1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Solved Trojan/Virus Adware Serious problem

Discussion in 'Malware and Virus Removal Archive' started by living life, 2008/07/16.

Page 1 of 2
  1. 2008/07/16
    living life

    living life Inactive Thread Starter

    Joined:
    2008/07/15
    Messages:
    74
    Likes Received:
    0
    [Resolved] Trojan/Virus Adware Serious problem

    I opened what I thought was an E card from Hallmark only to find that my computer was taken over by something called software referral dot com. It took over my home page and would continuously change my cookie settings and download pages. It took over as my administrator and prevented me from doing most things. I read other posts and downloaded the tools from another computer to a jump drive and added them to mine as it blocked all the web sites.
    there are still some viruses on my pc but the VIRUS ALERT display is gone and I can now use the websites to download. the following is the reports.

    I ran ComboFix three times and then ATF Cleaner and then did the Kapersky with the Resident Shield of on my AVG.
    Thank you for your help, reading the other posts makes me very grateful and hopeful for what you do.

    I have to make three entries as my text is too long for the window

    ComboFix 08-07-14.2 - andrew 2008-07-15 23:09:29.1 - FAT32x86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.137 [GMT -4:00]
    Running from: C:\Documents and Settings\andrew\Desktop\ComboFix2.exe.exe
    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\Documents and Settings\andrew\Application Data\macromedia\Flash Player\#SharedObjects\NGVM2NU3\Broadcaster.com | Home | Viral Video Clips, Live Community, News, Software, Movies, Music, Games, Mobile Media & More
    C:\Documents and Settings\andrew\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#Broadcaster.com | Home | Viral Video Clips, Live Community, News, Software, Movies, Music, Games, Mobile Media & More
    C:\Documents and Settings\andrew\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol
    C:\Documents and Settings\andrew\g2mdlhlpx.exe
    C:\Documents and Settings\Grant\Application Data\ShoppingReport
    C:\Documents and Settings\Grant\Application Data\ShoppingReport\cs\Config.xml
    C:\Documents and Settings\Grant\Application Data\ShoppingReport\cs\db\Aliases.dbs
    C:\Documents and Settings\Grant\Application Data\ShoppingReport\cs\db\Sites.dbs
    C:\Documents and Settings\Grant\Application Data\ShoppingReport\cs\dwld\WhiteList.xip
    C:\Documents and Settings\Grant\Application Data\ShoppingReport\cs\report\aggr_storage.xml
    C:\Documents and Settings\Grant\Application Data\ShoppingReport\cs\report\send_storage.xml
    C:\Documents and Settings\Grant\Application Data\ShoppingReport\cs\res1\WhiteList.dbs
    C:\Documents and Settings\Guest\Application Data\ShoppingReport
    C:\Documents and Settings\Guest\Application Data\ShoppingReport\cs\Config.xml
    C:\Documents and Settings\Guest\Application Data\ShoppingReport\cs\db\Aliases.dbs
    C:\Documents and Settings\Guest\Application Data\ShoppingReport\cs\db\Sites.dbs
    C:\Documents and Settings\Guest\Application Data\ShoppingReport\cs\dwld\WhiteList.xip
    C:\Documents and Settings\Guest\Application Data\ShoppingReport\cs\report\aggr_storage.xml
    C:\Documents and Settings\Guest\Application Data\ShoppingReport\cs\report\send_storage.xml
    C:\Documents and Settings\Guest\Application Data\ShoppingReport\cs\res1\WhiteList.dbs
    C:\Documents and Settings\Morgan\Application Data\ShoppingReport
    C:\Documents and Settings\Morgan\Application Data\ShoppingReport\cs\Config.xml
    C:\Documents and Settings\Morgan\Application Data\ShoppingReport\cs\db\Aliases.dbs
    C:\Documents and Settings\Morgan\Application Data\ShoppingReport\cs\db\Sites.dbs
    C:\Documents and Settings\Morgan\Application Data\ShoppingReport\cs\dwld\WhiteList.xip
    C:\Documents and Settings\Morgan\Application Data\ShoppingReport\cs\report\aggr_storage.xml
    C:\Documents and Settings\Morgan\Application Data\ShoppingReport\cs\report\send_storage.xml
    C:\Documents and Settings\Morgan\Application Data\ShoppingReport\cs\res1\WhiteList.dbs
    C:\Documents and Settings\Morgan\Application Data\WeatherDPA
    C:\Documents and Settings\Morgan\Application Data\WeatherDPA\Weather\WeatherStartup.xml
    C:\Documents and Settings\Morgan\Start Menu\Programs\PlayMP3z
    C:\Documents and Settings\Morgan\Start Menu\Programs\PlayMP3z\Run PlayMP3z.lnk
    C:\Program Files\FunWebProducts
    C:\Program Files\FunWebProducts\ScreenSaver\Images\003927C6.urr
    C:\Program Files\FunWebProducts\ScreenSaver\Images\05B6B2CE.urr
    C:\Program Files\MyWebSearch
    C:\Program Files\MyWebSearch\bar\History\search2
    C:\Program Files\MyWebSearch\bar\Settings\s_pid.dat
    C:\Program Files\MyWebSearch\bar\Settings\setting2.htm
    C:\Program Files\MyWebSearch\bar\Settings\settings.dat
    C:\Program Files\PCHealthCenter
    C:\Program Files\PCHealthCenter\0.exe
    C:\Program Files\PCHealthCenter\0.gif
    C:\Program Files\PCHealthCenter\1.exe
    C:\Program Files\PCHealthCenter\1.gif
    C:\Program Files\PCHealthCenter\2.exe
    C:\Program Files\PCHealthCenter\2.gif
    C:\Program Files\PCHealthCenter\3.exe
    C:\Program Files\PCHealthCenter\3.gif
    C:\Program Files\PCHealthCenter\4.exe
    C:\Program Files\PCHealthCenter\sex1.ico
    C:\Program Files\PCHealthCenter\sex2.ico
    C:\Program Files\VAV
    C:\Program Files\VAV\vav.ooo
    C:\Program Files\VAV\vav0.dat
    C:\Program Files\VAV\vav1.dat
    C:\WINDOWS\cookies.ini
    C:\WINDOWS\erem.exe
    C:\WINDOWS\gpefaowr.exe
    C:\WINDOWS\system32\_000003_.tmp.dll
    C:\WINDOWS\system32\_000004_.tmp.dll
    C:\WINDOWS\system32\_000006_.tmp.dll
    C:\WINDOWS\system32\_000007_.tmp.dll
    C:\WINDOWS\system32\_000008_.tmp.dll
    C:\WINDOWS\system32\_000013_.tmp.dll
    C:\WINDOWS\system32\avhieg.dll
    C:\WINDOWS\system32\ayjruo.dll
    C:\WINDOWS\system32\clbdll.dll
    C:\WINDOWS\system32\clbdll.old
    C:\WINDOWS\system32\clbinit.dll
    C:\WINDOWS\system32\CRIEVX.DLL
    C:\WINDOWS\system32\ddem.dll
    C:\WINDOWS\system32\drivers\clbdriver.sys
    C:\WINDOWS\system32\faqzkn.dll
    C:\WINDOWS\system32\ijgdcuna.ini
    C:\WINDOWS\system32\isenubmb.dll
    C:\WINDOWS\system32\mcrh.tmp
    C:\WINDOWS\system32\nXIjQXbc.ini
    C:\WINDOWS\system32\nXIjQXbc.ini2
    C:\WINDOWS\system32\pgutoydj.dll
    C:\WINDOWS\system32\phvuolai.ini
    C:\WINDOWS\system32\qwinqyrt.dll
    C:\WINDOWS\system32\qxpqgveu.dll
    C:\WINDOWS\system32\rilmiu.dll
    C:\WINDOWS\system32\sex1.ico
    C:\WINDOWS\system32\sex2.ico
    C:\WINDOWS\system32\tryqniwq.ini
    C:\WINDOWS\system32\uabxikrd.dll
    C:\WINDOWS\system32\uevgqpxq.ini
    C:\WINDOWS\system32\umxiqirn.dll
    C:\WINDOWS\system32\xggixlid.dll
    C:\WINDOWS\system32\xnqjymjm.dll
    C:\WINDOWS\system32\ypoqww.dll

    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    -------\Legacy_CLBDRIVER


    ((((((((((((((((((((((((( Files Created from 2008-06-16 to 2008-07-16 )))))))))))))))))))))))))))))))
    .

    2008-07-15 23:21 . 2008-07-15 23:21 322,304 --a------ C:\WINDOWS\system32\ddcyyWMG.dll
    2008-07-15 23:21 . 2008-07-15 23:21 347 --ahs---- C:\WINDOWS\system32\GMWyycdd.ini2
    2008-07-15 23:21 . 2008-07-15 23:21 347 --ahs---- C:\WINDOWS\system32\GMWyycdd.ini
    2008-07-15 14:01 . 2008-07-15 14:09 4,286 --a------ C:\WINDOWS\system32\tmp.reg
    2008-07-15 13:59 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
    2008-07-15 13:59 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
    2008-07-15 13:59 . 2008-05-29 09:35 86,528 --a------ C:\WINDOWS\system32\VACFix.exe
    2008-07-15 13:59 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe
    2008-07-15 13:59 . 2008-07-02 13:33 82,432 --a------ C:\WINDOWS\system32\IEDFix.C.exe
    2008-07-15 13:59 . 2008-05-23 18:21 81,920 --a------ C:\WINDOWS\system32\404Fix.exe
    2008-07-15 13:59 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
    2008-07-15 13:59 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
    2008-07-15 13:59 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
    2008-07-15 12:52 . 2008-07-15 12:52 <DIR> d--hs---- C:\FOUND.032
    2008-07-15 11:33 . 2008-07-15 11:33 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
    2008-07-15 11:32 . 2008-07-15 11:32 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
    2008-07-14 23:20 . 2008-07-14 23:20 2 --a------ C:\WINDOWS\msoffice.ini
    2008-07-14 18:09 . 2003-01-10 17:13 33,588 -ra------ C:\WINDOWS\system32\drivers\wanatw4.sys
    2008-07-14 16:15 . 2008-07-14 16:15 <DIR> d-------- C:\Program Files\Enigma Software Group
    2008-07-14 16:10 . 2008-07-14 16:10 <DIR> d-------- C:\Documents and Settings\andrew\Application Data\AOL
    2008-07-14 16:07 . 2008-07-14 16:07 <DIR> d-------- C:\Program Files\Common Files\Nullsoft
    2008-07-14 16:05 . 2008-07-14 16:05 <DIR> d-------- C:\Program Files\Viewpoint
    2008-07-14 16:05 . 2008-07-14 16:05 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Viewpoint
    2008-07-14 14:24 . 2008-07-14 14:24 <DIR> d-------- C:\Program Files\Common Files\AOL
    2008-07-14 14:24 . 2008-07-14 14:24 335 --a------ C:\WINDOWS\nsreg.dat
    2008-07-14 14:23 . 2008-07-14 14:23 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\AOL Downloads
    2008-07-14 14:23 . 2008-07-14 14:23 29 --a------ C:\WINDOWS\atid.ini
    2008-07-14 13:22 . 2008-07-14 13:22 <DIR> d--hs---- C:\FOUND.031
    2008-07-14 13:05 . 2008-07-14 13:24 354 ---hs---- C:\WINDOWS\system32\aetktdwv.ini
    2008-07-11 20:09 . 2008-07-11 20:09 <DIR> d--hs---- C:\FOUND.030
    2008-07-11 19:46 . 2008-07-11 19:46 <DIR> d-------- C:\Documents and Settings\andrew\Application Data\MSNInstaller
    2008-07-11 18:51 . 2008-07-11 18:51 <DIR> d-------- C:\Documents and Settings\Morgan\Application Data\TmpRecentIcons
    2008-07-11 18:51 . 2008-07-11 18:51 <DIR> d-------- C:\Documents and Settings\Grant\Application Data\TmpRecentIcons
    2008-07-11 11:55 . 2008-07-11 11:55 <DIR> d--hs---- C:\FOUND.029
    2008-07-10 20:14 . 2008-07-10 20:14 <DIR> d--hs---- C:\FOUND.028
    2008-07-10 03:04 . 2008-07-10 03:04 318,208 --a------ C:\WINDOWS\system32\cbXQjIXn.dll
    2008-07-10 02:58 . 2008-07-10 02:58 29,568 --a------ C:\WINDOWS\system32\yaywuvTL.dll
    2008-07-10 02:58 . 2008-07-10 02:58 29,568 --a------ C:\WINDOWS\system32\jkkKaayW.dll
    2008-07-10 02:58 . 2004-08-04 05:00 4,224 --a------ C:\WINDOWS\system32\beep.sys
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d-------- C:\Program Files\Realtek Sound Manager
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d-------- C:\Program Files\Common Files\PocketSoft
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d-------- C:\Program Files\AvRack
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d-------- C:\Program Files\Atari
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.009
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.008
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.007
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.006
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.005
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.004
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.003
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.002
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.001
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.000
    2008-07-05 20:44 . 2008-07-09 09:54 54,156 --ah----- C:\WINDOWS\QTFont.qfn
    2008-07-05 20:44 . 2008-07-05 20:45 1,409 --a------ C:\WINDOWS\QTFont.for
    2008-07-05 20:42 . 2008-07-05 20:42 <DIR> d-------- C:\Program Files\QuickTime(2)
    2008-06-21 19:54 . 2008-06-21 19:54 <DIR> d-------- C:\Documents and Settings\Morgan\Application Data\ooVoo Details
    2008-06-17 19:23 . 2008-06-17 19:23 <DIR> d-------- C:\Documents and Settings\Morgan\Application Data\FrostWire
    2008-06-17 19:19 . 2008-06-17 19:19 <DIR> d-------- C:\Program Files\FrostWire
    2008-06-17 19:19 . 2008-06-17 19:19 <DIR> d-------- C:\Program Files\AskSBar

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
    2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\dllcache\mswsock.dll
    2008-06-20 17:41 148,992 ----a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
    2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\dllcache\tcpip.sys
    2008-06-20 10:45 360,320 ------w C:\WINDOWS\system32\drivers\tcpip.sys
    2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\dllcache\afd.sys
    2008-06-20 10:44 138,368 ------w C:\WINDOWS\system32\drivers\afd.sys
    2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\dllcache\tcpip6.sys
    2008-06-20 09:52 225,920 ------w C:\WINDOWS\system32\drivers\tcpip6.sys
    2008-06-13 20:06 --------- d-----w C:\Documents and Settings\Grant\Application Data\LimeWire
    2008-06-13 13:10 272,128 ------w C:\WINDOWS\system32\drivers\bthport.sys
    2008-06-13 13:10 272,128 ------w C:\WINDOWS\system32\dllcache\bthport.sys
    2008-06-12 20:25 --------- d-----w C:\Documents and Settings\Grant\Application Data\uTorrent
    2008-06-11 16:09 --------- d-----w C:\Program Files\FBrowserAdvisor
    2008-05-08 12:28 202,752 ------w C:\WINDOWS\system32\dllcache\rmcast.sys
    2008-05-07 05:18 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
    2008-05-07 05:18 1,287,680 ------w C:\WINDOWS\system32\dllcache\quartz.dll
    2008-04-24 02:16 3,591,680 ------w C:\WINDOWS\system32\dllcache\mshtml.dll
    2008-04-22 07:40 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe
    2008-04-22 07:39 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe
    2008-04-22 07:39 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe
    2008-04-20 05:07 161,792 ------w C:\WINDOWS\system32\dllcache\ieakui.dll
    2004-08-04 09:00 94,784 --sh--w C:\WINDOWS\twain.dll
    2004-08-04 09:00 50,688 --sh--w C:\WINDOWS\twain_32.dll
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5DF5DA73-C225-415E-87CF-DBB698F8B2B4}]
    2008-07-15 23:21 322304 --a------ C:\WINDOWS\system32\ddcyyWMG.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{684BFE7F-F5B2-4AB3-A95E-EB5036A2D286}]
    2008-07-10 02:58 29568 --a------ C:\WINDOWS\system32\jkkKaayW.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8532d95a-7ada-453b-be6a-e838c364099b}]
    2008-07-15 23:25 116864 --a------ C:\WINDOWS\system32\slvfjr.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E6DC6E97-E2D6-4654-9179-DBF79A0DB30F}]
    2008-07-10 03:04 318208 --a------ C:\WINDOWS\system32\cbXQjIXn.dll

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "WeatherEye "= "C:\Program Files\TheWeatherNetwork\WeatherEye\WeatherEye" [X]
    "ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 05:00 15360]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "LaunchApp "= "Alaunch" [X]
    "SynTPLpr "= "C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-10-07 23:44 98394]
    "SynTPEnh "= "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-10-07 23:43 688218]
    "SiS Windows KeyHook "= "C:\WINDOWS\system32\keyhook.exe" [2005-03-04 13:13 32768]
    "IMJPMIG8.1 "= "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 05:00 208952]
    "MSPY2002 "= "C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 05:00 59392]
    "PHIME2002ASync "= "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 05:00 455168]
    "PHIME2002A "= "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 05:00 455168]
    "eRecoveryService "= "C:\Acer\Empowering Technology\eRecovery\Monitor.exe" [2005-11-16 16:54 385024]
    "AVG7_CC "= "C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [2008-04-19 19:41 579584]
    "HPDJ Taskbar Utility "= "C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe" [2005-07-08 00:55 176128]
    "HPHUPD05 "= "C:\Program Files\Hewlett-Packard\\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\hphupd05.exe" [2005-07-08 00:55 49152]
    "HP Component Manager "= "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 08:38 241664]
    "HPHmon05 "= "C:\WINDOWS\system32\hphmon05.exe" [2005-07-08 00:55 491520]
    "eFax 4.2 "= "C:\Program Files\eFax Messenger 4.2\J2GDllCmd.exe" [2006-07-14 16:36 107008]
    "HP Software Update "= "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2007-05-08 16:24 54840]
    "Share-to-Web Namespace Daemon "= "C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" [2001-07-03 09:11 57344]
    "Acrobat Assistant 7.0 "= "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2008-04-23 02:08 483328]
    "iTunesHelper "= "C:\Program Files\iTunes\iTunesHelper.exe" [2007-11-02 18:36 267048]
    "SoundMan "= "SOUNDMAN.EXE" [2005-02-23 18:13 77824 C:\WINDOWS\SOUNDMAN.EXE]
    "AGRSMMSG "= "AGRSMMSG.exe" [2004-10-07 19:50 88363 C:\WINDOWS\AGRSMMSG.exe]
    "SiSPower "= "SiSPower.dll" [2005-02-25 19:35 49152 C:\WINDOWS\system32\SiSPower.dll]

    C:\Documents and Settings\andrew\Start Menu\Programs\Startup\
    Microsoft Office OneNote 2003 Quick Launch.lnk - C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE [2007-04-19 13:49:52 64864]
    DING!.lnk - C:\Program Files\Southwest Airlines\Ding\Ding.exe [2006-06-22 14:15:48 462848]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    Utility Tray.lnk - C:\WINDOWS\system32\sistray.exe [2005-01-04 16:52:52 331776]
    eFax 4.2.lnk - C:\Program Files\eFax Messenger 4.2\J2GTray.exe [2006-10-02 21:00:05 612352]
    Microsoft Office OneNote 2003 Quick Launch.lnk - C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE [2007-04-19 13:49:52 64864]
    Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26 29696]
    Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe [2007-04-06 15:54:09 25214]

    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    "{684BFE7F-F5B2-4AB3-A95E-EB5036A2D286} "= "C:\WINDOWS\system32\jkkKaayW.dll" [2008-07-10 02:58 29568]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\jkkKaayW]
    2008-07-10 02:58 29568 C:\WINDOWS\system32\jkkKaayW.dll

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
    Authentication Packages REG_MULTI_SZ msv1_0 C:\WINDOWS\system32\ddcyyWMG

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusOverride "=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe "=
    "C:\\Program Files\\Acer Inc\\Acer GridVista\\GridVistaU.exe "=
    "C:\\Program Files\\Grisoft\\AVG Free\\AVGCC.EXE "=
    "C:\\Program Files\\Grisoft\\AVG Free\\avgw.exe "=
    "C:\\Program Files\\Grisoft\\AVG Free\\avgvv.exe "=
    "C:\\Program Files\\eFax Messenger 4.2\\J2GPBook.exe "=
    "C:\\Program Files\\Hewlett-Packard\\Precisionscan Pro 3.1\\hpipcopy.exe "=
    "C:\\Program Files\\Hewlett-Packard\\HP Software Update\\HPWUCli.exe "=
    "C:\\Program Files\\Mozilla Firefox\\firefox.exe "=
    "C:\\HSH\\HBCS\\unins000.exe "=
    "C:\\Program Files\\TheWeatherNetwork\\WeatherEye\\WeatherEye.exe "=
    "C:\\Program Files\\AvRack\\rtlrack.exe "=

    R2 int15.sys;int15.sys;C:\Acer\Empowering Technology\eRecovery\int15.sys [2005-01-13 14:46]
    R3 SISNICXP;SiS PCI Fast Ethernet Adapter Driver for NDIS51;C:\WINDOWS\system32\DRIVERS\sisnicxp.sys [2004-11-05 01:43]
    S3 usbprint;Microsoft USB PRINTER Class;C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-03 23:01]

    .
    Contents of the 'Scheduled Tasks' folder
    "2008-07-15 17:10:08 C:\WINDOWS\Tasks\HP Usg Daily.job "
    - C:\Program Files\Hewlett-Packard\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\pexpress\hphped05.exe
    "2007-03-22 21:59:02 C:\WINDOWS\Tasks\MP Scheduled Quick Scan.job "
    - C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MpCmdRun.exe%Scan -RestrictPrivileges -ScanType 1
    "2008-07-15 14:49:28 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job "
    - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
    .
    - - - - ORPHANS REMOVED - - - -

    HKCU-Run-Sys2.exe - C:\Windows\Sys2.exe
    HKLM-Run-320d18a1 - C:\WINDOWS\system32\qxpqgveu.dll
    SSODL-fsrpknov-{D1D36229-9FD5-42F3-88C0-6E2BE7F25961} - C:\WINDOWS\fsrpknov.dll
    SSODL-fdxbameg-{B1F57EFF-BB03-42A4-A286-3D3427766604} - C:\WINDOWS\fdxbameg.dll


    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-07-15 23:22:06
    Windows 5.1.2600 Service Pack 2 FAT NTAPI

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    PROCESS: C:\WINDOWS\system32\winlogon.exe
    -> C:\WINDOWS\system32\jkkKaayW.dll

    PROCESS: C:\WINDOWS\explorer.exe
    -> C:\WINDOWS\system32\ddcyyWMG.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    C:\ACER\EMANAGER\ANBMSERV.EXE
    C:\PROGRAM FILES\COMMON FILES\APPLE\MOBILE DEVICE SUPPORT\BIN\APPLEMOBILEDEVICESERVICE.EXE
    C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGAMSVR.EXE
    C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGUPSVC.EXE
    C:\WINDOWS\SYSTEM32\HPZIPM12.EXE
    C:\WINDOWS\SYSTEM32\FXSSVC.EXE
    C:\WINDOWS\SYSTEM32\RUNDLL32.EXE
    C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGCC.EXE
    C:\Program Files\TheWeatherNetwork\WeatherEye\WeatherEye.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\SYSTEM32\RUNDLL32.EXE
    C:\WINDOWS\system32\imapi.exe
    .
    **************************************************************************
    .
    Completion time: 2008-07-15 23:27:40 - machine was rebooted
    ComboFix-quarantined-files.txt 2008-07-16 03:27:26

    Pre-Run: 5,781,749,760 bytes free
    Post-Run: 9,527,492,608 bytes free

    319 --- E O F --- 2008-07-10 07:03:50
     
    living life,
    #1
  2. 2008/07/16
    living life

    living life Inactive Thread Starter

    Joined:
    2008/07/15
    Messages:
    74
    Likes Received:
    0
    continued

    This is the second part of the Combo Fix log, I could only post half of it on the first page

    ComboFix 08-07-14.2 - andrew 2008-07-15 23:42:00.2 - FAT32x86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.124 [GMT -4:00]
    Running from: C:\Documents and Settings\andrew\Desktop\ComboFix.exe

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\WINDOWS\system32\GMWyycdd.ini
    C:\WINDOWS\system32\GMWyycdd.ini2
    C:\WINDOWS\system32\prnrwqmf.dll
    C:\WINDOWS\system32\slvfjr.dll

    .
    ((((((((((((((((((((((((( Files Created from 2008-06-16 to 2008-07-16 )))))))))))))))))))))))))))))))
    .

    2008-07-15 23:21 . 2008-07-15 23:21 322,304 --a------ C:\WINDOWS\system32\ddcyyWMG.dll
    2008-07-15 14:01 . 2008-07-15 14:09 4,286 --a------ C:\WINDOWS\system32\tmp.reg
    2008-07-15 13:59 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
    2008-07-15 13:59 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
    2008-07-15 13:59 . 2008-05-29 09:35 86,528 --a------ C:\WINDOWS\system32\VACFix.exe
    2008-07-15 13:59 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe
    2008-07-15 13:59 . 2008-07-02 13:33 82,432 --a------ C:\WINDOWS\system32\IEDFix.C.exe
    2008-07-15 13:59 . 2008-05-23 18:21 81,920 --a------ C:\WINDOWS\system32\404Fix.exe
    2008-07-15 13:59 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
    2008-07-15 13:59 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
    2008-07-15 13:59 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
    2008-07-15 12:52 . 2008-07-15 12:52 <DIR> d--hs---- C:\FOUND.032
    2008-07-15 11:33 . 2008-07-15 11:33 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
    2008-07-15 11:32 . 2008-07-15 11:32 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
    2008-07-14 23:20 . 2008-07-14 23:20 2 --a------ C:\WINDOWS\msoffice.ini
    2008-07-14 18:09 . 2003-01-10 17:13 33,588 -ra------ C:\WINDOWS\system32\drivers\wanatw4.sys
    2008-07-14 16:15 . 2008-07-14 16:15 <DIR> d-------- C:\Program Files\Enigma Software Group
    2008-07-14 16:10 . 2008-07-14 16:10 <DIR> d-------- C:\Documents and Settings\andrew\Application Data\AOL
    2008-07-14 16:07 . 2008-07-14 16:07 <DIR> d-------- C:\Program Files\Common Files\Nullsoft
    2008-07-14 16:05 . 2008-07-14 16:05 <DIR> d-------- C:\Program Files\Viewpoint
    2008-07-14 16:05 . 2008-07-14 16:05 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Viewpoint
    2008-07-14 14:24 . 2008-07-14 14:24 <DIR> d-------- C:\Program Files\Common Files\AOL
    2008-07-14 14:24 . 2008-07-14 14:24 335 --a------ C:\WINDOWS\nsreg.dat
    2008-07-14 14:23 . 2008-07-14 14:23 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\AOL Downloads
    2008-07-14 14:23 . 2008-07-14 14:23 29 --a------ C:\WINDOWS\atid.ini
    2008-07-14 13:22 . 2008-07-14 13:22 <DIR> d--hs---- C:\FOUND.031
    2008-07-14 13:05 . 2008-07-14 13:24 354 ---hs---- C:\WINDOWS\system32\aetktdwv.ini
    2008-07-11 20:09 . 2008-07-11 20:09 <DIR> d--hs---- C:\FOUND.030
    2008-07-11 19:46 . 2008-07-11 19:46 <DIR> d-------- C:\Documents and Settings\andrew\Application Data\MSNInstaller
    2008-07-11 18:51 . 2008-07-11 18:51 <DIR> d-------- C:\Documents and Settings\Morgan\Application Data\TmpRecentIcons
    2008-07-11 18:51 . 2008-07-11 18:51 <DIR> d-------- C:\Documents and Settings\Grant\Application Data\TmpRecentIcons
    2008-07-11 11:55 . 2008-07-11 11:55 <DIR> d--hs---- C:\FOUND.029
    2008-07-10 20:14 . 2008-07-10 20:14 <DIR> d--hs---- C:\FOUND.028
    2008-07-10 03:04 . 2008-07-10 03:04 318,208 --a------ C:\WINDOWS\system32\cbXQjIXn.dll
    2008-07-10 02:58 . 2008-07-10 02:58 29,568 --a------ C:\WINDOWS\system32\yaywuvTL.dll
    2008-07-10 02:58 . 2008-07-10 02:58 29,568 --a------ C:\WINDOWS\system32\jkkKaayW.dll
    2008-07-10 02:58 . 2004-08-04 05:00 4,224 --a------ C:\WINDOWS\system32\beep.sys
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d-------- C:\Program Files\Realtek Sound Manager
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d-------- C:\Program Files\Common Files\PocketSoft
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d-------- C:\Program Files\AvRack
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d-------- C:\Program Files\Atari
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.009
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.008
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.007
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.006
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.005
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.004
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.003
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.002
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.001
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.000
    2008-07-05 20:44 . 2008-07-09 09:54 54,156 --ah----- C:\WINDOWS\QTFont.qfn
    2008-07-05 20:44 . 2008-07-05 20:45 1,409 --a------ C:\WINDOWS\QTFont.for
    2008-07-05 20:42 . 2008-07-05 20:42 <DIR> d-------- C:\Program Files\QuickTime(2)
    2008-06-21 19:54 . 2008-06-21 19:54 <DIR> d-------- C:\Documents and Settings\Morgan\Application Data\ooVoo Details
    2008-06-17 19:23 . 2008-06-17 19:23 <DIR> d-------- C:\Documents and Settings\Morgan\Application Data\FrostWire
    2008-06-17 19:19 . 2008-06-17 19:19 <DIR> d-------- C:\Program Files\FrostWire
    2008-06-17 19:19 . 2008-06-17 19:19 <DIR> d-------- C:\Program Files\AskSBar

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
    2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\dllcache\mswsock.dll
    2008-06-20 17:41 148,992 ----a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
    2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\dllcache\tcpip.sys
    2008-06-20 10:45 360,320 ------w C:\WINDOWS\system32\drivers\tcpip.sys
    2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\dllcache\afd.sys
    2008-06-20 10:44 138,368 ------w C:\WINDOWS\system32\drivers\afd.sys
    2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\dllcache\tcpip6.sys
    2008-06-20 09:52 225,920 ------w C:\WINDOWS\system32\drivers\tcpip6.sys
    2008-06-13 20:06 --------- d-----w C:\Documents and Settings\Grant\Application Data\LimeWire
    2008-06-13 13:10 272,128 ------w C:\WINDOWS\system32\drivers\bthport.sys
    2008-06-13 13:10 272,128 ------w C:\WINDOWS\system32\dllcache\bthport.sys
    2008-06-12 20:25 --------- d-----w C:\Documents and Settings\Grant\Application Data\uTorrent
    2008-06-11 16:09 --------- d-----w C:\Program Files\FBrowserAdvisor
    2008-05-08 12:28 202,752 ------w C:\WINDOWS\system32\dllcache\rmcast.sys
    2008-05-07 05:18 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
    2008-05-07 05:18 1,287,680 ------w C:\WINDOWS\system32\dllcache\quartz.dll
    2008-04-24 02:16 3,591,680 ------w C:\WINDOWS\system32\dllcache\mshtml.dll
    2008-04-22 07:40 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe
    2008-04-22 07:39 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe
    2008-04-22 07:39 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe
    2008-04-20 05:07 161,792 ------w C:\WINDOWS\system32\dllcache\ieakui.dll
    2004-08-04 09:00 94,784 --sh--w C:\WINDOWS\twain.dll
    2004-08-04 09:00 50,688 --sh--w C:\WINDOWS\twain_32.dll
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5DF5DA73-C225-415E-87CF-DBB698F8B2B4}]
    2008-07-15 23:21 322304 --a------ C:\WINDOWS\system32\ddcyyWMG.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{684BFE7F-F5B2-4AB3-A95E-EB5036A2D286}]
    2008-07-10 02:58 29568 --a------ C:\WINDOWS\system32\jkkKaayW.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E6DC6E97-E2D6-4654-9179-DBF79A0DB30F}]
    2008-07-10 03:04 318208 --a------ C:\WINDOWS\system32\cbXQjIXn.dll

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "WeatherEye "= "C:\Program Files\TheWeatherNetwork\WeatherEye\WeatherEye" [X]
    "ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 05:00 15360]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "LaunchApp "= "Alaunch" [X]
    "SynTPLpr "= "C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-10-07 23:44 98394]
    "SynTPEnh "= "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-10-07 23:43 688218]
    "SiS Windows KeyHook "= "C:\WINDOWS\system32\keyhook.exe" [2005-03-04 13:13 32768]
    "IMJPMIG8.1 "= "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 05:00 208952]
    "MSPY2002 "= "C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 05:00 59392]
    "PHIME2002ASync "= "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 05:00 455168]
    "PHIME2002A "= "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 05:00 455168]
    "eRecoveryService "= "C:\Acer\Empowering Technology\eRecovery\Monitor.exe" [2005-11-16 16:54 385024]
    "AVG7_CC "= "C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [2008-04-19 19:41 579584]
    "HPDJ Taskbar Utility "= "C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe" [2005-07-08 00:55 176128]
    "HPHUPD05 "= "C:\Program Files\Hewlett-Packard\\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\hphupd05.exe" [2005-07-08 00:55 49152]
    "HP Component Manager "= "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 08:38 241664]
    "HPHmon05 "= "C:\WINDOWS\system32\hphmon05.exe" [2005-07-08 00:55 491520]
    "eFax 4.2 "= "C:\Program Files\eFax Messenger 4.2\J2GDllCmd.exe" [2006-07-14 16:36 107008]
    "HP Software Update "= "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2007-05-08 16:24 54840]
    "Share-to-Web Namespace Daemon "= "C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" [2001-07-03 09:11 57344]
    "Acrobat Assistant 7.0 "= "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2008-04-23 02:08 483328]
    "iTunesHelper "= "C:\Program Files\iTunes\iTunesHelper.exe" [2007-11-02 18:36 267048]
    "SoundMan "= "SOUNDMAN.EXE" [2005-02-23 18:13 77824 C:\WINDOWS\SOUNDMAN.EXE]
    "AGRSMMSG "= "AGRSMMSG.exe" [2004-10-07 19:50 88363 C:\WINDOWS\AGRSMMSG.exe]
    "SiSPower "= "SiSPower.dll" [2005-02-25 19:35 49152 C:\WINDOWS\system32\SiSPower.dll]

    C:\Documents and Settings\andrew\Start Menu\Programs\Startup\
    Microsoft Office OneNote 2003 Quick Launch.lnk - C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE [2007-04-19 13:49:52 64864]
    DING!.lnk - C:\Program Files\Southwest Airlines\Ding\Ding.exe [2006-06-22 14:15:48 462848]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    Utility Tray.lnk - C:\WINDOWS\system32\sistray.exe [2005-01-04 16:52:52 331776]
    eFax 4.2.lnk - C:\Program Files\eFax Messenger 4.2\J2GTray.exe [2006-10-02 21:00:05 612352]
    Microsoft Office OneNote 2003 Quick Launch.lnk - C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE [2007-04-19 13:49:52 64864]
    Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26 29696]
    Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe [2007-04-06 15:54:09 25214]

    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    "{684BFE7F-F5B2-4AB3-A95E-EB5036A2D286} "= "C:\WINDOWS\system32\jkkKaayW.dll" [2008-07-10 02:58 29568]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\jkkKaayW]
    2008-07-10 02:58 29568 C:\WINDOWS\system32\jkkKaayW.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusOverride "=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe "=
    "C:\\Program Files\\Acer Inc\\Acer GridVista\\GridVistaU.exe "=
    "C:\\Program Files\\Grisoft\\AVG Free\\AVGCC.EXE "=
    "C:\\Program Files\\Grisoft\\AVG Free\\avgw.exe "=
    "C:\\Program Files\\Grisoft\\AVG Free\\avgvv.exe "=
    "C:\\Program Files\\eFax Messenger 4.2\\J2GPBook.exe "=
    "C:\\Program Files\\Hewlett-Packard\\Precisionscan Pro 3.1\\hpipcopy.exe "=
    "C:\\Program Files\\Hewlett-Packard\\HP Software Update\\HPWUCli.exe "=
    "C:\\Program Files\\Mozilla Firefox\\firefox.exe "=
    "C:\\HSH\\HBCS\\unins000.exe "=
    "C:\\Program Files\\TheWeatherNetwork\\WeatherEye\\WeatherEye.exe "=
    "C:\\Program Files\\AvRack\\rtlrack.exe "=

    R2 int15.sys;int15.sys;C:\Acer\Empowering Technology\eRecovery\int15.sys [2005-01-13 14:46]
    R3 SISNICXP;SiS PCI Fast Ethernet Adapter Driver for NDIS51;C:\WINDOWS\system32\DRIVERS\sisnicxp.sys [2004-11-05 01:43]
    S3 usbprint;Microsoft USB PRINTER Class;C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-03 23:01]

    .
    Contents of the 'Scheduled Tasks' folder
    "2008-07-15 17:10:08 C:\WINDOWS\Tasks\HP Usg Daily.job "
    - C:\Program Files\Hewlett-Packard\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\pexpress\hphped05.exe
    "2007-03-22 21:59:02 C:\WINDOWS\Tasks\MP Scheduled Quick Scan.job "
    - C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MpCmdRun.exe%Scan -RestrictPrivileges -ScanType 1
    "2008-07-15 14:49:28 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job "
    - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
    .
    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-07-15 23:49:12
    Windows 5.1.2600 Service Pack 2 FAT NTAPI

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0
    **************************************************************************
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    PROCESS: C:\WINDOWS\system32\winlogon.exe
    -> C:\WINDOWS\system32\jkkKaayW.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    C:\ACER\EMANAGER\ANBMSERV.EXE
    C:\PROGRAM FILES\COMMON FILES\APPLE\MOBILE DEVICE SUPPORT\BIN\APPLEMOBILEDEVICESERVICE.EXE
    C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGAMSVR.EXE
    C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGUPSVC.EXE
    C:\WINDOWS\SYSTEM32\HPZIPM12.EXE
    C:\WINDOWS\SYSTEM32\FXSSVC.EXE
    C:\WINDOWS\SYSTEM32\RUNDLL32.EXE
    C:\PROGRAM FILES\THEWEATHERNETWORK\WEATHEREYE\WEATHEREYE.EXE
    C:\PROGRAM FILES\IPOD\BIN\IPODSERVICE.EXE
    C:\WINDOWS\system32\imapi.exe
    .
    **************************************************************************
    .
    Completion time: 2008-07-15 23:55:37 - machine was rebooted
    ComboFix-quarantined-files.txt 2008-07-16 03:55:06
    ComboFix2.txt 2008-07-16 03:27:44

    Pre-Run: 9,516,580,864 bytes free
    Post-Run: 9,519,333,376 bytes free

    212 --- E O F --- 2008-07-10 07:03:50

    ComboFix 08-07-14.2 - andrew 2008-07-16 0:12:34.3 - FAT32x86
    Running from: C:\Documents and Settings\andrew\Desktop\ComboFix.exe

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    ((((((((((((((((((((((((( Files Created from 2008-06-16 to 2008-07-16 )))))))))))))))))))))))))))))))
    .

    2008-07-16 00:18 . 2008-07-16 00:18 322,304 --a------ C:\WINDOWS\system32\iifebbaX.dll
    2008-07-16 00:18 . 2008-07-16 00:18 347 --ahs---- C:\WINDOWS\system32\Xabbefii.ini2
    2008-07-16 00:18 . 2008-07-16 00:18 347 --ahs---- C:\WINDOWS\system32\Xabbefii.ini
    2008-07-15 23:21 . 2008-07-15 23:21 322,304 --a------ C:\WINDOWS\system32\ddcyyWMG.dll
    2008-07-15 14:01 . 2008-07-15 14:09 4,286 --a------ C:\WINDOWS\system32\tmp.reg
    2008-07-15 13:59 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
    2008-07-15 13:59 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
    2008-07-15 13:59 . 2008-05-29 09:35 86,528 --a------ C:\WINDOWS\system32\VACFix.exe
    2008-07-15 13:59 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe
    2008-07-15 13:59 . 2008-07-02 13:33 82,432 --a------ C:\WINDOWS\system32\IEDFix.C.exe
    2008-07-15 13:59 . 2008-05-23 18:21 81,920 --a------ C:\WINDOWS\system32\404Fix.exe
    2008-07-15 13:59 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
    2008-07-15 13:59 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
    2008-07-15 13:59 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
    2008-07-15 12:52 . 2008-07-15 12:52 <DIR> d--hs---- C:\FOUND.032
    2008-07-15 11:33 . 2008-07-15 11:33 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
    2008-07-15 11:32 . 2008-07-15 11:32 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
    2008-07-14 23:20 . 2008-07-14 23:20 2 --a------ C:\WINDOWS\msoffice.ini
    2008-07-14 18:09 . 2003-01-10 17:13 33,588 -ra------ C:\WINDOWS\system32\drivers\wanatw4.sys
    2008-07-14 16:15 . 2008-07-14 16:15 <DIR> d-------- C:\Program Files\Enigma Software Group
    2008-07-14 16:10 . 2008-07-14 16:10 <DIR> d-------- C:\Documents and Settings\andrew\Application Data\AOL
    2008-07-14 16:07 . 2008-07-14 16:07 <DIR> d-------- C:\Program Files\Common Files\Nullsoft
    2008-07-14 16:05 . 2008-07-14 16:05 <DIR> d-------- C:\Program Files\Viewpoint
    2008-07-14 16:05 . 2008-07-14 16:05 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Viewpoint
    2008-07-14 14:24 . 2008-07-14 14:24 <DIR> d-------- C:\Program Files\Common Files\AOL
    2008-07-14 14:24 . 2008-07-14 14:24 335 --a------ C:\WINDOWS\nsreg.dat
    2008-07-14 14:23 . 2008-07-14 14:23 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\AOL Downloads
    2008-07-14 14:23 . 2008-07-14 14:23 29 --a------ C:\WINDOWS\atid.ini
    2008-07-14 13:22 . 2008-07-14 13:22 <DIR> d--hs---- C:\FOUND.031
    2008-07-14 13:05 . 2008-07-14 13:24 354 ---hs---- C:\WINDOWS\system32\aetktdwv.ini
    2008-07-11 20:09 . 2008-07-11 20:09 <DIR> d--hs---- C:\FOUND.030
    2008-07-11 19:46 . 2008-07-11 19:46 <DIR> d-------- C:\Documents and Settings\andrew\Application Data\MSNInstaller
    2008-07-11 18:51 . 2008-07-11 18:51 <DIR> d-------- C:\Documents and Settings\Morgan\Application Data\TmpRecentIcons
    2008-07-11 18:51 . 2008-07-11 18:51 <DIR> d-------- C:\Documents and Settings\Grant\Application Data\TmpRecentIcons
    2008-07-11 11:55 . 2008-07-11 11:55 <DIR> d--hs---- C:\FOUND.029
    2008-07-10 20:14 . 2008-07-10 20:14 <DIR> d--hs---- C:\FOUND.028
    2008-07-10 03:04 . 2008-07-10 03:04 318,208 --a------ C:\WINDOWS\system32\cbXQjIXn.dll
    2008-07-10 02:58 . 2008-07-10 02:58 29,568 --a------ C:\WINDOWS\system32\yaywuvTL.dll
    2008-07-10 02:58 . 2008-07-10 02:58 29,568 --a------ C:\WINDOWS\system32\jkkKaayW.dll
    2008-07-10 02:58 . 2004-08-04 05:00 4,224 --a------ C:\WINDOWS\system32\beep.sys
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d-------- C:\Program Files\Realtek Sound Manager
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d-------- C:\Program Files\Common Files\PocketSoft
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d-------- C:\Program Files\AvRack
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d-------- C:\Program Files\Atari
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.009
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.008
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.007
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.006
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.005
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.004
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.003
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.002
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.001
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.000
    2008-07-05 20:44 . 2008-07-09 09:54 54,156 --ah----- C:\WINDOWS\QTFont.qfn
    2008-07-05 20:44 . 2008-07-05 20:45 1,409 --a------ C:\WINDOWS\QTFont.for
    2008-07-05 20:42 . 2008-07-05 20:42 <DIR> d-------- C:\Program Files\QuickTime(2)
    2008-06-21 19:54 . 2008-06-21 19:54 <DIR> d-------- C:\Documents and Settings\Morgan\Application Data\ooVoo Details
    2008-06-17 19:23 . 2008-06-17 19:23 <DIR> d-------- C:\Documents and Settings\Morgan\Application Data\FrostWire
    2008-06-17 19:19 . 2008-06-17 19:19 <DIR> d-------- C:\Program Files\FrostWire
    2008-06-17 19:19 . 2008-06-17 19:19 <DIR> d-------- C:\Program Files\AskSBar

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
    2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\dllcache\mswsock.dll
    2008-06-20 17:41 148,992 ----a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
    2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\dllcache\tcpip.sys
    2008-06-20 10:45 360,320 ------w C:\WINDOWS\system32\drivers\tcpip.sys
    2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\dllcache\afd.sys
    2008-06-20 10:44 138,368 ------w C:\WINDOWS\system32\drivers\afd.sys
    2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\dllcache\tcpip6.sys
    2008-06-20 09:52 225,920 ------w C:\WINDOWS\system32\drivers\tcpip6.sys
    2008-06-13 20:06 --------- d-----w C:\Documents and Settings\Grant\Application Data\LimeWire
    2008-06-13 13:10 272,128 ------w C:\WINDOWS\system32\drivers\bthport.sys
    2008-06-13 13:10 272,128 ------w C:\WINDOWS\system32\dllcache\bthport.sys
    2008-06-12 20:25 --------- d-----w C:\Documents and Settings\Grant\Application Data\uTorrent
    2008-06-11 16:09 --------- d-----w C:\Program Files\FBrowserAdvisor
    2008-05-08 12:28 202,752 ------w C:\WINDOWS\system32\dllcache\rmcast.sys
    2008-05-07 05:18 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
    2008-05-07 05:18 1,287,680 ------w C:\WINDOWS\system32\dllcache\quartz.dll
    2008-04-24 02:16 3,591,680 ------w C:\WINDOWS\system32\dllcache\mshtml.dll
    2008-04-22 07:40 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe
    2008-04-22 07:39 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe
    2008-04-22 07:39 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe
    2008-04-20 05:07 161,792 ------w C:\WINDOWS\system32\dllcache\ieakui.dll
    2004-08-04 09:00 94,784 --sh--w C:\WINDOWS\twain.dll
    2004-08-04 09:00 50,688 --sh--w C:\WINDOWS\twain_32.dll
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5DF5DA73-C225-415E-87CF-DBB698F8B2B4}]
    2008-07-15 23:21 322304 --a------ C:\WINDOWS\system32\ddcyyWMG.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{684BFE7F-F5B2-4AB3-A95E-EB5036A2D286}]
    2008-07-10 02:58 29568 --a------ C:\WINDOWS\system32\jkkKaayW.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9931248B-7B58-4797-B786-262DACBD6D95}]
    2008-07-16 00:18 322304 --a------ C:\WINDOWS\system32\iifebbaX.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E6DC6E97-E2D6-4654-9179-DBF79A0DB30F}]
    2008-07-10 03:04 318208 --a------ C:\WINDOWS\system32\cbXQjIXn.dll

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "WeatherEye "= "C:\Program Files\TheWeatherNetwork\WeatherEye\WeatherEye" [X]
    "ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 05:00 15360]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "LaunchApp "= "Alaunch" [X]
    "SynTPLpr "= "C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-10-07 23:44 98394]
    "SynTPEnh "= "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-10-07 23:43 688218]
    "SiS Windows KeyHook "= "C:\WINDOWS\system32\keyhook.exe" [2005-03-04 13:13 32768]
    "IMJPMIG8.1 "= "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 05:00 208952]
    "MSPY2002 "= "C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 05:00 59392]
    "PHIME2002ASync "= "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 05:00 455168]
    "PHIME2002A "= "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 05:00 455168]
    "eRecoveryService "= "C:\Acer\Empowering Technology\eRecovery\Monitor.exe" [2005-11-16 16:54 385024]
    "AVG7_CC "= "C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [2008-04-19 19:41 579584]
    "HPDJ Taskbar Utility "= "C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe" [2005-07-08 00:55 176128]
    "HPHUPD05 "= "C:\Program Files\Hewlett-Packard\\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\hphupd05.exe" [2005-07-08 00:55 49152]
    "HP Component Manager "= "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 08:38 241664]
    "HPHmon05 "= "C:\WINDOWS\system32\hphmon05.exe" [2005-07-08 00:55 491520]
    "eFax 4.2 "= "C:\Program Files\eFax Messenger 4.2\J2GDllCmd.exe" [2006-07-14 16:36 107008]
    "HP Software Update "= "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2007-05-08 16:24 54840]
    "Share-to-Web Namespace Daemon "= "C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" [2001-07-03 09:11 57344]
    "Acrobat Assistant 7.0 "= "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2008-04-23 02:08 483328]
    "iTunesHelper "= "C:\Program Files\iTunes\iTunesHelper.exe" [2007-11-02 18:36 267048]
    "SoundMan "= "SOUNDMAN.EXE" [2005-02-23 18:13 77824 C:\WINDOWS\SOUNDMAN.EXE]
    "AGRSMMSG "= "AGRSMMSG.exe" [2004-10-07 19:50 88363 C:\WINDOWS\AGRSMMSG.exe]
    "SiSPower "= "SiSPower.dll" [2005-02-25 19:35 49152 C:\WINDOWS\system32\SiSPower.dll]

    C:\Documents and Settings\andrew\Start Menu\Programs\Startup\
    Microsoft Office OneNote 2003 Quick Launch.lnk - C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE [2007-04-19 13:49:52 64864]
    DING!.lnk - C:\Program Files\Southwest Airlines\Ding\Ding.exe [2006-06-22 14:15:48 462848]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    Utility Tray.lnk - C:\WINDOWS\system32\sistray.exe [2005-01-04 16:52:52 331776]
    eFax 4.2.lnk - C:\Program Files\eFax Messenger 4.2\J2GTray.exe [2006-10-02 21:00:05 612352]
    Microsoft Office OneNote 2003 Quick Launch.lnk - C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE [2007-04-19 13:49:52 64864]
    Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26 29696]
    Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe [2007-04-06 15:54:09 25214]

    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    "{684BFE7F-F5B2-4AB3-A95E-EB5036A2D286} "= "C:\WINDOWS\system32\jkkKaayW.dll" [2008-07-10 02:58 29568]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\jkkKaayW]
    2008-07-10 02:58 29568 C:\WINDOWS\system32\jkkKaayW.dll

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
    Authentication Packages REG_MULTI_SZ msv1_0 C:\WINDOWS\system32\iifebbaX

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusOverride "=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe "=
    "C:\\Program Files\\Acer Inc\\Acer GridVista\\GridVistaU.exe "=
    "C:\\Program Files\\Grisoft\\AVG Free\\AVGCC.EXE "=
    "C:\\Program Files\\Grisoft\\AVG Free\\avgw.exe "=
    "C:\\Program Files\\Grisoft\\AVG Free\\avgvv.exe "=
    "C:\\Program Files\\eFax Messenger 4.2\\J2GPBook.exe "=
    "C:\\Program Files\\Hewlett-Packard\\Precisionscan Pro 3.1\\hpipcopy.exe "=
    "C:\\Program Files\\Hewlett-Packard\\HP Software Update\\HPWUCli.exe "=
    "C:\\Program Files\\Mozilla Firefox\\firefox.exe "=
    "C:\\HSH\\HBCS\\unins000.exe "=
    "C:\\Program Files\\TheWeatherNetwork\\WeatherEye\\WeatherEye.exe "=
    "C:\\Program Files\\AvRack\\rtlrack.exe "=

    R2 int15.sys;int15.sys;C:\Acer\Empowering Technology\eRecovery\int15.sys [2005-01-13 14:46]
    R3 SISNICXP;SiS PCI Fast Ethernet Adapter Driver for NDIS51;C:\WINDOWS\system32\DRIVERS\sisnicxp.sys [2004-11-05 01:43]
    S3 usbprint;Microsoft USB PRINTER Class;C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-03 23:01]

    *Newly Created Service* - CATCHME
    .
    Contents of the 'Scheduled Tasks' folder
    "2008-07-15 17:10:08 C:\WINDOWS\Tasks\HP Usg Daily.job "
    - C:\Program Files\Hewlett-Packard\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\pexpress\hphped05.exe
    "2007-03-22 21:59:02 C:\WINDOWS\Tasks\MP Scheduled Quick Scan.job "
    - C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MpCmdRun.exe%Scan -RestrictPrivileges -ScanType 1
    "2008-07-15 14:49:28 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job "
    - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
    .
    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-07-16 00:18:41
    Windows 5.1.2600 Service Pack 2 FAT NTAPI

    scanning hidden processes ...

    C:\WINDOWS\EXPLORER.EXE [3684] 0x8404CDA0

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0
     
    living life,
    #2


  3. to hide this advert.

  4. 2008/07/16
    living life

    living life Inactive Thread Starter

    Joined:
    2008/07/15
    Messages:
    74
    Likes Received:
    0
    continued part two

    I apologize, but the report is very long, this is the remainder.

    **************************************************************************
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    PROCESS: C:\WINDOWS\system32\winlogon.exe
    -> C:\WINDOWS\system32\jkkKaayW.dll

    PROCESS: C:\WINDOWS\explorer.exe
    -> C:\WINDOWS\system32\iifebbaX.dll
    .
    Completion time: 2008-07-16 0:23:16
    ComboFix-quarantined-files.txt 2008-07-16 04:22:58
    ComboFix3.txt 2008-07-16 03:27:44
    ComboFix2.txt 2008-07-16 03:55:46

    Pre-Run: 9,526,542,336 bytes free
    Post-Run: 9,514,483,712 bytes free

    201 --- E O F --- 2008-07-10 07:03:50


    ------------------------------------------------------------------------------
    KASPERSKY ONLINE SCANNER REPORT
    Wednesday, July 16, 2008 3:55:18 AM
    Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
    Kaspersky Online Scanner version: 5.0.98.0
    Kaspersky Anti-Virus database last update: 16/07/2008
    Kaspersky Anti-Virus database records: 958233
    -------------------------------------------------------------------------------

    Scan Settings:
    Scan using the following antivirus database: extended
    Scan Archives: true
    Scan Mail Bases: true

    Scan Target - My Computer:
    C:\
    D:\
    E:\

    Scan Statistics:
    Total number of scanned objects: 77047
    Number of viruses found: 34
    Number of infected objects: 131
    Number of suspicious objects: 0
    Duration of the scan process: 01:24:12

    Infected Object Name / Virus Name / Last Action
    C:\WINDOWS\system32\config\system.LOG Object is locked skipped
    C:\WINDOWS\system32\config\software.LOG Object is locked skipped
    C:\WINDOWS\system32\config\default.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
    C:\WINDOWS\system32\config\SECURITY Object is locked skipped
    C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped
    C:\WINDOWS\system32\config\SYSTEM Object is locked skipped
    C:\WINDOWS\system32\config\DEFAULT Object is locked skipped
    C:\WINDOWS\system32\config\SAM Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
    C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
    C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
    C:\WINDOWS\system32\h323log.txt Object is locked skipped
    C:\WINDOWS\system32\ddcyyWMG.dll Infected: Trojan.Win32.Monderb.gen skipped
    C:\WINDOWS\system32\iifebbaX.dll Infected: Trojan.Win32.Monderb.gen skipped
    C:\WINDOWS\system32\jkkKaayW.dll Infected: Trojan.Win32.Monderb.gen skipped
    C:\WINDOWS\system32\yaywuvTL.dll Infected: Trojan.Win32.Monderb.gen skipped
    C:\WINDOWS\system32\cbXQjIXn.dll Infected: Trojan.Win32.Monderb.gen skipped
    C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
    C:\WINDOWS\Downloaded Program Files\popcaploader.dll Infected: not-a-virus:Downloader.Win32.PopCap.b skipped
    C:\WINDOWS\Sti_Trace.log Object is locked skipped
    C:\WINDOWS\wiaservc.log Object is locked skipped
    C:\WINDOWS\wiadebug.log Object is locked skipped
    C:\WINDOWS\SchedLgU.Txt Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Windows NT\MSFax\ActivityLog\InboxLOG.txt Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Windows NT\MSFax\ActivityLog\OutboxLOG.txt Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
    C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
    C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\andrew\ntuser.dat.LOG Object is locked skipped
    C:\Documents and Settings\andrew\Local Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\andrew\Local Settings\History\History.IE5\MSHist012008071620080717\index.dat Object is locked skipped
    C:\Documents and Settings\andrew\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\andrew\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
    C:\Documents and Settings\andrew\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\andrew\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\andrew\Desktop\SmitfraudFix.zip/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
    C:\Documents and Settings\andrew\Desktop\SmitfraudFix.zip ZIP: infected - 1 skipped
    C:\Documents and Settings\andrew\Desktop\SmitfraudFix\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
    C:\Documents and Settings\andrew\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\andrew\ntuser.dat Object is locked skipped
    C:\Program Files\HP\hpcoretech\hpcmerr.log Object is locked skipped
    C:\Program Files\MSN Messenger\riched20.dll Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped
    C:\Program Files\MSN Messenger\msimg32.dll Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP279\A0036240.exe Infected: not-a-virus:AdWare.Win32.HotBar.ck skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP279\A0036243.dll Infected: not-a-virus:AdWare.Win32.HotBar.ck skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP279\A0036245.dll Infected: not-a-virus:AdWare.Win32.HotBar.ck skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP279\A0036251.dll Infected: not-a-virus:AdWare.Win32.HotBar.ck skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP279\A0036253.dll Infected: not-a-virus:AdWare.Win32.HotBar.ck skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP279\A0036264.dll Infected: not-a-virus:AdWare.Win32.HotBar.ck skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP279\A0036267.dll Infected: not-a-virus:AdWare.Win32.HotBar.ck skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP283\A0036625.dll Infected: not-a-virus:AdWare.Win32.Shopper.v skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP291\A0038226.dll Infected: not-a-virus:AdWare.Win32.Agent.atx skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP291\A0038227.dll Infected: not-a-virus:AdWare.Win32.Mirar.w skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP296\A0038812.dll Infected: not-a-virus:AdWare.Win32.Agent.atx skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP296\A0038815.exe Infected: not-a-virus:AdWare.Win32.Agent.jb skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP297\A0039940.dll Infected: not-a-virus:AdWare.Win32.Agent.atx skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP297\A0039943.exe Infected: not-a-virus:AdWare.Win32.Agent.jb skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP298\A0041039.dll Infected: not-a-virus:AdWare.Win32.Agent.atx skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP298\A0041042.exe Infected: not-a-virus:AdWare.Win32.Agent.jb skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP308\A0042628.dll Infected: not-a-virus:AdWare.Win32.Agent.atx skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP318\A0043992.exe Infected: not-a-virus:AdWare.Win32.Agent.jb skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045857.dll Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045858.scr Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045859.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.at skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045861.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.bc skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045862.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045863.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.af skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045864.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045865.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045866.SCR Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045867.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045868.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045869.EXE Infected: not-a-virus:AdTool.Win32.MyWebSearch.a skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045870.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.an skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045871.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.aq skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045872.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.bh skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045874.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.bc skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045875.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.ax skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045877.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.bc skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045879.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045880.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.as skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045881.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.ad skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045883.EXE Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045884.exe Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045885.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045886.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.i skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP328\A0045919.exe Infected: not-a-virus:AdWare.Win32.Agent.jb skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP328\A0045931.dll Infected: not-a-virus:AdWare.Win32.Agent.atx skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP328\A0045933.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.l skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP328\A0045934.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.bc skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP328\A0045935.EXE Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP328\A0045936.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP328\A0045945.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.as skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP335\A0046554.dll Infected: not-a-virus:AdTool.Win32.MyWebSearch.bc skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP335\A0046555.exe Infected: not-a-virus:FraudTool.Win32.Agent.u skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP335\A0046556.exe Infected: not-a-virus:FraudTool.Win32.Agent.u skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP335\A0046557.exe Infected: Trojan.Win32.Agent.tws skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP335\A0046558.exe Infected: not-a-virus:****-Downloader.Win32.Agent.v skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP335\A0047554.exe Infected: Trojan.Win32.Agent.tws skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP335\A0047555.exe Infected: not-a-virus:****-Downloader.Win32.Agent.v skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP335\A0047556.exe Infected: not-a-virus:FraudTool.Win32.Agent.u skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP335\A0047557.exe Infected: not-a-virus:FraudTool.Win32.Agent.u skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP335\A0048554.exe Infected: not-a-virus:FraudTool.Win32.Agent.u skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP336\A0048573.exe Infected: not-a-virus:FraudTool.Win32.Agent.u skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP336\A0048584.dll Infected: Trojan.Win32.Monderb.gen skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP336\A0048585.dll Infected: Trojan.Win32.Monderb.gen skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP338\A0049592.exe Infected: not-a-virus:FraudTool.Win32.Agent.u skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP338\A0049601.exe Infected: not-a-virus:FraudTool.Win32.Agent.u skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP338\A0049617.exe Infected: not-a-virus:FraudTool.Win32.Agent.u skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP339\A0049655.exe Infected: not-a-virus:FraudTool.Win32.Agent.u skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP339\A0049665.DLL Infected: Trojan.Win32.Monder.alx skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP339\A0049666.DLL Infected: Trojan.Win32.Monderb.gen skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP339\A0049667.dll Infected: Trojan.Win32.Monderb.gen skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP339\A0049687.exe Infected: not-a-virus:FraudTool.Win32.Agent.u skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP339\A0051703.dll Infected: Trojan.Win32.Monder.alx skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP339\A0057314.dll Infected: Rootkit.Win32.Podnuha.il skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP339\A0058315.dll Infected: Trojan.Win32.Vapsup.ico skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP339\A0058316.dll Infected: Trojan.Win32.Vapsup.idq skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP339\A0058317.dll Infected: Trojan.Win32.Vapsup.idp skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP339\A0058318.dll Infected: Trojan.Win32.Vapsup.ido skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP339\A0061314.dll Infected: Trojan.Win32.Monderb.gen skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP340\A0061336.exe Infected: not-a-virus:FraudTool.Win32.Agent.u skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP340\A0061337.exe Infected: not-a-virus:FraudTool.Win32.Agent.u skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP340\A0061338.exe Infected: Trojan.Win32.Agent.tws skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP340\A0061339.exe Infected: not-a-virus:****-Downloader.Win32.Agent.v skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP340\A0061343.exe Infected: Trojan.Win32.Vapsup.icu skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP340\A0061354.dll Infected: Trojan.Win32.Monderb.gen skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP340\A0061355.dll Infected: Trojan.Win32.Monderb.gen skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP340\A0061356.DLL Infected: Trojan.Win32.Monderb.gen skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP340\A0061357.dll Infected: Trojan.Win32.Monderb.gen skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP340\A0061358.dll Infected: Trojan.Win32.Monderb.gen skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP340\A0061359.dll Infected: Trojan.Win32.Monderb.gen skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP340\A0061361.dll Infected: Trojan.Win32.Monderb.gen skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP340\A0061362.dll Infected: Trojan.Win32.Monderb.gen skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP340\A0061363.dll Infected: Trojan.Win32.Monderb.gen skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP340\A0061364.dll Infected: Trojan.Win32.Monderb.gen skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP340\A0061365.dll Infected: Trojan.Win32.Monderb.gen skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP340\A0061366.dll Infected: Trojan.Win32.Monderb.gen skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP340\A0061367.dll Infected: Trojan.Win32.Monderb.gen skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP340\A0061372.exe Infected: Trojan.Win32.Vapsup.idn skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP342\change.log Object is locked skipped
    C:\QooBox\Quarantine\C\Program Files\PCHealthCenter\1.exe.vir Infected: not-a-virus:FraudTool.Win32.Agent.u skipped
    C:\QooBox\Quarantine\C\Program Files\PCHealthCenter\2.exe.vir Infected: not-a-virus:FraudTool.Win32.Agent.u skipped
    C:\QooBox\Quarantine\C\Program Files\PCHealthCenter\3.exe.vir Infected: Trojan.Win32.Agent.tws skipped
    C:\QooBox\Quarantine\C\Program Files\PCHealthCenter\4.exe.vir Infected: not-a-virus:****-Downloader.Win32.Agent.v skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\avhieg.dll.vir Infected: Trojan.Win32.Monderb.gen skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\ayjruo.dll.vir Infected: Trojan.Win32.Monderb.gen skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\CRIEVX.DLL.vir Infected: Trojan.Win32.Monderb.gen skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\faqzkn.dll.vir Infected: Trojan.Win32.Monderb.gen skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\isenubmb.dll.vir Infected: Trojan.Win32.Monderb.gen skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\pgutoydj.dll.vir Infected: Trojan.Win32.Monderb.gen skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\qxpqgveu.dll.vir Infected: Trojan.Win32.Monderb.gen skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\rilmiu.dll.vir Infected: Trojan.Win32.Monderb.gen skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\uabxikrd.dll.vir Infected: Trojan.Win32.Monderb.gen skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\umxiqirn.dll.vir Infected: Trojan.Win32.Monderb.gen skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\xggixlid.dll.vir Infected: Trojan.Win32.Monderb.gen skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\xnqjymjm.dll.vir Infected: Trojan.Win32.Monderb.gen skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\ypoqww.dll.vir Infected: Trojan.Win32.Monderb.gen skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\prnrwqmf.dll.vir Infected: Trojan.Win32.Monderb.gen skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\slvfjr.dll.vir Infected: Trojan.Win32.Monderb.gen skipped
    C:\QooBox\Quarantine\C\WINDOWS\gpefaowr.exe.vir Infected: Trojan.Win32.Vapsup.icu skipped
    C:\QooBox\Quarantine\C\WINDOWS\erem.exe.vir Infected: Trojan.Win32.Vapsup.idn skipped
    C:\QooBox\Quarantine\catchme2008-07-15_231741.87.zip/clbdll.dll Infected: Rootkit.Win32.Clbd.ey skipped
    C:\QooBox\Quarantine\catchme2008-07-15_231741.87.zip ZIP: infected - 1 skipped
    D:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP342\change.log Object is locked skipped

    Scan process completed.
     
    living life,
    #3
  5. 2008/07/16
    living life

    living life Inactive Thread Starter

    Joined:
    2008/07/15
    Messages:
    74
    Likes Received:
    0
    My HJT Logfile and Kapersky report and AVG report from this morning

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 04:42, on 16/07/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16674)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Acer\eManager\anbmServ.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\fxssvc.exe
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Acer\Empowering Technology\eRecovery\Monitor.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\WINDOWS\AGRSMMSG.exe
    C:\WINDOWS\system32\Rundll32.exe
    C:\WINDOWS\system32\keyhook.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
    C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
    C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
    C:\Program Files\eFax Messenger 4.2\J2GDllCmd.exe
    C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
    C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\TheWeatherNetwork\WeatherEye\WeatherEye.exe


    ------------------------------------------------------------------------------
    KASPERSKY ONLINE SCANNER REPORT
    Wednesday, July 16, 2008 3:55:18 AM
    Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
    Kaspersky Online Scanner version: 5.0.98.0
    Kaspersky Anti-Virus database last update: 16/07/2008
    Kaspersky Anti-Virus database records: 958233
    -------------------------------------------------------------------------------

    Scan Settings:
    Scan using the following antivirus database: extended
    Scan Archives: true
    Scan Mail Bases: true

    Scan Target - My Computer:
    C:\
    D:\
    E:\

    Scan Statistics:
    Total number of scanned objects: 77047
    Number of viruses found: 34
    Number of infected objects: 131
    Number of suspicious objects: 0
    Duration of the scan process: 01:24:12

    Infected Object Name / Virus Name / Last Action
    C:\WINDOWS\system32\config\system.LOG Object is locked skipped
    C:\WINDOWS\system32\config\software.LOG Object is locked skipped
    C:\WINDOWS\system32\config\default.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
    C:\WINDOWS\system32\config\SECURITY Object is locked skipped
    C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped
    C:\WINDOWS\system32\config\SYSTEM Object is locked skipped
    C:\WINDOWS\system32\config\DEFAULT Object is locked skipped
    C:\WINDOWS\system32\config\SAM Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
    C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
    C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
    C:\WINDOWS\system32\h323log.txt Object is locked skipped
    C:\WINDOWS\system32\ddcyyWMG.dll Infected: Trojan.Win32.Monderb.gen skipped
    C:\WINDOWS\system32\iifebbaX.dll Infected: Trojan.Win32.Monderb.gen skipped
    C:\WINDOWS\system32\jkkKaayW.dll Infected: Trojan.Win32.Monderb.gen skipped
    C:\WINDOWS\system32\yaywuvTL.dll Infected: Trojan.Win32.Monderb.gen skipped
    C:\WINDOWS\system32\cbXQjIXn.dll Infected: Trojan.Win32.Monderb.gen skipped
    C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
    C:\WINDOWS\Downloaded Program Files\popcaploader.dll Infected: not-a-virus:Downloader.Win32.PopCap.b skipped
    C:\WINDOWS\Sti_Trace.log Object is locked skipped
    C:\WINDOWS\wiaservc.log Object is locked skipped
    C:\WINDOWS\wiadebug.log Object is locked skipped
    C:\WINDOWS\SchedLgU.Txt Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Windows NT\MSFax\ActivityLog\InboxLOG.txt Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Windows NT\MSFax\ActivityLog\OutboxLOG.txt Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
    C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
    C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\andrew\ntuser.dat.LOG Object is locked skipped
    C:\Documents and Settings\andrew\Local Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\andrew\Local Settings\History\History.IE5\MSHist012008071620080717\index.dat Object is locked skipped
    C:\Documents and Settings\andrew\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\andrew\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
    C:\Documents and Settings\andrew\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\andrew\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\andrew\Desktop\SmitfraudFix.zip/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
    C:\Documents and Settings\andrew\Desktop\SmitfraudFix.zip ZIP: infected - 1 skipped
    C:\Documents and Settings\andrew\Desktop\SmitfraudFix\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
    C:\Documents and Settings\andrew\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\andrew\ntuser.dat Object is locked skipped
    C:\Program Files\HP\hpcoretech\hpcmerr.log Object is locked skipped
    C:\Program Files\MSN Messenger\riched20.dll Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped
    C:\Program Files\MSN Messenger\msimg32.dll Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP279\A0036240.exe Infected: not-a-virus:AdWare.Win32.HotBar.ck skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP279\A0036243.dll Infected: not-a-virus:AdWare.Win32.HotBar.ck skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP279\A0036245.dll Infected: not-a-virus:AdWare.Win32.HotBar.ck skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP279\A0036251.dll Infected: not-a-virus:AdWare.Win32.HotBar.ck skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP279\A0036253.dll Infected: not-a-virus:AdWare.Win32.HotBar.ck skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP279\A0036264.dll Infected: not-a-virus:AdWare.Win32.HotBar.ck skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP279\A0036267.dll Infected: not-a-virus:AdWare.Win32.HotBar.ck skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP283\A0036625.dll Infected: not-a-virus:AdWare.Win32.Shopper.v skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP291\A0038226.dll Infected: not-a-virus:AdWare.Win32.Agent.atx skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP291\A0038227.dll Infected: not-a-virus:AdWare.Win32.Mirar.w skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP296\A0038812.dll Infected: not-a-virus:AdWare.Win32.Agent.atx skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP296\A0038815.exe Infected: not-a-virus:AdWare.Win32.Agent.jb skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP297\A0039940.dll Infected: not-a-virus:AdWare.Win32.Agent.atx skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP297\A0039943.exe Infected: not-a-virus:AdWare.Win32.Agent.jb skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP298\A0041039.dll Infected: not-a-virus:AdWare.Win32.Agent.atx skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP298\A0041042.exe Infected: not-a-virus:AdWare.Win32.Agent.jb skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP308\A0042628.dll Infected: not-a-virus:AdWare.Win32.Agent.atx skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP318\A0043992.exe Infected: not-a-virus:AdWare.Win32.Agent.jb skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045857.dll Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045858.scr Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045859.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.at skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045861.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.bc skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045862.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045863.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.af skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045864.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045865.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045866.SCR Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045867.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045868.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045869.EXE Infected: not-a-virus:AdTool.Win32.MyWebSearch.a skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045870.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.an skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045871.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.aq skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045872.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.bh skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045874.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.bc skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045875.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.ax skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045877.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.bc skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045879.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045880.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.as skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045881.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.ad skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045883.EXE Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045884.exe Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045885.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045886.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.i skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP328\A0045919.exe Infected: not-a-virus:AdWare.Win32.Agent.jb skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP328\A0045931.dll Infected: not-a-virus:AdWare.Win32.Agent.atx skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP328\A0045933.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.l skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP328\A0045934.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.bc skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP328\A0045935.EXE Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP328\A0045936.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP328\A0045945.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.as skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP335\A0046554.dll Infected: not-a-virus:AdTool.Win32.MyWebSearch.bc skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP335\A0046555.exe Infected: not-a-virus:FraudTool.Win32.Agent.u skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP335\A0046556.exe Infected: not-a-virus:FraudTool.Win32.Agent.u skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP335\A0046557.exe Infected: Trojan.Win32.Agent.tws skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP335\A0046558.exe Infected: not-a-virus:****-Downloader.Win32.Agent.v skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP335\A0047554.exe Infected: Trojan.Win32.Agent.tws skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP335\A0047555.exe Infected: not-a-virus:****-Downloader.Win32.Agent.v skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP335\A0047556.exe Infected: not-a-virus:FraudTool.Win32.Agent.u skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP335\A0047557.exe Infected: not-a-virus:FraudTool.Win32.Agent.u skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP335\A0048554.exe Infected: not-a-virus:FraudTool.Win32.Agent.u skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP336\A0048573.exe Infected: not-a-virus:FraudTool.Win32.Agent.u skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP336\A0048584.dll Infected: Trojan.Win32.Monderb.gen skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP336\A0048585.dll Infected: Trojan.Win32.Monderb.gen skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP338\A0049592.exe Infected: not-a-virus:FraudTool.Win32.Agent.u skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP338\A0049601.exe Infected: not-a-virus:FraudTool.Win32.Agent.u skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP338\A0049617.exe Infected: not-a-virus:FraudTool.Win32.Agent.u skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP339\A0049655.exe Infected: not-a-virus:FraudTool.Win32.Agent.u skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP339\A0049665.DLL Infected: Trojan.Win32.Monder.alx skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP339\A0049666.DLL Infected: Trojan.Win32.Monderb.gen skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP339\A0049667.dll Infected: Trojan.Win32.Monderb.gen skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP339\A0049687.exe Infected: not-a-virus:FraudTool.Win32.Agent.u skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP339\A0051703.dll Infected: Trojan.Win32.Monder.alx skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP339\A0057314.dll Infected: Rootkit.Win32.Podnuha.il skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP339\A0058315.dll Infected: Trojan.Win32.Vapsup.ico skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP339\A0058316.dll Infected: Trojan.Win32.Vapsup.idq skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP339\A0058317.dll Infected: Trojan.Win32.Vapsup.idp skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP339\A0058318.dll Infected: Trojan.Win32.Vapsup.ido skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP339\A0061314.dll Infected: Trojan.Win32.Monderb.gen skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP340\A0061336.exe Infected: not-a-virus:FraudTool.Win32.Agent.u skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP340\A0061337.exe Infected: not-a-virus:FraudTool.Win32.Agent.u skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP340\A0061338.exe Infected: Trojan.Win32.Agent.tws skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP340\A0061339.exe Infected: not-a-virus:****-Downloader.Win32.Agent.v skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP340\A0061343.exe Infected: Trojan.Win32.Vapsup.icu skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP340\A0061354.dll Infected: Trojan.Win32.Monderb.gen skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP340\A0061355.dll Infected: Trojan.Win32.Monderb.gen skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP340\A0061356.DLL Infected: Trojan.Win32.Monderb.gen skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP340\A0061357.dll Infected: Trojan.Win32.Monderb.gen skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP340\A0061358.dll Infected: Trojan.Win32.Monderb.gen skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP340\A0061359.dll Infected: Trojan.Win32.Monderb.gen skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP340\A0061361.dll Infected: Trojan.Win32.Monderb.gen skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP340\A0061362.dll Infected: Trojan.Win32.Monderb.gen skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP340\A0061363.dll Infected: Trojan.Win32.Monderb.gen skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP340\A0061364.dll Infected: Trojan.Win32.Monderb.gen skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP340\A0061365.dll Infected: Trojan.Win32.Monderb.gen skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP340\A0061366.dll Infected: Trojan.Win32.Monderb.gen skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP340\A0061367.dll Infected: Trojan.Win32.Monderb.gen skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP340\A0061372.exe Infected: Trojan.Win32.Vapsup.idn skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP342\change.log Object is locked skipped
    C:\QooBox\Quarantine\C\Program Files\PCHealthCenter\1.exe.vir Infected: not-a-virus:FraudTool.Win32.Agent.u skipped
    C:\QooBox\Quarantine\C\Program Files\PCHealthCenter\2.exe.vir Infected: not-a-virus:FraudTool.Win32.Agent.u skipped
    C:\QooBox\Quarantine\C\Program Files\PCHealthCenter\3.exe.vir Infected: Trojan.Win32.Agent.tws skipped
    C:\QooBox\Quarantine\C\Program Files\PCHealthCenter\4.exe.vir Infected: not-a-virus:****-Downloader.Win32.Agent.v skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\avhieg.dll.vir Infected: Trojan.Win32.Monderb.gen skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\ayjruo.dll.vir Infected: Trojan.Win32.Monderb.gen skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\CRIEVX.DLL.vir Infected: Trojan.Win32.Monderb.gen skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\faqzkn.dll.vir Infected: Trojan.Win32.Monderb.gen skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\isenubmb.dll.vir Infected: Trojan.Win32.Monderb.gen skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\pgutoydj.dll.vir Infected: Trojan.Win32.Monderb.gen skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\qxpqgveu.dll.vir Infected: Trojan.Win32.Monderb.gen skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\rilmiu.dll.vir Infected: Trojan.Win32.Monderb.gen skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\uabxikrd.dll.vir Infected: Trojan.Win32.Monderb.gen skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\umxiqirn.dll.vir Infected: Trojan.Win32.Monderb.gen skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\xggixlid.dll.vir Infected: Trojan.Win32.Monderb.gen skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\xnqjymjm.dll.vir Infected: Trojan.Win32.Monderb.gen skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\ypoqww.dll.vir Infected: Trojan.Win32.Monderb.gen skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\prnrwqmf.dll.vir Infected: Trojan.Win32.Monderb.gen skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\slvfjr.dll.vir Infected: Trojan.Win32.Monderb.gen skipped
    C:\QooBox\Quarantine\C\WINDOWS\gpefaowr.exe.vir Infected: Trojan.Win32.Vapsup.icu skipped
    C:\QooBox\Quarantine\C\WINDOWS\erem.exe.vir Infected: Trojan.Win32.Vapsup.idn skipped
    C:\QooBox\Quarantine\catchme2008-07-15_231741.87.zip/clbdll.dll Infected: Rootkit.Win32.Clbd.ey skipped
    C:\QooBox\Quarantine\catchme2008-07-15_231741.87.zip ZIP: infected - 1 skipped
    D:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP342\change.log Object is locked skipped

    Scan process completed.


    Although things are working better and no popups today, after AVG did its update (something that it has not been able to do), it found a threat. This is the message

    While opening file: C:\WINDOWS\System32\iifebbaX.dll Virus found Vundo

    I appreciate all of your help.
     
    living life,
    #4
  6. 2008/07/16
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Welcome to WindowsBBS living life :)

    Please delete the ComboFix.exe you currently have and replace it with a fresh copy from here.


    Please disable realtime protection applications as they sometimes interfere with the tool. Check this link for your applicable programs.

    • Close all open programs and windows
    • Double click combofix.exe and follow the prompts.
    • It may reboot your computer and resume running when you logon. Wait for it to complete. When finished, it will open a log for you. Post that log and a new HijackThis log in your next reply.
    Note: Do not mouseclick combofix's window while its running. That may cause it to stall


    Once done, download Malwarebytes' Anti-Malware (MBAM) from here or here and save the file to your desktop.

    Double click mbam-setup.exe to install the application.
    • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
    • If an update is found, it will download and install the latest version.
    • Once the program has loaded, select 'Perform Quick Scan', then click Scan.
    • The scan may take some time to finish,so please be patient.
    • When the scan is complete, click OK, then Show Results to view the results.
    • Make sure that everything is checked, and click Remove Selected.
    • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note below)
    • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
    • Post the entire report in another reply along with a fresh HijackThis log.

    Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.
     
    noahdfear,
    #5
  7. 2008/07/17
    living life

    living life Inactive Thread Starter

    Joined:
    2008/07/15
    Messages:
    74
    Likes Received:
    0
    New reports

    Thank you so much for your quick response to my post. The following is the log from combofix and HijackThis. I assume that I am leaving the realtime protection off for the Malwarebyte process and will send the results from that shortly.

    ComboFix 08-07-15.4 - andrew 2008-07-17 10:05:43.4 - FAT32x86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.167 [GMT -4:00]
    Running from: C:\Documents and Settings\andrew\Desktop\ComboFix.exe
    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\WINDOWS\system32\ixwdrijl.dll
    C:\WINDOWS\system32\ljirdwxi.ini
    C:\WINDOWS\system32\pfwncx.dll
    C:\WINDOWS\system32\upgdevkn.dll
    C:\WINDOWS\system32\Xabbefii.ini
    C:\WINDOWS\system32\Xabbefii.ini2

    .
    ((((((((((((((((((((((((( Files Created from 2008-06-17 to 2008-07-17 )))))))))))))))))))))))))))))))
    .

    2008-07-17 01:05 . 2008-07-17 10:10 0 --a------ C:\$bootcln.sch
    2008-07-16 10:24 . 2008-07-16 10:25 72,944,878 --a------ C:\SYM_REGISTRY_BACKUP.reg
    2008-07-16 04:41 . 2008-07-16 04:41 <DIR> d-------- C:\Program Files\Trend Micro
    2008-07-15 14:01 . 2008-07-15 14:09 4,286 --a------ C:\WINDOWS\system32\tmp.reg
    2008-07-15 13:59 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
    2008-07-15 13:59 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
    2008-07-15 13:59 . 2008-05-29 09:35 86,528 --a------ C:\WINDOWS\system32\VACFix.exe
    2008-07-15 13:59 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe
    2008-07-15 13:59 . 2008-07-02 13:33 82,432 --a------ C:\WINDOWS\system32\IEDFix.C.exe
    2008-07-15 13:59 . 2008-05-23 18:21 81,920 --a------ C:\WINDOWS\system32\404Fix.exe
    2008-07-15 13:59 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
    2008-07-15 13:59 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
    2008-07-15 13:59 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
    2008-07-15 12:52 . 2008-07-15 12:52 <DIR> d--hs---- C:\FOUND.032
    2008-07-15 11:33 . 2008-07-15 11:33 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
    2008-07-15 11:32 . 2008-07-15 11:32 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
    2008-07-14 23:20 . 2008-07-14 23:20 2 --a------ C:\WINDOWS\msoffice.ini
    2008-07-14 18:09 . 2003-01-10 17:13 33,588 -ra------ C:\WINDOWS\system32\drivers\wanatw4.sys
    2008-07-14 16:15 . 2008-07-14 16:15 <DIR> d-------- C:\Program Files\Enigma Software Group
    2008-07-14 16:10 . 2008-07-14 16:10 <DIR> d-------- C:\Documents and Settings\andrew\Application Data\AOL
    2008-07-14 16:07 . 2008-07-14 16:07 <DIR> d-------- C:\Program Files\Common Files\Nullsoft
    2008-07-14 16:05 . 2008-07-14 16:05 <DIR> d-------- C:\Program Files\Viewpoint
    2008-07-14 16:05 . 2008-07-14 16:05 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Viewpoint
    2008-07-14 14:24 . 2008-07-14 14:24 <DIR> d-------- C:\Program Files\Common Files\AOL
    2008-07-14 14:24 . 2008-07-14 14:24 335 --a------ C:\WINDOWS\nsreg.dat
    2008-07-14 14:23 . 2008-07-14 14:23 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\AOL Downloads
    2008-07-14 14:23 . 2008-07-14 14:23 29 --a------ C:\WINDOWS\atid.ini
    2008-07-14 13:22 . 2008-07-14 13:22 <DIR> d--hs---- C:\FOUND.031
    2008-07-14 13:05 . 2008-07-14 13:24 354 ---hs---- C:\WINDOWS\system32\aetktdwv.ini
    2008-07-11 20:09 . 2008-07-11 20:09 <DIR> d--hs---- C:\FOUND.030
    2008-07-11 19:46 . 2008-07-11 19:46 <DIR> d-------- C:\Documents and Settings\andrew\Application Data\MSNInstaller
    2008-07-11 18:51 . 2008-07-11 18:51 <DIR> d-------- C:\Documents and Settings\Morgan\Application Data\TmpRecentIcons
    2008-07-11 18:51 . 2008-07-11 18:51 <DIR> d-------- C:\Documents and Settings\Grant\Application Data\TmpRecentIcons
    2008-07-11 11:55 . 2008-07-11 11:55 <DIR> d--hs---- C:\FOUND.029
    2008-07-10 20:14 . 2008-07-10 20:14 <DIR> d--hs---- C:\FOUND.028
    2008-07-10 02:58 . 2004-08-04 05:00 4,224 --a------ C:\WINDOWS\system32\beep.sys
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d-------- C:\Program Files\Realtek Sound Manager
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d-------- C:\Program Files\Common Files\PocketSoft
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d-------- C:\Program Files\AvRack
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d-------- C:\Program Files\Atari
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.009
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.008
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.007
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.006
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.005
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.004
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.003
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.002
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.001
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.000
    2008-07-05 20:44 . 2008-07-09 09:54 54,156 --ah----- C:\WINDOWS\QTFont.qfn
    2008-07-05 20:44 . 2008-07-05 20:45 1,409 --a------ C:\WINDOWS\QTFont.for
    2008-07-05 20:42 . 2008-07-05 20:42 <DIR> d-------- C:\Program Files\QuickTime(2)
    2008-06-21 19:54 . 2008-06-21 19:54 <DIR> d-------- C:\Documents and Settings\Morgan\Application Data\ooVoo Details
    2008-06-17 19:23 . 2008-06-17 19:23 <DIR> d-------- C:\Documents and Settings\Morgan\Application Data\FrostWire
    2008-06-17 19:19 . 2008-06-17 19:19 <DIR> d-------- C:\Program Files\FrostWire
    2008-06-17 19:19 . 2008-06-17 19:19 <DIR> d-------- C:\Program Files\AskSBar

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
    2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\dllcache\mswsock.dll
    2008-06-20 17:41 148,992 ----a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
    2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\dllcache\tcpip.sys
    2008-06-20 10:45 360,320 ------w C:\WINDOWS\system32\drivers\tcpip.sys
    2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\dllcache\afd.sys
    2008-06-20 10:44 138,368 ------w C:\WINDOWS\system32\drivers\afd.sys
    2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\dllcache\tcpip6.sys
    2008-06-20 09:52 225,920 ------w C:\WINDOWS\system32\drivers\tcpip6.sys
    2008-06-13 20:06 --------- d-----w C:\Documents and Settings\Grant\Application Data\LimeWire
    2008-06-13 13:10 272,128 ------w C:\WINDOWS\system32\drivers\bthport.sys
    2008-06-13 13:10 272,128 ------w C:\WINDOWS\system32\dllcache\bthport.sys
    2008-06-12 20:25 --------- d-----w C:\Documents and Settings\Grant\Application Data\uTorrent
    2008-06-11 16:09 --------- d-----w C:\Program Files\FBrowserAdvisor
    2008-05-08 12:28 202,752 ------w C:\WINDOWS\system32\dllcache\rmcast.sys
    2008-05-07 05:18 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
    2008-05-07 05:18 1,287,680 ------w C:\WINDOWS\system32\dllcache\quartz.dll
    2008-04-24 02:16 3,591,680 ------w C:\WINDOWS\system32\dllcache\mshtml.dll
    2008-04-22 07:40 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe
    2008-04-22 07:39 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe
    2008-04-22 07:39 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe
    2008-04-20 05:07 161,792 ------w C:\WINDOWS\system32\dllcache\ieakui.dll
    2004-08-04 09:00 94,784 --sh--w C:\WINDOWS\twain.dll
    2004-08-04 09:00 50,688 --sh--w C:\WINDOWS\twain_32.dll
    .

    ((((((((((((((((((((((((((((( snapshot@2008-07-15_23.26.40.31 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2007-09-03 13:14:10 578,848 ----a-w C:\WINDOWS\Downloaded Program Files\tgctlsr.dll
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "WeatherEye "= "C:\Program Files\TheWeatherNetwork\WeatherEye\WeatherEye" [X]
    "ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 05:00 15360]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "LaunchApp "= "Alaunch" [X]
    "SynTPLpr "= "C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-10-07 23:44 98394]
    "SynTPEnh "= "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-10-07 23:43 688218]
    "SiS Windows KeyHook "= "C:\WINDOWS\system32\keyhook.exe" [2005-03-04 13:13 32768]
    "IMJPMIG8.1 "= "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 05:00 208952]
    "MSPY2002 "= "C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 05:00 59392]
    "PHIME2002ASync "= "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 05:00 455168]
    "PHIME2002A "= "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 05:00 455168]
    "eRecoveryService "= "C:\Acer\Empowering Technology\eRecovery\Monitor.exe" [2005-11-16 16:54 385024]
    "AVG7_CC "= "C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [2008-04-19 19:41 579584]
    "HPDJ Taskbar Utility "= "C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe" [2005-07-08 00:55 176128]
    "HPHUPD05 "= "C:\Program Files\Hewlett-Packard\\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\hphupd05.exe" [2005-07-08 00:55 49152]
    "HP Component Manager "= "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 08:38 241664]
    "HPHmon05 "= "C:\WINDOWS\system32\hphmon05.exe" [2005-07-08 00:55 491520]
    "eFax 4.2 "= "C:\Program Files\eFax Messenger 4.2\J2GDllCmd.exe" [2006-07-14 16:36 107008]
    "HP Software Update "= "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2007-05-08 16:24 54840]
    "Share-to-Web Namespace Daemon "= "C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" [2001-07-03 09:11 57344]
    "Acrobat Assistant 7.0 "= "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2008-04-23 02:08 483328]
    "iTunesHelper "= "C:\Program Files\iTunes\iTunesHelper.exe" [2007-11-02 18:36 267048]
    "320d18a1 "= "C:\WINDOWS\system32\ixwdrijl.dll" [BU]
    "SoundMan "= "SOUNDMAN.EXE" [2005-02-23 18:13 77824 C:\WINDOWS\SOUNDMAN.EXE]
    "AGRSMMSG "= "AGRSMMSG.exe" [2004-10-07 19:50 88363 C:\WINDOWS\AGRSMMSG.exe]
    "SiSPower "= "SiSPower.dll" [2005-02-25 19:35 49152 C:\WINDOWS\system32\SiSPower.dll]

    C:\Documents and Settings\andrew\Start Menu\Programs\Startup\
    Microsoft Office OneNote 2003 Quick Launch.lnk - C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE [2007-04-19 13:49:52 64864]
    DING!.lnk - C:\Program Files\Southwest Airlines\Ding\Ding.exe [2006-06-22 14:15:48 462848]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    Utility Tray.lnk - C:\WINDOWS\system32\sistray.exe [2005-01-04 16:52:52 331776]
    eFax 4.2.lnk - C:\Program Files\eFax Messenger 4.2\J2GTray.exe [2006-10-02 21:00:05 612352]
    Microsoft Office OneNote 2003 Quick Launch.lnk - C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE [2007-04-19 13:49:52 64864]
    Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26 29696]
    Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe [2007-04-06 15:54:09 25214]

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusOverride "=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe "=
    "C:\\Program Files\\Acer Inc\\Acer GridVista\\GridVistaU.exe "=
    "C:\\Program Files\\Grisoft\\AVG Free\\AVGCC.EXE "=
    "C:\\Program Files\\Grisoft\\AVG Free\\avgw.exe "=
    "C:\\Program Files\\Grisoft\\AVG Free\\avgvv.exe "=
    "C:\\Program Files\\eFax Messenger 4.2\\J2GPBook.exe "=
    "C:\\Program Files\\Hewlett-Packard\\Precisionscan Pro 3.1\\hpipcopy.exe "=
    "C:\\Program Files\\Hewlett-Packard\\HP Software Update\\HPWUCli.exe "=
    "C:\\HSH\\HBCS\\unins000.exe "=
    "C:\\Program Files\\TheWeatherNetwork\\WeatherEye\\WeatherEye.exe "=
    "C:\\Program Files\\AvRack\\rtlrack.exe "=

    R2 int15.sys;int15.sys;C:\Acer\Empowering Technology\eRecovery\int15.sys [2005-01-13 14:46]
    R3 SISNICXP;SiS PCI Fast Ethernet Adapter Driver for NDIS51;C:\WINDOWS\system32\DRIVERS\sisnicxp.sys [2004-11-05 01:43]
    S3 usbprint;Microsoft USB PRINTER Class;C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-03 23:01]
    .
    Contents of the 'Scheduled Tasks' folder
    "2008-07-17 13:47:10 C:\WINDOWS\Tasks\HP Usg Daily.job "
    - C:\Program Files\Hewlett-Packard\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\pexpress\hphped05.exe
    "2007-03-22 21:59:02 C:\WINDOWS\Tasks\MP Scheduled Quick Scan.job "
    - C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MpCmdRun.exe%Scan -RestrictPrivileges -ScanType 1
    "2008-07-15 14:49:28 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job "
    - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
    .
    - - - - ORPHANS REMOVED - - - -

    BHO-{5DF5DA73-C225-415E-87CF-DBB698F8B2B4} - C:\WINDOWS\system32\ddcyyWMG.dll
    BHO-{684BFE7F-F5B2-4AB3-A95E-EB5036A2D286} - C:\WINDOWS\system32\jkkKaayW.dll
    BHO-{A859FD2D-CD0E-4B3E-BAFA-8DE980DEF320} - C:\WINDOWS\system32\iifebbaX.dll
    BHO-{E6DC6E97-E2D6-4654-9179-DBF79A0DB30F} - C:\WINDOWS\system32\cbXQjIXn.dll
    ShellExecuteHooks-{684BFE7F-F5B2-4AB3-A95E-EB5036A2D286} - C:\WINDOWS\system32\jkkKaayW.dll
    Notify-jkkKaayW - jkkKaayW.dll


    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-07-17 10:10:50
    Windows 5.1.2600 Service Pack 2 FAT NTAPI

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    ------------------------ Other Running Processes ------------------------
    .
    C:\ACER\EMANAGER\ANBMSERV.EXE
    C:\PROGRAM FILES\COMMON FILES\APPLE\MOBILE DEVICE SUPPORT\BIN\APPLEMOBILEDEVICESERVICE.EXE
    C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGAMSVR.EXE
    C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGUPSVC.EXE
    C:\WINDOWS\SYSTEM32\HPZIPM12.EXE
    C:\WINDOWS\SYSTEM32\FXSSVC.EXE
    C:\WINDOWS\SYSTEM32\RUNDLL32.EXE
    C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGCC.EXE
    C:\Program Files\TheWeatherNetwork\WeatherEye\WeatherEye.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Acrobat_sl.exe
    .
    **************************************************************************
    .
    Completion time: 2008-07-17 10:13:13 - machine was rebooted
    ComboFix-quarantined-files.txt 2008-07-17 14:13:08
    ComboFix4.txt 2008-07-16 03:27:44
    ComboFix3.txt 2008-07-16 03:55:46
    ComboFix2.txt 2008-07-16 04:23:20

    Pre-Run: 9,382,428,672 bytes free
    Post-Run: 9,372,860,416 bytes free

    214 --- E O F --- 2008-07-10 07:03:50


    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 10:14, on 17/07/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16674)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Acer\eManager\anbmServ.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    C:\WINDOWS\system32\HPZipm12.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\fxssvc.exe
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\WINDOWS\AGRSMMSG.exe
    C:\WINDOWS\system32\Rundll32.exe
    C:\WINDOWS\system32\keyhook.exe
    C:\Acer\Empowering Technology\eRecovery\Monitor.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
    C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
    C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
    C:\WINDOWS\system32\hphmon05.exe
    C:\Program Files\eFax Messenger 4.2\J2GDllCmd.exe
    C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
    C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\TheWeatherNetwork\WeatherEye\WeatherEye.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\system32\sistray.exe
    C:\Program Files\eFax Messenger 4.2\J2GTray.exe
    C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
    C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Acrobat_sl.exe
    C:\Program Files\Southwest Airlines\Ding\Ding.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\explorer.exe
    C:\WINDOWS\system32\notepad.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.windowsbbs.com/removing-spyware-viruses/74817-malware-blocking-programs-urls.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Live Search
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Live Search
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = Internet Explorer: Get It Now
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
    O4 - HKLM\..\Run: [LaunchApp] Alaunch
    O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
    O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
    O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
    O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
    O4 - HKLM\..\Run: [HPHUPD05] C:\Program Files\Hewlett-Packard\\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\hphupd05.exe
    O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe "
    O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\system32\hphmon05.exe
    O4 - HKLM\..\Run: [eFax 4.2] "C:\Program Files\eFax Messenger 4.2\J2GDllCmd.exe" /R
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
    O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe "
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
    O4 - HKLM\..\Run: [320d18a1] rundll32.exe "C:\WINDOWS\system32\ixwdrijl.dll ",b
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [WeatherEye] C:\Program Files\TheWeatherNetwork\WeatherEye\WeatherEye
    O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
    O4 - Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
    O4 - Startup: DING!.lnk = C:\Program Files\Southwest Airlines\Ding\Ding.exe
    O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
    O4 - Global Startup: eFax 4.2.lnk = C:\Program Files\eFax Messenger 4.2\J2GTray.exe
    O4 - Global Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.nl/scanforvirus-en/kavwebscan_unicode.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
    O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
    O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - https://www-secure.symantec.com/techsupp/asa/ss/sa/sa_cabs/tgctlsr.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by120fd.bay120.hotmail.msn.com/resources/MsnPUpld.cab
    O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-CA/a-UNO1/GAME_UNO1.cab
    O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://gtroj73.spaces.live.com/PhotoUpload/MsnPUpld.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

    --
    End of file - 8882 bytes
     
    living life,
    #6
  8. 2008/07/17
    living life

    living life Inactive Thread Starter

    Joined:
    2008/07/15
    Messages:
    74
    Likes Received:
    0
    Second set of reports

    That went fast and well. Malware found 32 infected files and removed them without a problem. Below are the latest HijackThis log and the log from MBAM.
    I am now turning on the realtime protection application. This morning when I turned on my pc, there was a prompt to download updates from Microsoft, would I assume that it is safe now?

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 10:33, on 17/07/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16674)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Acer\eManager\anbmServ.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    C:\WINDOWS\system32\HPZipm12.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\fxssvc.exe
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\WINDOWS\AGRSMMSG.exe
    C:\WINDOWS\system32\Rundll32.exe
    C:\WINDOWS\system32\keyhook.exe
    C:\Acer\Empowering Technology\eRecovery\Monitor.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
    C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
    C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
    C:\WINDOWS\system32\hphmon05.exe
    C:\Program Files\eFax Messenger 4.2\J2GDllCmd.exe
    C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
    C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\TheWeatherNetwork\WeatherEye\WeatherEye.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\system32\sistray.exe
    C:\Program Files\eFax Messenger 4.2\J2GTray.exe
    C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
    C:\Program Files\Southwest Airlines\Ding\Ding.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\internet explorer\iexplore.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.windowsbbs.com/removing-spyware-viruses/74817-malware-blocking-programs-urls.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Live Search
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Live Search
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = Internet Explorer: Get It Now
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
    O4 - HKLM\..\Run: [LaunchApp] Alaunch
    O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
    O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
    O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
    O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
    O4 - HKLM\..\Run: [HPHUPD05] C:\Program Files\Hewlett-Packard\\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\hphupd05.exe
    O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe "
    O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\system32\hphmon05.exe
    O4 - HKLM\..\Run: [eFax 4.2] "C:\Program Files\eFax Messenger 4.2\J2GDllCmd.exe" /R
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
    O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe "
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [WeatherEye] C:\Program Files\TheWeatherNetwork\WeatherEye\WeatherEye
    O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
    O4 - Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
    O4 - Startup: DING!.lnk = C:\Program Files\Southwest Airlines\Ding\Ding.exe
    O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
    O4 - Global Startup: eFax 4.2.lnk = C:\Program Files\eFax Messenger 4.2\J2GTray.exe
    O4 - Global Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.nl/scanforvirus-en/kavwebscan_unicode.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
    O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
    O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - https://www-secure.symantec.com/techsupp/asa/ss/sa/sa_cabs/tgctlsr.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by120fd.bay120.hotmail.msn.com/resources/MsnPUpld.cab
    O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-CA/a-UNO1/GAME_UNO1.cab
    O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://gtroj73.spaces.live.com/PhotoUpload/MsnPUpld.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

    --
    End of file - 8669 bytes

    Malwarebytes' Anti-Malware 1.20
    Database version: 960
    Windows 5.1.2600 Service Pack 2

    10:32:24 AM 17/07/2008
    mbam-log-7-17-2008 (10-32-24).txt

    Scan type: Quick Scan
    Objects scanned: 49817
    Time elapsed: 4 minute(s), 14 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 29
    Registry Values Infected: 1
    Registry Data Items Infected: 0
    Folders Infected: 1
    Files Infected: 1

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    HKEY_CLASSES_ROOT\AppID\{40b2127e-cc18-37d0-43ca-afa158c64001} (Adware.BHO) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\browsingenhancer.pornpro_bho (Adware.BHO) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\browsingenhancer.pornpro_bho.1 (Adware.BHO) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\browsingenhancer.precachebrowserhost (Adware.BHO) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\browsingenhancer.precachebrowserhost.1 (Adware.BHO) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{96fdc0f6-929e-e96c-597f-386cd3c7d7aa} (Adware.BHO) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{125e9d24-2428-38d2-8e23-804e3275209c} (Adware.BHO) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{3f2579e9-ec37-3112-9bde-d2db14e95c32} (Adware.BHO) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{e12688ce-9384-28e3-a041-4e1a9ce14506} (Adware.BHO) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Typelib\{98d555cc-a569-43fb-2f43-3a98ccda4b50} (Adware.BHO) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\browsingenhancer.browserwatcher (Adware.BHO) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\browsingenhancer.browserwatcher.1 (Adware.BHO) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{b056fd59-0c72-3878-da81-4c5239908200} (Adware.BHO) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{18b843ee-ce5c-4f1a-b2d1-48cc4afaf4a8} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Typelib\{d4251691-3955-49d8-b59b-c50ee8cac586} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{8109fd3d-d891-4f80-8339-50a4913ace6f} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8109fd3d-d891-4f80-8339-50a4913ace6f} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{85e06077-c824-43d0-a8dc-5efb17bc348a} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Typelib\{5937cd7f-1c0b-41e1-9075-60ebdf3c7d34} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{a4730ebe-43a6-443e-9776-36915d323ad3} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{2e9937fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{741de825-a6f0-4497-9aa6-8023cf9b0fff} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\AppID\BrowsingEnhancer.DLL (Adware.Agent) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\sqvgnrpx.bbst (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> Quarantined and deleted successfully.

    Registry Values Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\320d18a1 (Trojan.Vundo) -> Quarantined and deleted successfully.

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    C:\Program Files\FBrowserAdvisor (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.

    Files Infected:
    C:\regxpcom.exe (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
     
    living life,
    #7
  9. 2008/07/17
    living life

    living life Inactive Thread Starter

    Joined:
    2008/07/15
    Messages:
    74
    Likes Received:
    0
    Follow up test and reports

    When I went to turn on my realtime protection I decided to look in my virus vault and saw the infected files still sitting in there. I deleted them and then ran another MBAM scan and another HijackThis log. Below are the results.

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 10:49, on 17/07/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16674)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Acer\eManager\anbmServ.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    C:\WINDOWS\system32\HPZipm12.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\fxssvc.exe
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\WINDOWS\AGRSMMSG.exe
    C:\WINDOWS\system32\Rundll32.exe
    C:\WINDOWS\system32\keyhook.exe
    C:\Acer\Empowering Technology\eRecovery\Monitor.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
    C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
    C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
    C:\WINDOWS\system32\hphmon05.exe
    C:\Program Files\eFax Messenger 4.2\J2GDllCmd.exe
    C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
    C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\TheWeatherNetwork\WeatherEye\WeatherEye.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\system32\sistray.exe
    C:\Program Files\eFax Messenger 4.2\J2GTray.exe
    C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
    C:\Program Files\Southwest Airlines\Ding\Ding.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\internet explorer\iexplore.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.windowsbbs.com/removing-spyware-viruses/74817-malware-blocking-programs-urls.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Live Search
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Live Search
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = Internet Explorer: Get It Now
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
    O4 - HKLM\..\Run: [LaunchApp] Alaunch
    O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
    O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
    O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
    O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
    O4 - HKLM\..\Run: [HPHUPD05] C:\Program Files\Hewlett-Packard\\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\hphupd05.exe
    O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe "
    O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\system32\hphmon05.exe
    O4 - HKLM\..\Run: [eFax 4.2] "C:\Program Files\eFax Messenger 4.2\J2GDllCmd.exe" /R
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
    O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe "
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [WeatherEye] C:\Program Files\TheWeatherNetwork\WeatherEye\WeatherEye
    O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
    O4 - Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
    O4 - Startup: DING!.lnk = C:\Program Files\Southwest Airlines\Ding\Ding.exe
    O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
    O4 - Global Startup: eFax 4.2.lnk = C:\Program Files\eFax Messenger 4.2\J2GTray.exe
    O4 - Global Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.nl/scanforvirus-en/kavwebscan_unicode.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
    O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
    O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - https://www-secure.symantec.com/techsupp/asa/ss/sa/sa_cabs/tgctlsr.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by120fd.bay120.hotmail.msn.com/resources/MsnPUpld.cab
    O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-CA/a-UNO1/GAME_UNO1.cab
    O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://gtroj73.spaces.live.com/PhotoUpload/MsnPUpld.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

    --
    End of file - 8669 bytes

    Malwarebytes' Anti-Malware 1.20
    Database version: 960
    Windows 5.1.2600 Service Pack 2

    10:47:50 AM 17/07/2008
    mbam-log-7-17-2008 (10-47-50).txt

    Scan type: Quick Scan
    Objects scanned: 49878
    Time elapsed: 4 minute(s), 5 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 0

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    (No malicious items detected)
     
    living life,
    #8
  10. 2008/07/17
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Looks great! Lets get another opinion. Please scan with Kaspersky WebScanner

    You will be promted to install an ActiveX component from Kaspersky, Click Yes.
    • The program will launch and then begin downloading the latest definition files:
    • Once the files have been downloaded click on NEXT
    • Now click on Scan Settings
    • In the scan settings make that the following are selected:
      • Scan using the following Anti-Virus database:
      • Extended (if available otherwise Standard)
      • Scan Options:
      • Scan Archives
        Scan Mail Bases
    • Click OK
    • Now under select a target to scan:
      • Select My Computer
    • This will program will start and scan your system.
    • The scan will take a while so be patient and let it run.
    • Once the scan is complete it will display if your system has been infected.
      • Now click on the Save as Text button:
    • Save the file to your desktop.

    Post the Kaspersky log here.
     
    noahdfear,
    #9
  11. 2008/07/18
    living life

    living life Inactive Thread Starter

    Joined:
    2008/07/15
    Messages:
    74
    Likes Received:
    0
    Kapersky and new HijackThis

    I was a little surprised to see this, considering that I ran a Malware and AVG this morning and they showed clean. The results are posted below. I don't understand what is locked?

    -------------------------------------------------------------------------------
    KASPERSKY ONLINE SCANNER REPORT
    Friday, July 18, 2008 3:19:25 PM
    Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
    Kaspersky Online Scanner version: 5.0.98.0
    Kaspersky Anti-Virus database last update: 18/07/2008
    Kaspersky Anti-Virus database records: 969432
    -------------------------------------------------------------------------------

    Scan Settings:
    Scan using the following antivirus database: extended
    Scan Archives: true
    Scan Mail Bases: true

    Scan Target - My Computer:
    C:\
    D:\
    E:\

    Scan Statistics:
    Total number of scanned objects: 80701
    Number of viruses found: 33
    Number of infected objects: 118
    Number of suspicious objects: 0
    Duration of the scan process: 01:28:14

    Infected Object Name / Virus Name / Last Action
    C:\WINDOWS\system32\config\system.LOG Object is locked skipped
    C:\WINDOWS\system32\config\software.LOG Object is locked skipped
    C:\WINDOWS\system32\config\default.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
    C:\WINDOWS\system32\config\SECURITY Object is locked skipped
    C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped
    C:\WINDOWS\system32\config\SYSTEM Object is locked skipped
    C:\WINDOWS\system32\config\DEFAULT Object is locked skipped
    C:\WINDOWS\system32\config\SAM Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
    C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
    C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
    C:\WINDOWS\system32\h323log.txt Object is locked skipped
    C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
    C:\WINDOWS\Downloaded Program Files\popcaploader.dll Infected: not-a-virus:Downloader.Win32.PopCap.b skipped
    C:\WINDOWS\SoftwareDistribution\EventCache\{D83B4526-FB6B-4843-B470-9C2943D111A7}.bin Object is locked skipped
    C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
    C:\WINDOWS\Sti_Trace.log Object is locked skipped
    C:\WINDOWS\wiaservc.log Object is locked skipped
    C:\WINDOWS\wiadebug.log Object is locked skipped
    C:\WINDOWS\WindowsUpdate.log Object is locked skipped
    C:\WINDOWS\SchedLgU.Txt Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Windows NT\MSFax\ActivityLog\InboxLOG.txt Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Windows NT\MSFax\ActivityLog\OutboxLOG.txt Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
    C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
    C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\andrew\ntuser.dat.LOG Object is locked skipped
    C:\Documents and Settings\andrew\Local Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\andrew\Local Settings\History\History.IE5\MSHist012008071820080719\index.dat Object is locked skipped
    C:\Documents and Settings\andrew\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\andrew\Local Settings\Temporary Internet Files\Content.IE5\F38CVEE8\600da4940f1951d4eede7e4da1d8b88d[1].flv Object is locked skipped
    C:\Documents and Settings\andrew\Local Settings\Temporary Internet Files\Content.IE5\F38CVEE8\b321958c77c34261bc0c82e98b55f306[1].flv Object is locked skipped
    C:\Documents and Settings\andrew\Local Settings\Temporary Internet Files\Content.IE5\3UXL2C3Q\bd0b835f701702b28c9829727de8fc82[1].flv Object is locked skipped
    C:\Documents and Settings\andrew\Local Settings\Temporary Internet Files\Content.IE5\MXXCDZZO\7bdb3b095a773662428b34bc35fff570[1].flv Object is locked skipped
    C:\Documents and Settings\andrew\Local Settings\Temporary Internet Files\Content.IE5\G4H8FDST\acd241fd887bd66342f5650db8d6532b[1].flv Object is locked skipped
    C:\Documents and Settings\andrew\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\andrew\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\andrew\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped
    C:\Documents and Settings\andrew\Local Settings\temp\ mon004.log Object is locked skipped
    C:\Documents and Settings\andrew\Desktop\SmitfraudFix.zip/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
    C:\Documents and Settings\andrew\Desktop\SmitfraudFix.zip ZIP: infected - 1 skipped
    C:\Documents and Settings\andrew\Desktop\SmitfraudFix\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
    C:\Documents and Settings\andrew\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\andrew\ntuser.dat Object is locked skipped
    C:\Program Files\HP\hpcoretech\hpcmerr.log Object is locked skipped
    C:\Program Files\MSN Messenger\riched20.dll Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped
    C:\Program Files\MSN Messenger\msimg32.dll Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP279\A0036240.exe Infected: not-a-virus:AdWare.Win32.HotBar.ck skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP279\A0036243.dll Infected: not-a-virus:AdWare.Win32.HotBar.ck skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP279\A0036245.dll Infected: not-a-virus:AdWare.Win32.HotBar.ck skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP279\A0036251.dll Infected: not-a-virus:AdWare.Win32.HotBar.ck skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP279\A0036253.dll Infected: not-a-virus:AdWare.Win32.HotBar.ck skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP279\A0036264.dll Infected: not-a-virus:AdWare.Win32.HotBar.ck skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP279\A0036267.dll Infected: not-a-virus:AdWare.Win32.HotBar.ck skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP283\A0036625.dll Infected: not-a-virus:AdWare.Win32.Shopper.v skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP291\A0038226.dll Infected: not-a-virus:AdWare.Win32.Agent.atx skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP291\A0038227.dll Infected: not-a-virus:AdWare.Win32.Mirar.w skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP296\A0038812.dll Infected: not-a-virus:AdWare.Win32.Agent.atx skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP296\A0038815.exe Infected: not-a-virus:AdWare.Win32.Agent.jb skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP297\A0039940.dll Infected: not-a-virus:AdWare.Win32.Agent.atx skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP297\A0039943.exe Infected: not-a-virus:AdWare.Win32.Agent.jb skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP298\A0041039.dll Infected: not-a-virus:AdWare.Win32.Agent.atx skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP298\A0041042.exe Infected: not-a-virus:AdWare.Win32.Agent.jb skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP308\A0042628.dll Infected: not-a-virus:AdWare.Win32.Agent.atx skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP318\A0043992.exe Infected: not-a-virus:AdWare.Win32.Agent.jb skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045857.dll Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045858.scr Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045859.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.at skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045861.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.bc skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045862.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045863.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.af skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045864.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045865.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045866.SCR Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045867.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045868.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045869.EXE Infected: not-a-virus:AdTool.Win32.MyWebSearch.a skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045870.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.an skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045871.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.aq skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045872.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.bh skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045874.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.bc skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045875.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.ax skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045877.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.bc skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045879.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045880.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.as skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045881.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.ad skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045883.EXE Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045884.exe Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045885.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP327\A0045886.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.i skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP328\A0045919.exe Infected: not-a-virus:AdWare.Win32.Agent.jb skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP328\A0045931.dll Infected: not-a-virus:AdWare.Win32.Agent.atx skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP328\A0045933.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.l skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP328\A0045934.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.bc skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP328\A0045935.EXE Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP328\A0045936.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP328\A0045945.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.as skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP335\A0046554.dll Infected: not-a-virus:AdTool.Win32.MyWebSearch.bc skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP335\A0046555.exe Infected: not-a-virus:FraudTool.Win32.Agent.u skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP335\A0046556.exe Infected: not-a-virus:FraudTool.Win32.Agent.u skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP335\A0046557.exe Infected: Trojan.Win32.Agent.tws skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP335\A0046558.exe Infected: not-a-virus:****-Downloader.Win32.Agent.v skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP335\A0047554.exe Infected: Trojan.Win32.Agent.tws skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP335\A0047555.exe Infected: not-a-virus:****-Downloader.Win32.Agent.v skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP335\A0047556.exe Infected: not-a-virus:FraudTool.Win32.Agent.u skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP335\A0047557.exe Infected: not-a-virus:FraudTool.Win32.Agent.u skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP335\A0048554.exe Infected: not-a-virus:FraudTool.Win32.Agent.u skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP336\A0048573.exe Infected: not-a-virus:FraudTool.Win32.Agent.u skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP338\A0049592.exe Infected: not-a-virus:FraudTool.Win32.Agent.u skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP338\A0049601.exe Infected: not-a-virus:FraudTool.Win32.Agent.u skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP338\A0049617.exe Infected: not-a-virus:FraudTool.Win32.Agent.u skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP339\A0049655.exe Infected: not-a-virus:FraudTool.Win32.Agent.u skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP339\A0049687.exe Infected: not-a-virus:FraudTool.Win32.Agent.u skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP339\A0057314.dll Infected: Rootkit.Win32.Podnuha.il skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP339\A0058315.dll Infected: Trojan.Win32.Vapsup.ico skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP339\A0058317.dll Infected: Trojan.Win32.Vapsup.idp skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP339\A0058318.dll Infected: Trojan.Win32.Vapsup.ido skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP340\A0061336.exe Infected: not-a-virus:FraudTool.Win32.Agent.u skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP340\A0061337.exe Infected: not-a-virus:FraudTool.Win32.Agent.u skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP340\A0061338.exe Infected: Trojan.Win32.Agent.tws skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP340\A0061339.exe Infected: not-a-virus:****-Downloader.Win32.Agent.v skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP340\A0061343.exe Infected: Trojan.Win32.Vapsup.icu skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP340\A0061362.dll Infected: Trojan.Win32.Monderb.gen skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP340\A0061363.dll Infected: Trojan.Win32.Monderb.gen skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP340\A0061364.dll Infected: Trojan.Win32.Monderb.gen skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP340\A0061365.dll Infected: Trojan.Win32.Monderb.gen skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP340\A0061366.dll Infected: Trojan.Win32.Monderb.gen skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP340\A0061367.dll Infected: Trojan.Win32.Monderb.gen skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP340\A0061372.exe Infected: Trojan.Win32.Vapsup.idn skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP343\A0061594.dll Infected: Trojan.Win32.Monderb.gen skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP343\A0061595.dll Infected: Trojan.Win32.Monderb.gen skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP343\A0061596.dll Infected: Trojan.Win32.Monderb.gen skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP343\A0061597.dll Infected: Trojan.Win32.Monderb.gen skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP343\A0061598.dll Infected: Trojan.Win32.Monderb.gen skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP344\A0061685.dll Infected: Trojan.Win32.Monder.ama skipped
    C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP353\change.log Object is locked skipped
    C:\QooBox\Quarantine\C\Program Files\PCHealthCenter\1.exe.vir Infected: not-a-virus:FraudTool.Win32.Agent.u skipped
    C:\QooBox\Quarantine\C\Program Files\PCHealthCenter\2.exe.vir Infected: not-a-virus:FraudTool.Win32.Agent.u skipped
    C:\QooBox\Quarantine\C\Program Files\PCHealthCenter\3.exe.vir Infected: Trojan.Win32.Agent.tws skipped
    C:\QooBox\Quarantine\C\Program Files\PCHealthCenter\4.exe.vir Infected: not-a-virus:****-Downloader.Win32.Agent.v skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\avhieg.dll.vir Infected: Trojan.Win32.Monderb.gen skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\ayjruo.dll.vir Infected: Trojan.Win32.Monderb.gen skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\CRIEVX.DLL.vir Infected: Trojan.Win32.Monderb.gen skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\faqzkn.dll.vir Infected: Trojan.Win32.Monderb.gen skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\isenubmb.dll.vir Infected: Trojan.Win32.Monderb.gen skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\pgutoydj.dll.vir Infected: Trojan.Win32.Monderb.gen skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\qxpqgveu.dll.vir Infected: Trojan.Win32.Monderb.gen skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\rilmiu.dll.vir Infected: Trojan.Win32.Monderb.gen skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\uabxikrd.dll.vir Infected: Trojan.Win32.Monderb.gen skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\umxiqirn.dll.vir Infected: Trojan.Win32.Monderb.gen skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\xggixlid.dll.vir Infected: Trojan.Win32.Monderb.gen skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\xnqjymjm.dll.vir Infected: Trojan.Win32.Monderb.gen skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\ypoqww.dll.vir Infected: Trojan.Win32.Monderb.gen skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\prnrwqmf.dll.vir Infected: Trojan.Win32.Monderb.gen skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\slvfjr.dll.vir Infected: Trojan.Win32.Monderb.gen skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\ixwdrijl.dll.vir Infected: Trojan.Win32.Monder.ama skipped
    C:\QooBox\Quarantine\C\WINDOWS\gpefaowr.exe.vir Infected: Trojan.Win32.Vapsup.icu skipped
    C:\QooBox\Quarantine\C\WINDOWS\erem.exe.vir Infected: Trojan.Win32.Vapsup.idn skipped
    C:\QooBox\Quarantine\catchme2008-07-15_231741.87.zip/clbdll.dll Infected: Rootkit.Win32.Clbd.ey skipped
    C:\QooBox\Quarantine\catchme2008-07-15_231741.87.zip ZIP: infected - 1 skipped

    Scan process completed.

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 15:21, on 18/07/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16674)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Acer\eManager\anbmServ.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\fxssvc.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\WINDOWS\AGRSMMSG.exe
    C:\WINDOWS\system32\Rundll32.exe
    C:\WINDOWS\system32\keyhook.exe
    C:\Acer\Empowering Technology\eRecovery\Monitor.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
    C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
    C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
    C:\WINDOWS\system32\hphmon05.exe
    C:\Program Files\eFax Messenger 4.2\J2GDllCmd.exe
    C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
    C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\TheWeatherNetwork\WeatherEye\WeatherEye.exe
    C:\WINDOWS\system32\sistray.exe
    C:\Program Files\eFax Messenger 4.2\J2GTray.exe
    C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Southwest Airlines\Ding\Ding.exe
    C:\WINDOWS\system32\HPZipm12.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.windowsbbs.com/removing-spyware-viruses/74817-malware-blocking-programs-urls.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Live Search
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Live Search
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
    O4 - HKLM\..\Run: [LaunchApp] Alaunch
    O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
    O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
    O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
    O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
    O4 - HKLM\..\Run: [HPHUPD05] C:\Program Files\Hewlett-Packard\\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\hphupd05.exe
    O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe "
    O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\system32\hphmon05.exe
    O4 - HKLM\..\Run: [eFax 4.2] "C:\Program Files\eFax Messenger 4.2\J2GDllCmd.exe" /R
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
    O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe "
    O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [WeatherEye] C:\Program Files\TheWeatherNetwork\WeatherEye\WeatherEye
    O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
    O4 - Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
    O4 - Startup: DING!.lnk = C:\Program Files\Southwest Airlines\Ding\Ding.exe
    O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
    O4 - Global Startup: eFax 4.2.lnk = C:\Program Files\eFax Messenger 4.2\J2GTray.exe
    O4 - Global Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.nl/scanforvirus-en/kavwebscan_unicode.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
    O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
    O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - https://www-secure.symantec.com/techsupp/asa/ss/sa/sa_cabs/tgctlsr.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by120fd.bay120.hotmail.msn.com/resources/MsnPUpld.cab
    O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-CA/a-UNO1/GAME_UNO1.cab
    O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://gtroj73.spaces.live.com/PhotoUpload/MsnPUpld.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

    --
    End of file - 8675 bytes
     
    living life,
    #10
  12. 2008/07/18
    living life

    living life Inactive Thread Starter

    Joined:
    2008/07/15
    Messages:
    74
    Likes Received:
    0
    new avg report

    I realize that this isnt the best to view, but I decided to do another AVG and it found 34 threats. It moved 9 into the vault and deleted 25. Below is what is sitting in the vault now. I do not know how this compares to the other report, I hope that it is readable for you.

    Trojan horse BHO.O C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP340\A0061353.dll 7/18/2008 4:02:50 PM A0061353.dll
    Trojan horse BHO.ERV C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP340\A0061362.dll 7/18/2008 4:02:50 PM A0061362.dll
    Trojan horse Generic10.BCRA C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP340\A0061363.dll 7/18/2008 4:02:51 PM A0061363.dll
    Virus found Vundo C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP340\A0061364.dll 7/18/2008 4:02:51 PM A0061364.dll
    Trojan horse BHO.ERR C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP340\A0061365.dll 7/18/2008 4:02:51 PM A0061365.dll
    Trojan horse BHO.ERA C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP340\A0061366.dll 7/18/2008 4:02:51 PM A0061366.dll
    Trojan horse BHO.ERV C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP340\A0061367.dll 7/18/2008 4:02:51 PM A0061367.dll
    Trojan horse Downloader.Zlob.ZLY C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP340\A0061372.exe 7/18/2008 4:02:51 PM A0061372.exe
    Virus found Vundo C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP343\A0061594.dll 7/18/2008 4:02:51 PM A0061594.dll
    Virus found Vundo C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP343\A0061595.dll 7/18/2008 4:02:51 PM A0061595.dll
    Trojan horse Generic10.BBNI C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP343\A0061596.dll 7/18/2008 4:02:51 PM A0061596.dll
    Trojan horse Generic10.BBNI C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP343\A0061597.dll 7/18/2008 4:02:51 PM A0061597.dll
    Trojan horse Generic10.BBNW C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP343\A0061598.dll 7/18/2008 4:02:51 PM A0061598.dll
    Trojan horse Generic10.BEIS C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP344\A0061685.dll 7/18/2008 4:02:51 PM A0061685.dll
    Trojan horse BackDoor.Generic9.AZWO C:\QooBox\Quarantine\catchme2008-07-15_231741.87.zip 7/18/2008 4:02:51 PM catchme2008-07-15_231741.87.zip
    Trojan horse Downloader.Zlob.ZLY C:\QooBox\Quarantine\C\WINDOWS\erem.exe.vir 7/18/2008 4:02:51 PM erem.exe.vir
    Trojan horse BHO.O C:\QooBox\Quarantine\C\WINDOWS\system32\ddem.dll.vir 7/18/2008 4:02:51 PM ddem.dll.vir
    Trojan horse BHO.ERA C:\QooBox\Quarantine\C\WINDOWS\system32\avhieg.dll.vir 7/18/2008 4:02:52 PM avhieg.dll.vir
    Virus found Vundo C:\QooBox\Quarantine\C\WINDOWS\system32\ayjruo.dll.vir 7/18/2008 4:02:52 PM ayjruo.dll.vir
    Trojan horse BHO.ERR C:\QooBox\Quarantine\C\WINDOWS\system32\CRIEVX.DLL.vir 7/18/2008 4:02:52 PM CRIEVX.DLL.vir
    Trojan horse Generic10.BCRA C:\QooBox\Quarantine\C\WINDOWS\system32\faqzkn.dll.vir 7/18/2008 4:02:52 PM faqzkn.dll.vir
    Trojan horse BHO.ERV C:\QooBox\Quarantine\C\WINDOWS\system32\isenubmb.dll.vir 7/18/2008 4:02:52 PM isenubmb.dll.vir
    Trojan horse BHO.ERV C:\QooBox\Quarantine\C\WINDOWS\system32\pgutoydj.dll.vir 7/18/2008 4:02:52 PM pgutoydj.dll.vir
    Trojan horse BHO.ERU C:\QooBox\Quarantine\C\WINDOWS\system32\qwinqyrt.dll.vir 7/18/2008 4:02:52 PM qwinqyrt.dll.vir
    Virus found Vundo C:\QooBox\Quarantine\C\WINDOWS\system32\qxpqgveu.dll.vir 7/18/2008 4:02:52 PM qxpqgveu.dll.vir
    Trojan horse BHO.ERV C:\QooBox\Quarantine\C\WINDOWS\system32\rilmiu.dll.vir 7/18/2008 4:02:52 PM rilmiu.dll.vir
    Trojan horse Generic10.BCRA C:\QooBox\Quarantine\C\WINDOWS\system32\uabxikrd.dll.vir 7/18/2008 4:02:52 PM uabxikrd.dll.vir
    Virus found Vundo C:\QooBox\Quarantine\C\WINDOWS\system32\umxiqirn.dll.vir 7/18/2008 4:02:52 PM umxiqirn.dll.vir
    Trojan horse BHO.ERR C:\QooBox\Quarantine\C\WINDOWS\system32\xggixlid.dll.vir 7/18/2008 4:02:52 PM xggixlid.dll.vir
    Trojan horse BHO.ERA C:\QooBox\Quarantine\C\WINDOWS\system32\xnqjymjm.dll.vir 7/18/2008 4:02:52 PM xnqjymjm.dll.vir
    Trojan horse BHO.ERV C:\QooBox\Quarantine\C\WINDOWS\system32\ypoqww.dll.vir 7/18/2008 4:02:52 PM ypoqww.dll.vir
    Virus found Vundo C:\QooBox\Quarantine\C\WINDOWS\system32\prnrwqmf.dll.vir 7/18/2008 4:02:52 PM prnrwqmf.dll.vir
    Virus found Vundo C:\QooBox\Quarantine\C\WINDOWS\system32\slvfjr.dll.vir 7/18/2008 4:02:52 PM slvfjr.dll.vir
    Trojan horse Generic10.BEIS C:\QooBox\Quarantine\C\WINDOWS\system32\ixwdrijl.dll.vir 7/18/2008 4:02:52 PM ixwdrijl.dll.vir
     
    living life,
    #11
  13. 2008/07/19
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Looks good. Click Start>Run and type ComboFix /u then hit Enter to uninstall ComboFix and remove the files it has quarantined. This action will also reset the System Restore points, removing the infected files there as well. The C:\Deckard's folder will also be removed. You can delete any logs that were created/saved too.

    Remove all quarantined items in AVG via the AVG interface.

    Download ATF Cleaner by Atribune and save it to your Desktop.
    • Double click ATF-Cleaner.exe to run the program.
    • Check the boxes to the left of:

      • Windows Temp
      • Current User Temp
      • All Users Temp
      • Temporary Internet Files
      • Prefetch
      • Java Cache
      • Recycle bin

    • The rest are optional - if you want it to remove everything check "Select All ".
    • Finally, click Empty Selected. When you get the "Done Cleaning" message, click OK.
    Reboot


    That should wrap things up. How's your computer performing now?
     
    noahdfear,
    #12
  14. 2008/07/21
    living life

    living life Inactive Thread Starter

    Joined:
    2008/07/15
    Messages:
    74
    Likes Received:
    0
    Perfect!

    I did all as you posted and ran another virus scan. It is clean. My pc works great and seems to be faster than before.
    The only question that I have is when I looked at the windows help menu and went to system restore, the furthest date that I can go back to is July 20. Not that there is a problem with that, but is it like that because of what the virus and clean up process had to do?

    I appreciate all of your efforts, you people are amazing. I would also suggest that everyone read your "USEFUL INFORMATION" article at the beginning of the post.

    Sincerely,
    Living Life
     
    living life,
    #13
  15. 2008/07/21
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    noahdfear,
    #14
  16. 2008/07/22
    living life

    living life Inactive Thread Starter

    Joined:
    2008/07/15
    Messages:
    74
    Likes Received:
    0
    Something strange happened!

    I noticed that whenever I opened IE it always opened up on runonce dot msn dot com. I didn't think much of it until my children told me that they had the VIRUS ALERT posted on beside their clock on their logins. They have not been on the computer since the virus showed up. I ran HiJack This and then ComboFix followed by Malware and then another HiJack This and then turned AVG resident shield back on. I never thought about their logins!
    I will post the other results in a new window.

    Oh, BTW, I had to reboot to remove some files during the Malware process

    ComboFix 08-07-21.2 - Grant 2008-07-22 22:26:26.6 - FAT32x86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.162 [GMT -4:00]
    Running from: C:\Documents and Settings\Grant\Desktop\Combo-Fix3.exe
    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    ((((((((((((((((((((((((( Files Created from 2008-06-23 to 2008-07-23 )))))))))))))))))))))))))))))))
    .

    2008-07-22 21:12 . 2008-07-22 21:12 <DIR> d-------- C:\Program Files\iPod
    2008-07-22 21:12 . 2008-07-22 21:12 <DIR> d-------- C:\Program Files\Bonjour
    2008-07-21 17:29 . 2007-07-12 02:22 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
    2008-07-20 22:45 . 2008-07-20 22:45 <DIR> d-------- C:\ComboFix
    2008-07-17 15:06 . 2008-07-17 15:06 <DIR> d-------- C:\Program Files\iTunes
    2008-07-17 15:04 . 2008-07-17 15:04 <DIR> d-------- C:\Program Files\QuickTime
    2008-07-17 10:26 . 2008-07-17 10:26 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-07-17 10:26 . 2008-07-17 10:26 <DIR> d-------- C:\Documents and Settings\andrew\Application Data\Malwarebytes
    2008-07-17 10:26 . 2008-07-17 10:26 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-07-17 10:26 . 2008-07-07 17:35 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
    2008-07-17 10:26 . 2008-07-07 17:35 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
    2008-07-17 01:05 . 2008-07-22 21:00 0 --a------ C:\$bootcln.sch
    2008-07-16 10:24 . 2008-07-16 10:25 72,944,878 --a------ C:\SYM_REGISTRY_BACKUP.reg
    2008-07-16 04:41 . 2008-07-16 04:41 <DIR> d-------- C:\Program Files\Trend Micro
    2008-07-15 14:01 . 2008-07-15 14:09 4,286 --a------ C:\WINDOWS\system32\tmp.reg
    2008-07-15 13:59 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
    2008-07-15 13:59 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
    2008-07-15 13:59 . 2008-05-29 09:35 86,528 --a------ C:\WINDOWS\system32\VACFix.exe
    2008-07-15 13:59 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe
    2008-07-15 13:59 . 2008-07-02 13:33 82,432 --a------ C:\WINDOWS\system32\IEDFix.C.exe
    2008-07-15 13:59 . 2008-05-23 18:21 81,920 --a------ C:\WINDOWS\system32\404Fix.exe
    2008-07-15 13:59 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
    2008-07-15 13:59 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
    2008-07-15 13:59 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
    2008-07-15 12:52 . 2008-07-15 12:52 <DIR> d--hs---- C:\FOUND.032
    2008-07-15 11:33 . 2008-07-15 11:33 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
    2008-07-15 11:32 . 2008-07-15 11:32 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
    2008-07-14 23:20 . 2008-07-14 23:20 2 --a------ C:\WINDOWS\msoffice.ini
    2008-07-14 18:09 . 2003-01-10 17:13 33,588 -ra------ C:\WINDOWS\system32\drivers\wanatw4.sys
    2008-07-14 16:15 . 2008-07-14 16:15 <DIR> d-------- C:\Program Files\Enigma Software Group
    2008-07-14 16:10 . 2008-07-14 16:10 <DIR> d-------- C:\Documents and Settings\andrew\Application Data\AOL
    2008-07-14 16:07 . 2008-07-14 16:07 <DIR> d-------- C:\Program Files\Common Files\Nullsoft
    2008-07-14 16:05 . 2008-07-14 16:05 <DIR> d-------- C:\Program Files\Viewpoint
    2008-07-14 16:05 . 2008-07-14 16:05 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Viewpoint
    2008-07-14 14:24 . 2008-07-14 14:24 <DIR> d-------- C:\Program Files\Common Files\AOL
    2008-07-14 14:24 . 2008-07-14 14:24 335 --a------ C:\WINDOWS\nsreg.dat
    2008-07-14 14:23 . 2008-07-14 14:23 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\AOL Downloads
    2008-07-14 14:23 . 2008-07-14 14:23 29 --a------ C:\WINDOWS\atid.ini
    2008-07-14 13:22 . 2008-07-14 13:22 <DIR> d--hs---- C:\FOUND.031
    2008-07-14 13:05 . 2008-07-14 13:24 354 ---hs---- C:\WINDOWS\system32\aetktdwv.ini
    2008-07-11 20:09 . 2008-07-11 20:09 <DIR> d--hs---- C:\FOUND.030
    2008-07-11 19:46 . 2008-07-11 19:46 <DIR> d-------- C:\Documents and Settings\andrew\Application Data\MSNInstaller
    2008-07-11 18:51 . 2008-07-11 18:51 <DIR> d-------- C:\Documents and Settings\Morgan\Application Data\TmpRecentIcons
    2008-07-11 18:51 . 2008-07-11 18:51 <DIR> d-------- C:\Documents and Settings\Grant\Application Data\TmpRecentIcons
    2008-07-11 11:55 . 2008-07-11 11:55 <DIR> d--hs---- C:\FOUND.029
    2008-07-10 20:14 . 2008-07-10 20:14 <DIR> d--hs---- C:\FOUND.028
    2008-07-10 02:58 . 2004-08-04 05:00 4,224 --a------ C:\WINDOWS\system32\beep.sys
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d-------- C:\Program Files\Realtek Sound Manager
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d-------- C:\Program Files\Common Files\PocketSoft
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d-------- C:\Program Files\AvRack
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d-------- C:\Program Files\Atari
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.009
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.008
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.007
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.006
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.005
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.004
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.003
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.002
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.001
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.000
    2008-07-05 20:44 . 2008-07-09 09:54 54,156 --ah----- C:\WINDOWS\QTFont.qfn
    2008-07-05 20:44 . 2008-07-05 20:45 1,409 --a------ C:\WINDOWS\QTFont.for
    2008-07-05 20:42 . 2008-07-05 20:42 <DIR> d-------- C:\Program Files\QuickTime(2)

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-06-21 23:54 --------- d-----w C:\Documents and Settings\Morgan\Application Data\ooVoo Details
    2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
    2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\dllcache\mswsock.dll
    2008-06-20 17:41 148,992 ----a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
    2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\dllcache\tcpip.sys
    2008-06-20 10:45 360,320 ------w C:\WINDOWS\system32\drivers\tcpip.sys
    2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\dllcache\afd.sys
    2008-06-20 10:44 138,368 ------w C:\WINDOWS\system32\drivers\afd.sys
    2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\dllcache\tcpip6.sys
    2008-06-20 09:52 225,920 ------w C:\WINDOWS\system32\drivers\tcpip6.sys
    2008-06-17 23:23 --------- d-----w C:\Documents and Settings\Morgan\Application Data\FrostWire
    2008-06-17 23:19 --------- d-----w C:\Program Files\FrostWire
    2008-06-17 23:19 --------- d-----w C:\Program Files\AskSBar
    2008-06-13 20:06 --------- d-----w C:\Documents and Settings\Grant\Application Data\LimeWire
    2008-06-13 13:10 272,128 ------w C:\WINDOWS\system32\drivers\bthport.sys
    2008-06-13 13:10 272,128 ------w C:\WINDOWS\system32\dllcache\bthport.sys
    2008-06-12 20:25 --------- d-----w C:\Documents and Settings\Grant\Application Data\uTorrent
    2008-05-08 12:28 202,752 ------w C:\WINDOWS\system32\dllcache\rmcast.sys
    2008-05-07 05:18 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
    2008-05-07 05:18 1,287,680 ------w C:\WINDOWS\system32\dllcache\quartz.dll
    2008-04-24 02:16 3,591,680 ------w C:\WINDOWS\system32\dllcache\mshtml.dll
    2004-08-04 09:00 94,784 --sh--w C:\WINDOWS\twain.dll
    2004-08-04 09:00 50,688 --sh--w C:\WINDOWS\twain_32.dll
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
    "{0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} "= "C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL" [2008-07-22 14:44 66912]

    [HKEY_CLASSES_ROOT\clsid\{0579b4b6-0293-4d73-b02d-5ebb0ba0f0a2}]

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2}]
    2008-07-22 14:44 66912 --a------ C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "QuickTime Task "= "C:\Program Files\QuickTime\qttask.exe" [2008-05-27 10:50 413696]
    "ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 05:00 15360]
    "MSMSGS "= "C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 12:24 1694208]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "LaunchApp "= "Alaunch" [X]
    "SynTPLpr "= "C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-10-07 23:44 98394]
    "SynTPEnh "= "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-10-07 23:43 688218]
    "SiS Windows KeyHook "= "C:\WINDOWS\system32\keyhook.exe" [2005-03-04 13:13 32768]
    "IMJPMIG8.1 "= "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 05:00 208952]
    "MSPY2002 "= "C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 05:00 59392]
    "PHIME2002ASync "= "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 05:00 455168]
    "PHIME2002A "= "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 05:00 455168]
    "eRecoveryService "= "C:\Acer\Empowering Technology\eRecovery\Monitor.exe" [2005-11-16 16:54 385024]
    "AVG7_CC "= "C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [2008-04-19 19:41 579584]
    "HPDJ Taskbar Utility "= "C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe" [2005-07-08 00:55 176128]
    "HPHUPD05 "= "C:\Program Files\Hewlett-Packard\\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\hphupd05.exe" [2005-07-08 00:55 49152]
    "HP Component Manager "= "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 08:38 241664]
    "HPHmon05 "= "C:\WINDOWS\system32\hphmon05.exe" [2005-07-08 00:55 491520]
    "eFax 4.2 "= "C:\Program Files\eFax Messenger 4.2\J2GDllCmd.exe" [2006-07-14 16:36 107008]
    "HP Software Update "= "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2007-05-08 16:24 54840]
    "Share-to-Web Namespace Daemon "= "C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" [2001-07-03 09:11 57344]
    "Acrobat Assistant 7.0 "= "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2008-04-23 02:08 483328]
    "AppleSyncNotifier "= "C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-10 09:47 116040]
    "SunJavaUpdateSched "= "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00 132496]
    "QuickTime Task "= "C:\Program Files\QuickTime\QTTask.exe" [2008-05-27 10:50 413696]
    "iTunesHelper "= "C:\Program Files\iTunes\iTunesHelper.exe" [2008-07-10 10:51 289064]
    "SoundMan "= "SOUNDMAN.EXE" [2005-02-23 18:13 77824 C:\WINDOWS\SOUNDMAN.EXE]
    "AGRSMMSG "= "AGRSMMSG.exe" [2004-10-07 19:50 88363 C:\WINDOWS\AGRSMMSG.exe]
    "SiSPower "= "SiSPower.dll" [2005-02-25 19:35 49152 C:\WINDOWS\system32\SiSPower.dll]

    C:\Documents and Settings\andrew\Start Menu\Programs\Startup\
    Microsoft Office OneNote 2003 Quick Launch.lnk - C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE [2007-04-19 13:49:52 64864]
    DING!.lnk - C:\Program Files\Southwest Airlines\Ding\Ding.exe [2006-06-22 14:15:48 462848]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    Utility Tray.lnk - C:\WINDOWS\system32\sistray.exe [2005-01-04 16:52:52 331776]
    eFax 4.2.lnk - C:\Program Files\eFax Messenger 4.2\J2GTray.exe [2006-10-02 21:00:05 612352]
    Microsoft Office OneNote 2003 Quick Launch.lnk - C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE [2007-04-19 13:49:52 64864]
    Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26 29696]
    Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe [2007-04-06 15:54:09 25214]

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusOverride "=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe "=
    "C:\\Program Files\\Acer Inc\\Acer GridVista\\GridVistaU.exe "=
    "C:\\Program Files\\Grisoft\\AVG Free\\AVGCC.EXE "=
    "C:\\Program Files\\Grisoft\\AVG Free\\avgw.exe "=
    "C:\\Program Files\\Grisoft\\AVG Free\\avgvv.exe "=
    "C:\\Program Files\\eFax Messenger 4.2\\J2GPBook.exe "=
    "C:\\Program Files\\Hewlett-Packard\\Precisionscan Pro 3.1\\hpipcopy.exe "=
    "C:\\Program Files\\Hewlett-Packard\\HP Software Update\\HPWUCli.exe "=
    "C:\\HSH\\HBCS\\unins000.exe "=
    "C:\\Program Files\\TheWeatherNetwork\\WeatherEye\\WeatherEye.exe "=
    "C:\\Program Files\\AvRack\\rtlrack.exe "=
    "C:\\Program Files\\Bonjour\\mDNSResponder.exe "=
    "C:\\Program Files\\iTunes\\iTunes.exe "=

    R2 int15.sys;int15.sys;C:\Acer\Empowering Technology\eRecovery\int15.sys [2005-01-13 14:46]
    R3 SISNICXP;SiS PCI Fast Ethernet Adapter Driver for NDIS51;C:\WINDOWS\system32\DRIVERS\sisnicxp.sys [2004-11-05 01:43]
    S3 usbprint;Microsoft USB PRINTER Class;C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-03 23:01]

    *Newly Created Service* - BONJOUR_SERVICE
    *Newly Created Service* - INT15.SYS
    *Newly Created Service* - IPOD_SERVICE
    .
    Contents of the 'Scheduled Tasks' folder
    "2008-07-23 01:10:04 C:\WINDOWS\Tasks\HP Usg Daily.job "
    - C:\Program Files\Hewlett-Packard\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\pexpress\hphped05.exe
    "2007-03-22 21:59:02 C:\WINDOWS\Tasks\MP Scheduled Quick Scan.job "
    - C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MpCmdRun.exe%Scan -RestrictPrivileges -ScanType 1
    "2008-07-17 19:04:34 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job "
    - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
    .
    - - - - ORPHANS REMOVED - - - -

    HKCU-Run-swg - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    HKCU-Run-msnmsgr - C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
    HKCU-Run-Sys2.exe - C:\Windows\Sys2.exe


    .
    ------- Supplementary Scan -------
    .
    R0 -: HKCU-Main,Start Page = hxxp://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2
    R1 -: HKCU-Internet Connection Wizard,ShellNext = iexplore
    O8 -: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZCxdm801YYCA
    O8 -: Convert link target to Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 -: Convert link target to existing PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 -: Convert selected links to Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    O8 -: Convert selected links to existing PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    O8 -: Convert selection to Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 -: Convert selection to existing PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 -: Convert to Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 -: Convert to existing PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 -: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000


    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-07-22 22:29:05
    Windows 5.1.2600 Service Pack 2 FAT NTAPI

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2008-07-22 22:29:33
    ComboFix2.txt 2008-07-21 02:42:20
    ComboFix-quarantined-files.txt 2008-07-23 02:29:30

    Pre-Run: 10,396,237,824 bytes free
    Post-Run: 10,550,247,424 bytes free

    214 --- E O F --- 2008-07-17 21:33:12
     
    living life,
    #15
  17. 2008/07/22
    living life

    living life Inactive Thread Starter

    Joined:
    2008/07/15
    Messages:
    74
    Likes Received:
    0
    continued

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 22:34, on 22/07/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16674)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Acer\eManager\anbmServ.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\system32\HPZipm12.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\WINDOWS\AGRSMMSG.exe
    C:\WINDOWS\system32\Rundll32.exe
    C:\WINDOWS\system32\keyhook.exe
    C:\Acer\Empowering Technology\eRecovery\Monitor.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
    C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
    C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
    C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
    C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
    C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\WINDOWS\system32\sistray.exe
    C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
    C:\WINDOWS\explorer.exe
    C:\Program Files\internet explorer\iexplore.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = UltimateCleaner 2007
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Live Search
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Live Search
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com
    R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
    O2 - BHO: Ask Search Assistant BHO - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\2.bin\ASKSBAR.DLL
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
    O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\2.bin\ASKSBAR.DLL
    O4 - HKLM\..\Run: [LaunchApp] Alaunch
    O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
    O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
    O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
    O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
    O4 - HKLM\..\Run: [HPHUPD05] C:\Program Files\Hewlett-Packard\\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\hphupd05.exe
    O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe "
    O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\system32\hphmon05.exe
    O4 - HKLM\..\Run: [eFax 4.2] "C:\Program Files\eFax Messenger 4.2\J2GDllCmd.exe" /R
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
    O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe "
    O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe "
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
    O4 - HKCU\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-21-1390373911-496075936-1108429520-1006\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime (User 'Morgan')
    O4 - HKUS\S-1-5-21-1390373911-496075936-1108429520-1006\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'Morgan')
    O4 - HKUS\S-1-5-21-1390373911-496075936-1108429520-1006\..\Run: [WeatherDPA] "C:\Program Files\Zango\bin\10.3.37.0\Weather.exe" -auto (User 'Morgan')
    O4 - S-1-5-21-1390373911-496075936-1108429520-1006 Startup: RollerCoaster Tycoon 3 Registration.lnk = C:\Documents and Settings\Morgan\Local Settings\Temp\{8290D75F-AF9A-4CE3-81E5-6AB242F658A9}\{907B4640-266B-4A21-92FB-CD1A86CD0F63}\ATR1.exe (User 'Morgan')
    O4 - S-1-5-21-1390373911-496075936-1108429520-1006 User Startup: RollerCoaster Tycoon 3 Registration.lnk = C:\Documents and Settings\Morgan\Local Settings\Temp\{8290D75F-AF9A-4CE3-81E5-6AB242F658A9}\{907B4640-266B-4A21-92FB-CD1A86CD0F63}\ATR1.exe (User 'Morgan')
    O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
    O4 - Global Startup: eFax 4.2.lnk = C:\Program Files\eFax Messenger 4.2\J2GTray.exe
    O4 - Global Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
    O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZCxdm801YYCA
    O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.nl/scanforvirus-en/kavwebscan_unicode.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
    O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
    O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - https://www-secure.symantec.com/techsupp/asa/ss/sa/sa_cabs/tgctlsr.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by120fd.bay120.hotmail.msn.com/resources/MsnPUpld.cab
    O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-CA/a-UNO1/GAME_UNO1.cab
    O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://gtroj73.spaces.live.com/PhotoUpload/MsnPUpld.cab
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jinstall-6-windows-i586.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

    --
    End of file - 12116 bytes
    Malwarebytes' Anti-Malware 1.22
    Database version: 981
    Windows 5.1.2600 Service Pack 2

    10:41:49 PM 22/07/2008
    mbam-log-7-22-2008 (22-41-49).txt

    Scan type: Quick Scan
    Objects scanned: 50807
    Time elapsed: 4 minute(s), 5 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 1
    Registry Keys Infected: 12
    Registry Values Infected: 3
    Registry Data Items Infected: 1
    Folders Infected: 0
    Files Infected: 1

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    C:\Program Files\AskSBar\bar\2.bin\ASKSBAR.DLL (Adware.AskSBAR) -> Unloaded module successfully.

    Registry Keys Infected:
    HKEY_CLASSES_ROOT\TypeLib\{f0d4b230-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{f0d4b23a-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{f0d4b23c-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{b15fd82e-85bc-430d-90cb-65db1b030510} (Adware.AskSBAR) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{f0d4b231-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{f0d4b231-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{f0d4b23b-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{f0d4b23b-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> Quarantined and deleted successfully.

    Registry Values Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\MenuExt\&Search\ (Adware.Hotbar) -> Quarantined and deleted successfully.

    Registry Data Items Infected:
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page (Hijack.Homepage) -> Bad: (UltimateCleaner 2007) Good: (Google) -> Quarantined and deleted successfully.

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    C:\Program Files\AskSBar\bar\2.bin\ASKSBAR.DLL (Adware.AskSBAR) -> Delete on reboot.
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 22:45, on 22/07/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16674)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Acer\eManager\anbmServ.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\system32\HPZipm12.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\WINDOWS\AGRSMMSG.exe
    C:\WINDOWS\system32\Rundll32.exe
    C:\WINDOWS\system32\keyhook.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
    C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
    C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
    C:\WINDOWS\system32\hphmon05.exe
    C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
    C:\Acer\Empowering Technology\eRecovery\Monitor.exe
    C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
    C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
    C:\Program Files\Adobe\Acrobat 7.0\Distillr\AcroDist.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\WINDOWS\system32\sistray.exe
    C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
    C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Acrobat_sl.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Live Search
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Live Search
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com
    R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
    O2 - BHO: Ask Search Assistant BHO - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
    O4 - HKLM\..\Run: [LaunchApp] Alaunch
    O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
    O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
    O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
    O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
    O4 - HKLM\..\Run: [HPHUPD05] C:\Program Files\Hewlett-Packard\\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\hphupd05.exe
    O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe "
    O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\system32\hphmon05.exe
    O4 - HKLM\..\Run: [eFax 4.2] "C:\Program Files\eFax Messenger 4.2\J2GDllCmd.exe" /R
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
    O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe "
    O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe "
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
    O4 - HKCU\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
    O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
    O4 - Global Startup: eFax 4.2.lnk = C:\Program Files\eFax Messenger 4.2\J2GTray.exe
    O4 - Global Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
    O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.nl/scanforvirus-en/kavwebscan_unicode.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
    O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
    O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - https://www-secure.symantec.com/techsupp/asa/ss/sa/sa_cabs/tgctlsr.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by120fd.bay120.hotmail.msn.com/resources/MsnPUpld.cab
    O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-CA/a-UNO1/GAME_UNO1.cab
    O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://gtroj73.spaces.live.com/PhotoUpload/MsnPUpld.cab
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jinstall-6-windows-i586.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

    --
    End of file - 10810 bytes
     
    living life,
    #16
  18. 2008/07/22
    living life

    living life Inactive Thread Starter

    Joined:
    2008/07/15
    Messages:
    74
    Likes Received:
    0
    reports from third login

    This is the report from my other childs login

    ComboFix 08-07-21.2 - Morgan 2008-07-22 23:21:58.7 - FAT32x86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.121 [GMT -4:00]
    Running from: C:\Documents and Settings\Morgan\Desktop\ComboFix.exe

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    ((((((((((((((((((((((((( Files Created from 2008-06-23 to 2008-07-23 )))))))))))))))))))))))))))))))
    .

    2008-07-22 22:36 . 2008-07-22 22:36 <DIR> d-------- C:\Documents and Settings\Grant\Application Data\Malwarebytes
    2008-07-22 22:36 . 2008-07-20 20:21 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
    2008-07-22 21:12 . 2008-07-22 21:12 <DIR> d-------- C:\Program Files\iPod
    2008-07-22 21:12 . 2008-07-22 21:12 <DIR> d-------- C:\Program Files\Bonjour
    2008-07-21 17:29 . 2007-07-12 02:22 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
    2008-07-17 15:06 . 2008-07-17 15:06 <DIR> d-------- C:\Program Files\iTunes
    2008-07-17 15:04 . 2008-07-17 15:04 <DIR> d-------- C:\Program Files\QuickTime
    2008-07-17 10:26 . 2008-07-17 10:26 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-07-17 10:26 . 2008-07-17 10:26 <DIR> d-------- C:\Documents and Settings\andrew\Application Data\Malwarebytes
    2008-07-17 10:26 . 2008-07-17 10:26 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-07-17 10:26 . 2008-07-20 20:21 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
    2008-07-17 01:05 . 2008-07-22 23:15 0 --a------ C:\$bootcln.sch
    2008-07-16 10:24 . 2008-07-16 10:25 72,944,878 --a------ C:\SYM_REGISTRY_BACKUP.reg
    2008-07-16 04:41 . 2008-07-16 04:41 <DIR> d-------- C:\Program Files\Trend Micro
    2008-07-15 14:01 . 2008-07-15 14:09 4,286 --a------ C:\WINDOWS\system32\tmp.reg
    2008-07-15 13:59 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
    2008-07-15 13:59 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
    2008-07-15 13:59 . 2008-05-29 09:35 86,528 --a------ C:\WINDOWS\system32\VACFix.exe
    2008-07-15 13:59 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe
    2008-07-15 13:59 . 2008-07-02 13:33 82,432 --a------ C:\WINDOWS\system32\IEDFix.C.exe
    2008-07-15 13:59 . 2008-05-23 18:21 81,920 --a------ C:\WINDOWS\system32\404Fix.exe
    2008-07-15 13:59 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
    2008-07-15 13:59 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
    2008-07-15 13:59 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
    2008-07-15 12:52 . 2008-07-15 12:52 <DIR> d--hs---- C:\FOUND.032
    2008-07-15 11:33 . 2008-07-15 11:33 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
    2008-07-15 11:32 . 2008-07-15 11:32 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
    2008-07-14 23:20 . 2008-07-14 23:20 2 --a------ C:\WINDOWS\msoffice.ini
    2008-07-14 18:09 . 2003-01-10 17:13 33,588 -ra------ C:\WINDOWS\system32\drivers\wanatw4.sys
    2008-07-14 16:15 . 2008-07-14 16:15 <DIR> d-------- C:\Program Files\Enigma Software Group
    2008-07-14 16:10 . 2008-07-14 16:10 <DIR> d-------- C:\Documents and Settings\andrew\Application Data\AOL
    2008-07-14 16:07 . 2008-07-14 16:07 <DIR> d-------- C:\Program Files\Common Files\Nullsoft
    2008-07-14 16:05 . 2008-07-14 16:05 <DIR> d-------- C:\Program Files\Viewpoint
    2008-07-14 16:05 . 2008-07-14 16:05 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Viewpoint
    2008-07-14 14:24 . 2008-07-14 14:24 <DIR> d-------- C:\Program Files\Common Files\AOL
    2008-07-14 14:24 . 2008-07-14 14:24 335 --a------ C:\WINDOWS\nsreg.dat
    2008-07-14 14:23 . 2008-07-14 14:23 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\AOL Downloads
    2008-07-14 14:23 . 2008-07-14 14:23 29 --a------ C:\WINDOWS\atid.ini
    2008-07-14 13:22 . 2008-07-14 13:22 <DIR> d--hs---- C:\FOUND.031
    2008-07-14 13:05 . 2008-07-14 13:24 354 ---hs---- C:\WINDOWS\system32\aetktdwv.ini
    2008-07-11 20:09 . 2008-07-11 20:09 <DIR> d--hs---- C:\FOUND.030
    2008-07-11 19:46 . 2008-07-11 19:46 <DIR> d-------- C:\Documents and Settings\andrew\Application Data\MSNInstaller
    2008-07-11 18:51 . 2008-07-11 18:51 <DIR> d-------- C:\Documents and Settings\Morgan\Application Data\TmpRecentIcons
    2008-07-11 18:51 . 2008-07-11 18:51 <DIR> d-------- C:\Documents and Settings\Grant\Application Data\TmpRecentIcons
    2008-07-11 11:55 . 2008-07-11 11:55 <DIR> d--hs---- C:\FOUND.029
    2008-07-10 20:14 . 2008-07-10 20:14 <DIR> d--hs---- C:\FOUND.028
    2008-07-10 02:58 . 2004-08-04 05:00 4,224 --a------ C:\WINDOWS\system32\beep.sys
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d-------- C:\Program Files\Realtek Sound Manager
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d-------- C:\Program Files\Common Files\PocketSoft
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d-------- C:\Program Files\AvRack
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d-------- C:\Program Files\Atari
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.009
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.008
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.007
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.006
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.005
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.004
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.003
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.002
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.001
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.000
    2008-07-05 20:44 . 2008-07-09 09:54 54,156 --ah----- C:\WINDOWS\QTFont.qfn
    2008-07-05 20:44 . 2008-07-05 20:45 1,409 --a------ C:\WINDOWS\QTFont.for
    2008-07-05 20:42 . 2008-07-05 20:42 <DIR> d-------- C:\Program Files\QuickTime(2)

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-06-21 23:54 --------- d-----w C:\Documents and Settings\Morgan\Application Data\ooVoo Details
    2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
    2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\dllcache\mswsock.dll
    2008-06-20 17:41 148,992 ----a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
    2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\dllcache\tcpip.sys
    2008-06-20 10:45 360,320 ------w C:\WINDOWS\system32\drivers\tcpip.sys
    2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\dllcache\afd.sys
    2008-06-20 10:44 138,368 ------w C:\WINDOWS\system32\drivers\afd.sys
    2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\dllcache\tcpip6.sys
    2008-06-20 09:52 225,920 ------w C:\WINDOWS\system32\drivers\tcpip6.sys
    2008-06-17 23:23 --------- d-----w C:\Documents and Settings\Morgan\Application Data\FrostWire
    2008-06-17 23:19 --------- d-----w C:\Program Files\FrostWire
    2008-06-17 23:19 --------- d-----w C:\Program Files\AskSBar
    2008-06-13 20:06 --------- d-----w C:\Documents and Settings\Grant\Application Data\LimeWire
    2008-06-13 13:10 272,128 ------w C:\WINDOWS\system32\drivers\bthport.sys
    2008-06-13 13:10 272,128 ------w C:\WINDOWS\system32\dllcache\bthport.sys
    2008-06-12 20:25 --------- d-----w C:\Documents and Settings\Grant\Application Data\uTorrent
    2008-05-08 12:28 202,752 ------w C:\WINDOWS\system32\dllcache\rmcast.sys
    2008-05-07 05:18 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
    2008-05-07 05:18 1,287,680 ------w C:\WINDOWS\system32\dllcache\quartz.dll
    2008-04-24 02:16 3,591,680 ------w C:\WINDOWS\system32\dllcache\mshtml.dll
    2004-08-04 09:00 94,784 --sh--w C:\WINDOWS\twain.dll
    2004-08-04 09:00 50,688 --sh--w C:\WINDOWS\twain_32.dll
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
    "{0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} "= "C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL" [2008-07-22 14:44 66912]

    [HKEY_CLASSES_ROOT\clsid\{0579b4b6-0293-4d73-b02d-5ebb0ba0f0a2}]

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2}]
    2008-07-22 14:44 66912 --a------ C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "QuickTime Task "= "C:\Program Files\QuickTime\qttask.exe" [2008-05-27 10:50 413696]
    "ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 05:00 15360]
    "msnmsgr "= "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [BU]
    "swg "= "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [BU]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "LaunchApp "= "Alaunch" [X]
    "SynTPLpr "= "C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-10-07 23:44 98394]
    "SynTPEnh "= "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-10-07 23:43 688218]
    "SiS Windows KeyHook "= "C:\WINDOWS\system32\keyhook.exe" [2005-03-04 13:13 32768]
    "IMJPMIG8.1 "= "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 05:00 208952]
    "MSPY2002 "= "C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 05:00 59392]
    "PHIME2002ASync "= "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 05:00 455168]
    "PHIME2002A "= "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 05:00 455168]
    "eRecoveryService "= "C:\Acer\Empowering Technology\eRecovery\Monitor.exe" [2005-11-16 16:54 385024]
    "AVG7_CC "= "C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [2008-04-19 19:41 579584]
    "HPDJ Taskbar Utility "= "C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe" [2005-07-08 00:55 176128]
    "HPHUPD05 "= "C:\Program Files\Hewlett-Packard\\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\hphupd05.exe" [2005-07-08 00:55 49152]
    "HP Component Manager "= "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 08:38 241664]
    "HPHmon05 "= "C:\WINDOWS\system32\hphmon05.exe" [2005-07-08 00:55 491520]
    "eFax 4.2 "= "C:\Program Files\eFax Messenger 4.2\J2GDllCmd.exe" [2006-07-14 16:36 107008]
    "HP Software Update "= "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2007-05-08 16:24 54840]
    "Share-to-Web Namespace Daemon "= "C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" [2001-07-03 09:11 57344]
    "Acrobat Assistant 7.0 "= "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2008-04-23 02:08 483328]
    "AppleSyncNotifier "= "C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-10 09:47 116040]
    "SunJavaUpdateSched "= "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00 132496]
    "QuickTime Task "= "C:\Program Files\QuickTime\qttask.exe" [2008-05-27 10:50 413696]
    "iTunesHelper "= "C:\Program Files\iTunes\iTunesHelper.exe" [2008-07-10 10:51 289064]
    "SoundMan "= "SOUNDMAN.EXE" [2005-02-23 18:13 77824 C:\WINDOWS\SOUNDMAN.EXE]
    "AGRSMMSG "= "AGRSMMSG.exe" [2004-10-07 19:50 88363 C:\WINDOWS\AGRSMMSG.exe]
    "SiSPower "= "SiSPower.dll" [2005-02-25 19:35 49152 C:\WINDOWS\system32\SiSPower.dll]

    C:\Documents and Settings\andrew\Start Menu\Programs\Startup\
    Microsoft Office OneNote 2003 Quick Launch.lnk - C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE [2007-04-19 13:49:52 64864]
    DING!.lnk - C:\Program Files\Southwest Airlines\Ding\Ding.exe [2006-06-22 14:15:48 462848]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    Utility Tray.lnk - C:\WINDOWS\system32\sistray.exe [2005-01-04 16:52:52 331776]
    eFax 4.2.lnk - C:\Program Files\eFax Messenger 4.2\J2GTray.exe [2006-10-02 21:00:05 612352]
    Microsoft Office OneNote 2003 Quick Launch.lnk - C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE [2007-04-19 13:49:52 64864]
    Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26 29696]
    Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe [2007-04-06 15:54:09 25214]

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusOverride "=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe "=
    "C:\\Program Files\\Acer Inc\\Acer GridVista\\GridVistaU.exe "=
    "C:\\Program Files\\Grisoft\\AVG Free\\AVGCC.EXE "=
    "C:\\Program Files\\Grisoft\\AVG Free\\avgw.exe "=
    "C:\\Program Files\\Grisoft\\AVG Free\\avgvv.exe "=
    "C:\\Program Files\\eFax Messenger 4.2\\J2GPBook.exe "=
    "C:\\Program Files\\Hewlett-Packard\\Precisionscan Pro 3.1\\hpipcopy.exe "=
    "C:\\Program Files\\Hewlett-Packard\\HP Software Update\\HPWUCli.exe "=
    "C:\\HSH\\HBCS\\unins000.exe "=
    "C:\\Program Files\\TheWeatherNetwork\\WeatherEye\\WeatherEye.exe "=
    "C:\\Program Files\\AvRack\\rtlrack.exe "=
    "C:\\Program Files\\Bonjour\\mDNSResponder.exe "=
    "C:\\Program Files\\iTunes\\iTunes.exe "=

    R2 int15.sys;int15.sys;C:\Acer\Empowering Technology\eRecovery\int15.sys [2005-01-13 14:46]
    R3 SISNICXP;SiS PCI Fast Ethernet Adapter Driver for NDIS51;C:\WINDOWS\system32\DRIVERS\sisnicxp.sys [2004-11-05 01:43]
    S3 usbprint;Microsoft USB PRINTER Class;C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-03 23:01]

    *Newly Created Service* - INT15.SYS
    .
    Contents of the 'Scheduled Tasks' folder
    "2008-07-23 01:10:04 C:\WINDOWS\Tasks\HP Usg Daily.job "
    - C:\Program Files\Hewlett-Packard\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\pexpress\hphped05.exe
    "2007-03-22 21:59:02 C:\WINDOWS\Tasks\MP Scheduled Quick Scan.job "
    - C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MpCmdRun.exe%Scan -RestrictPrivileges -ScanType 1
    "2008-07-17 19:04:34 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job "
    - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
    .
    .
    ------- Supplementary Scan -------
    .
    R0 -: HKCU-Main,Start Page = hxxp://www.ask.com?o=1607
    R1 -: HKCU-Internet Settings,ProxyOverride = *.local
    R1 -: HKCU-SearchURL,(Default) = hxxp://g.msn.ca/0SEENCA/SAOS01?FORM=TOOLBR
    O8 -: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZCxdm801YYCA
    O8 -: Convert link target to Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 -: Convert link target to existing PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 -: Convert selected links to Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    O8 -: Convert selected links to existing PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    O8 -: Convert selection to Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 -: Convert selection to existing PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 -: Convert to Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 -: Convert to existing PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 -: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000


    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-07-22 23:24:38
    Windows 5.1.2600 Service Pack 2 FAT NTAPI

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2008-07-22 23:25:10
    ComboFix3.txt 2008-07-21 02:42:20
    ComboFix-quarantined-files.txt 2008-07-23 03:25:06
    ComboFix2.txt 2008-07-23 02:29:36

    Pre-Run: 10,535,403,520 bytes free
    Post-Run: 10,540,548,096 bytes free

    210 --- E O F --- 2008-07-17 21:33:12

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 23:27, on 22/07/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16674)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Acer\eManager\anbmServ.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\system32\HPZipm12.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\WINDOWS\AGRSMMSG.exe
    C:\WINDOWS\system32\Rundll32.exe
    C:\WINDOWS\system32\keyhook.exe
    C:\Acer\Empowering Technology\eRecovery\Monitor.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
    C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
    C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
    C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
    C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
    C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\system32\sistray.exe
    C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Ask.com Search Engine - Better Web Search
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Live Search
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Live Search
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = Live Search:
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = Customize Your Settings
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
    O2 - BHO: Ask Search Assistant BHO - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
    O4 - HKLM\..\Run: [LaunchApp] Alaunch
    O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
    O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
    O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
    O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
    O4 - HKLM\..\Run: [HPHUPD05] C:\Program Files\Hewlett-Packard\\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\hphupd05.exe
    O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe "
    O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\system32\hphmon05.exe
    O4 - HKLM\..\Run: [eFax 4.2] "C:\Program Files\eFax Messenger 4.2\J2GDllCmd.exe" /R
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
    O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe "
    O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe "
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
    O4 - HKCU\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
    O4 - Startup: RollerCoaster Tycoon 3 Registration.lnk = C:\Documents and Settings\Morgan\Local Settings\Temp\{8290D75F-AF9A-4CE3-81E5-6AB242F658A9}\{907B4640-266B-4A21-92FB-CD1A86CD0F63}\ATR1.exe
    O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
    O4 - Global Startup: eFax 4.2.lnk = C:\Program Files\eFax Messenger 4.2\J2GTray.exe
    O4 - Global Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
    O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZCxdm801YYCA
    O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.nl/scanforvirus-en/kavwebscan_unicode.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
    O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
    O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - https://www-secure.symantec.com/techsupp/asa/ss/sa/sa_cabs/tgctlsr.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by120fd.bay120.hotmail.msn.com/resources/MsnPUpld.cab
    O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-CA/a-UNO1/GAME_UNO1.cab
    O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://gtroj73.spaces.live.com/PhotoUpload/MsnPUpld.cab
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jinstall-6-windows-i586.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

    --
    End of file - 11368 bytes
    Malwarebytes' Anti-Malware 1.22
    Database version: 981
    Windows 5.1.2600 Service Pack 2

    11:35:45 PM 22/07/2008
    mbam-log-7-22-2008 (23-35-45).txt

    Scan type: Quick Scan
    Objects scanned: 50016
    Time elapsed: 3 minute(s), 53 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 3
    Registry Values Infected: 2
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 0

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    HKEY_CURRENT_USER\SOFTWARE\BrowsingEnhancer (Adware.Agent) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> Quarantined and deleted successfully.

    Registry Values Infected:
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\MenuExt\&Search\ (Adware.Hotbar) -> Quarantined and deleted successfully.

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    (No malicious items detected)
     
    living life,
    #17
  19. 2008/07/22
    living life

    living life Inactive Thread Starter

    Joined:
    2008/07/15
    Messages:
    74
    Likes Received:
    0
    continued

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 23:36, on 22/07/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16674)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Acer\eManager\anbmServ.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\system32\HPZipm12.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\WINDOWS\AGRSMMSG.exe
    C:\WINDOWS\system32\Rundll32.exe
    C:\WINDOWS\system32\keyhook.exe
    C:\Acer\Empowering Technology\eRecovery\Monitor.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
    C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
    C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
    C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
    C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
    C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\system32\sistray.exe
    C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\internet explorer\iexplore.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Ask.com Search Engine - Better Web Search
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Live Search
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Live Search
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = Live Search:
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = Customize Your Settings
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
    O2 - BHO: Ask Search Assistant BHO - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
    O4 - HKLM\..\Run: [LaunchApp] Alaunch
    O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
    O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
    O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
    O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
    O4 - HKLM\..\Run: [HPHUPD05] C:\Program Files\Hewlett-Packard\\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\hphupd05.exe
    O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe "
    O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\system32\hphmon05.exe
    O4 - HKLM\..\Run: [eFax 4.2] "C:\Program Files\eFax Messenger 4.2\J2GDllCmd.exe" /R
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
    O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe "
    O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe "
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
    O4 - HKCU\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
    O4 - Startup: RollerCoaster Tycoon 3 Registration.lnk = C:\Documents and Settings\Morgan\Local Settings\Temp\{8290D75F-AF9A-4CE3-81E5-6AB242F658A9}\{907B4640-266B-4A21-92FB-CD1A86CD0F63}\ATR1.exe
    O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
    O4 - Global Startup: eFax 4.2.lnk = C:\Program Files\eFax Messenger 4.2\J2GTray.exe
    O4 - Global Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
    O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.nl/scanforvirus-en/kavwebscan_unicode.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
    O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
    O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - https://www-secure.symantec.com/techsupp/asa/ss/sa/sa_cabs/tgctlsr.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by120fd.bay120.hotmail.msn.com/resources/MsnPUpld.cab
    O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-CA/a-UNO1/GAME_UNO1.cab
    O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://gtroj73.spaces.live.com/PhotoUpload/MsnPUpld.cab
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jinstall-6-windows-i586.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

    --
    End of file - 11302 bytes
     
    living life,
    #18
  20. 2008/07/22
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Ahh yes, kids account. ComboFix repaired the clock?

    Highlight and copy the contents of the code box below and paste it into a blank notepad, then save it to your desktop as;

    Filename: CFScript.txt
    Save As Type: All Files (*.*)

    Code:
    
http://www.windowsbbs.com/newreply.php?do=newreply&noquote=1&p=407344

SkipFix::
Extra::
Suspect::[22]
C:\WINDOWS\system32\aetktdwv.ini
DirLook::
C:\Documents and Settings\Morgan\Application Data\TmpRecentIcons
C:\Documents and Settings\Grant\Application Data\TmpRecentIcons
    Close all other windows and programs. Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button. Combofix should run and may reboot the computer when it's done. A log will open when it's complete. Post the contents of that log and a fresh HijackThis log.

    Please do not click on the ComboFix window while it is running a scan. This can cause it to stall.


    Please note that I have instructed CFScript to collect some files for analysis. This means that when ComboFix finishes, you will be prompted to allow ComboFix to upload a zip file that was created on your desktop. The zip contains the aforementioned files. Please copy the path shown in the prompt and paste it into the box, then click Send. Thanks!


    BTW, you should be able to set your desired homepage to wherever you like.
     
    noahdfear,
    #19
  21. 2008/07/23
    living life

    living life Inactive Thread Starter

    Joined:
    2008/07/15
    Messages:
    74
    Likes Received:
    0
    todays reports

    Thank you so much.
    Yes, combofix repaired the clock and also the runonce situation has cleared.

    I did as you requested, but I did it on all three logins just to be safe. This is the first report, I will post the other two as well.

    ComboFix 08-07-23.4 - Grant 2008-07-23 22:03:39.10 - FAT32x86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.151 [GMT -4:00]
    Running from: C:\Documents and Settings\Grant\Desktop\ComboFix.exe
    Command switches used :: C:\Documents and Settings\Grant\Desktop\CFScript.txt
    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .
    - REDUCED FUNCTIONALITY MODE -
    .

    ((((((((((((((((((((((((( Files Created from 2008-06-24 to 2008-07-24 )))))))))))))))))))))))))))))))
    .

    2008-07-22 23:30 . 2008-07-22 23:30 <DIR> d-------- C:\Documents and Settings\Morgan\Application Data\Malwarebytes
    2008-07-22 22:36 . 2008-07-22 22:36 <DIR> d-------- C:\Documents and Settings\Grant\Application Data\Malwarebytes
    2008-07-22 22:36 . 2008-07-20 20:21 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
    2008-07-22 21:12 . 2008-07-22 21:12 <DIR> d-------- C:\Program Files\iPod
    2008-07-22 21:12 . 2008-07-22 21:12 <DIR> d-------- C:\Program Files\Bonjour
    2008-07-21 17:29 . 2007-07-12 02:22 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
    2008-07-17 15:06 . 2008-07-17 15:06 <DIR> d-------- C:\Program Files\iTunes
    2008-07-17 15:04 . 2008-07-17 15:04 <DIR> d-------- C:\Program Files\QuickTime
    2008-07-17 10:26 . 2008-07-17 10:26 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-07-17 10:26 . 2008-07-17 10:26 <DIR> d-------- C:\Documents and Settings\andrew\Application Data\Malwarebytes
    2008-07-17 10:26 . 2008-07-17 10:26 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-07-17 10:26 . 2008-07-20 20:21 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
    2008-07-17 01:05 . 2008-07-23 21:50 0 --a------ C:\$bootcln.sch
    2008-07-16 10:24 . 2008-07-16 10:25 72,944,878 --a------ C:\SYM_REGISTRY_BACKUP.reg
    2008-07-16 04:41 . 2008-07-16 04:41 <DIR> d-------- C:\Program Files\Trend Micro
    2008-07-15 14:01 . 2008-07-15 14:09 4,286 --a------ C:\WINDOWS\system32\tmp.reg
    2008-07-15 13:59 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
    2008-07-15 13:59 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
    2008-07-15 13:59 . 2008-05-29 09:35 86,528 --a------ C:\WINDOWS\system32\VACFix.exe
    2008-07-15 13:59 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe
    2008-07-15 13:59 . 2008-07-02 13:33 82,432 --a------ C:\WINDOWS\system32\IEDFix.C.exe
    2008-07-15 13:59 . 2008-05-23 18:21 81,920 --a------ C:\WINDOWS\system32\404Fix.exe
    2008-07-15 13:59 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
    2008-07-15 13:59 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
    2008-07-15 13:59 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
    2008-07-15 12:52 . 2008-07-15 12:52 <DIR> d--hs---- C:\FOUND.032
    2008-07-15 11:33 . 2008-07-15 11:33 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
    2008-07-15 11:32 . 2008-07-15 11:32 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
    2008-07-14 23:20 . 2008-07-14 23:20 2 --a------ C:\WINDOWS\msoffice.ini
    2008-07-14 18:09 . 2003-01-10 17:13 33,588 -ra------ C:\WINDOWS\system32\drivers\wanatw4.sys
    2008-07-14 16:15 . 2008-07-14 16:15 <DIR> d-------- C:\Program Files\Enigma Software Group
    2008-07-14 16:10 . 2008-07-14 16:10 <DIR> d-------- C:\Documents and Settings\andrew\Application Data\AOL
    2008-07-14 16:07 . 2008-07-14 16:07 <DIR> d-------- C:\Program Files\Common Files\Nullsoft
    2008-07-14 16:05 . 2008-07-14 16:05 <DIR> d-------- C:\Program Files\Viewpoint
    2008-07-14 16:05 . 2008-07-14 16:05 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Viewpoint
    2008-07-14 14:24 . 2008-07-14 14:24 <DIR> d-------- C:\Program Files\Common Files\AOL
    2008-07-14 14:24 . 2008-07-14 14:24 335 --a------ C:\WINDOWS\nsreg.dat
    2008-07-14 14:23 . 2008-07-14 14:23 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\AOL Downloads
    2008-07-14 14:23 . 2008-07-14 14:23 29 --a------ C:\WINDOWS\atid.ini
    2008-07-14 13:22 . 2008-07-14 13:22 <DIR> d--hs---- C:\FOUND.031
    2008-07-14 13:05 . 2008-07-14 13:24 354 ---hs---- C:\WINDOWS\system32\aetktdwv.ini
    2008-07-11 20:09 . 2008-07-11 20:09 <DIR> d--hs---- C:\FOUND.030
    2008-07-11 19:46 . 2008-07-11 19:46 <DIR> d-------- C:\Documents and Settings\andrew\Application Data\MSNInstaller
    2008-07-11 18:51 . 2008-07-11 18:51 <DIR> d-------- C:\Documents and Settings\Morgan\Application Data\TmpRecentIcons
    2008-07-11 18:51 . 2008-07-11 18:51 <DIR> d-------- C:\Documents and Settings\Grant\Application Data\TmpRecentIcons
    2008-07-11 11:55 . 2008-07-11 11:55 <DIR> d--hs---- C:\FOUND.029
    2008-07-10 20:14 . 2008-07-10 20:14 <DIR> d--hs---- C:\FOUND.028
    2008-07-10 02:58 . 2004-08-04 05:00 4,224 --a------ C:\WINDOWS\system32\beep.sys
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d-------- C:\Program Files\Realtek Sound Manager
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d-------- C:\Program Files\Common Files\PocketSoft
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d-------- C:\Program Files\AvRack
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d-------- C:\Program Files\Atari
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.009
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.008
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.007
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.006
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.005
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.004
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.003
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.002
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.001
    2008-07-10 01:30 . 2008-07-10 01:30 <DIR> d--hs---- C:\FOUND.000
    2008-07-05 20:44 . 2008-07-09 09:54 54,156 --ah----- C:\WINDOWS\QTFont.qfn
    2008-07-05 20:44 . 2008-07-05 20:45 1,409 --a------ C:\WINDOWS\QTFont.for
    2008-07-05 20:42 . 2008-07-05 20:42 <DIR> d-------- C:\Program Files\QuickTime(2)

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-06-21 23:54 --------- d-----w C:\Documents and Settings\Morgan\Application Data\ooVoo Details
    2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
    2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\dllcache\mswsock.dll
    2008-06-20 17:41 148,992 ----a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
    2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\dllcache\tcpip.sys
    2008-06-20 10:45 360,320 ------w C:\WINDOWS\system32\drivers\tcpip.sys
    2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\dllcache\afd.sys
    2008-06-20 10:44 138,368 ------w C:\WINDOWS\system32\drivers\afd.sys
    2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\dllcache\tcpip6.sys
    2008-06-20 09:52 225,920 ------w C:\WINDOWS\system32\drivers\tcpip6.sys
    2008-06-17 23:23 --------- d-----w C:\Documents and Settings\Morgan\Application Data\FrostWire
    2008-06-17 23:19 --------- d-----w C:\Program Files\FrostWire
    2008-06-17 23:19 --------- d-----w C:\Program Files\AskSBar
    2008-06-13 20:06 --------- d-----w C:\Documents and Settings\Grant\Application Data\LimeWire
    2008-06-13 13:10 272,128 ------w C:\WINDOWS\system32\drivers\bthport.sys
    2008-06-13 13:10 272,128 ------w C:\WINDOWS\system32\dllcache\bthport.sys
    2008-06-12 20:25 --------- d-----w C:\Documents and Settings\Grant\Application Data\uTorrent
    2008-05-08 12:28 202,752 ------w C:\WINDOWS\system32\dllcache\rmcast.sys
    2008-05-07 05:18 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
    2008-05-07 05:18 1,287,680 ------w C:\WINDOWS\system32\dllcache\quartz.dll
    2008-04-24 02:16 3,591,680 ------w C:\WINDOWS\system32\dllcache\mshtml.dll
    2004-08-04 09:00 94,784 --sh--w C:\WINDOWS\twain.dll
    2004-08-04 09:00 50,688 --sh--w C:\WINDOWS\twain_32.dll
    .

    (((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .

    ---- Directory of C:\Documents and Settings\Grant\Application Data\TmpRecentIcons ----


    ---- Directory of C:\Documents and Settings\Morgan\Application Data\TmpRecentIcons ----



    ((((((((((((((((((((((((((((( snapshot@2008-07-22_22.29.19.34 )))))))))))))))))))))))))))))))))))))))))
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
    "{0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} "= "C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL" [2008-07-22 14:44 66912]

    [HKEY_CLASSES_ROOT\clsid\{0579b4b6-0293-4d73-b02d-5ebb0ba0f0a2}]

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2}]
    2008-07-22 14:44 66912 --a------ C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "QuickTime Task "= "C:\Program Files\QuickTime\qttask.exe" [2008-05-27 10:50 413696]
    "ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 05:00 15360]
    "MSMSGS "= "C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 12:24 1694208]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "LaunchApp "= "Alaunch" [X]
    "SynTPLpr "= "C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-10-07 23:44 98394]
    "SynTPEnh "= "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-10-07 23:43 688218]
    "SiS Windows KeyHook "= "C:\WINDOWS\system32\keyhook.exe" [2005-03-04 13:13 32768]
    "IMJPMIG8.1 "= "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 05:00 208952]
    "MSPY2002 "= "C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 05:00 59392]
    "PHIME2002ASync "= "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 05:00 455168]
    "PHIME2002A "= "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 05:00 455168]
    "eRecoveryService "= "C:\Acer\Empowering Technology\eRecovery\Monitor.exe" [2005-11-16 16:54 385024]
    "AVG7_CC "= "C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [2008-04-19 19:41 579584]
    "HPDJ Taskbar Utility "= "C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe" [2005-07-08 00:55 176128]
    "HPHUPD05 "= "C:\Program Files\Hewlett-Packard\\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\hphupd05.exe" [2005-07-08 00:55 49152]
    "HP Component Manager "= "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 08:38 241664]
    "HPHmon05 "= "C:\WINDOWS\system32\hphmon05.exe" [2005-07-08 00:55 491520]
    "eFax 4.2 "= "C:\Program Files\eFax Messenger 4.2\J2GDllCmd.exe" [2006-07-14 16:36 107008]
    "HP Software Update "= "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2007-05-08 16:24 54840]
    "Share-to-Web Namespace Daemon "= "C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" [2001-07-03 09:11 57344]
    "Acrobat Assistant 7.0 "= "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2008-04-23 02:08 483328]
    "AppleSyncNotifier "= "C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-10 09:47 116040]
    "SunJavaUpdateSched "= "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00 132496]
    "QuickTime Task "= "C:\Program Files\QuickTime\qttask.exe" [2008-05-27 10:50 413696]
    "iTunesHelper "= "C:\Program Files\iTunes\iTunesHelper.exe" [2008-07-10 10:51 289064]
    "SoundMan "= "SOUNDMAN.EXE" [2005-02-23 18:13 77824 C:\WINDOWS\SOUNDMAN.EXE]
    "AGRSMMSG "= "AGRSMMSG.exe" [2004-10-07 19:50 88363 C:\WINDOWS\AGRSMMSG.exe]
    "SiSPower "= "SiSPower.dll" [2005-02-25 19:35 49152 C:\WINDOWS\system32\SiSPower.dll]

    C:\Documents and Settings\andrew\Start Menu\Programs\Startup\
    Microsoft Office OneNote 2003 Quick Launch.lnk - C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE [2007-04-19 13:49:52 64864]
    DING!.lnk - C:\Program Files\Southwest Airlines\Ding\Ding.exe [2006-06-22 14:15:48 462848]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    Utility Tray.lnk - C:\WINDOWS\system32\sistray.exe [2005-01-04 16:52:52 331776]
    eFax 4.2.lnk - C:\Program Files\eFax Messenger 4.2\J2GTray.exe [2006-10-02 21:00:05 612352]
    Microsoft Office OneNote 2003 Quick Launch.lnk - C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE [2007-04-19 13:49:52 64864]
    Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26 29696]
    Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe [2007-04-06 15:54:09 25214]

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
    SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusOverride "=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe "=
    "C:\\Program Files\\Acer Inc\\Acer GridVista\\GridVistaU.exe "=
    "C:\\Program Files\\Grisoft\\AVG Free\\AVGCC.EXE "=
    "C:\\Program Files\\Grisoft\\AVG Free\\avgw.exe "=
    "C:\\Program Files\\Grisoft\\AVG Free\\avgvv.exe "=
    "C:\\Program Files\\eFax Messenger 4.2\\J2GPBook.exe "=
    "C:\\Program Files\\Hewlett-Packard\\Precisionscan Pro 3.1\\hpipcopy.exe "=
    "C:\\Program Files\\Hewlett-Packard\\HP Software Update\\HPWUCli.exe "=
    "C:\\HSH\\HBCS\\unins000.exe "=
    "C:\\Program Files\\TheWeatherNetwork\\WeatherEye\\WeatherEye.exe "=
    "C:\\Program Files\\AvRack\\rtlrack.exe "=
    "C:\\Program Files\\Bonjour\\mDNSResponder.exe "=
    "C:\\Program Files\\iTunes\\iTunes.exe "=

    R2 int15.sys;int15.sys;C:\Acer\Empowering Technology\eRecovery\int15.sys [2005-01-13 14:46]
    R3 SISNICXP;SiS PCI Fast Ethernet Adapter Driver for NDIS51;C:\WINDOWS\system32\DRIVERS\sisnicxp.sys [2004-11-05 01:43]
    S3 usbprint;Microsoft USB PRINTER Class;C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-03 23:01]

    *Newly Created Service* - INT15.SYS
    .
    Contents of the 'Scheduled Tasks' folder
    "2008-07-24 01:10:02 C:\WINDOWS\Tasks\HP Usg Daily.job "
    - C:\Program Files\Hewlett-Packard\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\pexpress\hphped05.exe
    "2007-03-22 21:59:02 C:\WINDOWS\Tasks\MP Scheduled Quick Scan.job "
    - C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MpCmdRun.exe%Scan -RestrictPrivileges -ScanType 1
    "2008-07-17 19:04:34 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job "
    - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
    .
    .
    ------- Supplementary Scan -------
    .
    R0 -: HKCU-Main,Start Page = hxxp://www.google.com/
    R1 -: HKCU-Internet Connection Wizard,ShellNext = iexplore
    O8 -: &Search
    O8 -: Convert link target to Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 -: Convert link target to existing PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 -: Convert selected links to Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    O8 -: Convert selected links to existing PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    O8 -: Convert selection to Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 -: Convert selection to existing PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 -: Convert to Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 -: Convert to existing PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 -: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000


    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-07-23 22:04:01
    Windows 5.1.2600 Service Pack 2 FAT NTAPI

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2008-07-23 22:05:56
    ComboFix-quarantined-files.txt 2008-07-24 02:05:52
    ComboFix4.txt 2008-07-23 03:25:12
    ComboFix5.txt 2008-07-24 02:02:54
    ComboFix3.txt 2008-07-24 01:13:02
    ComboFix2.txt 2008-07-24 01:41:50

    Pre-Run: 10,011,410,432 bytes free
    Post-Run: 10,007,511,040 bytes free

    224 --- E O F --- 2008-07-23 03:56:19
     
    living life,
    #20
Page 1 of 2

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...