1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Warning! Spyware detected on your computer

Discussion in 'Malware and Virus Removal Archive' started by lvdlr, 2008/08/31.

Page 2 of 2
  1. 2008/09/01
    lvdlr

    lvdlr Inactive Thread Starter

    Joined:
    2008/08/31
    Messages:
    15
    Likes Received:
    0
    ComboFix 08-09-01.01 - Gary 2008-09-01 21:58:57.1 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.226 [GMT -4:00]
    Running from: C:\Team logos\ComboFix.exe
    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\Documents and Settings\Gary\Application Data\macromedia\Flash Player\#SharedObjects\4S2WZPUN\bin.clearspring.com
    C:\Documents and Settings\Gary\Application Data\macromedia\Flash Player\#SharedObjects\4S2WZPUN\bin.clearspring.com\clearspring.sol
    C:\Documents and Settings\Gary\Application Data\macromedia\Flash Player\#SharedObjects\4S2WZPUN\iforex.com
    C:\Documents and Settings\Gary\Application Data\macromedia\Flash Player\#SharedObjects\4S2WZPUN\iforex.com\Emerp\Events\flash_object.swf\user_data.sol
    C:\Documents and Settings\Gary\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#bin.clearspring.com
    C:\Documents and Settings\Gary\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#bin.clearspring.com\settings.sol
    C:\Documents and Settings\Gary\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com
    C:\Documents and Settings\Gary\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com\settings.sol
    C:\WINDOWS\Downloaded Program Files\Temp
    C:\WINDOWS\system32\drivers\ApiMon.sys
    C:\WINDOWS\system32\REGOBJ.DLL
    C:\WINDOWS\system32\stera.log

    .
    ((((((((((((((((((((((((( Files Created from 2008-08-02 to 2008-09-02 )))))))))))))))))))))))))))))))
    .

    2008-09-01 12:14 . 2008-09-01 12:14 <DIR> d-------- C:\Documents and Settings\Gary\Application Data\Malwarebytes
    2008-09-01 12:14 . 2008-08-17 15:01 38,472 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\mbamswissarmy.sys
    2008-09-01 12:14 . 2008-08-17 15:01 17,144 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\mbam.sys
    2008-09-01 12:13 . 2008-09-01 12:14 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-09-01 12:13 . 2008-09-01 12:13 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-09-01 00:51 . 2008-09-01 00:51 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
    2008-09-01 00:08 . 2008-09-01 00:08 <DIR> d-------- C:\Program Files\Trend Micro
    2008-08-31 22:48 . 2008-08-31 22:48 <DIR> d-------- C:\Program Files\sllmule
    2008-08-31 22:48 . 2008-08-31 22:49 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\puhiryvg
    2008-08-31 22:48 . 2008-08-31 22:48 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\pmfctibi
    2008-08-31 22:48 . 2008-08-31 22:48 81,920 --a------ C:\WINDOWS\SYSTEM32\hcfevevo.exe
    2008-08-23 03:13 . 2008-05-01 10:30 331,776 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\msadce.dll
    2008-08-11 02:04 . 2008-08-11 02:04 <DIR> d-------- C:\Program Files\Garmin GPS Plugin
    2008-08-11 02:04 . 2008-08-11 02:04 <DIR> d-------- C:\Garmin
    2008-08-11 02:04 . 2008-08-11 02:04 <DIR> d-------- C:\Documents and Settings\Gary\Application Data\GARMIN
    2008-08-06 22:47 . 2008-08-06 22:47 47,328 --ah----- C:\WINDOWS\SYSTEM32\mlfcache.dat
    2008-08-05 21:33 . 2008-08-05 21:34 <DIR> d-------- C:\Program Files\Safari

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-09-01 04:52 --------- d-----w C:\Program Files\Lavasoft
    2008-09-01 04:52 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
    2008-08-31 06:33 --------- d-----w C:\Program Files\DraftDominator
    2008-08-30 04:16 --------- d-----w C:\Program Files\LineupDominator
    2008-08-23 14:50 --------- d-----w C:\Program Files\MFL Import
    2008-08-17 03:21 --------- d-----w C:\Program Files\Java
    2008-08-06 01:40 --------- d-----w C:\Documents and Settings\Gary\Application Data\Apple Computer
    2008-08-06 01:34 --------- d-----w C:\Program Files\Apple Software Update
    2008-07-28 16:17 --------- d-----w C:\Program Files\Sun
    2008-07-20 04:42 --------- d-----w C:\Program Files\Nirvana
    2008-07-20 04:36 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-07-18 05:46 --------- d-----w C:\Program Files\Common Files\Business Objects
    2008-07-18 03:16 --------- d-----w C:\Program Files\Reference Assemblies
    2008-07-18 03:16 --------- d-----w C:\Program Files\MSBuild
    2008-07-18 03:07 --------- d-----w C:\Program Files\MSXML 6.0
    2008-07-07 20:32 253,952 ----a-w C:\WINDOWS\SYSTEM32\es.dll
    2008-07-07 20:32 253,952 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\es.dll
    2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\SYSTEM32\mscms.dll
    2008-06-24 16:23 74,240 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\mscms.dll
    2008-06-24 14:57 3,592,192 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\mshtml.dll
    2008-06-23 09:20 70,656 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\ie4uinit.exe
    2008-06-23 09:20 625,664 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\iexplore.exe
    2008-06-23 09:20 13,824 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\ieudinit.exe
    2008-06-21 05:23 161,792 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\ieakui.dll
    2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\SYSTEM32\mswsock.dll
    2008-06-20 17:41 245,248 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\mswsock.dll
    2008-06-20 17:41 148,992 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\dnsapi.dll
    2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\tcpip.sys
    2008-06-20 10:44 138,368 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\afd.sys
    2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\tcpip6.sys
    2008-06-13 13:10 272,128 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\bthport.sys
    2003-05-22 06:57 207,758 ----a-w C:\Program Files\INSTALL.LOG
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Uniblue RegistryBooster 2 "= "C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe" [2008-02-01 10:51 1885464]
    "ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:56 15360]
    "AIM "= "C:\PROGRA~1\AIM\aim.exe" [2005-08-05 16:08 67160]
    "procdscapp "= "C:\WINDOWS\system32\hcfevevo.exe" [2008-08-31 22:48 81920]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "NvCplDaemon "= "C:\WINDOWS\system32\NvCpl.dll" [2003-10-06 16:16 5058560]
    "Ulead AutoDetector v2 "= "C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe" [2004-08-27 20:22 90112]
    "SunJavaUpdateSched "= "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
    "NvMediaCenter "= "C:\WINDOWS\System32\NvMcTray.dll" [2003-10-06 16:16 49152]
    "MSConfig "= "C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2004-08-04 03:56 158208]
    "QuickTime Task "= "C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696]
    "iTunesHelper "= "C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-06-05 22:21:33 113664]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
    "AppApiMon "= {24FC040B-A820-5A81-3E3F-093B079E45A0} - C:\Program Files\sllmule\AppApiMon.dll [2008-08-31 22:48 126976]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "msacm.ctmp3 "= C:\WINDOWS\System32\ctmp3.acm

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
    SecurityProviders msapsspc.dllschannel.dlldigest.dllmsnsspc.dllzwebauth.dllntoskrnl.dll

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
    backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 8.0 Tray Icon.lnk]
    backup=C:\WINDOWS\pss\America Online 8.0 Tray Icon.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech Harmony Remote.lnk]
    backup=C:\WINDOWS\pss\Logitech Harmony Remote.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
    backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^Gary^Start Menu^Programs^Startup^PowerReg Scheduler.exe]
    backup=C:\WINDOWS\pss\PowerReg Scheduler.exeStartup

    [HKLM\~\startupfolder\C:^Documents and Settings^Gary^Start Menu^Programs^Startup^Webshots.lnk]
    backup=C:\WINDOWS\pss\Webshots.lnkStartup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load]
    ??? [?]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Run]
    ??? [?]
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdaptecDirectCD
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DDCActiveMenu
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DDCM
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\kavir
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Mapa de caracteres para NT
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCAgentExe
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCUpdateExe
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealPlayer
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Symantec NetDriver Monitor
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ViewMgr
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirusScan Online
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinAntiSpyware 2006

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
    --a------ 2008-01-11 23:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AIM]
    --a------ 2005-08-05 16:08 67160 C:\PROGRA~1\AIM\aim.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
    --a------ 2004-08-04 03:56 15360 C:\WINDOWS\SYSTEM32\ctfmon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\diagent]
    --a------ 2002-04-03 02:01 135264 C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DT HPW]
    --a------ 2007-09-28 16:52 81920 C:\Program Files\Common Files\Portrait Displays\Shared\DT_Startup.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDSentry]
    -ra------ 2002-08-14 19:22 28672 C:\WINDOWS\SYSTEM32\DSentry.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelliPoint]
    --a------ 2003-05-15 19:41 163840 C:\Program Files\Microsoft IntelliPoint\point32.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtask]
    --a------ 2006-01-17 15:03 53248 C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray]
    --a------ 2006-01-17 15:03 135168 C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
    --a------ 2004-10-13 12:24 1694208 C:\Program Files\Messenger\msmsgs.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OpwareSE2]
    --a------ 2003-05-08 14:00 49152 C:\Program Files\ScanSoft\OmniPageSE2.0\opwareSE2.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PivotSoftware]
    --a------ 2007-02-09 13:17 694008 C:\Program Files\Portrait Displays\Pivot Software\wpCtrl.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
    --a------ 2008-03-28 23:37 413696 C:\Program Files\QuickTime\QTTask.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SansaDispatch]
    --a------ 2007-10-22 13:52 75584 C:\Program Files\SanDisk\Sansa Updater\SansaDispatch.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Uniblue RegistryBooster 2]
    --a------ 2008-02-01 10:51 1885464 C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
    --------- 2000-05-11 02:00 90112 C:\WINDOWS\Updreg.EXE

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\zBrowser Launcher]
    --a------ 2004-03-18 10:33 892928 C:\Program Files\Logitech\iTouch\iTouch.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BCMSMMSG]
    --a------ 2003-08-29 06:59 122880 C:\WINDOWS\BCMSMMSG.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Utility]
    --a------ 2002-11-08 05:50 19968 C:\WINDOWS\Logi_MwX.Exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
    --a------ 2003-10-06 16:16 741376 C:\WINDOWS\SYSTEM32\nwiz.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusDisableNotify "=dword:00000001
    "AntiVirusOverride "=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring "=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall "= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe "=
    "C:\\Program Files\\Netscape\\Netscape\\Netscp.exe "=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe "=
    "C:\\Program Files\\iTunes\\iTunes.exe "=

    R1 Pivot;Pivot;C:\WINDOWS\system32\drivers\pivot.sys [2007-02-09 13:17]
    S3 AvFlt;Antivirus Filter Driver;C:\WINDOWS\system32\drivers\av5flt.sys []
    S3 pivotmou;Pivot Mouse/Pointers Filter Driver;C:\WINDOWS\System32\drivers\pivotmou.sys [2007-02-09 13:17]
    S3 usbprint;Microsoft USB PRINTER Class;C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-04 02:01]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b954ee68-544b-11dd-8c8f-0007e9b9f452}]
    \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL VisualTrader_Demo.exe

    *Newly Created Service* - CATCHME
    *Newly Created Service* - PROCEXP90
    .
    Contents of the 'Scheduled Tasks' folder
    .
    - - - - ORPHANS REMOVED - - - -

    HKU-Default-RunOnce-POSTRBT - C:\Program Files\Norton Internet Security\Norton AntiVirus\Navw32.exe


    .
    ------- Supplementary Scan -------
    .
    FireFox -: Profile - C:\Documents and Settings\Gary\Application Data\Mozilla\Firefox\Profiles\x86g23oq.default\
    FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://my.yahoo.com
    .

    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-09-01 22:02:35
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...


    **************************************************************************
    .
    Completion time: 2008-09-01 22:07:10
    ComboFix-quarantined-files.txt 2008-09-02 02:06:04

    Pre-Run: 38,818,942,976 bytes free
    Post-Run: 38,932,733,952 bytes free

    219 --- E O F --- 2008-08-30 05:01:36
     
    lvdlr,
    #21
  2. 2008/09/01
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi
    Do you know what this is?
    C:\Program Files\sllmule
     
    Geri,
    #22


  3. to hide this advert.

  4. 2008/09/01
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi
    OK please disreguard my last post.

    Please do this.

    Highlight and copy the contents of the code box below and paste it into a blank notepad, then save it to your desktop as;

    Filename: CFScript.txt
    Save As Type: All Files (*.*)

    Close all other windows and programs. Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button.
    Click here to see how to use CFScript.txt
    Combofix should run and may reboot the computer when it's done. A log will open when it's complete. Post the contents of that log and another fresh HijackThis log.

    Please do not click on the ComboFix window while it is running a scan. This can cause it to stall.

    Code:
    File::
C:\WINDOWS\SYSTEM32\hcfevevo.exe

Folder::
C:\Program Files\sllmule
C:\Documents and Settings\All Users\Application Data\puhiryvg
C:\Documents and Settings\All Users\Application Data\pmfctibi

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
 "procdscapp "=-
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
 "SecurityProviders "= "msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" 
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\kavir]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinAntiSpyware2006]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b954ee68-544b-11dd-8c8f-0007e9b9f452}]
    Please post the new combofix log.

    Thanks
    Geri
     
    Geri,
    #23
  5. 2008/09/02
    lvdlr

    lvdlr Inactive Thread Starter

    Joined:
    2008/08/31
    Messages:
    15
    Likes Received:
    0
    ComboFix 08-09-01.01 - Gary 2008-09-02 0:57:49.2 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.197 [GMT -4:00]
    Running from: C:\Team logos\ComboFix.exe
    Command switches used :: C:\Documents and Settings\Gary\Desktop\CFScript.txt
    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

    FILE ::
    C:\WINDOWS\SYSTEM32\hcfevevo.exe
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\Documents and Settings\All Users\Application Data\pmfctibi
    C:\Documents and Settings\All Users\Application Data\puhiryvg
    C:\Program Files\sllmule
    C:\Program Files\sllmule\AppApiMon.dll
    C:\WINDOWS\SYSTEM32\hcfevevo.exe

    .
    ((((((((((((((((((((((((( Files Created from 2008-08-02 to 2008-09-02 )))))))))))))))))))))))))))))))
    .

    2008-09-01 12:14 . 2008-09-01 12:14 <DIR> d-------- C:\Documents and Settings\Gary\Application Data\Malwarebytes
    2008-09-01 12:14 . 2008-08-17 15:01 38,472 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\mbamswissarmy.sys
    2008-09-01 12:14 . 2008-08-17 15:01 17,144 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\mbam.sys
    2008-09-01 12:13 . 2008-09-01 12:14 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-09-01 12:13 . 2008-09-01 12:13 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-09-01 00:51 . 2008-09-01 00:51 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
    2008-09-01 00:08 . 2008-09-01 00:08 <DIR> d-------- C:\Program Files\Trend Micro
    2008-08-23 03:13 . 2008-05-01 10:30 331,776 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\msadce.dll
    2008-08-11 02:04 . 2008-08-11 02:04 <DIR> d-------- C:\Program Files\Garmin GPS Plugin
    2008-08-11 02:04 . 2008-08-11 02:04 <DIR> d-------- C:\Garmin
    2008-08-11 02:04 . 2008-08-11 02:04 <DIR> d-------- C:\Documents and Settings\Gary\Application Data\GARMIN
    2008-08-06 22:47 . 2008-08-06 22:47 47,328 --ah----- C:\WINDOWS\SYSTEM32\mlfcache.dat
    2008-08-05 21:33 . 2008-08-05 21:34 <DIR> d-------- C:\Program Files\Safari

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-09-01 04:52 --------- d-----w C:\Program Files\Lavasoft
    2008-09-01 04:52 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
    2008-08-31 06:33 --------- d-----w C:\Program Files\DraftDominator
    2008-08-30 04:16 --------- d-----w C:\Program Files\LineupDominator
    2008-08-23 14:50 --------- d-----w C:\Program Files\MFL Import
    2008-08-17 03:21 --------- d-----w C:\Program Files\Java
    2008-08-06 01:40 --------- d-----w C:\Documents and Settings\Gary\Application Data\Apple Computer
    2008-08-06 01:34 --------- d-----w C:\Program Files\Apple Software Update
    2008-07-28 16:17 --------- d-----w C:\Program Files\Sun
    2008-07-20 04:42 --------- d-----w C:\Program Files\Nirvana
    2008-07-20 04:36 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-07-18 05:46 --------- d-----w C:\Program Files\Common Files\Business Objects
    2008-07-18 03:16 --------- d-----w C:\Program Files\Reference Assemblies
    2008-07-18 03:16 --------- d-----w C:\Program Files\MSBuild
    2008-07-18 03:07 --------- d-----w C:\Program Files\MSXML 6.0
    2008-07-07 20:32 253,952 ----a-w C:\WINDOWS\SYSTEM32\es.dll
    2008-07-07 20:32 253,952 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\es.dll
    2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\SYSTEM32\mscms.dll
    2008-06-24 16:23 74,240 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\mscms.dll
    2008-06-24 14:57 3,592,192 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\mshtml.dll
    2008-06-23 09:20 70,656 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\ie4uinit.exe
    2008-06-23 09:20 625,664 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\iexplore.exe
    2008-06-23 09:20 13,824 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\ieudinit.exe
    2008-06-21 05:23 161,792 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\ieakui.dll
    2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\SYSTEM32\mswsock.dll
    2008-06-20 17:41 245,248 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\mswsock.dll
    2008-06-20 17:41 148,992 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\dnsapi.dll
    2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\tcpip.sys
    2008-06-20 10:44 138,368 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\afd.sys
    2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\tcpip6.sys
    2008-06-13 13:10 272,128 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\bthport.sys
    2003-05-22 06:57 207,758 ----a-w C:\Program Files\INSTALL.LOG
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Uniblue RegistryBooster 2 "= "C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe" [2008-02-01 10:51 1885464]
    "ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:56 15360]
    "AIM "= "C:\PROGRA~1\AIM\aim.exe" [2005-08-05 16:08 67160]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "NvCplDaemon "= "C:\WINDOWS\system32\NvCpl.dll" [2003-10-06 16:16 5058560]
    "Ulead AutoDetector v2 "= "C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe" [2004-08-27 20:22 90112]
    "SunJavaUpdateSched "= "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
    "NvMediaCenter "= "C:\WINDOWS\System32\NvMcTray.dll" [2003-10-06 16:16 49152]
    "MSConfig "= "C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2004-08-04 03:56 158208]
    "QuickTime Task "= "C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696]
    "iTunesHelper "= "C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-06-05 22:21:33 113664]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "msacm.ctmp3 "= C:\WINDOWS\System32\ctmp3.acm

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
    SecurityProviders msapsspc.dllschannel.dlldigest.dllmsnsspc.dllzwebauth.dllntoskrnl.dll

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
    backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 8.0 Tray Icon.lnk]
    backup=C:\WINDOWS\pss\America Online 8.0 Tray Icon.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech Harmony Remote.lnk]
    backup=C:\WINDOWS\pss\Logitech Harmony Remote.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
    backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^Gary^Start Menu^Programs^Startup^PowerReg Scheduler.exe]
    backup=C:\WINDOWS\pss\PowerReg Scheduler.exeStartup

    [HKLM\~\startupfolder\C:^Documents and Settings^Gary^Start Menu^Programs^Startup^Webshots.lnk]
    backup=C:\WINDOWS\pss\Webshots.lnkStartup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load]
    ??? [?]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Run]
    ??? [?]
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdaptecDirectCD
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DDCActiveMenu
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DDCM
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Mapa de caracteres para NT
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCAgentExe
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCUpdateExe
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealPlayer
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Symantec NetDriver Monitor
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ViewMgr
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirusScan Online
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinAntiSpyware 2006

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
    --a------ 2008-01-11 23:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AIM]
    --a------ 2005-08-05 16:08 67160 C:\PROGRA~1\AIM\aim.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
    --a------ 2004-08-04 03:56 15360 C:\WINDOWS\SYSTEM32\ctfmon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\diagent]
    --a------ 2002-04-03 02:01 135264 C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DT HPW]
    --a------ 2007-09-28 16:52 81920 C:\Program Files\Common Files\Portrait Displays\Shared\DT_Startup.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDSentry]
    -ra------ 2002-08-14 19:22 28672 C:\WINDOWS\SYSTEM32\DSentry.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelliPoint]
    --a------ 2003-05-15 19:41 163840 C:\Program Files\Microsoft IntelliPoint\point32.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtask]
    --a------ 2006-01-17 15:03 53248 C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray]
    --a------ 2006-01-17 15:03 135168 C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
    --a------ 2004-10-13 12:24 1694208 C:\Program Files\Messenger\msmsgs.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OpwareSE2]
    --a------ 2003-05-08 14:00 49152 C:\Program Files\ScanSoft\OmniPageSE2.0\opwareSE2.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PivotSoftware]
    --a------ 2007-02-09 13:17 694008 C:\Program Files\Portrait Displays\Pivot Software\wpCtrl.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
    --a------ 2008-03-28 23:37 413696 C:\Program Files\QuickTime\QTTask.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SansaDispatch]
    --a------ 2007-10-22 13:52 75584 C:\Program Files\SanDisk\Sansa Updater\SansaDispatch.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Uniblue RegistryBooster 2]
    --a------ 2008-02-01 10:51 1885464 C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
    --------- 2000-05-11 02:00 90112 C:\WINDOWS\Updreg.EXE

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\zBrowser Launcher]
    --a------ 2004-03-18 10:33 892928 C:\Program Files\Logitech\iTouch\iTouch.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BCMSMMSG]
    --a------ 2003-08-29 06:59 122880 C:\WINDOWS\BCMSMMSG.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Utility]
    --a------ 2002-11-08 05:50 19968 C:\WINDOWS\Logi_MwX.Exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
    --a------ 2003-10-06 16:16 741376 C:\WINDOWS\SYSTEM32\nwiz.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusDisableNotify "=dword:00000001
    "AntiVirusOverride "=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring "=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall "= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe "=
    "C:\\Program Files\\Netscape\\Netscape\\Netscp.exe "=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe "=
    "C:\\Program Files\\iTunes\\iTunes.exe "=

    R1 Pivot;Pivot;C:\WINDOWS\system32\drivers\pivot.sys [2007-02-09 13:17]
    S3 AvFlt;Antivirus Filter Driver;C:\WINDOWS\system32\drivers\av5flt.sys []
    S3 pivotmou;Pivot Mouse/Pointers Filter Driver;C:\WINDOWS\System32\drivers\pivotmou.sys [2007-02-09 13:17]
    S3 usbprint;Microsoft USB PRINTER Class;C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-04 02:01]
    .
    Contents of the 'Scheduled Tasks' folder
    .
    - - - - ORPHANS REMOVED - - - -

    SSODL-AppApiMon-{24FC040B-A820-5A81-3E3F-093B079E45A0} - C:\Program Files\sllmule\AppApiMon.dll



    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-09-02 01:00:40
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...


    **************************************************************************
    .
    Completion time: 2008-09-02 1:03:59
    ComboFix-quarantined-files.txt 2008-09-02 05:02:56
    ComboFix2.txt 2008-09-02 02:07:11

    Pre-Run: 38,911,864,832 bytes free
    Post-Run: 38,895,349,760 bytes free

    198 --- E O F --- 2008-08-30 05:01:36

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 1:05:46 AM, on 9/2/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16705)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe
    C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
    C:\Program Files\QuickTime\QTTask.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\PROGRA~1\AIM\aim.exe
    C:\WINDOWS\System32\CTsvcCDA.exe
    C:\Program Files\Executive Software\DiskeeperWorkstation\DKService.exe
    C:\Program Files\Common Files\Portrait Displays\Shared\dtsrvc.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\Netscape\Netscape\Netscp.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.msn.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    N3 - Netscape 7: user_pref( "browser.startup.homepage ", "http://my.msn.com "); (C:\Documents and Settings\GARY\Application Data\Mozilla\Profiles\default\2f47u277.slt\prefs.js)
    N3 - Netscape 7: user_pref( "browser.search.defaultengine ", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src "); (C:\Documents and Settings\GARY\Application Data\Mozilla\Profiles\default\2f47u277.slt\prefs.js)
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [Ulead AutoDetector v2] C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
    O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\AIM\aim.exe -cnetwait.odl
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
    O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
    O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
    O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
    O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.c...ls/en/x86/client/wuweb_site.cab?1112350045187
    O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
    O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - http://download.zonelabs.com/bin/promotions/spywaredetector/ICSScanner37540.cab
    O16 - DPF: {CAFEEFAC-0014-0000-0003-ABCDEFFEDCBA} (Java Runtime Environment 1.4.0_03) -
    O16 - DPF: {CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1_02) -
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
    O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\DiskeeperWorkstation\DKService.exe
    O23 - Service: Portrait Displays Display Tune Service (DTSRVC) - Unknown owner - C:\Program Files\Common Files\Portrait Displays\Shared\dtsrvc.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

    --
    End of file - 6639 bytes
     
    lvdlr,
    #24
  6. 2008/09/02
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi
    OK please do this.

    Open "Notepad†Copy the contents of the code box below to the blank Notepad.
    Click "File" > "Save as "
    In the "Save In" box at the top click the down arrow and select DeskTop

    In the "File name" type in: fix.reg
    In the "Save As Type" select: All Files
    Once saved, Go to your desktop double click "fix.reg file" and let it merge with the registry.

    Code:
    REGEDIT4

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
 "SecurityProviders "= "msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" 

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinAntiSpyware 2006]
    Let me know that it merged with the Registry OK.

    Then please do this.

    • Download RSIT by random/random and save it to your desktop.
    • Double click RSIT.exe to start the tool and click Continue at the disclaimer.
    • When the scan completes it will open a log named log.txt maximized, and a log named info.txt minimized.
    • Please post the contents of both logs here in your next reply.

    Thanks
    Geri
     
    Geri,
    #25
  7. 2008/09/02
    lvdlr

    lvdlr Inactive Thread Starter

    Joined:
    2008/08/31
    Messages:
    15
    Likes Received:
    0
    Logfile of random's system information tool (written by random/random)
    Run by Gary at 2008-09-02 02:23:35
    Microsoft Windows XP Home Edition Service Pack 2
    System drive C: has 37 GB (65%) free of 57 GB
    Total RAM: 511 MB (30% free)

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 2:23:40 AM, on 9/2/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16705)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe
    C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
    C:\Program Files\QuickTime\QTTask.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\PROGRA~1\AIM\aim.exe
    C:\WINDOWS\System32\CTsvcCDA.exe
    C:\Program Files\Executive Software\DiskeeperWorkstation\DKService.exe
    C:\Program Files\Common Files\Portrait Displays\Shared\dtsrvc.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Netscape\Netscape\Netscp.exe
    C:\Program Files\Portrait Displays\HP My Display\dthtml.exe
    C:\Program Files\Common Files\Portrait Displays\Shared\HookManager.exe
    C:\Team logos\RSIT.exe
    C:\Program Files\Trend Micro\HijackThis\Gary.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.msn.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    N3 - Netscape 7: user_pref( "browser.startup.homepage ", "http://my.msn.com "); (C:\Documents and Settings\GARY\Application Data\Mozilla\Profiles\default\2f47u277.slt\prefs.js)
    N3 - Netscape 7: user_pref( "browser.search.defaultengine ", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src "); (C:\Documents and Settings\GARY\Application Data\Mozilla\Profiles\default\2f47u277.slt\prefs.js)
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [Ulead AutoDetector v2] C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
    O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\AIM\aim.exe -cnetwait.odl
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
    O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
    O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
    O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
    O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.c...ls/en/x86/client/wuweb_site.cab?1112350045187
    O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
    O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - http://download.zonelabs.com/bin/promotions/spywaredetector/ICSScanner37540.cab
    O16 - DPF: {CAFEEFAC-0014-0000-0003-ABCDEFFEDCBA} (Java Runtime Environment 1.4.0_03) -
    O16 - DPF: {CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1_02) -
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
    O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\DiskeeperWorkstation\DKService.exe
    O23 - Service: Portrait Displays Display Tune Service (DTSRVC) - Unknown owner - C:\Program Files\Common Files\Portrait Displays\Shared\dtsrvc.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

    --
    End of file - 6790 bytes

    Scheduled tasks folder

    C:\WINDOWS\tasks\AppleSoftwareUpdate.job
    C:\WINDOWS\tasks\System_Feed_Rescheduler.job
    C:\WINDOWS\tasks\System_Feed_Sync_Scheduler.job

    Registry dump

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
    Adobe PDF Reader Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-23 62080]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
    SSVHelper Class - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll [2008-06-10 509328]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    {EF99BD32-C1FB-11D2-892F-0090271D4F88} - Yahoo! Toolbar - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll [2005-08-04 343112]

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    "NvCplDaemon "=C:\WINDOWS\system32\NvCpl.dll [2003-10-06 5058560]
    "Ulead AutoDetector v2 "=C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe [2004-08-27 90112]
    "SunJavaUpdateSched "=C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe [2008-06-10 144784]
    "NvMediaCenter "=C:\WINDOWS\System32\NvMcTray.dll [2003-10-06 49152]
    "MSConfig "=C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe [2004-08-04 158208]
    "QuickTime Task "=C:\Program Files\QuickTime\QTTask.exe [2008-03-28 413696]
    "iTunesHelper "=C:\Program Files\iTunes\iTunesHelper.exe [2008-03-30 267048]

    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    "Uniblue RegistryBooster 2 "=C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe [2008-02-01 1885464]
    "ctfmon.exe "=C:\WINDOWS\system32\ctfmon.exe [2004-08-04 15360]
    "AIM "=C:\PROGRA~1\AIM\aim.exe [2005-08-05 67160]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdaptecDirectCD]
    []

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
    C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-01-11 39792]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AIM]
    C:\PROGRA~1\AIM\aim.exe [2005-08-05 67160]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BCMSMMSG]
    C:\WINDOWS\BCMSMMSG.exe [2003-08-29 122880]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
    []

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
    C:\WINDOWS\system32\ctfmon.exe [2004-08-04 15360]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DDCActiveMenu]
    []

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DDCM]
    []

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\diagent]
    C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe [2002-04-03 135264]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DT HPW]
    C:\Program Files\Common Files\Portrait Displays\Shared\DT_startup.exe [2007-09-28 81920]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDSentry]
    C:\WINDOWS\System32\DSentry.exe [2002-08-14 28672]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelliPoint]
    C:\Program Files\Microsoft IntelliPoint\point32.exe [2003-05-15 163840]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load]
    ???
    ??? ???
    ?
    ?
    ????? []

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Utility]
    C:\WINDOWS\Logi_MwX.Exe [2002-11-08 19968]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Mapa de caracteres para NT]
    []

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCAgentExe]
    []

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCUpdateExe]
    []

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtask]
    C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe [2006-01-17 53248]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray]
    C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe [2006-01-17 135168]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
    C:\Program Files\Messenger\msmsgs.exe [2004-10-13 1694208]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
    []

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
    C:\WINDOWS\system32\nwiz.exe [2003-10-06 741376]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OpwareSE2]
    C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe [2003-05-08 49152]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PivotSoftware]
    C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe [2007-02-09 694008]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
    C:\Program Files\QuickTime\QTTask.exe [2008-03-28 413696]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealPlayer]
    []

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Run]
    ???
    ??? ???
    ?
    ?
    ????? []

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SansaDispatch]
    C:\Program Files\SanDisk\Sansa Updater\SansaDispatch.exe [2007-10-22 75584]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
    []

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Symantec NetDriver Monitor]
    []

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
    []

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Uniblue RegistryBooster 2]
    C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe [2008-02-01 1885464]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
    []

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
    C:\WINDOWS\UpdReg.EXE [2000-05-11 90112]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ViewMgr]
    []

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirusScan Online]
    []

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\zBrowser Launcher]
    C:\Program Files\Logitech\iTouch\iTouch.exe [2004-03-18 892928]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
    []

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 8.0 Tray Icon.lnk]
    []

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech Harmony Remote.lnk]
    C:\PROGRA~1\Logitech\HARMON~1\HARMON~1.EXE [2005-04-18 1478144]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
    C:\PROGRA~1\MICROS~2\Office\OSA9.EXE [1999-02-17 65588]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Gary^Start Menu^Programs^Startup^PowerReg Scheduler.exe]
    []

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Gary^Start Menu^Programs^Startup^Webshots.lnk]
    []

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup
    Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
    C:\WINDOWS\system32\WgaLogon.dll [2006-06-19 702768]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
    WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    "{57B86673-276A-48B2-BAE7-C6DBB3020EB8} "=C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll [2007-06-30 79408]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AVG Anti-Spyware Driver]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AVG Anti-Spyware Guard]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\aawservice]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AVG Anti-Spyware Driver]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AVG Anti-Spyware Guard]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr]

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
    "dontdisplaylastusername "=0
    "legalnoticecaption "=
    "legalnoticetext "=
    "shutdownwithoutlogon "=1
    "undockwithoutlogon "=1

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
    "%windir%\system32\sessmgr.exe "= "%windir%\system32\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019 "
    "C:\Program Files\Netscape\Netscape\Netscp.exe "= "C:\Program Files\Netscape\Netscape\Netscp.exe:*:Disabled:Netscape "
    "%windir%\Network Diagnostic\xpnetdiag.exe "= "%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000 "
    "C:\Program Files\iTunes\iTunes.exe "= "C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes "

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
    "%windir%\system32\sessmgr.exe "= "%windir%\system32\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019 "
    "%windir%\Network Diagnostic\xpnetdiag.exe "= "%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000 "

    File associations

    .scr - config - "%1" /S

    List of files/folders created in the last three months

    2008-09-02 02:23:35 ----D---- C:\rsit
    2008-09-02 01:04:00 ----A---- C:\ComboFix.txt
    2008-09-01 22:07:22 ----D---- C:\WINDOWS\temp
    2008-09-01 12:16:21 ----D---- C:\WINDOWS\erdnt
    2008-09-01 12:16:04 ----D---- C:\QooBox
    2008-09-01 12:16:01 ----A---- C:\WINDOWS\zip.exe
    2008-09-01 12:16:01 ----A---- C:\WINDOWS\VFind.exe
    2008-09-01 12:16:01 ----A---- C:\WINDOWS\swxcacls.exe
    2008-09-01 12:16:01 ----A---- C:\WINDOWS\swsc.exe
    2008-09-01 12:16:01 ----A---- C:\WINDOWS\swreg.exe
    2008-09-01 12:16:01 ----A---- C:\WINDOWS\sed.exe
    2008-09-01 12:16:01 ----A---- C:\WINDOWS\Nircmd.exe
    2008-09-01 12:16:01 ----A---- C:\WINDOWS\grep.exe
    2008-09-01 12:16:01 ----A---- C:\WINDOWS\fdsv.exe
    2008-09-01 12:14:03 ----D---- C:\Documents and Settings\Gary\Application Data\Malwarebytes
    2008-09-01 12:13:59 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
    2008-09-01 12:13:59 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-09-01 00:51:42 ----D---- C:\Program Files\Common Files\Wise Installation Wizard
    2008-09-01 00:08:56 ----D---- C:\Program Files\Trend Micro
    2008-08-30 01:01:33 ----HDC---- C:\WINDOWS\$NtUninstallKB952954$
    2008-08-30 01:01:27 ----HDC---- C:\WINDOWS\$NtUninstallKB946648$
    2008-08-30 01:01:21 ----HDC---- C:\WINDOWS\$NtUninstallKB953839$
    2008-08-30 01:01:14 ----HDC---- C:\WINDOWS\$NtUninstallKB950974$
    2008-08-30 01:01:07 ----HDC---- C:\WINDOWS\$NtUninstallKB951072-v2$
    2008-08-30 01:00:57 ----HDC---- C:\WINDOWS\$NtUninstallKB951066$
    2008-08-23 03:17:31 ----HDC---- C:\WINDOWS\$NtUninstallKB952287$
    2008-08-16 23:21:10 ----A---- C:\WINDOWS\system32\javaws.exe
    2008-08-16 23:21:10 ----A---- C:\WINDOWS\system32\javaw.exe
    2008-08-16 23:21:10 ----A---- C:\WINDOWS\system32\java.exe
    2008-08-11 02:04:54 ----D---- C:\Documents and Settings\Gary\Application Data\GARMIN
    2008-08-11 02:04:11 ----D---- C:\Garmin
    2008-08-11 02:04:10 ----D---- C:\Program Files\Garmin GPS Plugin
    2008-08-09 02:21:47 ----HDC---- C:\WINDOWS\$NtUninstallKB951748$
    2008-08-05 21:33:45 ----D---- C:\Program Files\Safari
    2008-07-28 12:17:25 ----D---- C:\Program Files\Sun
    2008-07-20 03:31:31 ----HDC---- C:\WINDOWS\$NtUninstallKB925720$
    2008-07-19 23:28:37 ----D---- C:\Program Files\MFL Import
    2008-07-18 01:46:16 ----D---- C:\Program Files\Common Files\Business Objects
    2008-07-18 01:45:29 ----A---- C:\WINDOWS\system32\vba232.dll
    2008-07-18 01:45:28 ----A---- C:\WINDOWS\system32\msvcr70.dll
    2008-07-18 01:45:28 ----A---- C:\WINDOWS\system32\msvcp70.dll
    2008-07-18 01:45:28 ----A---- C:\WINDOWS\system32\msdart32.dll
    2008-07-18 01:45:28 ----A---- C:\WINDOWS\system32\inloader.dll
    2008-07-18 01:45:28 ----A---- C:\WINDOWS\system32\hlinkprx.dll
    2008-07-18 01:45:28 ----A---- C:\WINDOWS\system32\GAPI32.DLL
    2008-07-17 23:16:52 ----D---- C:\Program Files\MSBuild
    2008-07-17 23:16:39 ----D---- C:\WINDOWS\system32\XPSViewer
    2008-07-17 23:16:27 ----D---- C:\Program Files\Reference Assemblies
    2008-07-17 23:15:24 ----N---- C:\WINDOWS\system32\spmsg2.dll
    2008-07-17 23:08:14 ----HDC---- C:\WINDOWS\$NtUninstallWIC$
    2008-07-17 23:07:58 ----D---- C:\Program Files\MSXML 6.0
    2008-07-17 22:59:16 ----D---- C:\Program Files\Nirvana
    2008-06-27 01:43:21 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2$
    2008-06-13 12:18:00 ----HDC---- C:\WINDOWS\$NtUninstallKB951698$
    2008-06-13 12:17:48 ----HDC---- C:\WINDOWS\$NtUninstallKB950762$
    2008-06-13 12:17:39 ----HDC---- C:\WINDOWS\$NtUninstallKB950760$
    2008-06-13 12:17:17 ----HDC---- C:\WINDOWS\$NtUninstallKB951376$
    2008-06-07 02:50:05 ----HDC---- C:\WINDOWS\$NtUninstallKB932823-v3$
    2008-06-07 01:57:21 ----HDC---- C:\WINDOWS\$NtUninstallKB950749$
    2008-06-07 01:56:21 ----A---- C:\WINDOWS\system32\MRT.INI

    List of drivers

    R1 AVG Anti-Spyware Driver;AVG Anti-Spyware Driver; \??\C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.sys []
    R1 AvgAsCln;AVG Anti-Spyware Clean Driver; C:\WINDOWS\System32\DRIVERS\AvgAsCln.sys [2006-09-05 3968]
    R1 intelppm;Intel Processor Driver; C:\WINDOWS\System32\DRIVERS\intelppm.sys [2004-08-04 36096]
    R1 omci;OMCI WDM Device Driver; C:\WINDOWS\System32\DRIVERS\omci.sys [2002-07-19 17153]
    R1 Pivot;Pivot; C:\WINDOWS\System32\drivers\pivot.sys [2007-02-09 17465]
    R2 PfModNT;PfModNT; \??\C:\WINDOWS\System32\PfModNT.sys []
    R3 BCMModem;BCM V.92 56K Modem; C:\WINDOWS\System32\DRIVERS\BCMSM.sys [2003-08-29 1101696]
    R3 E100B;Intel(R) PRO Adapter Driver; C:\WINDOWS\System32\DRIVERS\e100b325.sys [2002-09-19 139776]
    R3 GEARAspiWDM;GEARAspiWDM; C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys [2008-01-29 16168]
    R3 itchfltr;iTouch Keyboard Filter; C:\WINDOWS\System32\DRIVERS\itchfltr.sys [2002-11-14 12640]
    R3 L8042pr2;Logitech PS/2 Mouse Filter Driver; C:\WINDOWS\System32\DRIVERS\L8042pr2.Sys [2002-11-08 52238]
    R3 LMouFlt2;Logitech Mouse Class Filter Driver; C:\WINDOWS\System32\DRIVERS\LMouFlt2.Sys [2002-11-08 70238]
    R3 nv;nv; C:\WINDOWS\System32\DRIVERS\nv4_mini.sys [2003-10-06 1550043]
    R3 P16X;Creative SB Live! Series (WDM); C:\WINDOWS\system32\drivers\P16X.sys [2002-08-30 1293440]
    R3 pdiddcci;DDC/CI monitor; C:\WINDOWS\System32\DRIVERS\pdiddcci.sys [2007-04-24 11776]
    R3 PdiPorts;Portrait Displays low level device driver; C:\WINDOWS\System32\Drivers\PdiPorts.sys [2006-11-16 15920]
    R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\System32\DRIVERS\usbehci.sys [2004-08-04 26624]
    R3 usbhub;Microsoft USB Standard Hub Driver; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2004-08-04 57600]
    R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\System32\DRIVERS\usbuhci.sys [2004-08-04 20480]
    R4 catchme;catchme; \??\C:\ComboFix\catchme.sys []
    S1 eeCtrl;Symantec Eraser Control driver; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys []
    S1 P3;Intel PentiumIII Processor Driver; C:\WINDOWS\System32\DRIVERS\p3.sys [2004-08-04 42496]
    S3 AvFlt;Antivirus Filter Driver; C:\WINDOWS\system32\system32\drivers\av5flt.sys []
    S3 EL90XBC;3Com EtherLink XL 90XB/C Adapter Driver; C:\WINDOWS\System32\DRIVERS\el90xbc5.sys [2001-08-17 66591]
    S3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-08-17 9600]
    S3 i81x;i81x; C:\WINDOWS\System32\DRIVERS\i81xnt5.sys [2004-08-04 161020]
    S3 iAimFP0;iAimFP0; C:\WINDOWS\System32\DRIVERS\wADV01nt.sys [2004-08-04 12415]
    S3 iAimFP1;iAimFP1; C:\WINDOWS\System32\DRIVERS\wADV02NT.sys [2004-08-04 12127]
    S3 iAimFP2;iAimFP2; C:\WINDOWS\System32\DRIVERS\wADV05NT.sys [2004-08-04 11775]
    S3 iAimFP3;iAimFP3; C:\WINDOWS\System32\DRIVERS\wSiINTxx.sys [2004-08-04 12063]
    S3 iAimFP4;iAimFP4; C:\WINDOWS\System32\DRIVERS\wVchNTxx.sys [2004-08-04 19455]
    S3 iAimTV0;iAimTV0; C:\WINDOWS\System32\DRIVERS\wATV01nt.sys [2004-08-04 29311]
    S3 iAimTV1;iAimTV1; C:\WINDOWS\System32\DRIVERS\wATV02NT.sys [2004-08-04 19551]
    S3 iAimTV2;iAimTV2; C:\WINDOWS\System32\DRIVERS\wATV03nt.sys []
    S3 iAimTV3;iAimTV3; C:\WINDOWS\System32\DRIVERS\wATV04nt.sys [2004-08-04 33599]
    S3 iAimTV4;iAimTV4; C:\WINDOWS\System32\DRIVERS\wCh7xxNT.sys [2004-08-04 23615]
    S3 MODEMCSA;Unimodem Streaming Filter Device; C:\WINDOWS\system32\drivers\MODEMCSA.sys [2001-08-17 16128]
    S3 NMSCFG;NIC Management Service Configuration Driver; \??\C:\WINDOWS\System32\drivers\NMSCFG.SYS []
    S3 pivotmou;Pivot Mouse/Pointers Filter Driver; \??\C:\WINDOWS\System32\drivers\pivotmou.sys []
    S3 Point32;Microsoft IntelliPoint Filter Driver; C:\WINDOWS\System32\DRIVERS\point32.sys [2003-05-15 19072]
    S3 QV2KUX;Casio Digital Camera; C:\WINDOWS\System32\DRIVERS\qv2kux.sys [2001-08-17 3328]
    S3 SANDRA;SANDRA; \??\C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2005.SR3\Sandra.sys []
    S3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\System32\DRIVERS\usbccgp.sys [2004-08-04 31616]
    S3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\System32\DRIVERS\usbprint.sys [2004-08-04 25856]
    S3 usbscan;USB Scanner Driver; C:\WINDOWS\System32\DRIVERS\usbscan.sys [2004-08-04 15104]
    S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [2004-08-04 26496]
    S3 WpdUsb;WpdUsb; C:\WINDOWS\System32\Drivers\wpdusb.sys [2006-10-18 38528]
    S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
    S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
    S4 agpCPQ;Compaq AGP Bus Filter; C:\WINDOWS\system32\System32\DRIVERS\agpCPQ.sys []
    S4 alim1541;ALI AGP Bus Filter; C:\WINDOWS\system32\System32\DRIVERS\alim1541.sys []
    S4 amdagp;AMD AGP Bus Filter Driver; C:\WINDOWS\system32\System32\DRIVERS\amdagp.sys []
    S4 cbidf;cbidf; C:\WINDOWS\system32\System32\DRIVERS\cbidf2k.sys []
    S4 IntelIde;IntelIde; C:\WINDOWS\system32\System32\DRIVERS\intelide.sys []
    S4 sisagp;SIS AGP Bus Filter; C:\WINDOWS\system32\System32\DRIVERS\sisagp.sys []
    S4 viaagp;VIA AGP Bus Filter; C:\WINDOWS\system32\System32\DRIVERS\viaagp.sys []
    S4 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; C:\WINDOWS\system32\System32\drivers\ws2ifsl.sys []

    List of services

    R2 aawservice;Lavasoft Ad-Aware Service; C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe [2008-09-01 611664]
    R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-02-18 110592]
    R2 AVG Anti-Spyware Guard;AVG Anti-Spyware Guard; C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe [2007-06-30 312880]
    R2 Creative Service for CDROM Access;Creative Service for CDROM Access; C:\WINDOWS\System32\CTsvcCDA.exe [1999-12-13 44032]
    R2 Diskeeper;Diskeeper; C:\Program Files\Executive Software\DiskeeperWorkstation\DKService.exe [2002-05-31 253952]
    R2 DTSRVC;Portrait Displays Display Tune Service; C:\Program Files\Common Files\Portrait Displays\Shared\dtsrvc.exe [2007-09-28 65536]
    R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\System32\nvsvc32.exe [2003-10-06 81920]
    R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2008-03-30 504104]
    S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800]
    S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
    S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe [2007-10-09 36864]
    S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2007-10-11 864256]
    S3 NMSSvc;Intel(R) NMS; C:\WINDOWS\System32\NMSSvc.exe [2002-10-10 1118208]
    S3 WMDM PMSP Service;WMDM PMSP Service; C:\WINDOWS\System32\MsPMSPSv.exe [2000-06-26 53520]
    S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-18 913408]
    S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2004-08-04 14336]
    S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2007-10-11 122880]

    -----------------EOF-----------------
     
    lvdlr,
    #26
  8. 2008/09/02
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi
    Please do the following.

    Delete the CFScript you have on your desktop.

    Highlight and copy the contents of the code box below and paste it into a blank notepad, then save it to your desktop as;

    Filename: CFScript.txt
    Save As Type: All Files (*.*)

    Close all other windows and programs. Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button.
    Click here to see how to use CFScript.txt
    Combofix should run and may reboot the computer when it's done. A log will open when it's complete. Post the contents of that log and another fresh HijackThis log.

    Please do not click on the ComboFix window while it is running a scan. This can cause it to stall.

    Code:
    Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Mapa de caracteres para NT] 
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load] 
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Run]
    Please post the combofix log.

    Thanks
    Geri
     
    Geri,
    #27
  9. 2008/09/02
    lvdlr

    lvdlr Inactive Thread Starter

    Joined:
    2008/08/31
    Messages:
    15
    Likes Received:
    0
    ComboFix 08-09-01.01 - Gary 2008-09-02 21:43:57.3 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.218 [GMT -4:00]
    Running from: C:\Team logos\ComboFix.exe
    Command switches used :: C:\Documents and Settings\Gary\Desktop\CFScript.txt
    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    ((((((((((((((((((((((((( Files Created from 2008-08-03 to 2008-09-03 )))))))))))))))))))))))))))))))
    .

    2008-09-02 02:23 . 2008-09-02 02:23 <DIR> d-------- C:\rsit
    2008-09-01 12:14 . 2008-09-01 12:14 <DIR> d-------- C:\Documents and Settings\Gary\Application Data\Malwarebytes
    2008-09-01 12:14 . 2008-08-17 15:01 38,472 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\mbamswissarmy.sys
    2008-09-01 12:14 . 2008-08-17 15:01 17,144 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\mbam.sys
    2008-09-01 12:13 . 2008-09-01 12:14 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-09-01 12:13 . 2008-09-01 12:13 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-09-01 00:51 . 2008-09-01 00:51 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
    2008-09-01 00:08 . 2008-09-01 00:08 <DIR> d-------- C:\Program Files\Trend Micro
    2008-08-23 03:13 . 2008-05-01 10:30 331,776 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\msadce.dll
    2008-08-11 02:04 . 2008-08-11 02:04 <DIR> d-------- C:\Program Files\Garmin GPS Plugin
    2008-08-11 02:04 . 2008-08-11 02:04 <DIR> d-------- C:\Garmin
    2008-08-11 02:04 . 2008-08-11 02:04 <DIR> d-------- C:\Documents and Settings\Gary\Application Data\GARMIN
    2008-08-06 22:47 . 2008-08-06 22:47 47,328 --ah----- C:\WINDOWS\SYSTEM32\mlfcache.dat
    2008-08-05 21:33 . 2008-08-05 21:34 <DIR> d-------- C:\Program Files\Safari

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-09-03 01:34 --------- d-----w C:\Program Files\DraftDominator
    2008-09-01 04:52 --------- d-----w C:\Program Files\Lavasoft
    2008-09-01 04:52 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
    2008-08-30 04:16 --------- d-----w C:\Program Files\LineupDominator
    2008-08-23 14:50 --------- d-----w C:\Program Files\MFL Import
    2008-08-17 03:21 --------- d-----w C:\Program Files\Java
    2008-08-06 01:40 --------- d-----w C:\Documents and Settings\Gary\Application Data\Apple Computer
    2008-08-06 01:34 --------- d-----w C:\Program Files\Apple Software Update
    2008-07-28 16:17 --------- d-----w C:\Program Files\Sun
    2008-07-20 04:42 --------- d-----w C:\Program Files\Nirvana
    2008-07-20 04:36 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-07-18 05:46 --------- d-----w C:\Program Files\Common Files\Business Objects
    2008-07-18 03:16 --------- d-----w C:\Program Files\Reference Assemblies
    2008-07-18 03:16 --------- d-----w C:\Program Files\MSBuild
    2008-07-18 03:07 --------- d-----w C:\Program Files\MSXML 6.0
    2008-07-07 20:32 253,952 ----a-w C:\WINDOWS\SYSTEM32\es.dll
    2008-07-07 20:32 253,952 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\es.dll
    2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\SYSTEM32\mscms.dll
    2008-06-24 16:23 74,240 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\mscms.dll
    2008-06-24 14:57 3,592,192 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\mshtml.dll
    2008-06-23 09:20 70,656 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\ie4uinit.exe
    2008-06-23 09:20 625,664 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\iexplore.exe
    2008-06-23 09:20 13,824 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\ieudinit.exe
    2008-06-21 05:23 161,792 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\ieakui.dll
    2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\SYSTEM32\mswsock.dll
    2008-06-20 17:41 245,248 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\mswsock.dll
    2008-06-20 17:41 148,992 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\dnsapi.dll
    2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\tcpip.sys
    2008-06-20 10:44 138,368 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\afd.sys
    2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\tcpip6.sys
    2008-06-13 13:10 272,128 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\bthport.sys
    2003-05-22 06:57 207,758 ----a-w C:\Program Files\INSTALL.LOG
    .

    ((((((((((((((((((((((((((((( snapshot@2008-09-02_ 1.02.38.66 )))))))))))))))))))))))))))))))))))))))))
    .
    - 2008-09-02 02:54:06 67,618 ----a-w C:\WINDOWS\SYSTEM32\PERFC009.DAT
    + 2008-09-03 01:31:15 67,618 ----a-w C:\WINDOWS\SYSTEM32\PERFC009.DAT
    - 2008-09-02 02:54:07 433,296 ----a-w C:\WINDOWS\SYSTEM32\PERFH009.DAT
    + 2008-09-03 01:31:15 433,296 ----a-w C:\WINDOWS\SYSTEM32\PERFH009.DAT
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Uniblue RegistryBooster 2 "= "C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe" [2008-02-01 10:51 1885464]
    "ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:56 15360]
    "AIM "= "C:\PROGRA~1\AIM\aim.exe" [2005-08-05 16:08 67160]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "NvCplDaemon "= "C:\WINDOWS\system32\NvCpl.dll" [2003-10-06 16:16 5058560]
    "Ulead AutoDetector v2 "= "C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe" [2004-08-27 20:22 90112]
    "SunJavaUpdateSched "= "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
    "NvMediaCenter "= "C:\WINDOWS\System32\NvMcTray.dll" [2003-10-06 16:16 49152]
    "MSConfig "= "C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2004-08-04 03:56 158208]
    "QuickTime Task "= "C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696]
    "iTunesHelper "= "C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-06-05 22:21:33 113664]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "msacm.ctmp3 "= C:\WINDOWS\System32\ctmp3.acm

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
    backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 8.0 Tray Icon.lnk]
    backup=C:\WINDOWS\pss\America Online 8.0 Tray Icon.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech Harmony Remote.lnk]
    backup=C:\WINDOWS\pss\Logitech Harmony Remote.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
    backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^Gary^Start Menu^Programs^Startup^PowerReg Scheduler.exe]
    backup=C:\WINDOWS\pss\PowerReg Scheduler.exeStartup

    [HKLM\~\startupfolder\C:^Documents and Settings^Gary^Start Menu^Programs^Startup^Webshots.lnk]
    backup=C:\WINDOWS\pss\Webshots.lnkStartup
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdaptecDirectCD
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DDCActiveMenu
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DDCM
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCAgentExe
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCUpdateExe
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealPlayer
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Symantec NetDriver Monitor
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ViewMgr
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirusScan Online

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
    --a------ 2008-01-11 23:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AIM]
    --a------ 2005-08-05 16:08 67160 C:\PROGRA~1\AIM\aim.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
    --a------ 2004-08-04 03:56 15360 C:\WINDOWS\SYSTEM32\ctfmon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\diagent]
    --a------ 2002-04-03 02:01 135264 C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DT HPW]
    --a------ 2007-09-28 16:52 81920 C:\Program Files\Common Files\Portrait Displays\Shared\DT_Startup.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDSentry]
    -ra------ 2002-08-14 19:22 28672 C:\WINDOWS\SYSTEM32\DSentry.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelliPoint]
    --a------ 2003-05-15 19:41 163840 C:\Program Files\Microsoft IntelliPoint\point32.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtask]
    --a------ 2006-01-17 15:03 53248 C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray]
    --a------ 2006-01-17 15:03 135168 C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
    --a------ 2004-10-13 12:24 1694208 C:\Program Files\Messenger\msmsgs.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OpwareSE2]
    --a------ 2003-05-08 14:00 49152 C:\Program Files\ScanSoft\OmniPageSE2.0\opwareSE2.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PivotSoftware]
    --a------ 2007-02-09 13:17 694008 C:\Program Files\Portrait Displays\Pivot Software\wpCtrl.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
    --a------ 2008-03-28 23:37 413696 C:\Program Files\QuickTime\QTTask.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SansaDispatch]
    --a------ 2007-10-22 13:52 75584 C:\Program Files\SanDisk\Sansa Updater\SansaDispatch.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Uniblue RegistryBooster 2]
    --a------ 2008-02-01 10:51 1885464 C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
    --------- 2000-05-11 02:00 90112 C:\WINDOWS\Updreg.EXE

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\zBrowser Launcher]
    --a------ 2004-03-18 10:33 892928 C:\Program Files\Logitech\iTouch\iTouch.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BCMSMMSG]
    --a------ 2003-08-29 06:59 122880 C:\WINDOWS\BCMSMMSG.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Utility]
    --a------ 2002-11-08 05:50 19968 C:\WINDOWS\Logi_MwX.Exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
    --a------ 2003-10-06 16:16 741376 C:\WINDOWS\SYSTEM32\nwiz.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusDisableNotify "=dword:00000001
    "AntiVirusOverride "=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring "=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall "= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe "=
    "C:\\Program Files\\Netscape\\Netscape\\Netscp.exe "=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe "=
    "C:\\Program Files\\iTunes\\iTunes.exe "=

    R1 Pivot;Pivot;C:\WINDOWS\system32\drivers\pivot.sys [2007-02-09 13:17]
    S3 AvFlt;Antivirus Filter Driver;C:\WINDOWS\system32\drivers\av5flt.sys []
    S3 pivotmou;Pivot Mouse/Pointers Filter Driver;C:\WINDOWS\System32\drivers\pivotmou.sys [2007-02-09 13:17]
    S3 usbprint;Microsoft USB PRINTER Class;C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-04 02:01]
    .
    Contents of the 'Scheduled Tasks' folder
    .

    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-09-02 21:47:33
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...


    **************************************************************************
    .
    Completion time: 2008-09-02 21:51:17
    ComboFix-quarantined-files.txt 2008-09-03 01:50:15
    ComboFix2.txt 2008-09-02 05:04:00
    ComboFix3.txt 2008-09-02 02:07:11

    Pre-Run: 38,911,078,400 bytes free
    Post-Run: 38,894,469,120 bytes free

    187 --- E O F --- 2008-08-30 05:01:36
     
    lvdlr,
    #28
  10. 2008/09/02
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi
    OK good.

    Now do this.

    Download ATF Cleaner by Atribune and save it to your Desktop.
    This is a good tool to get rid of the temporary garbage you pick up while surfing the net.
    Double click ATF-Cleaner.exe to run the program.
    Check the boxes to the left of:

    Windows Temp
    Current User Temp
    All Users Temp
    Cookies
    Temporary Internet Files
    Prefetch
    Java Cache
    Recycle bin

    The rest are optional - if you want it to remove everything check "Select All ".
    Finally, click Empty Selected. When you get the "Done Cleaning" message, click OK.


    Now lets get a on-line scan.

    Please do an online scan with Kaspersky WebScanner

    Click on "Accept" If your pop "“up blocker blocks any windows from opening.

    Click Run on the window that opens.
    Windows Vista users you must open the web browser using the Run as Administrator command.
    • The program will launch and then begin downloading the latest definition files:
    • Under Scan on the left side.Click on My Computer
    • This will start the program and scan your system.
    • Click the "Scan Report" On the left side.
    • The scan will take a while so be patient and let it run.
    • Once the scan is complete it will display if your system has been infected.
      • Click the Save Report As button, and in the Browse dialog box, type a name for the scan report file that you want to create and select its type Text file. Click OK to save the file.:
    • Save the text file to your desktop.
    • Copy and paste that information in your next post.

    Please post the Kaspersky results.

    Thanks
    Geri
     
    Geri,
    #29
  11. 2008/09/03
    lvdlr

    lvdlr Inactive Thread Starter

    Joined:
    2008/08/31
    Messages:
    15
    Likes Received:
    0
    --------------------------------------------------------------------------------
    KASPERSKY ONLINE SCANNER 7 REPORT
    Wednesday, September 3, 2008
    Operating System: Microsoft Windows XP Home Edition Service Pack 2 (build 2600)
    Kaspersky Online Scanner 7 version: 7.0.25.0
    Program database last update: Wednesday, September 03, 2008 20:17:25
    Records in database: 1188827
    --------------------------------------------------------------------------------

    Scan settings:
    Scan using the following database: extended
    Scan archives: yes
    Scan mail databases: yes

    Scan area - My Computer:
    A:\
    C:\
    D:\

    Scan statistics:
    Files scanned: 69831
    Threat name: 10
    Infected objects: 10
    Suspicious objects: 15
    Duration of the scan: 01:45:50


    File name / Threat name / Threats count
    C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\49273A7A.exe Infected: not-a-virus:Downloader.Win32.WinFixer.b 1
    C:\Documents and Settings\All Users\Documents\taztouchdownclocksetup.exe Infected: not-a-virus:AdWare.Win32.Quick.a 1
    C:\Documents and Settings\All Users\Documents\taztouchdownclocksetup.exe Infected: not-a-virus:AdWare.Win32.NewDotNet 1
    C:\Documents and Settings\All Users\Documents\taztouchdownclocksetup.exe Infected: not-a-virus:AdWare.Win32.EZula.cp 1
    C:\Documents and Settings\All Users\Documents\taztouchdownclocksetup.exe Infected: not-a-virus:AdWare.Win32.Gator.3103 1
    C:\Documents and Settings\All Users\Documents\taztouchdownclocksetup.exe Infected: Trojan-Dropper.Win32.Small.jh 1
    C:\Documents and Settings\Gary\Application Data\Mozilla\Profiles\default\2f47u277.slt\Mail\pop-server.midsouth.-1.com\Drafts Suspicious: Trojan-Spy.HTML.Fraud.gen 1
    C:\Documents and Settings\Gary\Application Data\Mozilla\Profiles\default\2f47u277.slt\Mail\pop-server.midsouth.-1.com\Sent Infected: Trojan-Spy.HTML.Bayfraud.aa 1
    C:\Documents and Settings\Gary\Application Data\Mozilla\Profiles\default\2f47u277.slt\Mail\pop-server.midsouth.-1.com\Sent Suspicious: Trojan-Spy.HTML.Fraud.gen 14
    C:\Documents and Settings\Gary\Application Data\Sun\Java\Deployment\cache\6.0\37\63380ea5-6cb09130 Infected: Trojan-Downloader.Java.OpenConnection.ap 1
    C:\Program Files\Common Files\mozilla.org\GRE\1.7.2_2004080415\SmitfraudFix\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f 1
    C:\Program Files\Common Files\mozilla.org\GRE\1.7.2_2004080415\SmitfraudFix.zip Infected: not-a-virus:RiskTool.Win32.Reboot.f 1

    The selected area was scanned.
     
    lvdlr,
    #30
  12. 2008/09/03
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi

    Empty your Norton AntiVirus Quarantine Folder.

    Do you know what this is?
    taztouchdownclocksetup.exe

    I would recommend deleting it.
    Using Windows Explorer (to get there right-click your Start button and go to "Explore "), please delete these files (if present):

    C:\Documents and Settings\All Users\Documents\taztouchdownclocksetup.exe

    Do you have a email account with Netscape 7 ? and do you know what midsouth.-1.com is?
    The folders in the mail account needs to be deleted. Sent folder, Drafts folder and then the Deleted items folder.

    Then do this.

    Please download JavaRa and save the file to your desktop.
    • Right click and Extract All
    • Once extracted, open and run JavaRa.exe
    • Click Search For Updates
    • Select Update Using jucheck.exe
    • Click Search
    • If a newer version is found, allow it to be installed
    • Uncheck the Google Toolbar option. (if you don't want the Google tool bar)
    • When complete, click Remove Older Versions in the JavaRa interface and allow it to proceed
    • When that is complete, click Additional Tasks, then select Remove Useless JRE Files and click Go
    • Exit the tool when complete.
    Read and then You can delete the gpl-2.0.txt file.

    Please delete SmitfraudFix and the SmitfraudFix.Zip file.

    Then run another Kaspersky scan and post the log.

    Thanks
    Geri
     
    Geri,
    #31
  13. 2008/09/04
    lvdlr

    lvdlr Inactive Thread Starter

    Joined:
    2008/08/31
    Messages:
    15
    Likes Received:
    0
    Thursday, September 4, 2008
    Operating System: Microsoft Windows XP Home Edition Service Pack 2 (build 2600)
    Kaspersky Online Scanner 7 version: 7.0.25.0
    Program database last update: Thursday, September 04, 2008 05:41:13
    Records in database: 1190247
    Scan settings
    Scan using the following database extended
    Scan archives yes
    Scan mail databases yes
    Scan area My Computer
    A:\
    C:\
    D:\
    Scan statistics
    Files scanned 68467
    Threat name 3
    Infected objects 3
    Suspicious objects 0
    Duration of the scan 01:17:40

    File name Threat name Threats count
    C:\Documents and Settings\Gary\Application Data\Sun\Java\Deployment\cache\6.0\37\63380ea5-6cb09130 Infected: Trojan-Downloader.Java.OpenConnection.ap 1
    C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP349\A0018275.exe Infected: not-a-virus:Downloader.Win32.WinFixer.b 1
    C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP349\A0018545.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f 1
    The selected area was scanned.
     
    lvdlr,
    #32
  14. 2008/09/04
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi
    Still showing the Java cache infected?

    Try to clean it this way.


    • Go back into the Control Panel and double-click the Java Icon.
    • On the general tab, at the bottom it has "temporary internet files "
    • Click the settings button. Then the Delete files button.
    • There are two options in the window to clear the cache - Leave both Checked

      • Applications and Applets
        Trace and Log files
    • Click OK
      Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
    • Click OK to leave the Java Control Panel.

    Now one more Kaspersky scan.

    Thanks
    Geri
     
    Geri,
    #33
  15. 2008/09/04
    lvdlr

    lvdlr Inactive Thread Starter

    Joined:
    2008/08/31
    Messages:
    15
    Likes Received:
    0
    Thursday, September 4, 2008
    Operating System: Microsoft Windows XP Home Edition Service Pack 2 (build 2600)
    Kaspersky Online Scanner 7 version: 7.0.25.0
    Program database last update: Thursday, September 04, 2008 19:25:14
    Records in database: 1192110
    Scan settings
    Scan using the following database extended
    Scan archives yes
    Scan mail databases yes
    Scan area My Computer
    A:\
    C:\
    D:\
    Scan statistics
    Files scanned 67604
    Threat name 2
    Infected objects 2
    Suspicious objects 0
    Duration of the scan 01:18:06

    File name Threat name Threats count
    C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP349\A0018275.exe Infected: not-a-virus:Downloader.Win32.WinFixer.b 1
    C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP349\A0018545.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f 1
    The selected area was scanned.
     
    lvdlr,
    #34
  16. 2008/09/04
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi
    OK perfect.

    Click Start>Run in the run box copy and paste or type ComboFix /u then hit Enter to uninstall ComboFix and remove the files/folders it created. This action will also reset the System Restore points, removing any infected files there as well.

    That will clean you up.

    Let me know how things are running.

    Thanks
    Geri
     
    Geri,
    #35
Page 2 of 2

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...