Active Used computer full of bugs

DugE · 2009/07/19

[Active] Used computer full of bugs

My son bought a used computer last week and had been using it on the internet without any anti virus, firewall or any protection at all. Installed is Sp1 on this xp running IE 6. Needless to say the computer doesn't run quite right now.

I can install anti spyware, malwarebytes but cannot update them. He couldn't download the programs, I had to instll them from my backups. I also cannot get to Windows update.

I have the dds files you want and also a hijack this log which I will post now.
Thanks for any help.

======================================================

DDS (Ver_09-06-26.01) - NTFSx86
Run by Owner User at 16:16:54.07 on Sun 07/19/2009
Internet Explorer: 6.0.2900.5512
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.504.147 [GMT -4:00]

AV: avast! antivirus 4.8.1335 [VPS 090719-1] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: ZoneAlarm Firewall *enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AGI\common\win32\PythonService.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\lg_fwupdate\fwupdate.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\Webshots\webshots.scr
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Secunia\PSI\psi.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\rundll32.exe
C:\DOCUME~1\OWNERU~1\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.yahoo.com/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
mDefault_Search_URL = hxxp://www.google.com/ie
mSearch Page = hxxp://www.google.com
mStart Page = hxxp://www.google.com
uSearchURL,(Default) = hxxp://toolbar.ask.com/toolbarv/askRedirect?o=101757&gct=&gc=1&q=%s
mSearchAssistant = hxxp://www.google.com
TB: Ask Toolbar: {3041d03e-fd4b-44e0-b742-2d9b88305f98} - c:\program files\askbardis\bar\bin\askBar.dll
TB: {F0F8ECBE-D460-4B34-B007-56A92E8F84A7} - No File
TB: {724D43A0-0D85-11D4-9908-00400523E39A} - No File
TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRun: [cdloader] "c:\documents and settings\owner user\application data\mjusbsp\cdloader2.exe" MAGICJACK
uRun: [Weather] c:\program files\aws\weatherbug\Weather.exe 1
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [HP Software Update] "c:\program files\hp\hp software update\HPWuSchd.exe "
mRun: [HP Component Manager] "c:\program files\hp\hpcoretech\hpcmpmgr.exe "
mRun: [RemoteControl] "c:\program files\cyberlink\powerdvd\PDVDServ.exe "
mRun: [LanguageShortcut] "c:\program files\cyberlink\powerdvd\language\Language.exe "
mRun: [LGODDFU] "c:\program files\lg_fwupdate\fwupdate.exe" blrun
mRun: [RestartNeroSetup] "e:\cds\nero\installation\SetupX.exe "
mRun: [avast!] c:\progra~1\alwils~1\avast4\ashDisp.exe
mRun: [HPDJ Taskbar Utility] c:\windows\system32\spool\drivers\w32x86\3\hpztsb05.exe
mRun: [ZoneAlarm Client] "c:\program files\zone labs\zonealarm\zlclient.exe "
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe "
StartupFolder: c:\docume~1\owneru~1\startm~1\programs\startup\secuni~1.lnk - c:\program files\secunia\psi\psi.exe
StartupFolder: c:\docume~1\owneru~1\startm~1\programs\startup\webshots.lnk - c:\program files\webshots\Launcher.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~2.lnk - c:\program files\microsoft office\office\FINDFAST.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\office~1.lnk - c:\program files\microsoft office\office\OSA.EXE
uPolicies-explorer: ForceClassicControlPanel = 1 (0x1)
uPolicies-system: EnableProfileQuota = 1 (0x1)
IE: Add to AMV Converter... - c:\program files\mp3 player utilities 4.19\amvconverter\grab.html
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} - c:\program files\yahoo!\common\Yinsthelper.dll
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - c:\program files\belarc\advisor\system\BAVoilaX.dll
Handler: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - c:\program files\hp\hpcoretech\comp\hpuiprot.dll
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll
Notify: igfxcui - igfxsrvc.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL

============= SERVICES / DRIVERS ===============

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-6-14 114768]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2009-5-26 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2009-5-26 72944]
R1 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2009-7-19 353672]
R2 AGWinService;AG Windows Service;c:\program files\agi\common\win32\pythonservice.exe [2009-1-5 10240]
R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast4\ashServ.exe [2009-6-18 138680]
R2 vsmon;TrueVector Internet Monitor;c:\windows\system32\zonelabs\vsmon.exe -service --> c:\windows\system32\zonelabs\vsmon.exe -service [?]
R3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast4\ashMaiSv.exe [2009-6-18 254040]
R3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast4\ashWebSv.exe [2009-6-18 352920]
R3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [2009-3-24 7808]
R3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2009-5-26 7408]
S0 TLRecAgent;TLRecAgent; [x]
S2 dbtusyvnk;System Installer;c:\windows\system32\svchost.exe -k netsvcs [2003-3-31 14336]
S3 scusbvip;VL1800 USB Driver; [x]
S3 SLVAD_simple;Zoom Virtual Audio Device; [x]

=============== Created Last 30 ================

2009-07-19 16:07 <DIR> --d----- c:\program files\Trend Micro
2009-07-19 15:19 286,720 -c------ c:\windows\system32\dllcache\blackbox.dll
2009-07-19 15:18 364,544 -c------ c:\windows\system32\dllcache\npdsplay.dll
2009-07-19 15:16 <DIR> --d----- c:\windows\network diagnostic
2009-07-19 15:16 144,384 -------- c:\windows\system32\drivers\hdaudbus.sys
2009-07-19 15:16 10,240 -------- c:\windows\system32\drivers\sffp_mmc.sys
2009-07-19 15:15 19,569 a------- c:\windows\005032_.tmp
2009-07-19 14:49 <DIR> --d----- c:\program files\common files\Wise Installation Wizard
2009-07-19 14:39 4,212 a---h--- c:\windows\system32\zllictbl.dat
2009-07-19 14:38 1,221,512 a------- c:\windows\system32\zpeng25.dll
2009-07-19 14:38 <DIR> --d----- c:\windows\system32\ZoneLabs
2009-07-19 14:38 350,192 a------- c:\windows\system32\vsconfig.xml
2009-07-19 14:34 <DIR> --d----- c:\program files\Zone Labs
2009-07-19 14:24 <DIR> --d----- c:\windows\system32\wbem\AutoRecover
2009-07-19 14:19 59,392 -------- c:\windows\system32\logman.exe
2009-07-19 14:19 9,216 -------- c:\windows\system32\proxycfg.exe
2009-07-19 14:19 1,229 -------- c:\windows\system32\wbem\wscenter.mof
2009-07-19 14:15 <DIR> --d----- c:\windows\ServicePackFiles
2009-07-19 14:12 2,897,920 -------- c:\windows\system32\xpsp2res.dll
2009-07-19 14:11 19,528 a------- c:\windows\002256_.tmp
2009-07-19 14:11 <DIR> --d----- c:\windows\system32\ReinstallBackups
2009-07-19 14:11 26,488 a------- c:\windows\system32\spupdsvc.exe
2009-07-19 14:08 <DIR> --d----- c:\windows\EHome
2009-07-19 13:58 <DIR> --d----- c:\windows\Internet Logs
2009-07-19 13:58 <DIR> --d----- C:\Downloads
2009-07-19 13:37 <DIR> --d----- c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com
2009-07-19 13:37 <DIR> --d----- c:\program files\SUPERAntiSpyware
2009-07-19 13:37 <DIR> --d----- c:\docume~1\owneru~1\applic~1\SUPERAntiSpyware.com
2009-07-19 13:35 <DIR> --d----- c:\program files\Secunia
2009-07-19 13:29 <DIR> --d----- c:\docume~1\owneru~1\applic~1\Malwarebytes
2009-07-19 13:29 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-07-19 13:28 <DIR> --d----- c:\windows\system32\unknown
2009-07-19 12:22 72 a------- c:\windows\MediaManager.INI
2009-07-19 12:10 <DIR> --d----- c:\program files\MP3 Player Utilities 4.19
2009-07-13 17:24 2 a------- c:\windows\0535251103110107106.uio
2009-07-13 17:21 <DIR> --d----- c:\docume~1\owneru~1\applic~1\Titanium Gears
2009-07-13 17:12 <DIR> --d----- c:\docume~1\owneru~1\applic~1\WeatherBug
2009-07-11 18:22 2 a------- c:\windows\0101120101465749.dat
2009-07-11 18:22 1 ----h--- c:\windows\jmmark2.dat
2009-07-11 18:22 1 ----h--- c:\windows\bf23567.dat
2009-07-11 09:59 <DIR> --d----- c:\program files\PC_Security2009
2009-07-11 09:57 1 a------- c:\windows\934fdfg34fgjf23
2009-07-11 09:57 238,596 a------- c:\windows\system32\wisdstr.exe
2009-07-11 09:57 2 a------- c:\windows\0101120101464849.dat
2009-07-11 09:56 2 a------- c:\windows\010112010146118114.dat
2009-07-11 00:09 <DIR> --d----- c:\docume~1\owneru~1\applic~1\LimeWire
2009-07-11 00:08 410,984 a------- c:\windows\system32\deploytk.dll
2009-07-10 23:30 <DIR> --d----- c:\program files\AskSearch
2009-07-10 23:30 <DIR> --d----- c:\program files\AskBarDis
2009-07-03 22:28 7,168 a------- c:\windows\Owner User.pcb
2009-07-02 20:45 <DIR> --d----- c:\program files\Yahoo!
2009-07-02 19:41 <DIR> --d----- c:\program files\ATT-HSI
2009-07-02 19:41 <DIR> --d----- c:\program files\common files\Motive
2009-07-01 20:19 284 a------- c:\windows\EReg077.dat
2009-07-01 20:19 <DIR> --d----- c:\windows\DESKTOP
2009-07-01 20:19 <DIR> --d----- C:\TLC
2009-06-28 14:34 262,144 a------- C:\ffastunT.ffl
2009-06-21 17:23 19,840 a------- c:\windows\system32\drivers\StMp3Rec.sys
2009-06-21 17:23 <DIR> --d----- c:\program files\Philips
2009-06-21 09:53 <DIR> --d----- c:\documents and settings\owner user\acdc
2009-06-19 22:48 0 a------- c:\windows\iPlayer.INI
2009-06-19 22:40 <DIR> --d----- c:\program files\InterActual

==================== Find3M ====================

2009-07-19 15:26 76,487 a------- c:\windows\pchealth\helpctr\offlinecache\index.dat
2009-06-15 13:48 81,920 a------- c:\docume~1\owneru~1\applic~1\ezpinst.exe
2009-06-15 13:48 47,360 a------- c:\windows\system32\drivers\pcouffin.sys
2009-06-15 13:48 47,360 a------- c:\docume~1\owneru~1\applic~1\pcouffin.sys
2003-03-31 08:00 174,488 a--shr-- c:\windows\system32\navyqhc.dll

============= FINISH: 16:17:31.25 ===============

========================================================

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-06-26.01)

Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume1
Install Date: 1/4/2009 11:50:45 AM
System Uptime: 7/19/2009 3:29:41 PM (1 hours ago)

Motherboard: ASUSTeK Computer INC. | | P4G533LA
Processor: Intel(R) Celeron(R) CPU 2.50GHz | PGA 478 | 2490/100mhz

==== Disk Partitions =========================

A: is Removable
C: is FIXED (NTFS) - 466 GiB total, 456.276 GiB free.
D: is CDROM (CDFS)
E: is CDROM ()

==== Disabled Device Manager Items =============

==== System Restore Points ===================

No restore point in system.

==== Installed Programs ======================

1300
1300_Help
1300Tour
1300Trb
ACD FotoSlate
ACDSee 5.0 Standard
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 8.1.0
Adobe SVG Viewer 3.0
AiO_Scan
AIOMinimal
AiOSoftware
Ask Toolbar
AT&T Yahoo! Internet Mail
avast! Antivirus
Belarc Advisor 7.2
CloneDVD 4.1.0.23
DVD Suite
Fax
FreeZip
HijackThis 2.0.2
hp deskjet 5550 series (Remove only)
HP PSC & OfficeJet 3.5
HP Software Update
Intel(R) Extreme Graphics Driver
LG ODD Auto Firmware Update
Media Player Codec Pack 3.4.0
Memories Disc Creator 2.0
Microsoft .NET Framework 1.1
Microsoft Office 97, Standard Edition
MP3 Player Utilities 4.19
Overland
PowerDVD
PowerProducer
PrintScreen
Readme
SA3020 Device Manager
SA30xx Media Converter
Scan
Secunia PSI
SUPERAntiSpyware Free Edition
VC 9.0 Runtime
WebFldrs XP
Webshots Desktop
Windows XP Service Pack 3
Yahoo! Install Manager
ZoneAlarm

==== Event Viewer Messages From Past Week ========

7/19/2009 3:35:28 PM, error: Server [2505] - The server could not bind to the transport \Device\NetBT_Tcpip_{4348C216-C6D1-4F43-A542-479E9AC5ECDC} because another computer on the network has the same name. The server could not start.
7/13/2009 5:29:20 PM, error: Service Control Manager [7023] - The Application Management service terminated with the following error: The specified module could not be found.
7/13/2009 5:27:29 PM, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service wuauserv with arguments " " in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
7/13/2009 4:24:47 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: TLRecAgent
7/13/2009 4:24:47 PM, error: Service Control Manager [7023] - The System Installer service terminated with the following error: A dynamic link library (DLL) initialization routine failed.

==== End Of File ===========================

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:09:55 PM, on 7/19/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AGI\common\win32\PythonService.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\lg_fwupdate\fwupdate.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\Webshots\webshots.scr
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Secunia\PSI\psi.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedirect?o=101757&gct=&gc=1&q=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://toolbar.ask.com/toolbarv/askRedirect?o=101757&gct=&gc=1&q=%s
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe "
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe "
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe "
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe "
O4 - HKLM\..\Run: [LGODDFU] "C:\Program Files\lg_fwupdate\fwupdate.exe" blrun
O4 - HKLM\..\Run: [RestartNeroSetup] "E:\CDS\Nero\Installation\SetupX.exe "
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe "
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe "
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [cdloader] "C:\Documents and Settings\Owner User\Application Data\mjusbsp\cdloader2.exe" MAGICJACK
O4 - HKCU\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe 1
O4 - Startup: Secunia PSI.lnk = C:\Program Files\Secunia\PSI\psi.exe
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.19\AMVConverter\grab.html
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: AG Windows Service (AGWinService) - Unknown owner - C:\Program Files\AGI\common\win32\PythonService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: McciCMService - Motive Communications, Inc. - C:\Program Files\Common Files\Motive\McciCMService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 5549 bytes

broni · 2009/07/19

Please download ComboFix from [color= "Red"]Here[/color] or [color= "#FF0000"]Here[/color] to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

Please, never rename Combofix unless instructed.

Close any open browsers.

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results ".

Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

Close any open browsers.

WARNING: Combofix will disconnect your machine from the Internet as soon as it starts

Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.

If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

Double click on combofix.exe & follow the prompts.

When finished, it will produce a report for you.

Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

Make sure, you re-enable your security programs, when you're done with Combofix.

DugE · 2009/07/19

ComboFix 09-07-19.02 - Owner User 07/19/2009 17:28.1.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.504.237 [GMT -4:00]
Running from: c:\documents and settings\Owner User\Desktop\ComboFix.exe
AV: avast! antivirus 4.8.1335 [VPS 090719-1] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: ZoneAlarm Firewall *enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\progra~1\COMMON~1\{525D3~1
c:\progra~1\COMMON~1\{525D3~1\slscp.log
c:\progra~1\COMMON~1\{525D3~1\SLZOOM\SLExtBU\ivr.scp
c:\progra~1\COMMON~1\{525D3~1\SLZOOM\SLExtBU\Setup.scp
c:\program files\AskSearch\bin\DefaultSearch.dll
c:\windows\010112010146118114.dat
c:\windows\0101120101464849.dat
c:\windows\0101120101465749.dat
c:\windows\desktop
c:\windows\desktop\Instal~1.lnk
c:\windows\system32\systeminfo3.dll

c:\windows\system32\proquota.exe was missing
Restored copy from - c:\windows\ServicePackFiles\i386\proquota.exe

.
((((((((((((((((((((((((( Files Created from 2009-06-19 to 2009-07-19 )))))))))))))))))))))))))))))))
.

2009-07-19 21:04 . 2009-07-19 21:04 -------- d-sh--w- c:\documents and settings\Owner User\PrivacIE
2009-07-19 21:02 . 2009-07-19 21:02 -------- d-sh--w- c:\documents and settings\Owner User\IETldCache
2009-07-19 21:00 . 2009-07-19 21:07 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo!
2009-07-19 20:57 . 2009-07-19 20:59 -------- dc-h--w- c:\windows\ie8
2009-07-19 20:41 . 2009-07-19 20:41 -------- d--h--w- c:\windows\$hf_mig$
2009-07-19 20:39 . 2009-07-19 20:39 -------- d-----w- c:\program files\Java
2009-07-19 20:38 . 2009-07-19 21:00 -------- d--h--w- c:\windows\msdownld.tmp
2009-07-19 20:38 . 2009-07-19 20:38 -------- d-----w- c:\windows\Logs
2009-07-19 20:34 . 2009-04-06 19:32 15504 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-07-19 20:34 . 2009-04-06 19:32 38496 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-19 20:34 . 2009-07-19 20:34 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-07-19 20:07 . 2009-07-19 20:07 -------- d-----w- c:\program files\Trend Micro
2009-07-19 20:00 . 2009-02-05 20:07 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-07-19 19:53 . 2009-07-19 19:53 -------- d-----w- c:\documents and settings\Owner User\Local Settings\Application Data\Adobe
2009-07-19 19:19 . 2008-04-14 09:41 286720 -c----w- c:\windows\system32\dllcache\blackbox.dll
2009-07-19 19:18 . 2008-04-14 09:42 356352 -c----w- c:\windows\system32\dllcache\msscp.dll
2009-07-19 19:16 . 2008-04-14 02:06 144384 ------w- c:\windows\system32\drivers\hdaudbus.sys
2009-07-19 19:16 . 2008-04-14 04:10 10240 ------w- c:\windows\system32\drivers\sffp_mmc.sys
2009-07-19 18:49 . 2009-07-19 18:49 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-07-19 18:39 . 2009-07-19 18:39 4212 ---ha-w- c:\windows\system32\zllictbl.dat
2009-07-19 18:39 . 2009-02-16 04:10 103816 ----a-w- c:\windows\system32\zlcommdb.dll
2009-07-19 18:39 . 2009-02-16 04:10 69000 ----a-w- c:\windows\system32\zlcomm.dll
2009-07-19 18:38 . 2009-02-16 04:10 1221512 ----a-w- c:\windows\system32\zpeng25.dll
2009-07-19 18:38 . 2009-07-19 18:39 -------- d-----w- c:\windows\system32\ZoneLabs
2009-07-19 18:34 . 2009-07-19 18:34 -------- d-----w- c:\program files\Zone Labs
2009-07-19 18:24 . 2009-07-19 19:25 -------- d-----w- c:\windows\system32\wbem\AutoRecover
2009-07-19 18:19 . 2008-04-14 09:42 9216 ------w- c:\windows\system32\proxycfg.exe
2009-07-19 18:19 . 2008-04-14 09:42 59392 ------w- c:\windows\system32\logman.exe
2009-07-19 18:15 . 2009-07-19 19:23 -------- d-----w- c:\windows\ServicePackFiles
2009-07-19 18:12 . 2008-04-14 03:09 2897920 ------w- c:\windows\system32\xpsp2res.dll
2009-07-19 18:11 . 2009-01-07 22:21 26144 ----a-w- c:\windows\system32\spupdsvc.exe
2009-07-19 18:08 . 2009-07-19 19:09 -------- d-----w- c:\windows\EHome
2009-07-19 17:58 . 2009-07-19 21:30 -------- d-----w- c:\windows\Internet Logs
2009-07-19 17:58 . 2009-07-19 20:55 -------- d-----w- C:\Downloads
2009-07-19 17:37 . 2009-07-19 17:37 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-07-19 17:37 . 2009-07-19 18:50 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-07-19 17:37 . 2009-07-19 18:50 -------- d-----w- c:\docume~1\OWNERU~1\APPLIC~1\SUPERAntiSpyware.com
2009-07-19 17:35 . 2009-07-19 17:35 -------- d-----w- c:\program files\Secunia
2009-07-19 17:29 . 2009-07-19 17:29 -------- d-----w- c:\docume~1\OWNERU~1\APPLIC~1\Malwarebytes
2009-07-19 17:29 . 2009-07-19 17:29 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-07-19 17:28 . 2009-07-19 17:28 -------- d-----w- c:\windows\system32\unknown
2009-07-19 16:10 . 2009-07-19 16:10 -------- d-----w- c:\program files\MP3 Player Utilities 4.19
2009-07-13 21:21 . 2009-07-13 21:21 -------- d-----w- c:\docume~1\OWNERU~1\APPLIC~1\Titanium Gears
2009-07-13 21:16 . 2009-07-13 21:16 -------- d-----w- c:\documents and settings\All Users\Application Data\Winferno
2009-07-13 21:12 . 2009-07-13 21:12 -------- d-----w- c:\documents and settings\Owner User\Local Settings\Application Data\WeatherBug
2009-07-13 21:12 . 2009-07-13 21:12 -------- d-----w- c:\docume~1\OWNERU~1\APPLIC~1\WeatherBug
2009-07-13 21:11 . 2009-07-13 21:11 -------- d-----w- c:\docume~1\OWNERU~1\APPLIC~1\Yahoo!
2009-07-11 22:22 . 2009-07-11 22:22 1 ---h--w- c:\windows\jmmark2.dat
2009-07-11 22:22 . 2009-07-11 22:22 1 ---h--w- c:\windows\bf23567.dat
2009-07-11 13:59 . 2009-07-15 23:02 -------- d-----w- c:\program files\PC_Security2009
2009-07-11 13:57 . 2009-07-11 13:57 238596 ----a-w- c:\windows\system32\wisdstr.exe
2009-07-11 04:09 . 2009-07-11 04:48 -------- d-----w- c:\docume~1\OWNERU~1\APPLIC~1\LimeWire
2009-07-11 04:08 . 2009-07-19 20:39 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-07-11 03:30 . 2009-07-11 03:30 -------- d-----w- c:\program files\AskSearch
2009-07-11 03:30 . 2009-07-19 18:39 -------- d-----w- c:\program files\AskBarDis
2009-07-03 00:45 . 2009-07-19 21:09 -------- d-----w- c:\program files\Yahoo!
2009-07-02 23:42 . 2009-07-04 00:08 -------- d-----w- c:\docume~1\OWNERU~1\APPLIC~1\Motive
2009-07-02 23:41 . 2009-07-02 23:41 -------- d-----w- c:\program files\ATT-HSI
2009-07-02 23:41 . 2009-07-02 23:41 -------- d-----w- c:\program files\Common Files\Motive
2009-07-02 23:39 . 2009-07-02 23:39 -------- d-----w- c:\documents and settings\All Users\Application Data\Motive
2009-07-02 00:19 . 2009-07-02 00:19 284 ----a-w- c:\windows\EReg077.dat
2009-07-02 00:19 . 2009-07-02 00:19 -------- d-----w- C:\TLC
2009-06-21 21:23 . 2008-06-21 14:48 19840 ----a-w- c:\windows\system32\drivers\StMp3Rec.sys
2009-06-21 21:23 . 2009-06-21 21:24 -------- d-----w- c:\program files\Philips
2009-06-21 21:22 . 2009-06-21 21:22 -------- d-----w- c:\docume~1\OWNERU~1\APPLIC~1\InstallShield
2009-06-21 13:53 . 2009-06-21 13:53 -------- d-----w- c:\documents and settings\Owner User\acdc
2009-06-21 00:57 . 2009-06-21 00:57 -------- d-----w- c:\docume~1\OWNERU~1\APPLIC~1\DivX
2009-06-20 02:40 . 2009-07-13 20:18 -------- d-----w- c:\program files\InterActual

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-19 21:09 . 2009-06-13 17:39 -------- d-----w- c:\program files\lg_fwupdate
2009-07-19 19:56 . 2009-06-13 17:32 -------- d-----w- c:\program files\Common Files\Adobe
2009-07-19 19:26 . 2009-01-04 16:48 76487 ----a-w- c:\windows\PCHealth\HelpCtr\OfflineCache\index.dat
2009-07-19 18:25 . 2009-05-27 04:33 15920 ----a-w- c:\documents and settings\Owner User\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-07-09 16:59 . 2009-06-19 14:01 -------- d-----w- c:\docume~1\OWNERU~1\APPLIC~1\ACD Systems
2009-07-06 05:54 . 2009-06-15 17:48 10638 ----a-w- c:\documents and settings\All Users\Application Data\DVDXStudio\CloneDVD4\MainApp.dll
2009-07-06 05:54 . 2009-06-15 17:48 -------- d-----w- c:\docume~1\OWNERU~1\APPLIC~1\Vso
2009-06-27 01:14 . 2009-01-05 12:32 -------- d-----w- c:\program files\Webshots
2009-06-21 21:24 . 2009-02-21 14:28 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-06-21 19:56 . 2009-06-15 17:48 -------- d-----w- c:\program files\CloneDVD
2009-06-21 00:58 . 2009-06-14 13:38 -------- d-----w- c:\docume~1\OWNERU~1\APPLIC~1\CyberLink
2009-06-21 00:57 . 2009-06-14 13:38 -------- d-----w- c:\documents and settings\All Users\Application Data\CyberLink
2009-06-18 15:37 . 2009-06-15 00:51 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
2009-06-18 15:34 . 2009-01-06 22:54 -------- d-----w- c:\program files\Aquatica 3D
2009-06-15 18:03 . 2009-06-15 18:01 -------- d-----w- c:\program files\ACD Systems
2009-06-15 18:01 . 2009-06-15 18:01 -------- d-----w- c:\program files\Common Files\ACD Systems
2009-06-15 18:01 . 2009-06-15 18:01 -------- d-----w- c:\documents and settings\All Users\Application Data\ACD Systems
2009-06-15 17:48 . 2009-06-15 17:48 81920 ----a-w- c:\docume~1\OWNERU~1\APPLIC~1\ezpinst.exe
2009-06-15 17:48 . 2009-06-15 17:48 47360 ----a-w- c:\windows\system32\drivers\pcouffin.sys
2009-06-15 17:48 . 2009-06-15 17:48 47360 ----a-w- c:\docume~1\OWNERU~1\APPLIC~1\pcouffin.sys
2009-06-15 17:48 . 2009-06-15 17:48 -------- d-----w- c:\documents and settings\All Users\Application Data\DVDXStudio
2009-06-15 17:35 . 2009-04-07 20:09 -------- d-----w- c:\docume~1\OWNERU~1\APPLIC~1\MSN6
2009-06-15 16:00 . 2009-05-27 18:13 -------- d-----w- c:\program files\ErrorFix
2009-06-15 15:37 . 2009-06-15 15:37 -------- d-----w- c:\program files\hp deskjet 5550 series
2009-06-15 15:35 . 2009-06-15 15:33 -------- d-----w- c:\program files\Hewlett-Packard
2009-06-14 16:40 . 2009-06-14 16:40 -------- d-----w- c:\program files\Windows Messaging
2009-06-14 15:44 . 2009-03-31 16:30 -------- d-----w- c:\program files\Symantec
2009-06-14 15:44 . 2009-03-31 16:30 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-06-14 15:44 . 2009-03-31 16:30 -------- d-----w- c:\program files\Symantec AntiVirus
2009-06-14 15:44 . 2009-03-31 16:30 -------- d-----w- c:\documents and settings\All Users\Application Data\Symantec
2009-06-13 18:23 . 2009-05-26 19:41 -------- d-----w- c:\program files\Common Files\Real
2009-06-13 18:10 . 2009-05-26 18:03 -------- d-----w- c:\documents and settings\All Users\Application Data\DriverCure
2009-06-13 17:37 . 2009-06-13 17:34 -------- d-----w- c:\program files\CyberLink
2009-06-07 18:40 . 2009-06-07 18:10 -------- d-----w- c:\docume~1\OWNERU~1\APPLIC~1\mjusbsp
2009-05-28 16:00 . 2009-05-27 19:03 -------- d-----w- c:\docume~1\OWNERU~1\APPLIC~1\ErrorFix
2009-05-27 17:58 . 2009-05-27 17:58 -------- d-----w- c:\program files\Belarc
2009-05-27 14:40 . 2009-05-27 14:40 -------- d-----w- c:\program files\VideoLAN
2009-05-27 14:39 . 2009-05-27 14:39 -------- d-----w- c:\program files\Free Offers from Freeze.com
2009-05-26 18:03 . 2009-05-26 18:03 -------- d-----w- c:\documents and settings\All Users\Application Data\ParetoLogic
2009-05-26 16:20 . 2009-02-21 14:53 -------- d-----w- c:\docume~1\OWNERU~1\APPLIC~1\skypePM
2009-05-22 12:38 . 2009-02-21 14:27 -------- d-----w- c:\program files\Common Files\InstallShield
2003-03-31 12:00 . 2003-03-31 12:00 174488 --sha-r- c:\windows\system32\navyqhc.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98} "= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-09-29 325000]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS "= "c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"cdloader "= "c:\documents and settings\Owner User\Application Data\mjusbsp\cdloader2.exe" [2008-12-17 50520]
"ctfmon.exe "= "c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray "= "c:\windows\System32\igfxtray.exe" [2004-11-02 155648]
"HotKeysCmds "= "c:\windows\System32\hkcmd.exe" [2004-11-02 126976]
"HP Software Update "= "c:\program files\HP\HP Software Update\HPWuSchd.exe" [2003-08-04 49152]
"HP Component Manager "= "c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 241664]
"RemoteControl "= "c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2007-03-15 71216]
"LanguageShortcut "= "c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2007-01-09 52256]
"LGODDFU "= "c:\program files\lg_fwupdate\fwupdate.exe" [2007-02-26 249856]
"avast! "= "c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"HPDJ Taskbar Utility "= "c:\windows\System32\spool\drivers\w32x86\3\hpztsb05.exe" [2002-03-18 188416]
"ZoneAlarm Client "= "c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2009-02-16 981384]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 40048]
"SunJavaUpdateSched "= "c:\program files\Java\jre6\bin\jusched.exe" [2009-07-19 148888]

c:\documents and settings\Owner User\Start Menu\Programs\Startup\
Secunia PSI.lnk - c:\program files\Secunia\PSI\psi.exe [2009-3-24 748840]
Webshots.lnk - c:\program files\Webshots\Launcher.exe [2009-1-5 157000]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Find Fast.lnk - c:\program files\Microsoft Office\Office\FINDFAST.EXE [1997-8-6 111376]
Office Startup.lnk - c:\program files\Microsoft Office\Office\OSA.EXE [1997-8-6 51984]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel "= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} "= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 16:05 356352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify "=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall "= 0 (0x0)
"DisableNotifications "= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5166:TCP "= 5166:TCP:yasamy

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [6/14/2009 11:47 AM 114768]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [5/26/2009 10:05 AM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/26/2009 10:05 AM 72944]
R2 AGWinService;AG Windows Service;c:\program files\AGI\common\win32\pythonservice.exe [1/5/2009 8:30 AM 10240]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [7/19/2009 4:00 PM 20560]
S0 TLRecAgent;TLRecAgent; [x]
S2 dbtusyvnk;System Installer;c:\windows\system32\svchost.exe -k netsvcs [3/31/2003 8:00 AM 14336]
S3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [3/24/2009 7:03 AM 7808]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [5/26/2009 10:05 AM 7408]
S3 scusbvip;VL1800 USB Driver; [x]
S3 SLVAD_simple;Zoom Virtual Audio Device; [x]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
dbtusyvnk

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]
c:\windows\system32\rundll32.exe c:\windows\system32\advpack.dll,LaunchINFSectionEx c:\program files\Internet Explorer\clrtour.inf,DefaultInstall.ResetTour,,12
.
Contents of the 'Scheduled Tasks' folder
.
- - - - ORPHANS REMOVED - - - -

URLSearchHooks-{0BC6E3FA-78EF-4886-842C-5A1258C4455A} - (no file)
HKCU-Run-Weather - c:\program files\AWS\WeatherBug\Weather.exe
HKLM-Run-RestartNeroSetup - e:\cds\Nero\Installation\SetupX.exe
Notify-NavLogon - (no file)

.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/?fr=fp-yie8
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearchURL,(Default) = hxxp://toolbar.ask.com/toolbarv/askRedirect?o=101757&gct=&gc=1&q=%s
IE: Add to AMV Converter... - c:\program files\MP3 Player Utilities 4.19\AMVConverter\grab.html
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-19 17:34
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

c:\docume~1\OWNERU~1\LOCALS~1\Temp\Perflib_Perfdata_8fc.dat 16384 bytes

scan completed successfully
hidden files: 1

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\dbtusyvnk]
"ServiceDll "= "c:\windows\System32\navyqhc.dll "
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(520)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
.
Completion time: 2009-07-19 17:36
ComboFix-quarantined-files.txt 2009-07-19 21:36

Pre-Run: 489,997,471,744 bytes free
Post-Run: 489,986,396,160 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT= "Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS= "Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

Current=1 Default=1 Failed=0 LastKnownGood=4 Sets=1,2,3,4
249

DugE · 2009/07/19

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:43:13 PM, on 7/19/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AGI\common\win32\PythonService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\lg_fwupdate\fwupdate.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\Webshots\webshots.scr
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?fr=fp-yie8
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedirect?o=101757&gct=&gc=1&q=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://toolbar.ask.com/toolbarv/askRedirect?o=101757&gct=&gc=1&q=%s
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe "
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe "
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe "
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe "
O4 - HKLM\..\Run: [LGODDFU] "C:\Program Files\lg_fwupdate\fwupdate.exe" blrun
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe "
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe "
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe "
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [cdloader] "C:\Documents and Settings\Owner User\Application Data\mjusbsp\cdloader2.exe" MAGICJACK
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Secunia PSI.lnk = C:\Program Files\Secunia\PSI\psi.exe
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.19\AMVConverter\grab.html
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: AG Windows Service (AGWinService) - Unknown owner - C:\Program Files\AGI\common\win32\PythonService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McciCMService - Motive Communications, Inc. - C:\Program Files\Common Files\Motive\McciCMService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 6468 bytes

broni · 2009/07/19

1. Please open Notepad

Click Start , then Run

Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:
Code:
File::
c:\windows\system32\wisdstr.exe
c:\windows\system32\navyqhc.dll


Folder::

Driver::
TLRecAgent
dbtusyvnk
scusbvip
SLVAD_simple


Registry::
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\dbtusyvnk]
 "ServiceDll "=-

RegLockDel::
3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

Combofix.txt

A new HijackThis log.

DugE · 2009/07/19

ComboFix 09-07-19.02 - Owner User 07/19/2009 19:06.2.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.504.241 [GMT -4:00]
Running from: c:\documents and settings\Owner User\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Owner User\Desktop\CFScript.txt
AV: avast! antivirus 4.8.1335 [VPS 090719-1] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: ZoneAlarm Firewall *enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}

FILE ::
"c:\windows\system32\navyqhc.dll "
"c:\windows\system32\wisdstr.exe "
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\navyqhc.dll
c:\windows\system32\wisdstr.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_DBTUSYVNK
-------\Legacy_TLRECAGENT
-------\Service_dbtusyvnk
-------\Service_scusbvip
-------\Service_SLVAD_simple
-------\Service_TLRecAgent

((((((((((((((((((((((((( Files Created from 2009-06-19 to 2009-07-19 )))))))))))))))))))))))))))))))
.

2009-07-19 21:34 . 2008-04-14 09:42 50176 -c--a-w- c:\windows\system32\dllcache\proquota.exe
2009-07-19 21:34 . 2008-04-14 09:42 50176 ----a-w- c:\windows\system32\proquota.exe
2009-07-19 21:04 . 2009-07-19 21:04 -------- d-sh--w- c:\documents and settings\Owner User\PrivacIE
2009-07-19 21:02 . 2009-07-19 21:02 -------- d-sh--w- c:\documents and settings\Owner User\IETldCache
2009-07-19 21:00 . 2009-07-19 21:07 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo!
2009-07-19 20:57 . 2009-07-19 20:59 -------- dc-h--w- c:\windows\ie8
2009-07-19 20:41 . 2009-07-19 20:41 -------- d--h--w- c:\windows\$hf_mig$
2009-07-19 20:39 . 2009-07-19 20:39 -------- d-----w- c:\program files\Java
2009-07-19 20:38 . 2009-07-19 21:00 -------- d--h--w- c:\windows\msdownld.tmp
2009-07-19 20:38 . 2009-07-19 20:38 -------- d-----w- c:\windows\Logs
2009-07-19 20:34 . 2009-04-06 19:32 15504 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-07-19 20:34 . 2009-04-06 19:32 38496 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-19 20:34 . 2009-07-19 20:34 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-07-19 20:07 . 2009-07-19 20:07 -------- d-----w- c:\program files\Trend Micro
2009-07-19 20:00 . 2009-02-05 20:07 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-07-19 19:53 . 2009-07-19 19:53 -------- d-----w- c:\documents and settings\Owner User\Local Settings\Application Data\Adobe
2009-07-19 19:19 . 2008-04-14 09:41 286720 -c----w- c:\windows\system32\dllcache\blackbox.dll
2009-07-19 19:18 . 2008-04-14 09:42 356352 -c----w- c:\windows\system32\dllcache\msscp.dll
2009-07-19 19:16 . 2008-04-14 02:06 144384 ------w- c:\windows\system32\drivers\hdaudbus.sys
2009-07-19 19:16 . 2008-04-14 04:10 10240 ------w- c:\windows\system32\drivers\sffp_mmc.sys
2009-07-19 18:49 . 2009-07-19 18:49 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-07-19 18:39 . 2009-07-19 18:39 4212 ---ha-w- c:\windows\system32\zllictbl.dat
2009-07-19 18:39 . 2009-02-16 04:10 103816 ----a-w- c:\windows\system32\zlcommdb.dll
2009-07-19 18:39 . 2009-02-16 04:10 69000 ----a-w- c:\windows\system32\zlcomm.dll
2009-07-19 18:38 . 2009-02-16 04:10 1221512 ----a-w- c:\windows\system32\zpeng25.dll
2009-07-19 18:38 . 2009-07-19 18:39 -------- d-----w- c:\windows\system32\ZoneLabs
2009-07-19 18:34 . 2009-07-19 18:34 -------- d-----w- c:\program files\Zone Labs
2009-07-19 18:24 . 2009-07-19 19:25 -------- d-----w- c:\windows\system32\wbem\AutoRecover
2009-07-19 18:19 . 2008-04-14 09:42 9216 ------w- c:\windows\system32\proxycfg.exe
2009-07-19 18:19 . 2008-04-14 09:42 59392 ------w- c:\windows\system32\logman.exe
2009-07-19 18:15 . 2009-07-19 19:23 -------- d-----w- c:\windows\ServicePackFiles
2009-07-19 18:12 . 2008-04-14 03:09 2897920 ------w- c:\windows\system32\xpsp2res.dll
2009-07-19 18:11 . 2009-01-07 22:21 26144 ----a-w- c:\windows\system32\spupdsvc.exe
2009-07-19 18:08 . 2009-07-19 19:09 -------- d-----w- c:\windows\EHome
2009-07-19 17:58 . 2009-07-19 23:12 -------- d-----w- c:\windows\Internet Logs
2009-07-19 17:58 . 2009-07-19 20:55 -------- d-----w- C:\Downloads
2009-07-19 17:37 . 2009-07-19 17:37 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-07-19 17:37 . 2009-07-19 18:50 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-07-19 17:37 . 2009-07-19 18:50 -------- d-----w- c:\docume~1\OWNERU~1\APPLIC~1\SUPERAntiSpyware.com
2009-07-19 17:29 . 2009-07-19 17:29 -------- d-----w- c:\docume~1\OWNERU~1\APPLIC~1\Malwarebytes
2009-07-19 17:29 . 2009-07-19 17:29 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-07-19 17:28 . 2009-07-19 17:28 -------- d-----w- c:\windows\system32\unknown
2009-07-19 16:10 . 2009-07-19 16:10 -------- d-----w- c:\program files\MP3 Player Utilities 4.19
2009-07-13 21:21 . 2009-07-13 21:21 -------- d-----w- c:\docume~1\OWNERU~1\APPLIC~1\Titanium Gears
2009-07-13 21:16 . 2009-07-13 21:16 -------- d-----w- c:\documents and settings\All Users\Application Data\Winferno
2009-07-13 21:12 . 2009-07-13 21:12 -------- d-----w- c:\documents and settings\Owner User\Local Settings\Application Data\WeatherBug
2009-07-13 21:12 . 2009-07-13 21:12 -------- d-----w- c:\docume~1\OWNERU~1\APPLIC~1\WeatherBug
2009-07-13 21:11 . 2009-07-13 21:11 -------- d-----w- c:\docume~1\OWNERU~1\APPLIC~1\Yahoo!
2009-07-11 22:22 . 2009-07-11 22:22 1 ---h--w- c:\windows\jmmark2.dat
2009-07-11 22:22 . 2009-07-11 22:22 1 ---h--w- c:\windows\bf23567.dat
2009-07-11 13:59 . 2009-07-15 23:02 -------- d-----w- c:\program files\PC_Security2009
2009-07-11 04:09 . 2009-07-11 04:48 -------- d-----w- c:\docume~1\OWNERU~1\APPLIC~1\LimeWire
2009-07-11 04:08 . 2009-07-19 20:39 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-07-11 03:30 . 2009-07-11 03:30 -------- d-----w- c:\program files\AskSearch
2009-07-11 03:30 . 2009-07-19 18:39 -------- d-----w- c:\program files\AskBarDis
2009-07-03 00:45 . 2009-07-19 21:09 -------- d-----w- c:\program files\Yahoo!
2009-07-02 23:42 . 2009-07-04 00:08 -------- d-----w- c:\docume~1\OWNERU~1\APPLIC~1\Motive
2009-07-02 23:41 . 2009-07-02 23:41 -------- d-----w- c:\program files\ATT-HSI
2009-07-02 23:41 . 2009-07-02 23:41 -------- d-----w- c:\program files\Common Files\Motive
2009-07-02 23:39 . 2009-07-02 23:39 -------- d-----w- c:\documents and settings\All Users\Application Data\Motive
2009-07-02 00:19 . 2009-07-02 00:19 284 ----a-w- c:\windows\EReg077.dat
2009-07-02 00:19 . 2009-07-02 00:19 -------- d-----w- C:\TLC
2009-06-21 21:23 . 2008-06-21 14:48 19840 ----a-w- c:\windows\system32\drivers\StMp3Rec.sys
2009-06-21 21:23 . 2009-06-21 21:24 -------- d-----w- c:\program files\Philips
2009-06-21 21:22 . 2009-06-21 21:22 -------- d-----w- c:\docume~1\OWNERU~1\APPLIC~1\InstallShield
2009-06-21 13:53 . 2009-06-21 13:53 -------- d-----w- c:\documents and settings\Owner User\acdc
2009-06-21 00:57 . 2009-06-21 00:57 -------- d-----w- c:\docume~1\OWNERU~1\APPLIC~1\DivX
2009-06-20 02:40 . 2009-07-13 20:18 -------- d-----w- c:\program files\InterActual

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-19 23:14 . 2009-06-13 17:39 -------- d-----w- c:\program files\lg_fwupdate
2009-07-19 19:56 . 2009-06-13 17:32 -------- d-----w- c:\program files\Common Files\Adobe
2009-07-19 19:26 . 2009-01-04 16:48 76487 ----a-w- c:\windows\PCHealth\HelpCtr\OfflineCache\index.dat
2009-07-19 18:25 . 2009-05-27 04:33 15920 ----a-w- c:\documents and settings\Owner User\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-07-09 16:59 . 2009-06-19 14:01 -------- d-----w- c:\docume~1\OWNERU~1\APPLIC~1\ACD Systems
2009-07-06 05:54 . 2009-06-15 17:48 10638 ----a-w- c:\documents and settings\All Users\Application Data\DVDXStudio\CloneDVD4\MainApp.dll
2009-07-06 05:54 . 2009-06-15 17:48 -------- d-----w- c:\docume~1\OWNERU~1\APPLIC~1\Vso
2009-06-27 01:14 . 2009-01-05 12:32 -------- d-----w- c:\program files\Webshots
2009-06-21 21:24 . 2009-02-21 14:28 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-06-21 19:56 . 2009-06-15 17:48 -------- d-----w- c:\program files\CloneDVD
2009-06-21 00:58 . 2009-06-14 13:38 -------- d-----w- c:\docume~1\OWNERU~1\APPLIC~1\CyberLink
2009-06-21 00:57 . 2009-06-14 13:38 -------- d-----w- c:\documents and settings\All Users\Application Data\CyberLink
2009-06-18 15:37 . 2009-06-15 00:51 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
2009-06-18 15:34 . 2009-01-06 22:54 -------- d-----w- c:\program files\Aquatica 3D
2009-06-15 18:03 . 2009-06-15 18:01 -------- d-----w- c:\program files\ACD Systems
2009-06-15 18:01 . 2009-06-15 18:01 -------- d-----w- c:\program files\Common Files\ACD Systems
2009-06-15 18:01 . 2009-06-15 18:01 -------- d-----w- c:\documents and settings\All Users\Application Data\ACD Systems
2009-06-15 17:48 . 2009-06-15 17:48 81920 ----a-w- c:\docume~1\OWNERU~1\APPLIC~1\ezpinst.exe
2009-06-15 17:48 . 2009-06-15 17:48 47360 ----a-w- c:\windows\system32\drivers\pcouffin.sys
2009-06-15 17:48 . 2009-06-15 17:48 47360 ----a-w- c:\docume~1\OWNERU~1\APPLIC~1\pcouffin.sys
2009-06-15 17:48 . 2009-06-15 17:48 -------- d-----w- c:\documents and settings\All Users\Application Data\DVDXStudio
2009-06-15 17:35 . 2009-04-07 20:09 -------- d-----w- c:\docume~1\OWNERU~1\APPLIC~1\MSN6
2009-06-15 16:00 . 2009-05-27 18:13 -------- d-----w- c:\program files\ErrorFix
2009-06-15 15:37 . 2009-06-15 15:37 -------- d-----w- c:\program files\hp deskjet 5550 series
2009-06-15 15:35 . 2009-06-15 15:33 -------- d-----w- c:\program files\Hewlett-Packard
2009-06-14 16:40 . 2009-06-14 16:40 -------- d-----w- c:\program files\Windows Messaging
2009-06-14 15:44 . 2009-03-31 16:30 -------- d-----w- c:\program files\Symantec
2009-06-14 15:44 . 2009-03-31 16:30 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-06-14 15:44 . 2009-03-31 16:30 -------- d-----w- c:\program files\Symantec AntiVirus
2009-06-14 15:44 . 2009-03-31 16:30 -------- d-----w- c:\documents and settings\All Users\Application Data\Symantec
2009-06-13 18:23 . 2009-05-26 19:41 -------- d-----w- c:\program files\Common Files\Real
2009-06-13 18:10 . 2009-05-26 18:03 -------- d-----w- c:\documents and settings\All Users\Application Data\DriverCure
2009-06-13 17:37 . 2009-06-13 17:34 -------- d-----w- c:\program files\CyberLink
2009-06-07 18:40 . 2009-06-07 18:10 -------- d-----w- c:\docume~1\OWNERU~1\APPLIC~1\mjusbsp
2009-05-28 16:00 . 2009-05-27 19:03 -------- d-----w- c:\docume~1\OWNERU~1\APPLIC~1\ErrorFix
2009-05-27 17:58 . 2009-05-27 17:58 -------- d-----w- c:\program files\Belarc
2009-05-27 14:40 . 2009-05-27 14:40 -------- d-----w- c:\program files\VideoLAN
2009-05-27 14:39 . 2009-05-27 14:39 -------- d-----w- c:\program files\Free Offers from Freeze.com
2009-05-26 18:03 . 2009-05-26 18:03 -------- d-----w- c:\documents and settings\All Users\Application Data\ParetoLogic
2009-05-26 16:20 . 2009-02-21 14:53 -------- d-----w- c:\docume~1\OWNERU~1\APPLIC~1\skypePM
2009-05-22 12:38 . 2009-02-21 14:27 -------- d-----w- c:\program files\Common Files\InstallShield
.

((((((((((((((((((((((((((((( SnapShot@2009-07-19_21.34.25 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-19 23:14 . 2009-07-19 23:14 16384 c:\windows\Temp\Perflib_Perfdata_564.dat
+ 2003-03-31 12:00 . 2009-07-19 22:44 52968 c:\windows\system32\perfc009.dat
- 2003-03-31 12:00 . 2009-07-19 19:32 52968 c:\windows\system32\perfc009.dat
+ 2003-03-31 12:00 . 2009-07-19 22:44 380680 c:\windows\system32\perfh009.dat
- 2003-03-31 12:00 . 2009-07-19 19:32 380680 c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98} "= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-09-29 325000]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"cdloader "= "c:\documents and settings\Owner User\Application Data\mjusbsp\cdloader2.exe" [2008-12-17 50520]
"ctfmon.exe "= "c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray "= "c:\windows\System32\igfxtray.exe" [2004-11-02 155648]
"HotKeysCmds "= "c:\windows\System32\hkcmd.exe" [2004-11-02 126976]
"HP Software Update "= "c:\program files\HP\HP Software Update\HPWuSchd.exe" [2003-08-04 49152]
"HP Component Manager "= "c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 241664]
"RemoteControl "= "c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2007-03-15 71216]
"LanguageShortcut "= "c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2007-01-09 52256]
"LGODDFU "= "c:\program files\lg_fwupdate\fwupdate.exe" [2007-02-26 249856]
"avast! "= "c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"HPDJ Taskbar Utility "= "c:\windows\System32\spool\drivers\w32x86\3\hpztsb05.exe" [2002-03-18 188416]
"ZoneAlarm Client "= "c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2009-02-16 981384]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 40048]
"SunJavaUpdateSched "= "c:\program files\Java\jre6\bin\jusched.exe" [2009-07-19 148888]

c:\documents and settings\Owner User\Start Menu\Programs\Startup\
Webshots.lnk - c:\program files\Webshots\Launcher.exe [2009-1-5 157000]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Find Fast.lnk - c:\program files\Microsoft Office\Office\FINDFAST.EXE [1997-8-6 111376]
Office Startup.lnk - c:\program files\Microsoft Office\Office\OSA.EXE [1997-8-6 51984]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel "= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} "= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 16:05 356352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify "=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall "= 0 (0x0)
"DisableNotifications "= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5166:TCP "= 5166:TCP:yasamy

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [6/14/2009 11:47 AM 114768]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [5/26/2009 10:05 AM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/26/2009 10:05 AM 72944]
R2 AGWinService;AG Windows Service;c:\program files\AGI\common\win32\pythonservice.exe [1/5/2009 8:30 AM 10240]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [7/19/2009 4:00 PM 20560]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [5/26/2009 10:05 AM 7408]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]
c:\windows\system32\rundll32.exe c:\windows\system32\advpack.dll,LaunchINFSectionEx c:\program files\Internet Explorer\clrtour.inf,DefaultInstall.ResetTour,,12
.
- - - - ORPHANS REMOVED - - - -

URLSearchHooks-{0BC6E3FA-78EF-4886-842C-5A1258C4455A} - (no file)

.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/?fr=fp-yie8
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearchURL,(Default) = hxxp://toolbar.ask.com/toolbarv/askRedirect?o=101757&gct=&gc=1&q=%s
IE: Add to AMV Converter... - c:\program files\MP3 Player Utilities 4.19\AMVConverter\grab.html
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-19 19:14
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(528)
c:\program files\SUPERAntiSpyware\SASWINLO.dll

- - - - - - - > 'explorer.exe'(3020)
c:\windows\system32\ieframe.dll
c:\windows\system32\OneX.DLL
c:\windows\system32\eappprxy.dll
c:\windows\system32\webcheck.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ZoneLabs\vsmon.exe
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Motive\McciCMService.exe
c:\program files\CyberLink\Shared Files\RichVideo.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\program files\Webshots\Webshots.scr
.
**************************************************************************
.
Completion time: 2009-07-19 19:18 - machine was rebooted
ComboFix-quarantined-files.txt 2009-07-19 23:17
ComboFix2.txt 2009-07-19 21:36

Pre-Run: 489,993,957,376 bytes free
Post-Run: 489,918,038,016 bytes free

Current=1 Default=1 Failed=0 LastKnownGood=4 Sets=1,2,3,4
253

DugE · 2009/07/19

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:20:30 PM, on 7/19/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AGI\common\win32\PythonService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\lg_fwupdate\fwupdate.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\Webshots\webshots.scr
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?fr=fp-yie8
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedirect?o=101757&gct=&gc=1&q=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://toolbar.ask.com/toolbarv/askRedirect?o=101757&gct=&gc=1&q=%s
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe "
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe "
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe "
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe "
O4 - HKLM\..\Run: [LGODDFU] "C:\Program Files\lg_fwupdate\fwupdate.exe" blrun
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe "
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe "
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe "
O4 - HKCU\..\Run: [cdloader] "C:\Documents and Settings\Owner User\Application Data\mjusbsp\cdloader2.exe" MAGICJACK
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.19\AMVConverter\grab.html
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: AG Windows Service (AGWinService) - Unknown owner - C:\Program Files\AGI\common\win32\PythonService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McciCMService - Motive Communications, Inc. - C:\Program Files\Common Files\Motive\McciCMService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 6276 bytes

broni · 2009/07/19

Uninstall Combofix:
Go Start > Run
Type in:
combofix /u
Note the space between the "combofix" and the "/u "
Restart computer.

Print these instructions out.

NOTE. If any of the programs listed below refuse to run, try renaming executive file to something else; for instance, rename hijackthis.exe to scanner.exe

***VERY IMPORTANT! Make sure, you update Superantispyware, and Malwarebytes before running the scans.***

STEP 1. Download SUPERAntiSpyware Free for Home Users:
http://www.superantispyware.com/

* Double-click SUPERAntiSpyware.exe and use the default settings for installation.
* An icon will be created on your desktop. Double-click that icon to launch the program.
* If asked to update the program definitions, click "Yes ". If not, update the definitions before scanning by selecting "Check for Updates ". (If you encounter any problems while downloading the updates, manually download and unzip them from here: http://www.superantispyware.com/definitions.html.)
* Close SUPERAntiSpyware.

PHYSICALLY DISCONNECT FROM THE INTERNET

Restart computer in Safe Mode.
To enter Safe Mode, restart computer, and keep tapping F8 key, until menu appears; select Safe Mode; you'll see "Safe Mode" in all four corners of your screen

* Open SUPERAntiSpyware.
* Click Scan your Computer... button.
* Click Scanning Preferences/Control Center... button.
* Under General and Startup tab, make sure, Start SUPERAntiSpyware when Windows starts option is UN-checked.
* Click the Scanning Control tab.
* Under Scanner Options make sure the following are checked (leave all others unchecked):
- Close browsers before scanning.
- Terminate memory threats before quarantining.
* Click the Close button to leave the control center screen.
* On the left, make sure you check C:\Fixed Drive.
* On the right, choose Perform Complete Scan.
* Click Next to start the scan. Please be patient while it scans your computer.
* After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click OK.
* Make sure everything has a checkmark next to it and click Next.
* A notification will appear that Quarantine and Removal is Complete. Click OK and then click the Finish button to return to the main menu.
* If asked if you want to reboot, click Yes.
* To retrieve the removal information after reboot, launch SUPERAntispyware again.
- Click Preferences, then click the Statistics/Logs tab.
- Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
- If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
- Please copy and paste the Scan Log results in your next reply.
* Click Close to exit the program.
Post SUPERAntiSpyware log.

RECONNECT TO THE INTERNET

RESTART COMPUTER!

STEP 2. Download Malwarebytes' Anti-Malware: http://www.malwarebytes.org/mbam.php to your desktop.
(Malwarebytes is free to use as a manual scanner. Payment is only required if you wish to have it run and update automatically which is not necessary for our purposes)

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.

The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

RESTART COMPUTER!

STEP 3.
Post fresh HijackThis log.
Do NOT attempt to "fix" anything!

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

DugE · 2009/07/19

ASUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 07/19/2009 at 09:32 PM

Application Version : 4.26.1006

Core Rules Database Version : 4004
Trace Rules Database Version: 1944

Scan type : Quick Scan
Total Scan Time : 00:25:34

Memory items scanned : 216
Memory threats detected : 0
Registry items scanned : 346
Registry threats detected : 1
File items scanned : 10577
File threats detected : 10

Rogue.PCSecurity2009
HKLM\SOFTWARE\PC_Security2009
C:\Program Files\PC_SECURITY2009\data\daily.cvd
C:\Program Files\PC_SECURITY2009\data
C:\Program Files\PC_SECURITY2009\htmlayout.dll
C:\Program Files\PC_SECURITY2009\Microsoft.VC80.CRT\Microsoft.VC80.CRT.manifest
C:\Program Files\PC_SECURITY2009\Microsoft.VC80.CRT\msvcm80.dll
C:\Program Files\PC_SECURITY2009\Microsoft.VC80.CRT\msvcp80.dll
C:\Program Files\PC_SECURITY2009\Microsoft.VC80.CRT\msvcr80.dll
C:\Program Files\PC_SECURITY2009\Microsoft.VC80.CRT
C:\Program Files\PC_SECURITY2009\pthreadVC2.dll
C:\Program Files\PC_SECURITY2009

======================================================

Malwarebytes' Anti-Malware 1.39
Database version: 2421
Windows 5.1.2600 Service Pack 3

7/19/2009 9:43:45 PM
mbam-log-2009-07-19 (21-43-45).txt

Scan type: Quick Scan
Objects scanned: 81167
Time elapsed: 6 minute(s), 18 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 1
Registry Data Items Infected: 1
Folders Infected: 7
Files Infected: 83

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\ErrorFix (Rogue.ErrorFix) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\ErrorFix (Rogue.ErrorFix) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ForceClassicControlPanel (Hijack.ControlPanelStyle) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
C:\Documents and Settings\Owner User\Application Data\ErrorFix (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\Logs (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\QuarantineW (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\quarantinew\2009-05-28 12-03-120 (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\quarantinew\2009-06-14 12-00-570 (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\Results (Rogue.ErrorFix) -> Quarantined and deleted successfully.
C:\Program Files\ErrorFix (Rogue.ErrorFix) -> Quarantined and deleted successfully.

Files Infected:
c:\documents and settings\owner user\application data\ErrorFix\database.tmp (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\spy_ignore.db (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\Logs\2009-05-27 15-03-060.log (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\Logs\2009-05-28 10-00-580.log (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\Logs\2009-05-28 10-05-010.log (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\Logs\2009-05-28 12-00-000.log (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\Logs\2009-05-28 12-00-001.log (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\Logs\2009-06-04 16-32-410.log (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\Logs\2009-06-05 14-04-030.log (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\Logs\2009-06-05 14-19-070.log (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\Logs\2009-06-14 12-00-020.log (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\Logs\2009-06-14 12-00-021.log (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\Logs\2009-06-15 12-00-030.log (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\Logs\2009-06-15 12-00-031.log (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\quarantinew\2009-05-28 12-03-120\filelist.db (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\quarantinew\2009-05-28 12-03-120\regb-0.db (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\quarantinew\2009-05-28 12-03-120\regb-1.db (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\quarantinew\2009-05-28 12-03-120\regb-10.db (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\quarantinew\2009-05-28 12-03-120\regb-11.db (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\quarantinew\2009-05-28 12-03-120\regb-12.db (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\quarantinew\2009-05-28 12-03-120\regb-13.db (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\quarantinew\2009-05-28 12-03-120\regb-14.db (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\quarantinew\2009-05-28 12-03-120\regb-15.db (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\quarantinew\2009-05-28 12-03-120\regb-16.db (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\quarantinew\2009-05-28 12-03-120\regb-17.db (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\quarantinew\2009-05-28 12-03-120\regb-18.db (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\quarantinew\2009-05-28 12-03-120\regb-19.db (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\quarantinew\2009-05-28 12-03-120\regb-2.db (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\quarantinew\2009-05-28 12-03-120\regb-20.db (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\quarantinew\2009-05-28 12-03-120\regb-21.db (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\quarantinew\2009-05-28 12-03-120\regb-22.db (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\quarantinew\2009-05-28 12-03-120\regb-23.db (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\quarantinew\2009-05-28 12-03-120\regb-24.db (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\quarantinew\2009-05-28 12-03-120\regb-25.db (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\quarantinew\2009-05-28 12-03-120\regb-26.db (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\quarantinew\2009-05-28 12-03-120\regb-27.db (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\quarantinew\2009-05-28 12-03-120\regb-28.db (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\quarantinew\2009-05-28 12-03-120\regb-29.db (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\quarantinew\2009-05-28 12-03-120\regb-3.db (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\quarantinew\2009-05-28 12-03-120\regb-30.db (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\quarantinew\2009-05-28 12-03-120\regb-31.db (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\quarantinew\2009-05-28 12-03-120\regb-32.db (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\quarantinew\2009-05-28 12-03-120\regb-33.db (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\quarantinew\2009-05-28 12-03-120\regb-34.db (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\quarantinew\2009-05-28 12-03-120\regb-35.db (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\quarantinew\2009-05-28 12-03-120\regb-36.db (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\quarantinew\2009-05-28 12-03-120\regb-37.db (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\quarantinew\2009-05-28 12-03-120\regb-38.db (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\quarantinew\2009-05-28 12-03-120\regb-39.db (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\quarantinew\2009-05-28 12-03-120\regb-4.db (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\quarantinew\2009-05-28 12-03-120\regb-40.db (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\quarantinew\2009-05-28 12-03-120\regb-41.db (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\quarantinew\2009-05-28 12-03-120\regb-42.db (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\quarantinew\2009-05-28 12-03-120\regb-43.db (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\quarantinew\2009-05-28 12-03-120\regb-44.db (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\quarantinew\2009-05-28 12-03-120\regb-45.db (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\quarantinew\2009-05-28 12-03-120\regb-46.db (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\quarantinew\2009-05-28 12-03-120\regb-47.db (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\quarantinew\2009-05-28 12-03-120\regb-48.db (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\quarantinew\2009-05-28 12-03-120\regb-49.db (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\quarantinew\2009-05-28 12-03-120\regb-5.db (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\quarantinew\2009-05-28 12-03-120\regb-50.db (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\quarantinew\2009-05-28 12-03-120\regb-51.db (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\quarantinew\2009-05-28 12-03-120\regb-52.db (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\quarantinew\2009-05-28 12-03-120\regb-53.db (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\quarantinew\2009-05-28 12-03-120\regb-54.db (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\quarantinew\2009-05-28 12-03-120\regb-55.db (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\quarantinew\2009-05-28 12-03-120\regb-56.db (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\quarantinew\2009-05-28 12-03-120\regb-57.db (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\quarantinew\2009-05-28 12-03-120\regb-58.db (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\quarantinew\2009-05-28 12-03-120\regb-6.db (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\quarantinew\2009-05-28 12-03-120\regb-7.db (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\quarantinew\2009-05-28 12-03-120\regb-8.db (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\quarantinew\2009-05-28 12-03-120\regb-9.db (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\quarantinew\2009-06-14 12-00-570\filelist.db (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\Results\Evidence.db (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\Results\Junk.db (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\Results\Registry.db (Rogue.ErrorFix) -> Quarantined and deleted successfully.
c:\documents and settings\owner user\application data\ErrorFix\Results\Update.db (Rogue.ErrorFix) -> Quarantined and deleted successfully.
C:\WINDOWS\bf23567.dat (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\WINDOWS\jmmark2.dat (Worm.KoobFace) -> Quarantined and deleted successfully.
c:\WINDOWS\934fdfg34fgjf23 (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner User\Application Data\Microsoft\Internet Explorer\Quick Launch\PC_Security2009.lnk (Rogue.PCSecurity2009) -> Quarantined and deleted successfully.

DugE · 2009/07/19

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:55:20 PM, on 7/19/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AGI\common\win32\PythonService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\lg_fwupdate\fwupdate.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\Webshots\webshots.scr
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?fr=fp-yie8
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedirect?o=101757&gct=&gc=1&q=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://toolbar.ask.com/toolbarv/askRedirect?o=101757&gct=&gc=1&q=%s
R3 - URLSearchHook: (no name) - {0BC6E3FA-78EF-4886-842C-5A1258C4455A} - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe "
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe "
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe "
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe "
O4 - HKLM\..\Run: [LGODDFU] "C:\Program Files\lg_fwupdate\fwupdate.exe" blrun
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe "
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe "
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe "
O4 - HKCU\..\Run: [cdloader] "C:\Documents and Settings\Owner User\Application Data\mjusbsp\cdloader2.exe" MAGICJACK
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.19\AMVConverter\grab.html
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: AG Windows Service (AGWinService) - Unknown owner - C:\Program Files\AGI\common\win32\PythonService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McciCMService - Motive Communications, Inc. - C:\Program Files\Common Files\Motive\McciCMService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 6491 bytes

broni · 2009/07/19

Download Dr.Web CureIt to the desktop:
ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe

Doubleclick the drweb-cureit.exe file and click Scan to run express scan. Click OK in pop-up window to allow scan.

This will scan the files currently running in memory and when something is found, click the Yes button when it asks you if you want to cure it. This is only a short scan.

Once the short scan has finished, select Complete scan.

Click the green arrow at the right, and the scan will start.

Click Yes to all if it asks if you want to cure/move the file.

When the scan has finished, in the menu, click File and choose Save report list

Save the report to your desktop. The report will be called DrWeb.csv

Close Dr.Web Cureit.

Important! Reboot your computer because it could be possible that files in use will be moved/deleted during reboot.

Copy and paste that log in the next reply. You can use Notepad to open the DrWeb.cvs report.

NOTE. During the scan, pop-up window will open asking for full version purchase. Simply close the window by clicking on X in upper right corner.

Post fresh HijackThis log as well.

DugE · 2009/07/20

Broni, the save report thingy is greyed out so I cant save a log. It came up clean tho, no infections found. Still need a hijack log?

broni · 2009/07/20

No. Let me check the log, you posted already.

broni · 2009/07/20

Please download JavaRa to your desktop and unzip it to its own folder

Run JavaRa.exe, pick the language of your choice and click Select. Then click Remove Older Versions.

Accept any prompts.

Open JavaRa.exe again and select Search For Updates.

Select Update Using Sun Java's Website then click Search and click on the Open Webpage button. Download and install the latest Java Runtime Environment (JRE) version for your computer.

Note 1: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.

Note 2: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. If you don't want to run another extra service, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and restart your computer.

================================================================

Go to Add\Remove, and uninstall AskBarDis.

================================================================

Print this post out, since you won't have an access to it, at some point.

1. Open HijackThis.

2. Close all windows, except for HijackThis.

3. Put checkmarks next to the following HijackThis entries:

- R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://toolbar.ask.com/toolbarv/askR...7&gct=&gc=1&q=
- R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://toolbar.ask.com/toolbarv/askR...gct=&gc=1&q=%s
- R3 - URLSearchHook: (no name) - {0BC6E3FA-78EF-4886-842C-5A1258C4455A} - (no file)
- O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
- O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll

4. You should also checkmark following entries (these are unnecessary startups; no actual programs will be removed):

- O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
- O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe "
- O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe "
- O4 - HKLM\..\Run: [LGODDFU] "C:\Program Files\lg_fwupdate\fwupdate.exe" blrun
- O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe "
- O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
- O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
- O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

5. Click on Fix checked button.

6. Restart computer.

7. Post new HijackThis log.

DugE · 2009/07/22

Ok we made it back but the link for JavaRa is not working. Got another?

Never mind. Found version 1.12

broni · 2009/07/22

Found version 1.12
Click to expand...

??

http://java.sun.com/javase/downloads/index.jsp
JRE 6 Update 14

DugE · 2009/07/22

version 1.12 of JavaRa

broni · 2009/07/22

Download, and install this:

http://java.sun.com/javase/downloads/index.jsp
JRE 6 Update 14
Click to expand...

DugE · 2009/07/22

he is
thx

This is the first time he's been on a computer. I was at his house to help him when I first made this post.

Now I'm 60 miles from him and trying to help him via email. Very tough but I still have my hair so far.

We getting there.

broni · 2009/07/22

Ok, ok.....lol

Log in or Sign up

Active Used computer full of bugs

DugE Well-Known Member Thread Starter

broni Moderator Malware Analyst

DugE Well-Known Member Thread Starter

DugE Well-Known Member Thread Starter

broni Moderator Malware Analyst

DugE Well-Known Member Thread Starter

DugE Well-Known Member Thread Starter

broni Moderator Malware Analyst

DugE Well-Known Member Thread Starter

DugE Well-Known Member Thread Starter

broni Moderator Malware Analyst

DugE Well-Known Member Thread Starter

broni Moderator Malware Analyst

broni Moderator Malware Analyst

DugE Well-Known Member Thread Starter

broni Moderator Malware Analyst

DugE Well-Known Member Thread Starter

broni Moderator Malware Analyst

DugE Well-Known Member Thread Starter

broni Moderator Malware Analyst

Share This Page

Log in or Sign up

Active Used computer full of bugs

DugE Well-Known Member Thread Starter

broni Moderator Malware Analyst

DugE Well-Known Member Thread Starter

DugE Well-Known Member Thread Starter

broni Moderator Malware Analyst

DugE Well-Known Member Thread Starter

DugE Well-Known Member Thread Starter

broni Moderator Malware Analyst

DugE Well-Known Member Thread Starter

DugE Well-Known Member Thread Starter

broni Moderator Malware Analyst

DugE Well-Known Member Thread Starter

broni Moderator Malware Analyst

broni Moderator Malware Analyst

DugE Well-Known Member Thread Starter

broni Moderator Malware Analyst

DugE Well-Known Member Thread Starter

broni Moderator Malware Analyst

DugE Well-Known Member Thread Starter

broni Moderator Malware Analyst

Share This Page

Useful Searches