There's no such thing as a stupid question, but they're the easiest to answer.
JoinTour
Login
 
Tag Cloud
acer black screen boot bsod computer connection crash css dell drive driver drivers email error ethernet excel explorer firefox firefox 3 game hard drive internet internet explorer itunes laptop lcd linux malware monitor network networking outlook outlook 2003 outlook express printer problem problems ram router slow sound sprtcmd.exe startup trojan usb virus vista windows windows xp wireless
Malware Removal & HijackThis Logs
Search
Search in:
 
Advanced Search
Tech Support Guy Forums > Security & Malware Removal > Malware Removal & HijackThis Logs >
Solved: Strange happenings


HELLO AND WELCOME! Before you can post your question, you'll have to register -- it's completely free! Click here to join today! We highly recommend that you print a copy of our Guide for New Members. Enjoy!

Closed Thread
Page 1 of 2 1 2 >
 
Thread Tools
Zeppfan's Avatar
Computer Specs
Senior Member with 367 posts.
  
Join Date: Apr 2006
Location: Over the Hills and Far Away
Experience: Dazed and Confused
10-May-2008, 10:11 AM #1
Solved: Strange happenings
Hi Guys,

I have some strange happenings going on here.

Got home from work yesterday and started up my desktop which is running Vista Home Premium 32 bit with 2.5 gig of RAM.

Malwarrior has installed itself onto this desktop. I also have right clicked the toolbar to open "Task Manager" and even that will not open because it is not in bold(Highlighted) indicating that it is not available.

Everything opened (ie. AVG, Internet explorer, Windows Explorer) freezes and states as "Not Responding".

I restarted in safe mode and ran AVG which showed 1 critical threat(Quarentined) and 552 tracking cookies(Deleted)

After restarting, some programs open but have slowed.

My questions are: Would Malwarrior disable "Task Manager"? How can I remove Malwarrior and re-enable "Task Manager"?
__________________
Zeppfan(It's all in the CODA)

http://pwp.att.net/p/PWP-icanfixthat4u
lunarlander's Avatar
Computer Specs
Senior Member with 831 posts.
  
Join Date: Sep 2007
10-May-2008, 10:22 AM #2
Hi ,

I found this via google, try it and see if it works:

http://www.2-spyware.com/remove-malwarrior.html
Zeppfan's Avatar
Computer Specs
Senior Member with 367 posts.
  
Join Date: Apr 2006
Location: Over the Hills and Far Away
Experience: Dazed and Confused
10-May-2008, 10:25 AM #3
That site offers spywaredoctor. I ran this, but to remove, I would have to purchase spywaredoctor.

I ran a HJT log and there is a MaWarrior.exe program in the running processes list
Zeppfan's Avatar
Computer Specs
Senior Member with 367 posts.
  
Join Date: Apr 2006
Location: Over the Hills and Far Away
Experience: Dazed and Confused
10-May-2008, 11:14 AM #4
I have attempted to kill the MalWarrior process, but have been unable to locate it. Task manager will not open. Windows Explorer cannot locate it. Should this thread be moved to Security and malwre removal? MaWarrior seems to be able to disable Windows Defender, AVG, and my firewall. "And I thought Vista had better security than XP"
__________________
Zeppfan(It's all in the CODA)

http://pwp.att.net/p/PWP-icanfixthat4u
Blackmirror's Avatar
Computer Specs
Distinguished Member with 21,262 posts.
  
Join Date: Dec 2006
Location: uk
Experience: Chocoholic
10-May-2008, 11:15 AM #5
I would post a hjt log
lunarlander's Avatar
Computer Specs
Senior Member with 831 posts.
  
Join Date: Sep 2007
10-May-2008, 05:01 PM #6
Try following the manual removal steps in Safe Mode from that page.
BlueEyedFox's Avatar
Computer Specs
Senior Member with 100 posts.
  
Join Date: May 2008
Experience: Advanced
10-May-2008, 05:09 PM #7
Quote:
Originally Posted by Zeppfan View Post
That site offers spywaredoctor. I ran this, but to remove, I would have to purchase spywaredoctor.

I ran a HJT log and there is a MaWarrior.exe program in the running processes list
Please post the HiJack this log here.

If you have HJT already please uninstall before reinstalling new version
Click here to download HJTInstall.exe
  • Save HJTInstall.exe to your desktop.
  • Doubleclick on the HJTInstall.exe icon on your desktop.
  • By default it will install to C:\Program Files\Trend Micro\HijackThis .
  • Click on Install.
  • It will create a HijackThis icon on the desktop.
  • Once installed, it will launch Hijackthis.
  • Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
  • Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
  • Come back here to this thread and Paste the log in your next reply.
  • DO NOT use the AnalyseThis button, its findings are dangerous if misinterpreted.
  • DO NOT have Hijackthis fix anything yet. Most of what it finds will be harmless or even required.

I REALLY reccomend these two programs to remove the Malware.Try running them in regular mode if that doesnt work Boot in Safe Mode you can learn how to Here

SUPERantispyware- Download Link
MalwareBytes- Download Link
__________________
Blue Eyed Fox
Technical Helper
Intermediate
Zeppfan's Avatar
Computer Specs
Senior Member with 367 posts.
  
Join Date: Apr 2006
Location: Over the Hills and Far Away
Experience: Dazed and Confused
10-May-2008, 10:33 PM #8
Sorry for not responding promptly. My boys had baseballo games all day today.

Here is the HJT Log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:31:38 PM, on 5/10/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16643)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\hp\support\hpsysdrv.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Windows\System32\wpcumi.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
C:\Windows\System32\rundll32.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\ProgramData\Adsl Software Limited\MalWarrior 2008\Malwarrior.exe
C:\Program Files\HP Connections\6811507\Program\HP Connections.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exe
C:\hp\kbd\kbd.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TY...ion&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TY...ion&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {12DD7F92-72C8-4FF2-9DB0-2F251D83882E} - C:\Windows\system32\fccaBUoO.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Yahoo! IE Suggest - {5A263CF7-56A6-4D68-A8CF-345BE45BC911} - C:\Program Files\Yahoo!\Search\YSearchSuggest.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KbdStub.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [AIMPro] "C:\Program Files\AIM\AIM Pro\aimpro.exe"
O4 - HKLM\..\Run: [WPCUMI] C:\Windows\system32\WpcUmi.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\byXrqRjG.dll,#1
O4 - HKLM\..\Run: [0ecd2170] rundll32.exe "C:\Windows\system32\lcbyrlks.dll",b
O4 - HKCU\..\Run: [HPAdvisor] C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe
O4 - HKCU\..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe -NoStart
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [MalWarrior] "C:\ProgramData\Adsl Software Limited\MalWarrior 2008\Malwarrior.exe" /autorun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Global Startup: HP Connections.lnk = C:\Program Files\HP Connections\6811507\Program\HP Connections.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O13 - Gopher Prefix:
O16 - DPF: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - http://freemeeting.6.football.nfl.com/rank
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn...tDetection.cab
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/de...e/HPDEXAXO.cab
O16 - DPF: {80AEEC0E-A2BE-4B8D-985F-350FE869DC40} (HPDDClientExec Class) - http://h20264.www2.hp.com/ediags/dd/...sticsVista.cab
O20 - Winlogon Notify: avgwlntf - C:\Windows\SYSTEM32\avgwlntf.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG7 Resident Shield Service (AvgCoreSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: KService - Kontiki Inc. - C:\Program Files\Kontiki\KService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 8390 bytes
__________________
Zeppfan(It's all in the CODA)

http://pwp.att.net/p/PWP-icanfixthat4u
dvk01's Avatar
Moderator with 24,762 posts.
  
Join Date: Dec 2002
Location: Loughton, Essex, UK
11-May-2008, 05:13 AM #9
Please visit Combofix Guide & Instructions for instructions for downloading and running ComboFix: especially follow the advice about installing the recovery console

Post the log from ComboFix when you've accomplished that, along with a new HijackThis log.

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Note: ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.
Note: Combofix prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell us when you reply
__________________
Derek
Microsoft MVP/Windows - Security
For help with spyware or hijackers thespykiller

please help me by donating to help keep the Hedgehog Rescue Centre running
We Care about Animals and the Environment
Zeppfan's Avatar
Computer Specs
Senior Member with 367 posts.
  
Join Date: Apr 2006
Location: Over the Hills and Far Away
Experience: Dazed and Confused
11-May-2008, 05:04 PM #10
ComboFix 08-05-11.1 - Jim 2008-05-11 15:42:59.3 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1033.18.1513 [GMT -5:00]
Running from: C:\Users\Jim\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\kmd.exe
C:\Windows\Downloaded Program Files\setup.inf
C:\Windows\System32\AGQAIkkj.ini
C:\Windows\System32\AGQAIkkj.ini2
C:\Windows\system32\fxdqnwkd.ini
C:\Windows\System32\IhjQqqss.ini
C:\Windows\System32\IhjQqqss.ini2
C:\Windows\system32\jqkcnhkd.ini
C:\Windows\system32\kmd.exe
C:\Windows\System32\mVwDJTwa.ini
C:\Windows\System32\mVwDJTwa.ini2
C:\Windows\System32\MWFMVvut.ini
C:\Windows\System32\MWFMVvut.ini2
C:\Windows\System32\OoUBaccf.ini
C:\Windows\System32\OoUBaccf.ini2
C:\Windows\system32\pyyajrdn.ini
C:\Windows\system32\sklrybcl.ini
C:\Windows\system32\yvpogoye.ini

.
((((((((((((((((((((((((( Files Created from 2008-04-11 to 2008-05-11 )))))))))))))))))))))))))))))))
.

2008-05-11 15:49 . 2008-05-11 15:49 294 ---hs---- C:\Windows\System32\sklrybcl.ini
2008-05-11 15:48 . 2008-05-09 10:19 30,336 --a------ C:\Windows\System32\iifGvSjI.dll
2008-05-10 22:30 . 2008-05-10 22:30 320,640 --a------ C:\Windows\System32\jkkIAQGA.dll
2008-05-10 21:48 . 2008-05-10 21:48 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2008-05-10 20:56 . 2008-05-10 20:56 91,776 --a------ C:\Windows\System32\lcbyrlks.dll
2008-05-10 20:55 . 2008-05-10 20:55 320,640 --a------ C:\Windows\System32\tuvVMFWM.dll
2008-05-10 18:39 . 2008-05-10 18:39 320,640 --a------ C:\Windows\System32\ssqqQjhI.dll
2008-05-09 23:26 . 2008-05-10 09:47 <DIR> d-a------ C:\Users\All Users\TEMP
2008-05-09 23:26 . 2008-05-10 09:47 <DIR> d-a------ C:\ProgramData\TEMP
2008-05-09 23:26 . 2008-05-09 23:26 321,152 --a------ C:\Windows\System32\awTJDwVm.dll
2008-05-09 12:42 . 2008-05-09 12:42 62,910 --a------ C:\Program Files\Uninstall.exe
2008-05-09 12:42 . 2008-05-09 12:42 0 --a------ C:\Program Files\uninstall.dat
2008-05-09 10:19 . 2008-05-09 10:19 1 --a------ C:\Windows\System32\kr_done1de
2008-05-09 10:18 . 2008-05-09 10:18 <DIR> d-------- C:\Users\All Users\Adsl Software Limited
2008-05-09 10:18 . 2008-05-09 10:18 <DIR> d-------- C:\ProgramData\Adsl Software Limited

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-11 20:46 --------- d-----w C:\ProgramData\Kontiki
2008-05-11 15:01 --------- d-----w C:\Users\Jim\AppData\Roaming\AVG7
2008-05-11 02:48 --------- d-----w C:\Users\Jim\AppData\Roaming\SUPERAntiSpyware.com
2008-05-11 02:47 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-05-11 02:44 --------- d-----w C:\Users\Jim\AppData\Roaming\Reno 911 Paintball
2008-05-10 14:47 --------- d-----w C:\Program Files\HP Games
2008-05-05 17:00 --------- d-----w C:\Users\Boyz\AppData\Roaming\AVG7
2008-04-16 20:03 --------- d-----w C:\Users\Jim\AppData\Roaming\FrostWire
2008-04-16 00:23 --------- d-----w C:\Program Files\Google
2008-04-15 01:22 --------- d-----w C:\Program Files\Image-Line
2008-04-15 01:21 --------- d-----w C:\Program Files\HP
2008-04-15 01:19 --------- d-----w C:\ProgramData\Viewpoint
2008-04-15 01:19 --------- d-----w C:\Program Files\TweakNow RegCleaner Std
2008-04-12 00:54 --------- d-----w C:\Users\Jim\AppData\Roaming\Audacity
2008-04-11 14:24 --------- d-----w C:\Program Files\FrostWire
2008-04-09 11:14 --------- d-----w C:\Program Files\Windows Mail
2008-03-20 00:20 --------- d-----w C:\Program Files\LimeWire
2008-03-19 22:21 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-03-14 23:03 53,768 ----a-w C:\Windows\system32\drivers\avgwfp.sys
2008-02-21 04:43 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-02-13 13:16 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll
2008-02-13 13:16 449,536 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-02-13 13:16 2,560 ----a-w C:\Windows\AppPatch\AcRes.dll
2008-02-13 13:16 2,144,256 ----a-w C:\Windows\AppPatch\AcGenral.dll
2008-02-13 13:16 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
2007-08-30 02:10 174 --sha-w C:\Program Files\desktop.ini
2007-03-31 16:12 0 ----a-w C:\Users\Jim\AppData\Roaming\wklnhst.dat
2005-09-14 05:57 258 ----a-w C:\Program Files\serial.txt
2005-09-13 18:53 92,828,160 ----a-w C:\Program Files\Fireworks8-en.exe
2005-09-13 18:51 113,060,248 ----a-w C:\Program Files\Flash8-en.exe
2005-09-13 18:47 62,651,176 ----a-w C:\Program Files\Dreamweaver8-en.exe
2007-05-16 04:44 22 --sha-w C:\Windows\SMINST\HPCD.sys
.

------- Sigcheck -------

.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{12DD7F92-72C8-4FF2-9DB0-2F251D83882E}]
C:\Windows\system32\fccaBUoO.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EB875A2E-93D4-498F-9DF7-2C93ED0C88B6}]
2008-05-10 22:30 320640 --a------ C:\Windows\system32\jkkIAQGA.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Aim6"="" []
"OM_Monitor"="C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe" [ ]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 07:35 125440]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 07:36 201728]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-02-29 16:03 1481968]
"HPAdvisor"="C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2007-04-10 23:12 1006264]
"hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2006-09-28 08:42 65536]
"RtHDVCpl"="RtHDVCpl.exe" [2007-10-25 05:52 4702208 C:\Windows\RtHDVCpl.exe]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-04-17 19:51 579584]
"KBD"="C:\HP\KBD\KbdStub.EXE" [2006-12-08 15:16 65536]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43 83608]
"WPCUMI"="C:\Windows\system32\WpcUmi.exe" [2006-11-02 07:35 176128]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-07-06 21:15 86016]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-07-06 21:15 8466432]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-07-06 21:15 81920]
"MSServer"="C:\Windows\system32\iifGvSjI.dll" [2008-05-09 10:19 30336]
"0ecd2170"="C:\Windows\system32\lcbyrlks.dll" [2008-05-10 20:56 91776]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-11-13 21:45 185632]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-07 19:34 98304]
"AIMPro"="C:\Program Files\AIM\AIM Pro\aimpro.exe" [ ]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-10-25 18:49 219136]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
HP Connections.lnk - C:\Program Files\HP Connections\6811507\Program\HP Connections.exe [2007-01-17 19:51:56 34520]
HP Digital Imaging Monitor.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe [2007-01-02 21:40:10 210520]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\syste m]
"EnableLUA"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"LogonHoursAction"= 2 (0x2)
"DontDisplayLogonHoursWarnings"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shell executehooks]
"{C3A9074B-1E3C-45D6-9195-604CE2F1D5B8}"= C:\Windows\system32\iifGvSjI.dll [2008-05-09 10:19 30336]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 12:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 12:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgwlntf]
avgwlntf.dll 2007-05-30 08:35 9216 C:\Windows\System32\avgwlntf.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{C26E2428-D39B-4195-B612-B633199E9AD8}"= UDP:C:\Program Files\HP Connections\6811507\Program\HP Connections.exe:HP Connections
"{6D5865B9-33B6-4392-8817-ACC5BD6EC61E}"= C:\Program Files\HP Connections\6811507\Program\HP Connections:HP Connections
"{8F1AC832-FA08-41B5-BA07-21D0BB33E918}"= UDP:C:\Program Files\HP Connections\6811507\Program\HP Connections.exe:HP Connections
"{FBBD64FC-AD92-4D08-9B69-18904D3C9AE3}"= TCP:C:\Program Files\HP Connections\6811507\Program\HP Connections.exe:HP Connections
"{82931695-04F3-4695-86E8-6C7F7012C7F9}"= UDP:C:\Program Files\HP Connections\6811507\Program\HP Connections.exe:HP Connections
"{F005862C-4C62-4CD9-A2A8-DE9AC35E8AB8}"= TCP:C:\Program Files\HP Connections\6811507\Program\HP Connections.exe:HP Connections
"{920F0572-488C-4D72-95DB-5F3866E14789}"= UDP:C:\Program Files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{CE2215A8-A65E-4108-8784-2B251D44DA56}"= TCP:C:\Program Files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{18D0B124-71DB-4D54-91A6-C4E05A86100F}"= UDP:C:\Program Files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{00FC659F-B5C2-4B81-B9C3-6245D2CA3A92}"= TCP:C:\Program Files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{8AFC4557-40ED-4F8E-B60A-AF053FE61B95}"= UDP:C:\Program Files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{50E2FA48-FD25-4719-86B7-9AA942AC7738}"= TCP:C:\Program Files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{311A612A-B638-47CD-B59F-D7D213F98460}"= UDP:C:\Program Files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{EDD1981E-D3EF-4B00-9FA7-203F62344CEF}"= TCP:C:\Program Files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{90DF6D22-79B4-4F5B-8117-70241B32EA67}"= UDP:C:\Program Files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{A0D815AD-3A5D-470F-A596-26973E5F1114}"= TCP:C:\Program Files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{A8FD3540-2C44-4F36-9705-0D8FCF75E985}"= UDP:C:\Program Files\Kontiki\KService.exeelivery Manager Service
"{D5F508BB-42D3-48F3-9011-340EDD235AD2}"= TCP:C:\Program Files\Kontiki\KService.exeelivery Manager Service
"{13C0C180-561B-4078-95AA-A7F42691532E}"= UDP:C:\Program Files\Kontiki\KService.exeelivery Manager Service
"{56D0C22C-DD07-466F-B2D7-0984B9275FE5}"= TCP:C:\Program Files\Kontiki\KService.exeelivery Manager Service
"{82CF9FC9-21A1-4928-923F-A252804669A1}"= UDP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
"{485AD620-7F11-4DF4-8E5B-5323A802A82A}"= TCP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
"{BB2F4BE0-6869-4BC4-91C8-9F286E9960B0}"= UDP:C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{FDFADC78-90AB-4B04-B1D2-2B653F4F31F7}"= TCP:C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"TCP Query User{3F4DFCB1-72F6-4429-9415-8895D823C46B}C:\\program files\\internet explorer\\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{303C24C5-6C28-4BE8-811C-675D1E519540}C:\\program files\\internet explorer\\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"TCP Query User{91B9FB6A-9652-41C7-8080-D2956AB30784}C:\\program files\\mozilla firefox\\firefox.exe"= UDP:C:\program files\mozilla firefox\firefox.exe:Firefox
"UDP Query User{80CA61D4-E6D3-4843-88E2-C9BD6785A4E3}C:\\program files\\mozilla firefox\\firefox.exe"= TCP:C:\program files\mozilla firefox\firefox.exe:Firefox
"TCP Query User{0F4BF16E-8FC4-4354-8CBA-1DFC4DE8CE89}C:\\program files\\macromedia\\dreamweaver 8\\dreamweaver.exe"= UDP:C:\program files\macromedia\dreamweaver 8\dreamweaver.exereamweaver 8
"UDP Query User{FAFD25CD-981D-4BF0-B087-F292B3F2DC20}C:\\program files\\macromedia\\dreamweaver 8\\dreamweaver.exe"= TCP:C:\program files\macromedia\dreamweaver 8\dreamweaver.exereamweaver 8
"{2031E367-51E4-4B96-AE2B-F32542BCF53F}"= Disabled:UDP:21856:SolidNetworkManager
"{63BC833F-9032-4F39-884E-11284C2253B4}"= Disabled:TCP:21856:SolidNetworkManager
"{7C9F669F-09E6-483D-89E7-83C88F8D99DE}"= UDP:C:\Program Files\FrostWire\FrostWire.exe:LimeWire
"{C94F3D0C-2D44-4FCA-873B-6CE7E35CDC86}"= TCP:C:\Program Files\FrostWire\FrostWire.exe:LimeWire
"TCP Query User{99A93988-F395-4B18-AA9B-2E7066BA6E1A}C:\\users\\jim\\appdata\\local\\temp\\nwizsrv.exe"= UDP:C:\users\jim\appdata\local\temp\nwizsrv.exe:nwizsrv.exe
"UDP Query User{D95A19A3-C29C-42A9-892E-1534A8D5E594}C:\\users\\jim\\appdata\\local\\temp\\nwizsrv.exe"= TCP:C:\users\jim\appdata\local\temp\nwizsrv.exe:nwizsrv.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\S tatic\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\Auth orizedApplications\List]
"C:\\Program Files\\EarthLink TotalAccess\\TaskPanl.exe"= C:\Program Files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink

R2 XAudio;XAudio;C:\Windows\system32\DRIVERS\xaudio.sys [2006-11-28 11:44]
R3 AvgWFP;AVG7 Firewall Driver x86;C:\Windows\system32\Drivers\avgwfp.sys [2008-03-14 18:03]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

.
Contents of the 'Scheduled Tasks' folder
"2008-05-11 15:36:17 C:\Windows\Tasks\User_Feed_Synchronization-{77ECB66C-A183-4A5E-93C6-6EC482D72B38}.job"
- C:\Windows\system32\msfeedssync.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-11 15:49:02
Windows 6.0.6000 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


C:\Users\Jim\AppData\Local\Microsoft\Portable Devices\wpdlog03.sqm
C:\Users\Jim\AppData\Local\Microsoft\Portable Devices\wpdlog04.sqm
C:\Users\Jim\AppData\Local\Temp\STS25E7.tmp 81 bytes

scan completed successfully
hidden files: 3

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\Windows\system32\winlogon.exe
-> C:\Windows\system32\iifGvSjI.dll

PROCESS: C:\Windows\Explorer.exe
-> C:\Windows\system32\lcbyrlks.dll
.
------------------------ Other Running Processes ------------------------
.
C:\Windows\System32\audiodg.exe
C:\Windows\System32\WUDFHost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
C:\Program Files\Kontiki\KService.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\Program Files\Common Files\microsoft shared\VS7DEBUG\MDM.EXE
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\System32\drivers\XAudio.exe
C:\Windows\System32\WUDFHost.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqste08.exe
C:\Windows\System32\wbem\unsecapp.exe
C:\hp\KBD\kbd.exe
.
**************************************************************************
.
Completion time: 2008-05-11 15:52:31 - machine was rebooted [Jim]
ComboFix-quarantined-files.txt 2008-05-11 20:52:18
ComboFix2.txt 2008-02-06 23:27:51
ComboFix3.txt 2008-02-05 23:56:59

Pre-Run: 196,481,249,280 bytes free
Post-Run: 196,430,815,232 bytes free

245 --- E O F --- 2008-05-09 00:46:20



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:56:15 PM, on 5/11/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16643)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\hp\support\hpsysdrv.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\Windows\System32\wpcumi.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\HP Connections\6811507\Program\HP Connections.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\hp\kbd\kbd.exe
C:\Windows\Explorer.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\rundll32.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TY...ion&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KbdStub.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [WPCUMI] C:\Windows\system32\WpcUmi.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\iifGvSjI.dll,#1
O4 - HKLM\..\Run: [0ecd2170] rundll32.exe "C:\Windows\system32\lcbyrlks.dll",b
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AIMPro] "C:\Program Files\AIM\AIM Pro\aimpro.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe -NoStart
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [HPAdvisor] C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Global Startup: HP Connections.lnk = C:\Program Files\HP Connections\6811507\Program\HP Connections.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O13 - Gopher Prefix:
O16 - DPF: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - http://freemeeting.6.football.nfl.com/rank
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn...tDetection.cab
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/de...e/HPDEXAXO.cab
O16 - DPF: {80AEEC0E-A2BE-4B8D-985F-350FE869DC40} (HPDDClientExec Class) - http://h20264.www2.hp.com/ediags/dd/...sticsVista.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG7 Resident Shield Service (AvgCoreSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: KService - Kontiki Inc. - C:\Program Files\Kontiki\KService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 7255 bytes
__________________
Zeppfan(It's all in the CODA)

http://pwp.att.net/p/PWP-icanfixthat4u
dvk01's Avatar
Moderator with 24,762 posts.
  
Join Date: Dec 2002
Location: Loughton, Essex, UK
13-May-2008, 01:59 PM #11
download the attached CFScript.txt and save it to your desktop ( click on the link underneath this post & if you are using internet explorer when the "File download" pop up comes press SAVE and choose desktop in the list of selections in that window & press save)

Close any open browsers and make sure you are disconnected from the net. Unplug the cable if need be before going any further

Then drag the CFScript.txt into the ComboFix.exe as shown in the screenshot below.







This will start ComboFix again. It may ask to reboot. Post the contents of Combofix.txt in your next reply together with a new HijackThis log.

Remember to reconnect to the net and enable any disabled antivirus etc BEFORE reconnecting

Note: these instructions and script were created specifically for this user. If you are not this user, do NOT follow these instructions or use this script as it could damage the workings of your system.

This will create a zip file named something like [38]-Submit_2008-01-17@17.50.zip

at the end it will pop up an alert & open your browser and ask you to send the zip file

please follow those instructions. We need to see the zip file before we can carry on with the fix

If there is no pop up alert or open browser then

please go to http://www.thespykiller.co.uk/index.php?board=1.0 and upload these files so I can examine them and if needed distribute them to antivirus companies.
Just press new topic, fill in the needed details and just give a link to your post here & then press the browse button and then navigate to & select the files on your computer, If there is more than 1 file then press the more attachments button for each extra file and browse and select etc and then when all the files are listed in the windows press send to upload the files ( do not post HJT logs there as they will not get dealt with)

Files to submit:
the zip file on desktop created by combofix named something like [38]-Submit_2008-01-17@17.50.zip
Attached Files
File Type: txt CFScript.txt (887 Bytes, 21 views)
__________________
Derek
Microsoft MVP/Windows - Security
For help with spyware or hijackers thespykiller

please help me by donating to help keep the Hedgehog Rescue Centre running
We Care about Animals and the Environment
Zeppfan's Avatar
Computer Specs
Senior Member with 367 posts.
  
Join Date: Apr 2006
Location: Over the Hills and Far Away
Experience: Dazed and Confused
13-May-2008, 10:01 PM #12
dvk01, I have submitted the zipfile to the website as per your instruction.

The following are both the ComboFix log and a new HJT log.

ComboFix 08-05-11.1 - Jim 2008-05-13 20:37:31.4 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1033.18.1368 [GMT -5:00]
Running from: C:\Users\Jim\Desktop\ComboFix.exe
Command switches used :: C:\Users\Jim\Desktop\CFScript.txt
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Windows\System32\AGQAIkkj.ini
C:\Windows\System32\AGQAIkkj.ini2
C:\Windows\System32\awTJDwVm.dll
C:\Windows\system32\grlobhtx.ini
C:\Windows\System32\jkkIAQGA.dll
C:\Windows\System32\kodqmpve.ini
C:\Windows\System32\kr_done1de
C:\Windows\System32\pqWxacdd.ini
C:\Windows\System32\pqWxacdd.ini2
C:\Windows\System32\rsvutvGh.ini
C:\Windows\System32\rsvutvGh.ini2
C:\Windows\System32\sklrybcl.ini
C:\Windows\System32\ssqqQjhI.dll
C:\Windows\System32\tuvVMFWM.dll
C:\Windows\system32\yamiyjvj.ini

.
((((((((((((((((((((((((( Files Created from 2008-04-14 to 2008-05-14 )))))))))))))))))))))))))))))))
.

2008-05-12 19:34 . 2008-05-12 19:34 319,104 --a------ C:\Windows\System32\ddcaxWqp.dll
2008-05-12 19:34 . 2008-05-12 19:34 91,328 --a------ C:\Windows\System32\jvjyimay.dll
2008-05-12 19:28 . 2008-05-09 10:19 30,336 --a------ C:\Windows\System32\iIbYPhHX.dll
2008-05-12 16:23 . 2008-05-12 16:23 319,104 --a------ C:\Windows\System32\hGvtuvsr.dll
2008-05-10 21:48 . 2008-05-10 21:48 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2008-05-09 23:26 . 2008-05-10 09:47 <DIR> d-a------ C:\Users\All Users\TEMP
2008-05-09 23:26 . 2008-05-10 09:47 <DIR> d-a------ C:\ProgramData\TEMP
2008-05-09 12:42 . 2008-05-09 12:42 62,910 --a------ C:\Program Files\Uninstall.exe
2008-05-09 12:42 . 2008-05-09 12:42 0 --a------ C:\Program Files\uninstall.dat
2008-05-09 10:18 . 2008-05-09 10:18 <DIR> d-------- C:\Users\All Users\Adsl Software Limited
2008-05-09 10:18 . 2008-05-09 10:18 <DIR> d-------- C:\ProgramData\Adsl Software Limited

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-14 01:44 --------- d-----w C:\ProgramData\Kontiki
2008-05-13 13:00 --------- d-----w C:\Users\Jim\AppData\Roaming\AVG7
2008-05-11 02:48 --------- d-----w C:\Users\Jim\AppData\Roaming\SUPERAntiSpyware.com
2008-05-11 02:47 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-05-11 02:44 --------- d-----w C:\Users\Jim\AppData\Roaming\Reno 911 Paintball
2008-05-10 14:47 --------- d-----w C:\Program Files\HP Games
2008-05-05 17:00 --------- d-----w C:\Users\Boyz\AppData\Roaming\AVG7
2008-04-16 20:03 --------- d-----w C:\Users\Jim\AppData\Roaming\FrostWire
2008-04-16 00:23 --------- d-----w C:\Program Files\Google
2008-04-15 01:22 --------- d-----w C:\Program Files\Image-Line
2008-04-15 01:21 --------- d-----w C:\Program Files\HP
2008-04-15 01:19 --------- d-----w C:\ProgramData\Viewpoint
2008-04-15 01:19 --------- d-----w C:\Program Files\TweakNow RegCleaner Std
2008-04-12 00:54 --------- d-----w C:\Users\Jim\AppData\Roaming\Audacity
2008-04-11 14:24 --------- d-----w C:\Program Files\FrostWire
2008-04-09 11:14 --------- d-----w C:\Program Files\Windows Mail
2008-03-20 00:20 --------- d-----w C:\Program Files\LimeWire
2008-03-19 22:21 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-03-14 23:03 53,768 ----a-w C:\Windows\system32\drivers\avgwfp.sys
2008-02-29 06:51 19,000 ----a-w C:\Windows\System32\kd1394.dll
2008-02-29 06:39 40,960 ----a-w C:\Windows\System32\srclient.dll
2008-02-29 06:39 371,712 ----a-w C:\Windows\System32\srcore.dll
2008-02-29 06:38 313,856 ----a-w C:\Windows\System32\rstrui.exe
2008-02-29 06:38 16,384 ----a-w C:\Windows\System32\srdelayed.exe
2008-02-29 06:35 6,656 ----a-w C:\Windows\System32\kbd106n.dll
2008-02-29 06:34 7,168 ----a-w C:\Windows\System32\f3ahvoas.dll
2008-02-29 04:16 2,027,008 ----a-w C:\Windows\System32\win32k.sys
2008-02-21 04:43 826,368 ----a-w C:\Windows\System32\wininet.dll
2008-02-21 04:43 56,320 ----a-w C:\Windows\System32\iesetup.dll
2008-02-21 04:43 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-02-21 04:43 296,448 ----a-w C:\Windows\System32\gdi32.dll
2008-02-21 04:43 26,624 ----a-w C:\Windows\System32\ieUnatt.exe
2008-02-19 05:10 620,088 ----a-w C:\Windows\System32\ci.dll
2008-02-14 23:19 944,184 ----a-w C:\Windows\System32\winload.exe
2007-08-30 02:10 174 --sha-w C:\Program Files\desktop.ini
2007-03-31 16:12 0 ----a-w C:\Users\Jim\AppData\Roaming\wklnhst.dat
2005-09-14 05:57 258 ----a-w C:\Program Files\serial.txt
2005-09-13 18:53 92,828,160 ----a-w C:\Program Files\Fireworks8-en.exe
2005-09-13 18:51 113,060,248 ----a-w C:\Program Files\Flash8-en.exe
2005-09-13 18:47 62,651,176 ----a-w C:\Program Files\Dreamweaver8-en.exe
2007-05-16 04:44 22 --sha-w C:\Windows\SMINST\HPCD.sys
.

------- Sigcheck -------

.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C3A9074B-1E3C-45D6-9195-604CE2F1D5B8}]
2008-05-09 10:19 30336 --a------ C:\Windows\system32\iIbYPhHX.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Aim6"="" []
"OM_Monitor"="C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe" [ ]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 07:35 125440]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 07:36 201728]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-02-29 16:03 1481968]
"HPAdvisor"="C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2007-04-10 23:12 1006264]
"hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2006-09-28 08:42 65536]
"RtHDVCpl"="RtHDVCpl.exe" [2007-10-25 05:52 4702208 C:\Windows\RtHDVCpl.exe]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-04-17 19:51 579584]
"KBD"="C:\HP\KBD\KbdStub.EXE" [2006-12-08 15:16 65536]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43 83608]
"WPCUMI"="C:\Windows\system32\WpcUmi.exe" [2006-11-02 07:35 176128]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-07-06 21:15 86016]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-07-06 21:15 8466432]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-07-06 21:15 81920]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-11-13 21:45 185632]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-07 19:34 98304]
"AIMPro"="C:\Program Files\AIM\AIM Pro\aimpro.exe" [ ]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-10-25 18:49 219136]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
HP Connections.lnk - C:\Program Files\HP Connections\6811507\Program\HP Connections.exe [2007-01-17 19:51:56 34520]
HP Digital Imaging Monitor.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe [2007-01-02 21:40:10 210520]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\syste m]
"EnableLUA"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"LogonHoursAction"= 2 (0x2)
"DontDisplayLogonHoursWarnings"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shell executehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 12:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 12:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgwlntf]
avgwlntf.dll 2007-05-30 08:35 9216 C:\Windows\System32\avgwlntf.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{C26E2428-D39B-4195-B612-B633199E9AD8}"= UDP:C:\Program Files\HP Connections\6811507\Program\HP Connections.exe:HP Connections
"{6D5865B9-33B6-4392-8817-ACC5BD6EC61E}"= C:\Program Files\HP Connections\6811507\Program\HP Connections:HP Connections
"{8F1AC832-FA08-41B5-BA07-21D0BB33E918}"= UDP:C:\Program Files\HP Connections\6811507\Program\HP Connections.exe:HP Connections
"{FBBD64FC-AD92-4D08-9B69-18904D3C9AE3}"= TCP:C:\Program Files\HP Connections\6811507\Program\HP Connections.exe:HP Connections
"{82931695-04F3-4695-86E8-6C7F7012C7F9}"= UDP:C:\Program Files\HP Connections\6811507\Program\HP Connections.exe:HP Connections
"{F005862C-4C62-4CD9-A2A8-DE9AC35E8AB8}"= TCP:C:\Program Files\HP Connections\6811507\Program\HP Connections.exe:HP Connections
"{920F0572-488C-4D72-95DB-5F3866E14789}"= UDP:C:\Program Files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{CE2215A8-A65E-4108-8784-2B251D44DA56}"= TCP:C:\Program Files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{18D0B124-71DB-4D54-91A6-C4E05A86100F}"= UDP:C:\Program Files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{00FC659F-B5C2-4B81-B9C3-6245D2CA3A92}"= TCP:C:\Program Files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{8AFC4557-40ED-4F8E-B60A-AF053FE61B95}"= UDP:C:\Program Files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{50E2FA48-FD25-4719-86B7-9AA942AC7738}"= TCP:C:\Program Files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{311A612A-B638-47CD-B59F-D7D213F98460}"= UDP:C:\Program Files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{EDD1981E-D3EF-4B00-9FA7-203F62344CEF}"= TCP:C:\Program Files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{90DF6D22-79B4-4F5B-8117-70241B32EA67}"= UDP:C:\Program Files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{A0D815AD-3A5D-470F-A596-26973E5F1114}"= TCP:C:\Program Files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{A8FD3540-2C44-4F36-9705-0D8FCF75E985}"= UDP:C:\Program Files\Kontiki\KService.exeelivery Manager Service
"{D5F508BB-42D3-48F3-9011-340EDD235AD2}"= TCP:C:\Program Files\Kontiki\KService.exeelivery Manager Service
"{13C0C180-561B-4078-95AA-A7F42691532E}"= UDP:C:\Program Files\Kontiki\KService.exeelivery Manager Service
"{56D0C22C-DD07-466F-B2D7-0984B9275FE5}"= TCP:C:\Program Files\Kontiki\KService.exeelivery Manager Service
"{82CF9FC9-21A1-4928-923F-A252804669A1}"= UDP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
"{485AD620-7F11-4DF4-8E5B-5323A802A82A}"= TCP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
"{BB2F4BE0-6869-4BC4-91C8-9F286E9960B0}"= UDP:C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{FDFADC78-90AB-4B04-B1D2-2B653F4F31F7}"= TCP:C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"TCP Query User{3F4DFCB1-72F6-4429-9415-8895D823C46B}C:\\program files\\internet explorer\\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{303C24C5-6C28-4BE8-811C-675D1E519540}C:\\program files\\internet explorer\\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"TCP Query User{91B9FB6A-9652-41C7-8080-D2956AB30784}C:\\program files\\mozilla firefox\\firefox.exe"= UDP:C:\program files\mozilla firefox\firefox.exe:Firefox
"UDP Query User{80CA61D4-E6D3-4843-88E2-C9BD6785A4E3}C:\\program files\\mozilla firefox\\firefox.exe"= TCP:C:\program files\mozilla firefox\firefox.exe:Firefox
"TCP Query User{0F4BF16E-8FC4-4354-8CBA-1DFC4DE8CE89}C:\\program files\\macromedia\\dreamweaver 8\\dreamweaver.exe"= UDP:C:\program files\macromedia\dreamweaver 8\dreamweaver.exereamweaver 8
"UDP Query User{FAFD25CD-981D-4BF0-B087-F292B3F2DC20}C:\\program files\\macromedia\\dreamweaver 8\\dreamweaver.exe"= TCP:C:\program files\macromedia\dreamweaver 8\dreamweaver.exereamweaver 8
"{2031E367-51E4-4B96-AE2B-F32542BCF53F}"= Disabled:UDP:21856:SolidNetworkManager
"{63BC833F-9032-4F39-884E-11284C2253B4}"= Disabled:TCP:21856:SolidNetworkManager
"{7C9F669F-09E6-483D-89E7-83C88F8D99DE}"= UDP:C:\Program Files\FrostWire\FrostWire.exe:LimeWire
"{C94F3D0C-2D44-4FCA-873B-6CE7E35CDC86}"= TCP:C:\Program Files\FrostWire\FrostWire.exe:LimeWire
"TCP Query User{99A93988-F395-4B18-AA9B-2E7066BA6E1A}C:\\users\\jim\\appdata\\local\\temp\\nwizsrv.exe"= UDP:C:\users\jim\appdata\local\temp\nwizsrv.exe:nwizsrv.exe
"UDP Query User{D95A19A3-C29C-42A9-892E-1534A8D5E594}C:\\users\\jim\\appdata\\local\\temp\\nwizsrv.exe"= TCP:C:\users\jim\appdata\local\temp\nwizsrv.exe:nwizsrv.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\S tatic\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\Auth orizedApplications\List]
"C:\\Program Files\\EarthLink TotalAccess\\TaskPanl.exe"= C:\Program Files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink

R2 XAudio;XAudio;C:\Windows\system32\DRIVERS\xaudio.sys [2006-11-28 11:44]
R3 AvgWFP;AVG7 Firewall Driver x86;C:\Windows\system32\Drivers\avgwfp.sys [2008-03-14 18:03]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

.
Contents of the 'Scheduled Tasks' folder
"2008-05-13 22:18:05 C:\Windows\Tasks\User_Feed_Synchronization-{77ECB66C-A183-4A5E-93C6-6EC482D72B38}.job"
- C:\Windows\system32\msfeedssync.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-13 20:42:40
Windows 6.0.6000 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Windows\System32\audiodg.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
C:\Program Files\Kontiki\KService.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\microsoft shared\VS7DEBUG\MDM.EXE
C:\Windows\System32\drivers\XAudio.exe
C:\Windows\System32\WUDFHost.exe
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\System32\wbem\unsecapp.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqste08.exe
C:\hp\KBD\kbd.exe
C:\Windows\System32\wbem\WMIADAP.exe
C:\Windows\servicing\TrustedInstaller.exe
.
**************************************************************************
.
Completion time: 2008-05-13 20:47:12 - machine was rebooted
ComboFix-quarantined-files.txt 2008-05-14 01:47:06
ComboFix2.txt 2008-05-11 20:52:31
ComboFix3.txt 2008-02-06 23:27:51
ComboFix4.txt 2008-02-05 23:56:59

Pre-Run: 194,993,709,056 bytes free
Post-Run: 195,053,268,992 bytes free

235 --- E O F --- 2008-05-09 00:46:20





Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:50:33 PM, on 5/13/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16643)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\hp\support\hpsysdrv.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\Windows\System32\wpcumi.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\HP Connections\6811507\Program\HP Connections.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exe
C:\hp\kbd\kbd.exe
C:\Windows\Explorer.exe
C:\Windows\system32\notepad.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TY...ion&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Yahoo! IE Suggest - {5A263CF7-56A6-4D68-A8CF-345BE45BC911} - C:\Program Files\Yahoo!\Search\YSearchSuggest.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {C3A9074B-1E3C-45D6-9195-604CE2F1D5B8} - C:\Windows\system32\iIbYPhHX.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KbdStub.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [WPCUMI] C:\Windows\system32\WpcUmi.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AIMPro] "C:\Program Files\AIM\AIM Pro\aimpro.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe -NoStart
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [HPAdvisor] C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Global Startup: HP Connections.lnk = C:\Program Files