-06-04 23:12]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.ask.com?o=15549&l=dis
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mStart Page = hxxp://www.myspace.com/
uCustomizeSearch = c:\windows\search.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: {{220E39C3-B081-4719-AB1A-9A884DCBD05C} - {C7A2084B-969C-439A-96E8-176BF9A93879} - c:\program files\WhistleSoftware\WselServices\webband.dll
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - hxxp://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei-4/ZwinkyInitialSetup1.0.1.1.cab
DPF: {54771E6F-A5A2-4413-8FB8-7B8F85398174} - hxxp://dl.lygo.com/Sidesearch/en_US/Lycos/Sidesearch.cab
DPF: {9AC54695-69A4-46F1-BE10-10C74F9520D5} - hxxp://cabs.elitemediagroup.net/cabs/mediaview.cab
DPF: {9C23D886-43CB-43DE-B2DB-112A68D7E10A} - hxxp://lads.myspace.com/upload/MySpaceUploader2.cab
DPF: {D4C15E81-E2F6-4013-B81D-6F796D2C78C5} - hxxps://secure.stamps.com/download/us/registration/4_1_0_175/SdcWebSecurity.cab
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\rdjeb382.default\
FF - prefs.js: browser.search.defaulturl - hxxp://aim.search.aol.com/search/search?query={searchTerms}&invocationType=tb50-ff-aim-chromesbox-en-us
FF - prefs.js: browser.startup.homepage - hxxp://www.ask.com?o=15549&l=dis
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
FF - component: c:\program files\Real\RealPlayer\browserrecord\firefox\ext\components\nprpffbrowserrecordext.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\nptgeqplugin.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npaudio.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npavi32.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npdrmv2.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npdsplay.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\NPMAsst32.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npnul32.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\NPOFF12.DLL
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\nppdf32.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\nppl3260.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npqtplugin.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npqtplugin2.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npqtplugin3.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npqtplugin4.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npqtplugin5.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npqtplugin6.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npqtplugin7.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\nprfxins.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\nprjplug.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\nprpjplug.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npstm32.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npswf32.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npwmsdrm.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npwthost.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npwtplug.dll

---- FIREFOX POLICIES ----
FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(network.protocol-handler.warn-external.dnupdate, false.
- - - - ORPHANS REMOVED - - - -

URLSearchHooks-_{CFBFAE00-17A6-11D0-99CB-00C04FD64497 - (no file)
BHO-{1D7E3B41-23CE-469B-BE1B-A64B877923E1} - (no file)
WebBrowser-{5CBE2611-C31B-401F-89BC-4CBB25E853D7} - (no file)
WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file)
WebBrowser-{90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
Notify-WgaLogon - (no file)
AddRemove-Call of Duty - c:\progra~1\CALLOF~1\Uninstall\Unwise.exe
AddRemove-KBD - c:\hp\KBD\KBD.EXE
AddRemove-Python 2.2 combined Win32 extensions - c:\python22\Lib\SITE-P~1\UNWISE~1.EXE
AddRemove-Spinner - c:\program files\Spinner\uninst.isu
AddRemove-WildTangent CDA - c:\program files\WildTangent\Apps\CDA\CDAUninstall.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-01 10:23
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
windows auto update = msblast.exe?I just want to say LOVE YOU SAN!!?bill

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(728)
c:\program files\Softex\OmniPass\opxpgina.dll
.
Completion time: 2010-03-01 10:37:22 - machine was rebooted
ComboFix-quarantined-files.txt 2010-03-01 18:37

Pre-Run: 82,852,634,624 bytes free
Post-Run: 83,173,564,416 bytes free

- - End Of File - - 0227A8B1454FE909A4CF14934831F599


**********

Logfile of Trend Micro HijackThis v2.0.3 (BETA)
Scan saved at 10:46:10 AM, on 3/1/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16850)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Softex\OmniPass\Omniserv.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Softex\OmniPass\OPXPApp.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Owner\Desktop\Fixing Computer\TrendMicro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://super-spider.com/sp.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ask.com?o=15549&l=dis
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = C:\WINDOWS\search.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.myspace.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = C:\WINDOWS\search.htm
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.0988.2\msneshellx.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.0988.2\msneshellx.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb06.exe
O4 - HKLM\..\Run: [windows auto update] msblast.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [nsdriver] C:\WINDOWS\System32\nssys32.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [nsjsxcv] C:\WINDOWS\nsjsxcv.exe
O4 - HKLM\..\Run: [ezcnqxwp] C:\WINDOWS\ezcnqxwp.exe
O4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.exe "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll ",cdaEngineMain
O4 - HKLM\..\Run: [qebwfbjjxtra] C:\WINDOWS\System32\rhmmcze.exe
O4 - HKLM\..\Run: [xxlgv] C:\Program Files\Befhozf.exe
O4 - HKLM\..\Run: [Jawa322] C:\WINDOWS\jawa32.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [AutoLoaderw0v01bdeMQPL] "C:\WINDOWS\system32\actbjs.exe" /PC= "CP.CDT3" /ShowLegalNote= "nonbranded" /UninstallName= "CtxPls"
O4 - HKLM\..\Run: [w74i3ng] actbjs.exe
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [OmniPass] C:\Program Files\Softex\OmniPass\scureapp.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [omreplc] C:\WINDOWS\system32\omreplc.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe "
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [oiwjckum] C:\Documents and Settings\Owner\Local Settings\Application Data\lgqqwa\nnbbsftav.exe
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [NSAgent] C:\Documents and Settings\Owner\Desktop\SaddamSetup09_np.exe
O4 - HKCU\..\Run: [uoltray] C:\Program Files\NetZero\exec.exe regrun
O4 - HKCU\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.EXE 1
O4 - HKCU\..\Run: [omuw] C:\PROGRA~1\COMMON~1\omuw\omuwm.exe
O4 - HKCU\..\Run: [hwvsRhMsX] atippcmp.exe
O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] C:\PROGRA~1\Nero\data\Xtras\mssysmgr.exe
O4 - HKCU\..\Run: [DW6] "C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe "
O4 - HKCU\..\Run: [oiwjckum] C:\Documents and Settings\Owner\Local Settings\Application Data\lgqqwa\nnbbsftav.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Whistle - {220E39C3-B081-4719-AB1A-9A884DCBD05C} - C:\Program Files\WhistleSoftware\WselServices\webband.dll (file missing)
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O12 - Plugin for .asx: C:\Program Files\Netscape\Communicator\Program\PLUGINS\npdsplay.dll
O12 - Plugin for .wmv: C:\Program Files\Netscape\Communicator\Program\PLUGINS\npdsplay.dll
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei-4/ZwinkyInitialSetup1.0.1.1.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w3/resources/MSNPUpld.cab
O16 - DPF: {54771E6F-A5A2-4413-8FB8-7B8F85398174} - http://dl.lygo.com/Sidesearch/en_US/Lycos/Sidesearch.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?978967456656
O16 - DPF: {9AC54695-69A4-46F1-BE10-10C74F9520D5} - http://cabs.elitemediagroup.net/cabs/mediaview.cab
O16 - DPF: {9C23D886-43CB-43DE-B2DB-112A68D7E10A} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader2.cab
O16 - DPF: {9E17A5F9-2B9C-4C66-A592-199A4BA1FBC8} - http://pictures05.aim.com/ygp/aol/plugin/upf/AOLUPF.en-US-AIM.9.5.1.8.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D4C15E81-E2F6-4013-B81D-6F796D2C78C5} (SdcWebSecurityCtrl Class) - https://secure.stamps.com/download/us/registration/4_1_0_175/SdcWebSecurity.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/dim2/default/popcaploader_v6.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Softex OmniPass Service (omniserv) - Unknown owner - C:\Program Files\Softex\OmniPass\Omniserv.exe

--
End of file - 10584 bytes

 

I have uninstalled all P2P programs that I know of on my computer (Torrent and MP3 rocket). My husband is the culprit here... he is not allowed to download anything anymore.

Here are the requested logs:

************

ComboFix 10-02-28.04 - Owner 03/01/2010 16:34:13.2.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.503.199 [GMT -8:00]
Running from: c:\documents and settings\Owner\Desktop\Fixing Computer\ComboFix.com
Command switches used :: c:\docume~1\Owner\Desktop\FIXING~1\CFscript.txt
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

FILE ::
"c:\documents and settings\Owner\Desktop\SaddamSetup09_np.exe "
"c:\documents and settings\Owner\Local Settings\Application Data\lgqqwa\nnbbsftav.exe "
"c:\program files\Adobe\Reader 9.0\Reader\reader_sl .exe "
"c:\program files\AVG\AVG8\avgtray .exe "
"c:\program files\Befhozf.exe "
"c:\program files\BroadJump\Client Foundation\cfd .exe "
"c:\program files\Common Files\Adobe\ARM\1.0\adobearm .exe "
"c:\program files\Common Files\Microsoft Shared\Works Shared\wkufind .exe "
"c:\program files\Common Files\Real\Update_OB\realsched .exe "
"c:\program files\Common Files\Sonic\Update Manager\sgtray .exe "
"c:\program files\IESetup701.msi "
"c:\program files\Java\jre6\bin\jusched .exe "
"c:\program files\QuickTime\qttask .exe "
"c:\program files\Softex\OmniPass\scureapp .exe "
"c:\windows\ezcnqxwp.exe "
"c:\windows\jawa32.exe "
"c:\windows\nsjsxcv.exe "
"c:\windows\SMINST\recguard .exe "
"c:\windows\system32\actbjs.exe "
"c:\windows\system32\f9t.dat "
"c:\windows\system32\nssys32.exe "
"c:\windows\system32\omreplc.exe "
"c:\windows\system32\rhmmcze.exe "
"c:\windows\system32\spool\drivers\w32x86\3\hpztsb06 .exe "
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Adobe\Reader 9.0\Reader\reader_sl .exe
c:\program files\AVG\AVG8\avgtray .exe
c:\program files\BroadJump\Client Foundation\cfd .exe
c:\program files\Common Files\Adobe\ARM\1.0\adobearm .exe
c:\program files\Common Files\Microsoft Shared\Works Shared\wkufind .exe
c:\program files\Common Files\Real\Update_OB\realsched .exe
c:\program files\Common Files\Sonic\Update Manager\sgtray .exe
c:\program files\IESetup701.msi
c:\program files\Java\jre6\bin\jusched .exe
c:\program files\QuickTime\qttask .exe
c:\program files\Softex\OmniPass\scureapp .exe
c:\windows\ezcnqxwp.exe
c:\windows\jawa32.exe
c:\windows\nsjsxcv.exe
c:\windows\SMINST\recguard .exe
c:\windows\system32\actbjs.exe
c:\windows\system32\f9t.dat
c:\windows\system32\nssys32.exe
c:\windows\system32\omreplc.exe
c:\windows\system32\rhmmcze.exe
c:\windows\system32\spool\drivers\w32x86\3\hpztsb06 .exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_ulsqtlor


((((((((((((((((((((((((( Files Created from 2010-02-02 to 2010-03-02 )))))))))))))))))))))))))))))))
.

2010-02-25 09:35 . 2010-02-25 09:35 -------- d-----w- C:\found.000
2010-02-24 04:38 . 2010-02-24 04:38 -------- d-----w- c:\program files\Trend Micro
2010-02-24 02:47 . 2010-02-24 02:47 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2010-02-13 05:28 . 2010-02-13 05:35 -------- d-----w- c:\documents and settings\Owner\Application Data\Stamps.com Internet Postage
2010-02-13 05:27 . 2010-02-13 05:27 -------- d-----w- c:\documents and settings\All Users\Application Data\{B0AFCE64-DF3F-4824-8985-B21DB0EEE07B}
2010-02-13 05:26 . 2010-02-13 05:26 -------- d-----w- c:\documents and settings\All Users\Application Data\{BFCD9266-8B97-4A73-8FDF-E2743DE8939E}
2010-02-13 05:25 . 2010-02-13 05:28 -------- d-----w- c:\program files\Stamps.com Internet Postage
2010-02-13 05:24 . 2010-02-13 05:24 -------- d-----w- c:\documents and settings\Owner\Local Settings\Application Data\Seven Zip
2010-02-13 03:56 . 2008-04-14 00:11 21504 -c--a-w- c:\windows\system32\dllcache\hidserv.dll
2010-02-13 03:56 . 2008-04-14 00:11 21504 ----a-w- c:\windows\system32\hidserv.dll
2010-02-13 03:56 . 2008-04-13 18:39 14592 -c--a-w- c:\windows\system32\dllcache\kbdhid.sys
2010-02-13 03:56 . 2008-04-13 18:39 14592 ----a-w- c:\windows\system32\drivers\kbdhid.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-02 00:44 . 2010-01-09 23:56 -------- d-----w- c:\program files\QuickTime
2010-03-02 00:27 . 2009-12-27 20:19 -------- d-----w- c:\documents and settings\Owner\Application Data\MP3Rocket
2010-03-02 00:20 . 2009-03-25 17:46 -------- d-----w- c:\documents and settings\Owner\Application Data\uTorrent
2010-02-24 04:10 . 2009-02-06 00:39 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
2010-02-24 03:26 . 2000-02-11 23:46 -------- d-----w- c:\program files\Common Files\omuw
2010-02-24 01:12 . 2004-08-20 23:55 57344 ----a-w- c:\windows\system32\igfxtray.exe
2010-02-24 01:11 . 2003-04-10 10:42 57344 ----a-w- c:\windows\system32\ps2.exe
2010-02-24 01:11 . 2004-08-20 23:51 57344 ----a-w- c:\windows\system32\hkcmd.exe
2010-02-13 05:27 . 2010-02-13 05:27 2513557 ----a-w- c:\documents and settings\All Users\Application Data\{B0AFCE64-DF3F-4824-8985-B21DB0EEE07B}\MSW2KPIMstmp.exe
2010-01-25 18:24 . 2000-05-22 00:00 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2010-01-25 18:23 . 2010-01-09 23:52 -------- d-----w- c:\program files\Common Files\Apple
2010-01-25 18:23 . 2010-01-25 18:23 -------- d-----w- c:\program files\Apple Software Update
2010-01-21 14:59 . 2009-02-13 17:46 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2010-01-20 17:50 . 2010-01-20 17:48 -------- d-----w- c:\documents and settings\Owner\Application Data\Paltalk
2010-01-20 16:25 . 2003-04-10 10:58 -------- d-----w- c:\program files\Common Files\Adobe
2010-01-20 16:18 . 2010-01-20 16:18 86016 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\arh.exe
2010-01-10 18:53 . 2001-01-08 00:44 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-01-10 18:48 . 2003-04-10 10:48 -------- d-----w- c:\program files\InterVideo
2010-01-10 18:48 . 2003-04-10 10:28 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-01-10 18:42 . 2009-09-21 16:22 -------- d-----w- c:\program files\Aptana
2010-01-10 00:01 . 2000-06-25 19:44 -------- d-----w- c:\documents and settings\Owner\Application Data\Apple Computer
2010-01-09 23:59 . 2010-01-09 23:57 -------- d-----w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2009-12-31 16:50 . 2003-04-25 15:45 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-17 21:26 . 2010-02-13 05:27 321108 ----a-w- c:\documents and settings\All Users\Application Data\{B0AFCE64-DF3F-4824-8985-B21DB0EEE07B}\mia.dll
2009-12-17 21:26 . 2010-02-13 05:26 321108 ----a-w- c:\documents and settings\All Users\Application Data\{BFCD9266-8B97-4A73-8FDF-E2743DE8939E}\mia.dll
2009-12-17 21:26 . 2010-02-13 05:26 5121427 ----a-w- c:\documents and settings\All Users\Application Data\{BFCD9266-8B97-4A73-8FDF-E2743DE8939E}\stamps.exe
2009-12-16 18:43 . 2003-04-25 15:44 343040 ----a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:08 . 2003-04-25 16:23 33280 ----a-w- c:\windows\system32\csrsrv.dll
2009-12-08 19:26 . 2002-08-29 08:04 2145280 ------w- c:\windows\system32\ntoskrnl.exe
2009-12-08 18:43 . 2002-08-29 08:04 2023936 ------w- c:\windows\system32\ntkrnlpa.exe
2009-12-04 18:22 . 2003-04-25 16:24 455424 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NVIEW "= "nview.dll" [2003-03-03 831557]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv "= "c:\windows\system\hpsysdrv.exe" [2010-02-24 57344]
"HotKeysCmds "= "c:\windows\System32\hkcmd.exe" [2010-02-24 57344]
"Recguard "= "c:\windows\SMINST\RECGUARD.EXE" [2010-02-24 57344]
"NvCplDaemon "= "c:\windows\System32\NvCpl.dll" [2003-03-03 4595712]
"nwiz "= "nwiz.exe" [2003-03-03 323584]
"PS2 "= "c:\windows\system32\ps2.exe" [2010-02-24 57344]
"HPDJ Taskbar Utility "= "c:\windows\system32\spool\drivers\w32x86\3\hpztsb06.exe" [2010-02-24 57344]
"IgfxTray "= "c:\windows\System32\igfxtray.exe" [2010-02-24 57344]
"OmniPass "= "c:\program files\Softex\OmniPass\scureapp.exe" [2010-02-24 57344]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-08-16 23:47 11952 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OPXPGina]
2003-02-21 10:50 40960 ----a-w- c:\program files\Softex\OmniPass\OPXPGina.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0stera

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall "= 0 (0x0)
"DisableNotifications "= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE "=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe "=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe "=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe "=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe "=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe "=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe "=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP "= 3389:TCPxpsp2res.dll,-22009

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2/5/2009 4:40 PM 335240]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2/5/2009 4:40 PM 108552]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2/5/2009 4:39 PM 908056]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2/5/2009 4:39 PM 297752]
R3 NB762_XP;NB 802.11g XG762 1211B Driver;c:\windows\system32\drivers\WlanUZXP.sys [8/8/2009 3:46 PM 437760]
S3 sctdisk;sctdisk;c:\windows\system32\sctdisk.sys [4/25/2003 8:24 AM 2304]
.
Contents of the 'Scheduled Tasks' folder

2010-03-01 c:\windows\Tasks\FRU Task 2002-06-04 23:12ewlett-Packardeskjet4E8BF07F6DE51996434C1696D032A924550.job
- c:\program files\Hewlett-Packard\upapp\hpqfruv.exe [2002-06-04 23:12]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.ask.com?o=15549&l=dis
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mStart Page = hxxp://www.myspace.com/
uCustomizeSearch = c:\windows\search.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: {{220E39C3-B081-4719-AB1A-9A884DCBD05C} - {C7A2084B-969C-439A-96E8-176BF9A93879} - c:\program files\WhistleSoftware\WselServices\webband.dll
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - hxxp://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei-4/ZwinkyInitialSetup1.0.1.1.cab
DPF: {54771E6F-A5A2-4413-8FB8-7B8F85398174} - hxxp://dl.lygo.com/Sidesearch/en_US/Lycos/Sidesearch.cab
DPF: {9AC54695-69A4-46F1-BE10-10C74F9520D5} - hxxp://cabs.elitemediagroup.net/cabs/mediaview.cab
DPF: {9C23D886-43CB-43DE-B2DB-112A68D7E10A} - hxxp://lads.myspace.com/upload/MySpaceUploader2.cab
DPF: {D4C15E81-E2F6-4013-B81D-6F796D2C78C5} - hxxps://secure.stamps.com/download/us/registration/4_1_0_175/SdcWebSecurity.cab
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\rdjeb382.default\
FF - prefs.js: browser.search.defaulturl - hxxp://aim.search.aol.com/search/search?query={searchTerms}&invocationType=tb50-ff-aim-chromesbox-en-us
FF - prefs.js: browser.startup.homepage - hxxp://www.ask.com?o=15549&l=dis
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
FF - component: c:\program files\Real\RealPlayer\browserrecord\firefox\ext\components\nprpffbrowserrecordext.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\nptgeqplugin.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npaudio.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npavi32.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npdrmv2.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npdsplay.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\NPMAsst32.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npnul32.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\NPOFF12.DLL
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\nppdf32.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\nppl3260.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npqtplugin.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npqtplugin2.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npqtplugin3.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npqtplugin4.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npqtplugin5.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npqtplugin6.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npqtplugin7.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\nprfxins.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\nprjplug.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\nprpjplug.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npstm32.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npswf32.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npwmsdrm.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npwthost.dll
FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npwtplug.dll

---- FIREFOX POLICIES ----
FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(network.protocol-handler.warn-external.dnupdate, false.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-MsnMsgr - c:\program files\Windows Live\Messenger\msnmsgr.exe
HKCU-Run-uoltray - c:\program files\NetZero\exec.exe
HKCU-Run-Weather - c:\program files\AWS\WeatherBug\Weather.EXE
HKCU-Run-PhotoShow Deluxe Media Manager - c:\progra~1\Nero\data\Xtras\mssysmgr.exe
HKCU-Run-DW6 - c:\program files\The Weather Channel FW\Desktop\DesktopWeather.exe
HKLM-Run-KBD - c:\hp\KBD\KBD.EXE
HKLM-Run-Microsoft Works Update Detection - c:\program files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
HKLM-Run-UpdateManager - c:\program files\Common Files\Sonic\Update Manager\sgtray.exe
HKLM-Run-WildTangent CDA - c:\program files\WildTangent\Apps\CDA\cdaEngine0400.dll
HKLM-Run-Jawa322 - c:\windows\jawa32.exe
HKLM-Run-BJCFD - c:\program files\BroadJump\Client Foundation\CFD.exe
HKLM-Run-AVG8_TRAY - c:\progra~1\AVG\AVG8\avgtray.exe
HKLM-Run-TkBellExe - c:\program files\Common Files\Real\Update_OB\realsched.exe
HKLM-Run-Adobe ARM - c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
HKLM-Run-QuickTime Task - c:\program files\QuickTime\QTTask.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-01 16:49
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(720)
c:\program files\Softex\OmniPass\opxpgina.dll
.
Completion time: 2010-03-01 16:58:50 - machine was rebooted
ComboFix-quarantined-files.txt 2010-03-02 00:58
ComboFix2.txt 2010-03-01 18:37

Pre-Run: 83,131,805,696 bytes free
Post-Run: 83,063,058,432 bytes free

- - End Of File - - 3FA5153BAA3E8EBCB35FAC0DA63B7243

******************

Logfile of Trend Micro HijackThis v2.0.3 (BETA)
Scan saved at 5:24:49 PM, on 3/1/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16850)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Softex\OmniPass\Omniserv.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Softex\OmniPass\OPXPApp.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\TrendMicro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://super-spider.com/sp.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ask.com?o=15549&l=dis
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = C:\WINDOWS\search.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.myspace.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = C:\WINDOWS\search.htm
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.0988.2\msneshellx.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.0988.2\msneshellx.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb06.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [OmniPass] C:\Program Files\Softex\OmniPass\scureapp.exe
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Whistle - {220E39C3-B081-4719-AB1A-9A884DCBD05C} - C:\Program Files\WhistleSoftware\WselServices\webband.dll (file missing)
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O12 - Plugin for .asx: C:\Program Files\Netscape\Communicator\Program\PLUGINS\npdsplay.dll
O12 - Plugin for .wmv: C:\Program Files\Netscape\Communicator\Program\PLUGINS\npdsplay.dll
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei-4/ZwinkyInitialSetup1.0.1.1.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w3/resources/MSNPUpld.cab
O16 - DPF: {54771E6F-A5A2-4413-8FB8-7B8F85398174} - http://dl.lygo.com/Sidesearch/en_US/Lycos/Sidesearch.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?978967456656
O16 - DPF: {9AC54695-69A4-46F1-BE10-10C74F9520D5} - http://cabs.elitemediagroup.net/cabs/mediaview.cab
O16 - DPF: {9C23D886-43CB-43DE-B2DB-112A68D7E10A} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader2.cab
O16 - DPF: {9E17A5F9-2B9C-4C66-A592-199A4BA1FBC8} - http://pictures05.aim.com/ygp/aol/plugin/upf/AOLUPF.en-US-AIM.9.5.1.8.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D4C15E81-E2F6-4013-B81D-6F796D2C78C5} (SdcWebSecurityCtrl Class) - https://secure.stamps.com/download/us/registration/4_1_0_175/SdcWebSecurity.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/dim2/default/popcaploader_v6.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Softex OmniPass Service (omniserv) - Unknown owner - C:\Program Files\Softex\OmniPass\Omniserv.exe

--
End of file - 8218 bytes

**************

Thank you.

 

Avg

Quick question: Is the free version of AVG a decent anti-virus program?

 

Here are the 2 attached documents. Thanks.

********

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0: scan report
Tuesday, March 2, 2010
Operating system: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Tuesday, March 02, 2010 12:42:32
Records in database: 3686105
--------------------------------------------------------------------------------

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
A:\
C:\
D:\
E:\
F:\

Scan statistics:
Objects scanned: 90774
Threats found: 14
Infected objects found: 54
Suspicious objects found: 0
Scan duration: 08:09:46


File name / Threat / Threats count
C:\Documents and Settings\NetworkService\Local Settings\Application Data\av.exe Infected: Trojan.Win32.FraudPack.ankh 1
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\1I0S2LOB\z002106201318r0409J0f000601R2cdb60fdW6be34445Xcc1d6c99Y87919bffZ0100f0700[1] Infected: Trojan.Win32.FraudPack.ankh 1
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\G8XVKV86\q002106201317r0409R2cdb60fdXcc1d6cbcY87919bffZ0100f070[1].pdf Infected: Exploit.JS.Pdfka.bso 1
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rdjeb382.default\extensions\{0b521176-81b5-4849-b963-98c7a257827d}\opinstaller.msi Infected: not-a-virus:AdWare.Win32.RK.aw 3
C:\Documents and Settings\Owner\Local Settings\Application Data\av.exe Infected: Trojan.Win32.FraudPack.angp 1
C:\Documents and Settings\Owner\Local Settings\temp\ctv243.exe Infected: Trojan-PSW.Win32.Papras.uz 1
C:\Documents and Settings\Owner\Local Settings\temp\wmpscfgs.exe Infected: Trojan-Downloader.Win32.FraudLoad.wysx 1
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\8ONK6IHP\oHff911d12V0100f070006Rb9f32a55102Tb41dd7b6201l0409K1501dfc5317[1].pdf Infected: Exploit.JS.Pdfka.bta 1
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\EWZ75F3V\eHff911d12V0100f070006Rb9f32a55102Tb41dd7ae201l0409K1501dfc5318J0f0006010[1] Infected: Trojan.Win32.FraudPack.angp 1
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\VP3DUZJO\TATRA9[1].htm Infected: Packed.JS.Agent.bz 1
C:\Documents and Settings\Owner\nwiz .exe Infected: Trojan-Downloader.Win32.FraudLoad.wysx 1
C:\Documents and Settings\Owner\nwiz.exe Infected: Trojan-Downloader.Win32.FraudLoad.wysx 1
C:\Documents and Settings\Owner\rundll32 .exe Infected: Trojan-Downloader.Win32.FraudLoad.wysx 1
C:\Documents and Settings\Owner\rundll32.exe Infected: Trojan-Downloader.Win32.FraudLoad.wysx 1
C:\hp\region\EN_US-ie.reg Infected: Trojan.WinREG.StartPage 1
C:\Program Files\Adobe\acrotray .exe Infected: Trojan-PSW.Win32.Papras.va 1
C:\Program Files\Internet Explorer\js.mui Infected: Trojan-Downloader.Win32.FraudLoad.wysx 1
C:\Program Files\Internet Explorer\wmpscfgs.exe Infected: Trojan-Downloader.Win32.FraudLoad.wysx 1
C:\Program Files\Softex\OmniPass\scureapp .exe Infected: Trojan-Downloader.Win32.FraudLoad.wysx 1
C:\Program Files\Softex\OmniPass\scureapp.exe Infected: Trojan-Downloader.Win32.FraudLoad.wysx 1
C:\System Volume Information\_restore{E0C22EC0-D318-4D95-967D-A5C2B4653ED0}\RP1\A0000029.EXE Infected: Trojan-Downloader.Win32.VB.dx 1
C:\System Volume Information\_restore{E0C22EC0-D318-4D95-967D-A5C2B4653ED0}\RP1\A0000029.EXE Infected: not-a-virus:AdWare.Win32.F1Organizer.h 1
C:\System Volume Information\_restore{E0C22EC0-D318-4D95-967D-A5C2B4653ED0}\RP3\A0000326.exe Infected: Trojan-Downloader.Win32.FraudLoad.wysx 1
C:\System Volume Information\_restore{E0C22EC0-D318-4D95-967D-A5C2B4653ED0}\RP3\A0000327.exe Infected: Trojan-Downloader.Win32.FraudLoad.wysx 1
C:\System Volume Information\_restore{E0C22EC0-D318-4D95-967D-A5C2B4653ED0}\RP3\A0000328.exe Infected: Trojan-Downloader.Win32.FraudLoad.wysx 1
C:\System Volume Information\_restore{E0C22EC0-D318-4D95-967D-A5C2B4653ED0}\RP3\A0000330.exe Infected: Trojan-Downloader.Win32.FraudLoad.wysx 1
C:\System Volume Information\_restore{E0C22EC0-D318-4D95-967D-A5C2B4653ED0}\RP3\A0000331.exe Infected: Trojan-Downloader.Win32.FraudLoad.wysx 1
C:\System Volume Information\_restore{E0C22EC0-D318-4D95-967D-A5C2B4653ED0}\RP3\A0000332.exe Infected: Trojan-Downloader.Win32.FraudLoad.wysx 1
C:\System Volume Information\_restore{E0C22EC0-D318-4D95-967D-A5C2B4653ED0}\RP3\A0000333.exe Infected: Trojan-Downloader.Win32.FraudLoad.wysx 1
C:\System Volume Information\_restore{E0C22EC0-D318-4D95-967D-A5C2B4653ED0}\RP5\A0000720.exe Infected: Trojan-Downloader.Win32.FraudLoad.wysx 1
C:\System Volume Information\_restore{E0C22EC0-D318-4D95-967D-A5C2B4653ED0}\RP5\A0000721.exe Infected: Trojan-Downloader.Win32.FraudLoad.wysx 1
C:\System Volume Information\_restore{E0C22EC0-D318-4D95-967D-A5C2B4653ED0}\RP5\A0000722.exe Infected: Trojan-Downloader.Win32.FraudLoad.wysx 1
C:\System Volume Information\_restore{E0C22EC0-D318-4D95-967D-A5C2B4653ED0}\RP5\A0000723.exe Infected: Trojan-Downloader.Win32.FraudLoad.wysx 1
C:\System Volume Information\_restore{E0C22EC0-D318-4D95-967D-A5C2B4653ED0}\RP5\A0000724.exe Infected: Trojan-Downloader.Win32.FraudLoad.wysx 1
C:\System Volume Information\_restore{E0C22EC0-D318-4D95-967D-A5C2B4653ED0}\RP5\A0000725.exe Infected: Trojan-Downloader.Win32.FraudLoad.wysx 1
C:\System Volume Information\_restore{E0C22EC0-D318-4D95-967D-A5C2B4653ED0}\RP5\A0000726.exe Infected: Trojan-Downloader.Win32.FraudLoad.wysx 1
C:\System Volume Information\_restore{E0C22EC0-D318-4D95-967D-A5C2B4653ED0}\RP5\A0000745.exe Infected: Trojan-PSW.Win32.Papras.va 1
C:\WINDOWS\Befhozf.exe Infected: Backdoor.Win32.Agent.bg 1
C:\WINDOWS\SMINST\recguard .exe Infected: Trojan-Downloader.Win32.FraudLoad.wysx 1
C:\WINDOWS\SMINST\recguard.exe Infected: Trojan-Downloader.Win32.FraudLoad.wysx 1
C:\WINDOWS\SMINST\recguard.exe.delme171 Infected: Trojan-Downloader.Win32.FraudLoad.wysx 1
C:\WINDOWS\system\hpsysdrv .exe Infected: Trojan-Downloader.Win32.FraudLoad.wysx 1
C:\WINDOWS\system\hpsysdrv.exe Infected: Trojan-Downloader.Win32.FraudLoad.wysx 1
C:\WINDOWS\system32\hkcmd .exe Infected: Trojan-Downloader.Win32.FraudLoad.wysx 1
C:\WINDOWS\system32\hkcmd.exe Infected: Trojan-Downloader.Win32.FraudLoad.wysx 1
C:\WINDOWS\system32\igfxtray .exe Infected: Trojan-Downloader.Win32.FraudLoad.wysx 1
C:\WINDOWS\system32\igfxtray.exe Infected: Trojan-Downloader.Win32.FraudLoad.wysx 1
C:\WINDOWS\system32\ps2 .exe Infected: Trojan-Downloader.Win32.FraudLoad.wysx 1
C:\WINDOWS\system32\ps2.exe Infected: Trojan-Downloader.Win32.FraudLoad.wysx 1
C:\WINDOWS\system32\sctdisk.sys Infected: Trojan-Downloader.Win32.Geral.pyz 1
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb06 .exe Infected: Trojan-Downloader.Win32.FraudLoad.wysx 1
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb06.exe Infected: Trojan-Downloader.Win32.FraudLoad.wysx 1

Selected area has been scanned.

********
Logfile of Trend Micro HijackThis v2.0.3 (BETA)
Scan saved at 6:06:23 PM, on 3/2/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16981)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Softex\OmniPass\Omniserv.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Softex\OmniPass\OPXPApp.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Documents and Settings\Owner\Local Settings\Application Data\av.exe
C:\Program Files\Softex\OmniPass\scureapp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\MSN\Toolbar\3.0.0988.2\msntask.exe
C:\Program Files\Common Files\Adobe\Updater6\Adobe_Updater.exe
c:\program files\adobe\acrotray .exe
C:\Program Files\TrendMicro\HiJackThis\HiJackThis.exe
C:\WINDOWS\system32\NOTEPAD.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://super-spider.com/sp.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ask.com?o=15549&l=dis
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = C:\WINDOWS\search.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.myspace.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = C:\WINDOWS\search.htm
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.0988.2\msneshellx.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.0988.2\msneshellx.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb06.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [OmniPass] C:\Program Files\Softex\OmniPass\scureapp.exe
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Whistle - {220E39C3-B081-4719-AB1A-9A884DCBD05C} - C:\Program Files\WhistleSoftware\WselServices\webband.dll (file missing)
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O12 - Plugin for .asx: C:\Program Files\Netscape\Communicator\Program\PLUGINS\npdsplay.dll
O12 - Plugin for .wmv: C:\Program Files\Netscape\Communicator\Program\PLUGINS\npdsplay.dll
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei-4/ZwinkyInitialSetup1.0.1.1.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w3/resources/MSNPUpld.cab
O16 - DPF: {54771E6F-A5A2-4413-8FB8-7B8F85398174} - http://dl.lygo.com/Sidesearch/en_US/Lycos/Sidesearch.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?978967456656
O16 - DPF: {9AC54695-69A4-46F1-BE10-10C74F9520D5} - http://cabs.elitemediagroup.net/cabs/mediaview.cab
O16 - DPF: {9C23D886-43CB-43DE-B2DB-112A68D7E10A} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader2.cab
O16 - DPF: {9E17A5F9-2B9C-4C66-A592-199A4BA1FBC8} - http://pictures05.aim.com/ygp/aol/plugin/upf/AOLUPF.en-US-AIM.9.5.1.8.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D4C15E81-E2F6-4013-B81D-6F796D2C78C5} (SdcWebSecurityCtrl Class) - https://secure.stamps.com/download/us/registration/4_1_0_175/SdcWebSecurity.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/dim2/default/popcaploader_v6.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Softex OmniPass Service (omniserv) - Unknown owner - C:\Program Files\Softex\OmniPass\Omniserv.exe

--
End of file - 8616 bytes

 

Explorer.exe Virustotal Log attached

File Explorer.EXE
received on 2010.03.02 19:47:49 (UTC)
Current status: finished
Result: 0/41 (0.00%)

Antivirus Version Last Update Result
a-squared 4.5.0.50 2010.03.02 -
AhnLab-V3 5.0.0.2 2010.03.02 -
AntiVir 8.2.1.180 2010.03.02 -
Antiy-AVL 2.0.3.7 2010.03.02 -
Authentium 5.2.0.5 2010.03.02 -
Avast 4.8.1351.0 2010.03.02 -
AVG 9.0.0.730 2010.03.02 -
BitDefender 7.2 2010.03.02 -
CAT-QuickHeal 10.00 2010.03.02 -
ClamAV 0.96.0.0-git 2010.03.02 -
Comodo 4091 2010.02.28 -
DrWeb 5.0.1.12222 2010.03.02 -
eSafe 7.0.17.0 2010.03.02 -
eTrust-Vet 35.2.7335 2010.03.02 -
F-Prot 4.5.1.85 2010.03.02 -
F-Secure 9.0.15370.0 2010.03.02 -
Fortinet 4.0.14.0 2010.02.28 -
GData 19 2010.03.02 -
Ikarus T3.1.1.80.0 2010.03.02 -
Jiangmin 13.0.900 2010.03.02 -
K7AntiVirus 7.10.987 2010.03.02 -
Kaspersky 7.0.0.125 2010.03.02 -
McAfee 5908 2010.03.02 -
McAfee+Artemis 5908 2010.03.02 -
McAfee-GW-Edition 6.8.5 2010.03.02 -
Microsoft 1.5502 2010.03.02 -
NOD32 4910 2010.03.02 -
Norman 6.04.08 2010.03.02 -
nProtect 2009.1.8.0 2010.03.02 -
Panda 10.0.2.2 2010.03.02 -
PCTools 7.0.3.5 2010.03.02 -
Prevx 3.0 2010.03.02 -
Rising 22.37.01.04 2010.03.02 -
Sophos 4.50.0 2010.03.02 -
Sunbelt 5729 2010.03.02 -
Symantec 20091.2.0.41 2010.03.02 -
TheHacker 6.5.1.7.218 2010.03.02 -
TrendMicro 9.120.0.1004 2010.03.02 -
VBA32 3.12.12.2 2010.03.02 -
ViRobot 2010.3.2.2208 2010.03.02 -
VirusBuster 5.0.27.0 2010.03.02 -


Additional information

File size: 1033728 bytes
MD5 : 12896823fb95bfb3dc9b46bcaedc9923
SHA1 : 9d2bf84874abc5b6e9a2744b7865c193c08d362f
SHA256: 1e675cb7df214172f7eb0497f7275556038a0d09c6e5a3e6862c5e26885ef455
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x1A55F
timedatestamp.....: 0x48025C30 (Sun Apr 13 21:17:04 2008)
machinetype.......: 0x14C (Intel I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x44C09 0x44E00 6.38 fd89c9ce334764ffdbb62637ad9b5809
.data 0x46000 0x1DB4 0x1800 1.30 983f35021232560eaaa99fcbc1b7d359
.rsrc 0x48000 0xB2268 0xB2400 6.63 95339c37646fa93e3695e06572a21889
.reloc 0xFB000 0x374C 0x3800 6.78 ec335057489badbf6d8142b57175fd91

( 0 imports )


( 0 exports )
TrID : File type identification
Win32 Executable Generic (42.3%)
Win32 Dynamic Link Library (generic) (37.6%)
Generic Win/DOS Executable (9.9%)
DOS Executable Generic (9.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
ThreatExpert: http://www.threatexpert.com/report.aspx?md5=12896823fb95bfb3dc9b46bcaedc9923
ssdeep: 12288:HHmcoCUyZtwAvAs4wTCyrPTloHWYUrkf8w0Vnzac1/g/J/vMS:nmfty/wAvN7lrvbkf8w0VnH1/g/J/k
sigcheck: publisher....: Microsoft Corporation
copyright....: (c) Microsoft Corporation. All rights reserved.
product......: Microsoft_ Windows_ Operating System
description..: Windows Explorer
original name: EXPLORER.EXE
internal name: explorer
file version.: 6.00.2900.5512 (xpsp.080413-2105)
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned
PEiD : -
PDFiD : ['-', None, None]
RDS : NSRL Reference Data Set

 

svchost.exe Virustotal Log attached

File svchost.exe
received on 2010.03.02 09:41:17 (UTC)
Current status: finished
Result: 0/41 (0.00%)


Antivirus Version Last Update Result
a-squared 4.5.0.50 2010.03.02 -
AhnLab-V3 5.0.0.2 2010.03.02 -
AntiVir 8.2.1.176 2010.03.02 -
Antiy-AVL 2.0.3.7 2010.03.02 -
Authentium 5.2.0.5 2010.03.02 -
Avast 4.8.1351.0 2010.03.01 -
AVG 9.0.0.730 2010.03.01 -
BitDefender 7.2 2010.03.02 -
CAT-QuickHeal 10.00 2010.03.02 -
ClamAV 0.96.0.0-git 2010.03.02 -
Comodo 4091 2010.02.28 -
DrWeb 5.0.1.12222 2010.03.02 -
eSafe 7.0.17.0 2010.03.01 -
eTrust-Vet 35.2.7335 2010.03.02 -
F-Prot 4.5.1.85 2010.03.01 -
F-Secure 9.0.15370.0 2010.03.02 -
Fortinet 4.0.14.0 2010.02.28 -
GData 19 2010.03.02 -
Ikarus T3.1.1.80.0 2010.03.02 -
Jiangmin 13.0.900 2010.03.02 -
K7AntiVirus 7.10.986 2010.03.01 -
Kaspersky 7.0.0.125 2010.03.02 -
McAfee 5907 2010.03.01 -
McAfee+Artemis 5907 2010.03.01 -
McAfee-GW-Edition 6.8.5 2010.03.02 -
Microsoft 1.5502 2010.03.02 -
NOD32 4908 2010.03.02 -
Norman 6.04.08 2010.03.01 -
nProtect 2009.1.8.0 2010.03.02 -
Panda 10.0.2.2 2010.03.01 -
PCTools 7.0.3.5 2010.03.02 -
Prevx 3.0 2010.03.02 -
Rising 22.37.01.04 2010.03.02 -
Sophos 4.50.0 2010.03.02 -
Sunbelt 5716 2010.03.01 -
Symantec 20091.2.0.41 2010.03.02 -
TheHacker 6.5.1.7.218 2010.03.02 -
TrendMicro 9.120.0.1004 2010.03.02 -
VBA32 3.12.12.2 2010.03.02 -
ViRobot 2010.3.2.2208 2010.03.02 -
VirusBuster 5.0.27.0 2010.03.01 -


Additional information

File size: 14336 bytes
MD5 : 27c6d03bcdb8cfeb96b716f3d8be3e18
SHA1 : 49083ae3725a0488e0a8fbbe1335c745f70c4667
SHA256: 2910ebc692d833d949bfd56059e8106d324a276d5f165f874f3fb1b6c613cdd5
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x2509
timedatestamp.....: 0x48025BC0 (Sun Apr 13 21:15:12 2008)
machinetype.......: 0x14C (Intel I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x2C00 0x2C00 6.29 f6589e1ed3da6afefb0b4294d9ff7f2e
.data 0x4000 0x210 0x200 1.62 cbd504e46c836e09e8faabdcfbabaec2
.rsrc 0x5000 0x408 0x600 2.51 dcede0c303bbb48c6875eb64477e5882

( 0 imports )


( 0 exports )
TrID : File type identification
Win32 Executable Generic (42.3%)
Win32 Dynamic Link Library (generic) (37.6%)
Generic Win/DOS Executable (9.9%)
DOS Executable Generic (9.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
ThreatExpert: http://www.threatexpert.com/report.aspx?md5=27c6d03bcdb8cfeb96b716f3d8be3e18
ssdeep: 384:IDvi+JmG6yqlCRaJt4RHS5LutGJae7g9VJnpWCNJbW:INcG6xlCRaJKGOA7SHJ
sigcheck: publisher....: Microsoft Corporation
copyright....: (c) Microsoft Corporation. All rights reserved.
product......: Microsoft_ Windows_ Operating System
description..: Generic Host Process for Win32 Services
original name: svchost.exe
internal name: svchost.exe
file version.: 5.1.2600.5512 (xpsp.080413-2111)
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned
PEiD : -
PDFiD : ['-', None, None]
RDS : NSRL Reference Data Set

 

userinit.exe Virustotal log attached

File userinit.exe
received on 2010.03.03 07:24:02 (UTC)
Current status: finished
Result: 0/42 (0.00%)


Antivirus Version Last Update Result
a-squared 4.5.0.50 2010.03.03 -
AhnLab-V3 5.0.0.2 2010.03.02 -
AntiVir 8.2.1.180 2010.03.02 -
Antiy-AVL 2.0.3.7 2010.03.02 -
Authentium 5.2.0.5 2010.03.03 -
Avast 4.8.1351.0 2010.03.02 -
Avast5 5.0.332.0 2010.03.02 -
AVG 9.0.0.730 2010.03.02 -
BitDefender 7.2 2010.03.03 -
CAT-QuickHeal 10.00 2010.03.02 -
ClamAV 0.96.0.0-git 2010.03.03 -
Comodo 4091 2010.02.28 -
DrWeb 5.0.1.12222 2010.03.03 -
eSafe 7.0.17.0 2010.03.02 -
eTrust-Vet 35.2.7337 2010.03.03 -
F-Prot 4.5.1.85 2010.03.02 -
F-Secure 9.0.15370.0 2010.03.02 -
Fortinet 4.0.14.0 2010.02.28 -
GData 19 2010.03.03 -
Ikarus T3.1.1.80.0 2010.03.03 -
Jiangmin 13.0.900 2010.03.03 -
K7AntiVirus 7.10.987 2010.03.02 -
Kaspersky 7.0.0.125 2010.03.03 -
McAfee 5908 2010.03.02 -
McAfee+Artemis 5908 2010.03.02 -
McAfee-GW-Edition 6.8.5 2010.03.03 -
Microsoft 1.5502 2010.03.03 -
NOD32 4910 2010.03.02 -
Norman 6.04.08 2010.03.02 -
nProtect 2009.1.8.0 2010.03.03 -
Panda 10.0.2.2 2010.03.02 -
PCTools 7.0.3.5 2010.03.02 -
Prevx 3.0 2010.03.03 -
Rising 22.37.02.03 2010.03.03 -
Sophos 4.50.0 2010.03.03 -
Sunbelt 5736 2010.03.03 -
Symantec 20091.2.0.41 2010.03.03 -
TheHacker 6.5.1.7.218 2010.03.03 -
TrendMicro 9.120.0.1004 2010.03.03 -
VBA32 3.12.12.2 2010.03.02 -
ViRobot 2010.3.2.2208 2010.03.02 -
VirusBuster 5.0.27.0 2010.03.02 -

Additional information

File size: 26112 bytes
MD5 : a93aee1928a9d7ce3e16d24ec7380f89
SHA1 : 513f8bdf67a5a9e09803cfb61f590b39f2683853
SHA256: 944cd2135e171af338352568aa7fe1b8004733a4281395ad6723e0cf43d5f53f
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x54AD
timedatestamp.....: 0x480251A8 (Sun Apr 13 20:32:08 2008)
machinetype.......: 0x14C (Intel I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x520E 0x5400 5.95 099b53205ad3f1c3b853a5310d08a9b1
.data 0x7000 0x14C 0x200 1.86 0bb948f267e82975313a03d8c0e8a1cf
.rsrc 0x8000 0xB50 0xC00 3.27 bac832e39f87c4f5f640e5d5c6a1c2fc

( 0 imports )


( 0 exports )
TrID : File type identification
Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)
ThreatExpert: http://www.threatexpert.com/report.aspx?md5=a93aee1928a9d7ce3e16d24ec7380f89
ssdeep: 768:0RMJi8jDLIDSAaQFxfftjaLacmkLGKOq:0RMJbDMDSA7FxffJaLaSLG9q
sigcheck: publisher....: Microsoft Corporation
copyright....: (c) Microsoft Corporation. All rights reserved.
product......: Microsoft_ Windows_ Operating System
description..: Userinit Logon Application
original name: USERINIT.EXE
internal name: userinit
file version.: 5.1.2600.5512 (xpsp.080413-2113)
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned
PEiD : -
RDS : NSRL Reference Data Set
-