Solved: Security warning: your computer may be infected...

[darlinho]

one word spyware. i havent been able to use my computer properly for 2 days now everything is slow. this message as well other keep coming up with caution exclamation mark on my sidebar icons. guess this is what i get for trying to get a crack for a spyware program...wow

anyways heres my hjt log. please cn someone help me i need tofix this before this weekend beofre my dad comes back...

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:31:02 PM, on 11/1/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Trend Micro\Internet Security 14\TMAS_OE\TMAS_OEMon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\Program Files\Whizzo\SpyJacker\SpyFound.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - URLSearchHook: (no name) - {0A94B116-4504-4e26-AB05-E61E474AA38B} - C:\Program Files\AskPBar\SrchAstt\1.bin\A9SRCHAS.DLL
O3 - Toolbar: (no name) - {F4D76F09-7896-458a-890F-E1F05C46069F} - (no file)
O3 - Toolbar: Security Toolbar - {11A69AE4-FBED-4832-A2BF-45AF82825583} - C:\WINDOWS\system32\pyzdrqmh.dll
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [f87b2656] rundll32.exe "C:\WINDOWS\system32\mkvsgckp.dll",b
O4 - HKCU\..\Run: [OE_OEM] "C:\Program Files\Trend Micro\Internet Security 14\TMAS_OE\TMAS_OEMon.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/webplayer/stage6/windows/AutoDLDivXWebPlayerInstaller.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
O23 - Service: SpyJacker (_Service_SpyJacker) - CompanyName - C:\Program Files\Whizzo\SpyJacker\SpyFound.exe

--
End of file - 5856 bytes

 

[Cheeseball81]

Download ComboFix to your Desktop.

• Double click combofix.exe and follow the prompts.
• When finished, it will produce a log for you. Post that log and a new HijackThis log in your next reply

Note: Do not mouseclick combofix's window while it's running as that may cause it to stall

 

[darlinho]

heres the combofix log

ComboFix 07-11-01.1 - Darlington Omeni 2007-11-02 22:13:06.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.147 [GMT -4:00]
Running from: C:\Documents and Settings\Darlington Omeni\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\DOCUME~1\ALLUSE~1\APPLIC~1.\salesmonitor
C:\DOCUME~1\ALLUSE~1\STARTM~1\Live Safety Center.lnk
C:\DOCUME~1\ALLUSE~1\STARTM~1\Online Security Guide.lnk
C:\DOCUME~1\DARLIN~1\Desktop\Live Safety Center.lnk
C:\DOCUME~1\DARLIN~1\Desktop\Online Security Guide.lnk
C:\DOCUME~1\DARLIN~1\FAVORI~1\Online Security Guide.lnk
C:\Documents and Settings\Darlington Omeni\Desktop\Live Safety Center.lnk
C:\Documents and Settings\Darlington Omeni\Desktop\Online Security Guide.lnk
C:\Documents and Settings\Darlington Omeni\Favorites\Online Security Guide.lnk
C:\Program Files\SecCenter
C:\Program Files\SecCenter\scprot4.exe
C:\Program Files\SecCenter\scprot4.exe.bak
C:\WINDOWS\system32\lerrcneu.dll
C:\WINDOWS\system32\lidkfqkv
C:\WINDOWS\system32\lidkfqkv\bg1.gif
C:\WINDOWS\system32\lidkfqkv\bgtop.gif
C:\WINDOWS\system32\lidkfqkv\bottom1.gif
C:\WINDOWS\system32\lidkfqkv\essentials.gif
C:\WINDOWS\system32\lidkfqkv\icon1.ico
C:\WINDOWS\system32\lidkfqkv\install1.gif
C:\WINDOWS\system32\lidkfqkv\left1.gif
C:\WINDOWS\system32\lidkfqkv\li.gif
C:\WINDOWS\system32\lidkfqkv\lidkfqkv1.exe
C:\WINDOWS\system32\lidkfqkv\lidkfqkv2.exe
C:\WINDOWS\system32\lidkfqkv\lidkfqkv3.exe
C:\WINDOWS\system32\lidkfqkv\logo.gif
C:\WINDOWS\system32\lidkfqkv\main.htm
C:\WINDOWS\system32\lidkfqkv\mainframe.htm
C:\WINDOWS\system32\lidkfqkv\reinstall1.gif
C:\WINDOWS\system32\lidkfqkv\right1.gif
C:\WINDOWS\system32\lidkfqkv\s1.htm
C:\WINDOWS\system32\lidkfqkv\s2.htm
C:\WINDOWS\system32\lidkfqkv\s3.htm
C:\WINDOWS\system32\lidkfqkv\SMTop1.gif
C:\WINDOWS\system32\lidkfqkv\SMTop2.gif
C:\WINDOWS\system32\lidkfqkv\SMTop3.gif
C:\WINDOWS\system32\lidkfqkv\SMTop4.gif
C:\WINDOWS\system32\lidkfqkv\soft1_off.gif
C:\WINDOWS\system32\lidkfqkv\soft1_off_ext.gif
C:\WINDOWS\system32\lidkfqkv\soft1_on.gif
C:\WINDOWS\system32\lidkfqkv\soft1_on_ext.gif
C:\WINDOWS\system32\lidkfqkv\soft2_off.gif
C:\WINDOWS\system32\lidkfqkv\soft2_off_ext.gif
C:\WINDOWS\system32\lidkfqkv\soft2_on.gif
C:\WINDOWS\system32\lidkfqkv\soft2_on_ext.gif
C:\WINDOWS\system32\lidkfqkv\soft3_off.gif
C:\WINDOWS\system32\lidkfqkv\soft3_off_ext.gif
C:\WINDOWS\system32\lidkfqkv\soft3_on.gif
C:\WINDOWS\system32\lidkfqkv\soft3_on_ext.gif
C:\WINDOWS\system32\lidkfqkv\softbottom_off.gif
C:\WINDOWS\system32\lidkfqkv\softbottom_on.gif
C:\WINDOWS\system32\lidkfqkv\softleft_off.gif
C:\WINDOWS\system32\lidkfqkv\softleft_on.gif
C:\WINDOWS\system32\lidkfqkv\Thumbs.db
C:\WINDOWS\system32\lidkfqkv\top1.gif
C:\WINDOWS\system32\lidkfqkv\top2.gif
C:\WINDOWS\system32\lidkfqkv\turnoff1.gif
C:\WINDOWS\system32\lidkfqkv\turnon1.gif
C:\WINDOWS\system32\mkvsgckp.dll
C:\WINDOWS\system32\nxypblsq.ini
C:\WINDOWS\system32\pkcgsvkm.ini
C:\WINDOWS\system32\ppqss.bak1
C:\WINDOWS\system32\ppqss.bak2
C:\WINDOWS\system32\ppqss.ini
C:\WINDOWS\system32\ppqss.ini2
C:\WINDOWS\system32\qslbpyxn.dll
C:\WINDOWS\system32\ssqpp.dll
C:\WINDOWS\system32\twtvxtrd.dllbox

.
((((((((((((((((((((((((( Files Created from 2007-10-03 to 2007-11-03 )))))))))))))))))))))))))))))))
.

2007-11-02 22:15 82,496 --a------ C:\WINDOWS\system32\orhqbldt.dll
2007-11-02 22:12 340,032 --a------ C:\WINDOWS\system32\twtvxtrd.dll
2007-11-02 22:12 340,032 --a------ C:\WINDOWS\system32\prcoqxgm.dll
2007-11-02 22:06 86,080 --a------ C:\WINDOWS\system32\cproyidp.dll
2007-11-01 11:32 <DIR> d-------- C:\WINDOWS\SpyMonitor
2007-11-01 11:32 1,246,720 --a------ C:\WINDOWS\system32\ModalCreateFileWarning.dll
2007-11-01 11:32 1,238,016 --a------ C:\WINDOWS\system32\ModalRegistryWarning.dll
2007-11-01 11:22 <DIR> d-------- C:\Program Files\Whizzo
2007-10-31 18:46 11,254 --a------ C:\WINDOWS\system32\locate.com
2007-10-31 17:47 <DIR> d-------- C:\WINDOWS\BDOSCAN8
2007-10-31 14:01 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2007-10-31 12:31 <DIR> d-------- C:\Documents and Settings\Darlington Omeni\Application Data\Grisoft
2007-10-31 12:31 <DIR> d-------- C:\DOCUME~1\DARLIN~1\APPLIC~1\Grisoft
2007-10-31 12:31 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-10-31 11:47 <DIR> d-------- C:\Program Files\Faxfgqar
2007-10-31 06:49 <DIR> d-------- C:\Program Files\Xlazjrnb
2007-10-30 20:57 <DIR> d-------- C:\Program Files\Mxrqqohc
2007-10-30 06:53 <DIR> d-------- C:\Program Files\Zkrcdsrj
2007-10-30 06:41 <DIR> d-------- C:\ShowNew
2007-10-30 06:41 <DIR> d-------- C:\GetRunKey
2007-10-29 22:33 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-10-29 17:44 17,408 --a------ C:\psapi.dll
2007-10-29 06:49 <DIR> d-------- C:\Program Files\Enigma Software Group
2007-10-28 21:54 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-10-28 20:19 33,280 --a------ C:\WINDOWS\system32\wvuvuus.dll
2007-10-28 20:18 <DIR> d-------- C:\Program Files\spihyxqn
2007-10-28 08:15 <DIR> d-------- C:\VundoFix Backups
2007-10-28 00:55 <DIR> d-------- C:\Program Files\RogueRemover FREE
2007-10-28 00:54 <DIR> d-------- C:\Program Files\Sunbelt Software
2007-10-28 00:26 <DIR> d-------- C:\Documents and Settings\Darlington Omeni\Application Data\True Sword
2007-10-28 00:26 <DIR> d-------- C:\DOCUME~1\DARLIN~1\APPLIC~1\True Sword
2007-10-28 00:25 <DIR> d-------- C:\Program Files\True Sword 4
2007-10-27 23:28 <DIR> d-------- C:\Program Files\Iqpwprej
2007-10-27 22:09 <DIR> d-------- C:\Documents and Settings\Darlington Omeni\Application Data\systemerrorfixer
2007-10-27 22:09 <DIR> d-------- C:\DOCUME~1\DARLIN~1\APPLIC~1\systemerrorfixer
2007-10-27 22:04 <DIR> d-------- C:\Program Files\Common Files\SystemErrorFixer
2007-10-27 22:04 <DIR> dr------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\systemerrorfixer
2007-10-27 17:13 48 --a------ C:\Documents and Settings\Darlington Omeni\readme.bat
2007-10-27 17:12 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Agnitum
2007-10-27 17:11 <DIR> d-------- C:\Program Files\lmxqtyrm
2007-10-25 10:26 53,248 --a------ C:\WINDOWS\bdoscandel.exe
2007-10-16 14:46 <DIR> d-------- C:\Program Files\DAEMON Tools
2007-10-16 14:42 685,816 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2007-10-16 14:22 <DIR> d-------- C:\Documents and Settings\Darlington Omeni\Application Data\dvdcss
2007-10-16 14:22 <DIR> d-------- C:\DOCUME~1\DARLIN~1\APPLIC~1\dvdcss
2007-10-15 16:59 <DIR> d-------- C:\Program Files\PCSecureDeleteTrial
2007-10-10 04:18 584,192 --------- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2007-10-08 23:36 83,096 --a------ C:\WINDOWS\system32\SSSensor.dll
2007-10-08 23:35 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-01 18:04 --------- d-----w C:\Program Files\eMule
2007-11-01 00:48 --------- d-----w C:\Documents and Settings\Darlington Omeni\Application Data\Azureus
2007-11-01 00:48 --------- d-----w C:\DOCUME~1\DARLIN~1\APPLIC~1\Azureus
2007-10-31 18:38 --------- d-----w C:\Program Files\WinAce
2007-10-30 02:19 --------- d-----w C:\Program Files\Trend Micro
2007-10-29 00:16 --------- d-----w C:\Program Files\DivX
2007-10-28 12:54 5,258 ----a-w C:\WINDOWS\system32\drivers\fwdrv.err
2007-10-26 03:06 --------- d-----w C:\Program Files\Trillian
2007-10-24 16:34 --------- d-----w C:\Program Files\HP
2007-10-05 06:15 --------- d-----w C:\Program Files\Azureus
2007-10-01 16:26 --------- d-----w C:\Program Files\DVD Shrink
2007-10-01 16:26 --------- d-----w C:\DOCUME~1\ALLUSE~1\APPLIC~1\DVD Shrink
2007-09-30 15:20 --------- d-----w C:\Program Files\Common Files\xing shared
2007-09-30 15:20 --------- d-----w C:\Program Files\Common Files\Real
2007-09-30 15:19 --------- d-----w C:\Program Files\Real
2007-09-30 15:10 --------- d-----w C:\Documents and Settings\Darlington Omeni\Application Data\Apple Computer
2007-09-30 15:10 --------- d-----w C:\DOCUME~1\DARLIN~1\APPLIC~1\Apple Computer
2007-09-30 15:04 --------- d-----w C:\Program Files\Apple Software Update
2007-09-30 15:03 --------- d-----w C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
2007-09-30 14:04 --------- d-----w C:\Program Files\AllToAVI
2007-09-30 03:13 47,360 ----a-w C:\Documents and Settings\Darlington Omeni\Application Data\pcouffin.sys
2007-09-30 03:13 47,360 ----a-w C:\DOCUME~1\DARLIN~1\APPLIC~1\pcouffin.sys
2007-09-30 03:13 --------- d-----w C:\Documents and Settings\Darlington Omeni\Application Data\Vso
2007-09-30 03:13 --------- d-----w C:\DOCUME~1\DARLIN~1\APPLIC~1\Vso
2007-09-29 17:38 --------- d-----w C:\Program Files\WinAVI Video Converter
2007-09-29 03:29 3,082 ----a-w C:\WINDOWS\system32\affv208325p1now.sys
2007-09-29 03:09 --------- d-----w C:\Documents and Settings\Darlington Omeni\Application Data\DVD Flick
2007-09-29 03:09 --------- d-----w C:\DOCUME~1\DARLIN~1\APPLIC~1\DVD Flick
2007-09-28 21:20 --------- d-----w C:\Program Files\Common Files\AVSMedia
2007-09-28 21:18 --------- d-----w C:\Documents and Settings\Darlington Omeni\Application Data\AVSMedia
2007-09-28 21:18 --------- d-----w C:\DOCUME~1\DARLIN~1\APPLIC~1\AVSMedia
2007-09-28 21:18 --------- d-----w C:\DOCUME~1\ALLUSE~1\APPLIC~1\AVS4YOU
2007-09-28 21:17 --------- d-----w C:\Program Files\Common Files\Download Manager
2007-09-28 21:12 --------- d-----w C:\DOCUME~1\ALLUSE~1\APPLIC~1\River Past G5
2007-09-28 21:02 36,734 ----a-w C:\WINDOWS\system32\OggDSuninst.exe
2007-09-28 21:02 --------- d-----w C:\Documents and Settings\Darlington Omeni\Application Data\River Past G5
2007-09-28 21:02 --------- d-----w C:\DOCUME~1\DARLIN~1\APPLIC~1\River Past G5
2007-09-28 04:19 --------- d-----w C:\Program Files\AC3Filter
2007-09-28 01:02 47,360 ----a-w C:\WINDOWS\system32\drivers\pcouffin.sys
2007-09-28 01:00 --------- d-----w C:\Documents and Settings\Darlington Omeni\Application Data\DivX
2007-09-28 01:00 --------- d-----w C:\DOCUME~1\DARLIN~1\APPLIC~1\DivX
2007-09-28 00:59 --------- d-----w C:\Program Files\Movkit
2007-09-26 01:19 --------- d-----w C:\Program Files\Smart Projects
2007-09-26 00:24 --------- d-----w C:\Program Files\Custom Technology
2007-09-25 23:26 --------- d-----w C:\Program Files\AVIcodec
2007-09-25 23:04 --------- d-----w C:\Program Files\MediaInfo
2007-09-25 16:55 --------- d-----w C:\Documents and Settings\Darlington Omeni\Application Data\CCEFront
2007-09-25 16:55 --------- d-----w C:\DOCUME~1\DARLIN~1\APPLIC~1\CCEFront
2007-09-25 12:02 --------- d-----w C:\Program Files\OpenVideoConverter
2007-09-22 14:58 --------- d-----w C:\DOCUME~1\ALLUSE~1\APPLIC~1\Azureus
2007-09-22 00:11 --------- d-----w C:\Documents and Settings\Darlington Omeni\Application Data\Sunbelt Software
2007-09-22 00:11 --------- d-----w C:\DOCUME~1\DARLIN~1\APPLIC~1\Sunbelt Software
2007-09-20 01:47 --------- d-----w C:\Documents and Settings\Darlington Omeni\Application Data\Comodo
2007-09-20 01:47 --------- d-----w C:\DOCUME~1\DARLIN~1\APPLIC~1\Comodo
2007-09-20 01:47 --------- d-----w C:\DOCUME~1\ALLUSE~1\APPLIC~1\Comodo
2007-09-18 02:59 --------- d-----w C:\Program Files\Nero
2007-09-18 00:54 --------- d-----w C:\Documents and Settings\Darlington Omeni\Application Data\Ahead
2007-09-18 00:54 --------- d-----w C:\DOCUME~1\DARLIN~1\APPLIC~1\Ahead
2007-09-17 18:40 35,856 ----a-w C:\WINDOWS\system32\drivers\tmpreflt.sys
2007-09-17 18:40 202,768 ----a-w C:\WINDOWS\system32\drivers\tmxpflt.sys
2007-09-17 18:31 1,126,072 ----a-w C:\WINDOWS\system32\drivers\vsapint.sys
2007-09-16 18:46 --------- d-----w C:\Program Files\MTV Networks
2007-09-16 18:44 --------- d-----w C:\Program Files\Windows Media Connect 2
2007-09-15 01:09 --------- d-----w C:\Program Files\Common Files\Sonic Shared
2007-09-15 01:08 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-09-12 11:02 --------- d-----w C:\Program Files\The Eagle
2007-09-11 23:14 156,992 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2007-09-10 01:19 --------- d-----w C:\Documents and Settings\Darlington Omeni\Application Data\The Eagle
2007-09-10 01:19 --------- d-----w C:\DOCUME~1\DARLIN~1\APPLIC~1\The Eagle
2007-09-08 20:17 --------- d-----w C:\Program Files\TVUPlayer
2007-09-05 23:41 --------- d-----w C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kontiki
2007-09-05 23:38 --------- d-----w C:\DOCUME~1\ALLUSE~1\APPLIC~1\Channel4
2007-09-05 01:21 --------- d-----w C:\Program Files\Common Files\HP
2007-08-22 12:55 96,256 ------w C:\WINDOWS\system32\dllcache\inseng.dll
2007-08-22 12:55 665,600 ------w C:\WINDOWS\system32\dllcache\wininet.dll
2007-08-22 12:55 617,984 ------w C:\WINDOWS\system32\dllcache\urlmon.dll
2007-08-22 12:55 55,808 ------w C:\WINDOWS\system32\dllcache\extmgr.dll
2007-08-22 12:55 532,480 ------w C:\WINDOWS\system32\dllcache\mstime.dll
2007-08-22 12:55 474,112 ------w C:\WINDOWS\system32\dllcache\shlwapi.dll
2007-08-22 12:55 449,024 ------w C:\WINDOWS\system32\dllcache\mshtmled.dll
2007-08-22 12:55 39,424 ------w C:\WINDOWS\system32\dllcache\pngfilt.dll
2007-08-22 12:55 357,888 ------w C:\WINDOWS\system32\dllcache\dxtmsft.dll
2007-08-22 12:55 3,064,832 ------w C:\WINDOWS\system32\dllcache\mshtml.dll
2007-08-22 12:55 251,904 ------w C:\WINDOWS\system32\dllcache\iepeers.dll
2007-08-22 12:55 205,824 ------w C:\WINDOWS\system32\dllcache\dxtrans.dll
2007-08-22 12:55 16,384 ------w C:\WINDOWS\system32\dllcache\jsproxy.dll
2007-08-22 12:55 151,040 ------w C:\WINDOWS\system32\dllcache\cdfview.dll
2007-08-22 12:55 146,432 ------w C:\WINDOWS\system32\dllcache\msrating.dll
2007-08-22 12:55 1,498,112 ------w C:\WINDOWS\system32\dllcache\shdocvw.dll
2007-08-22 12:55 1,054,208 ------w C:\WINDOWS\system32\dllcache\danim.dll
2007-08-22 12:55 1,022,976 ------w C:\WINDOWS\system32\dllcache\browseui.dll
2007-08-21 10:19 18,432 ------w C:\WINDOWS\system32\dllcache\iedw.exe
2007-08-21 06:15 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
2007-08-21 06:15 683,520 ------w C:\WINDOWS\system32\dllcache\inetcomm.dll
2007-08-15 22:33 129,784 ----a-w C:\WINDOWS\system32\pxafs.dll
2007-08-15 22:33 120,056 ----a-w C:\WINDOWS\system32\pxcpyi64.exe
2007-08-15 22:33 118,520 ----a-w C:\WINDOWS\system32\pxinsi64.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0DFCFB5E-3974-3338-8F09-0B2552E546A8}]
2007-10-31 11:47 94208 --a------ C:\Program Files\Faxfgqar\skpejvzn.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{44cbede0-6441-4d14-9f70-b20a126104fe}]
2007-11-02 22:15 82496 --a------ C:\WINDOWS\system32\orhqbldt.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{50666B8E-6CBD-4471-9E85-96B41D9BBCD3}]
2007-10-28 20:19 33280 --a------ C:\WINDOWS\system32\wvuvuus.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8248EA61-FBC6-446D-A63F-971D1F6D156B}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A95B2816-1D7E-4561-A202-68C0DE02353A}]
2007-11-02 22:12 340032 --a------ C:\WINDOWS\system32\twtvxtrd.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{11A69AE4-FBED-4832-A2BF-45AF82825583}"= C:\WINDOWS\system32\twtvxtrd.dll [2007-11-02 22:12 340032]

[HKEY_CLASSES_ROOT\CLSID\{11A69AE4-FBED-4832-A2BF-45AF82825583}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{11A69AE4-FBED-4832-A2BF-45AF82825583}"= C:\WINDOWS\system32\twtvxtrd.dll [2007-11-02 22:12 340032]

[HKEY_CLASSES_ROOT\CLSID\{11A69AE4-FBED-4832-A2BF-45AF82825583}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"pccguide.exe"="C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe" [2006-11-21 15:02]
"SigmatelSysTrayApp"="stsystra.exe" [2006-07-24 11:20 C:\WINDOWS\stsystra.exe]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2006-07-06 08:15]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2006-07-21 17:50]
"DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2005-09-08 06:20]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 05:25]
"f87b2656"="C:\WINDOWS\system32\cproyidp.dll" [2007-11-02 22:06]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OE_OEM"="C:\Program Files\Trend Micro\Internet Security 14\TMAS_OE\TMAS_OEMon.exe" [2006-08-04 17:15]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-27 20:03]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 06:00]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{50666B8E-6CBD-4471-9E85-96B41D9BBCD3}"= C:\WINDOWS\system32\wvuvuus.dll [2007-10-28 20:19 33280]

[HKEY_CURRENT_USER\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="C:\\WINDOWS\\system32\\vvgeowbv.exe,C:\\WINDOWS\\system32\\userinit.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\twtvxtrd]
twtvxtrd.dll 2007-11-02 22:12 340032 C:\WINDOWS\system32\twtvxtrd.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wvuvuus]
wvuvuus.dll 2007-10-28 20:19 33280 C:\WINDOWS\system32\wvuvuus.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\system32\ssqpp.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
backup=C:\WINDOWS\pss\Digital Line Detect.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
"C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]
"C:\Program Files\Dell Support\DSAgnt.exe" /startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DMXLauncher]
C:\Program Files\Dell\Media Experience\DMXLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ModemOnHold]
C:\Program Files\NetWaiting\netWaiting.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background

R2 _Service_SpyJacker;SpyJacker;C:\Program Files\Whizzo\SpyJacker\SpyFound.exe

.
**************************************************************************

catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-02 22:20:56
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-02 22:26:30 - machine was rebooted
C:\ComboFix2.txt ... 2007-10-29 22:43
.
--- E O F ---

 

[darlinho]

here the new hjt log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:27:58 PM, on 11/2/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Whizzo\SpyJacker\SpyFound.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PccGuide.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Trend Micro\Internet Security 14\TMAS_OE\TMAS_OEMon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - URLSearchHook: (no name) - {0A94B116-4504-4e26-AB05-E61E474AA38B} - C:\Program Files\AskPBar\SrchAstt\1.bin\A9SRCHAS.DLL
O3 - Toolbar: (no name) - {F4D76F09-7896-458a-890F-E1F05C46069F} - (no file)
O3 - Toolbar: Security Toolbar - {11A69AE4-FBED-4832-A2BF-45AF82825583} - C:\WINDOWS\system32\twtvxtrd.dll
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [f87b2656] rundll32.exe "C:\WINDOWS\system32\cproyidp.dll",b
O4 - HKCU\..\Run: [OE_OEM] "C:\Program Files\Trend Micro\Internet Security 14\TMAS_OE\TMAS_OEMon.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/webplayer/stage6/windows/AutoDLDivXWebPlayerInstaller.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
O23 - Service: SpyJacker (_Service_SpyJacker) - CompanyName - C:\Program Files\Whizzo\SpyJacker\SpyFound.exe

--
End of file - 5911 bytes

 

[Cheeseball81]

Download the Trial version of Superantispyware Pro (SAS):
http://www.superantispyware.com/superantispyware.html?rid=3132


Install it and double-click the icon on your desktop to run it.
· It will ask if you want to update the program definitions, click Yes.
· Under Configuration and Preferences, click the Preferences button.
· Click the Scanning Control tab.
· Under Scanner Options make sure the following are checked:
o Close browsers before scanning
o Scan for tracking cookies
o Terminate memory threats before quarantining.
o Please leave the others unchecked.
o Click the Close button to leave the control center screen.
· On the main screen, under Scan for Harmful Software click Scan your computer.
· On the left check C:\Fixed Drive.
· On the right, under Complete Scan, choose Perform Complete Scan.
· Click Next to start the scan. Please be patient while it scans your computer.
· After the scan is complete a summary box will appear. Click OK.
· Make sure everything in the white box has a check next to it, then click Next.
· It will quarantine what it found and if it asks if you want to reboot, click Yes.
· To retrieve the removal information for me please do the following:
o After reboot, double-click the SUPERAntispyware icon on your desktop.
o Click Preferences. Click the Statistics/Logs tab.
o Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
o It will open in your default text editor (such as Notepad/Wordpad).
o Please highlight everything in the notepad, then right-click and choose copy.
· Click close and close again to exit the program.
· Please paste that information here for me with a new Hijack This log.

 

[darlinho]

ok here the SAS log along with the HJT log


SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 11/03/2007 at 02:05 PM

Application Version : 3.9.1008

Core Rules Database Version : 3337
Trace Rules Database Version: 1338

Scan type : Complete Scan
Total Scan Time : 01:01:39

Memory items scanned : 433
Memory threats detected : 3
Registry items scanned : 6622
Registry threats detected : 22
File items scanned : 41673
File threats detected : 63

Trojan.WinFixer
C:\WINDOWS\SYSTEM32\VTSQN.DLL
C:\WINDOWS\SYSTEM32\VTSQN.DLL
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EC7A4EF0-AE25-4524-A144-A0B95E6F0946}
HKCR\CLSID\{EC7A4EF0-AE25-4524-A144-A0B95E6F0946}
HKCR\CLSID\{EC7A4EF0-AE25-4524-A144-A0B95E6F0946}\InprocServer32
HKCR\CLSID\{EC7A4EF0-AE25-4524-A144-A0B95E6F0946}\InprocServer32#ThreadingModel

Trojan.Downloader-Gen/MobRules
C:\PROGRAM FILES\FAXFGQAR\SKPEJVZN.DLL
C:\PROGRAM FILES\FAXFGQAR\SKPEJVZN.DLL
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0DFCFB5E-3974-3338-8F09-0B2552E546A8}
HKCR\CLSID\{0DFCFB5E-3974-3338-8F09-0B2552E546A8}
HKCR\CLSID\{0DFCFB5E-3974-3338-8F09-0B2552E546A8}\InprocServer32
HKCR\CLSID\{0DFCFB5E-3974-3338-8F09-0B2552E546A8}\InprocServer32#ThreadingModel
HKCR\CLSID\{0DFCFB5E-3974-3338-8F09-0B2552E546A8}\InprocServer32#t
C:\PROGRAM FILES\IQPWPREJ\ARVQADWX.DLL
C:\PROGRAM FILES\MXRQQOHC\NRLZETAJ.DLL
C:\PROGRAM FILES\XLAZJRNB\IQAAVOKO.DLL
C:\PROGRAM FILES\ZKRCDSRJ\MEOHNBMN.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{46DE8921-1D39-44D2-A9E9-64119261F211}\RP4\A0002714.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{46DE8921-1D39-44D2-A9E9-64119261F211}\RP4\A0002786.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{46DE8921-1D39-44D2-A9E9-64119261F211}\RP6\A0004347.DLL

Trojan.Downloader-NewJuan/VM
C:\WINDOWS\SYSTEM32\ORHQBLDT.DLL
C:\WINDOWS\SYSTEM32\ORHQBLDT.DLL

Unclassified.Unknown Origin
HKLM\Software\Classes\CLSID\{11A69AE4-FBED-4832-A2BF-45AF82825583}
HKCR\CLSID\{11A69AE4-FBED-4832-A2BF-45AF82825583}
HKCR\CLSID\{11A69AE4-FBED-4832-A2BF-45AF82825583}
HKCR\CLSID\{11A69AE4-FBED-4832-A2BF-45AF82825583}\InprocServer32
HKCR\CLSID\{11A69AE4-FBED-4832-A2BF-45AF82825583}\InprocServer32#ThreadingModel
C:\WINDOWS\SYSTEM32\TWTVXTRD.DLL
HKLM\Software\Microsoft\Internet Explorer\Toolbar#{11A69AE4-FBED-4832-A2BF-45AF82825583}
HKU\S-1-5-21-1131652235-2254646265-464740733-1007\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser#{11A69AE4-FBED-4832-A2BF-45AF82825583}

Adware.Vundo Variant
HKLM\Software\Classes\CLSID\{A95B2816-1D7E-4561-A202-68C0DE02353A}
HKCR\CLSID\{A95B2816-1D7E-4561-A202-68C0DE02353A}
HKCR\CLSID\{A95B2816-1D7E-4561-A202-68C0DE02353A}\InprocServer32
HKCR\CLSID\{A95B2816-1D7E-4561-A202-68C0DE02353A}\InprocServer32#ThreadingModel
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A95B2816-1D7E-4561-A202-68C0DE02353A}
HKCR\CLSID\{A95B2816-1D7E-4561-A202-68C0DE02353A}

Adware.Tracking Cookie
C:\Documents and Settings\Darlington Omeni\Cookies\darlington [email protected][2].txt
C:\Documents and Settings\Darlington Omeni\Cookies\darlington [email protected]stsellerantivirus[2].txt

Trojan.Unknown Origin
C:\DOCUMENTS AND SETTINGS\DARLINGTON OMENI\LOCAL SETTINGS\TEMP\ICO11.TMP
C:\DOCUMENTS AND SETTINGS\DARLINGTON OMENI\LOCAL SETTINGS\TEMP\ICO12.TMP
C:\DOCUMENTS AND SETTINGS\DARLINGTON OMENI\LOCAL SETTINGS\TEMP\ICO13.TMP
C:\DOCUMENTS AND SETTINGS\DARLINGTON OMENI\LOCAL SETTINGS\TEMP\ICO14.TMP
C:\DOCUMENTS AND SETTINGS\DARLINGTON OMENI\LOCAL SETTINGS\TEMP\ICO15.TMP
C:\DOCUMENTS AND SETTINGS\DARLINGTON OMENI\LOCAL SETTINGS\TEMP\ICO16.TMP
C:\DOCUMENTS AND SETTINGS\DARLINGTON OMENI\LOCAL SETTINGS\TEMP\ICO17.TMP
C:\DOCUMENTS AND SETTINGS\DARLINGTON OMENI\LOCAL SETTINGS\TEMP\ICO18.TMP
C:\DOCUMENTS AND SETTINGS\DARLINGTON OMENI\LOCAL SETTINGS\TEMP\ICO19.TMP
C:\DOCUMENTS AND SETTINGS\DARLINGTON OMENI\LOCAL SETTINGS\TEMP\ICO1A.TMP
C:\DOCUMENTS AND SETTINGS\DARLINGTON OMENI\LOCAL SETTINGS\TEMP\ICO1B.TMP
C:\DOCUMENTS AND SETTINGS\DARLINGTON OMENI\LOCAL SETTINGS\TEMP\ICO1C.TMP
C:\DOCUMENTS AND SETTINGS\DARLINGTON OMENI\LOCAL SETTINGS\TEMP\ICO1D.TMP
C:\DOCUMENTS AND SETTINGS\DARLINGTON OMENI\LOCAL SETTINGS\TEMP\ICO1E.TMP
C:\DOCUMENTS AND SETTINGS\DARLINGTON OMENI\LOCAL SETTINGS\TEMP\ICO1F.TMP
C:\DOCUMENTS AND SETTINGS\DARLINGTON OMENI\LOCAL SETTINGS\TEMP\ICO20.TMP
C:\DOCUMENTS AND SETTINGS\DARLINGTON OMENI\LOCAL SETTINGS\TEMP\ICO21.TMP
C:\DOCUMENTS AND SETTINGS\DARLINGTON OMENI\LOCAL SETTINGS\TEMP\ICO22.TMP
C:\DOCUMENTS AND SETTINGS\DARLINGTON OMENI\LOCAL SETTINGS\TEMP\ICO23.TMP
C:\DOCUMENTS AND SETTINGS\DARLINGTON OMENI\LOCAL SETTINGS\TEMP\ICO24.TMP
C:\DOCUMENTS AND SETTINGS\DARLINGTON OMENI\LOCAL SETTINGS\TEMP\ICO25.TMP
C:\DOCUMENTS AND SETTINGS\DARLINGTON OMENI\LOCAL SETTINGS\TEMP\ICO26.TMP
C:\DOCUMENTS AND SETTINGS\DARLINGTON OMENI\LOCAL SETTINGS\TEMP\ICO27.TMP
C:\DOCUMENTS AND SETTINGS\DARLINGTON OMENI\LOCAL SETTINGS\TEMP\ICO28.TMP
C:\DOCUMENTS AND SETTINGS\DARLINGTON OMENI\LOCAL SETTINGS\TEMP\ICO29.TMP
C:\DOCUMENTS AND SETTINGS\DARLINGTON OMENI\LOCAL SETTINGS\TEMP\ICO2E.TMP
C:\DOCUMENTS AND SETTINGS\DARLINGTON OMENI\LOCAL SETTINGS\TEMP\ICO2F.TMP
C:\DOCUMENTS AND SETTINGS\DARLINGTON OMENI\LOCAL SETTINGS\TEMP\ICO30.TMP
C:\DOCUMENTS AND SETTINGS\DARLINGTON OMENI\LOCAL SETTINGS\TEMP\ICO31.TMP
C:\DOCUMENTS AND SETTINGS\DARLINGTON OMENI\LOCAL SETTINGS\TEMP\ICO32.TMP
C:\DOCUMENTS AND SETTINGS\DARLINGTON OMENI\LOCAL SETTINGS\TEMP\ICO3B.TMP
C:\DOCUMENTS AND SETTINGS\DARLINGTON OMENI\LOCAL SETTINGS\TEMP\ICO3C.TMP
C:\DOCUMENTS AND SETTINGS\DARLINGTON OMENI\LOCAL SETTINGS\TEMP\ICO3D.TMP
C:\DOCUMENTS AND SETTINGS\DARLINGTON OMENI\LOCAL SETTINGS\TEMP\ICO3E.TMP
C:\DOCUMENTS AND SETTINGS\DARLINGTON OMENI\LOCAL SETTINGS\TEMP\ICO3F.TMP
C:\PROGRAM FILES\LMXQTYRM\HMVGNALQ.DLL
C:\PROGRAM FILES\SPIHYXQN\ABIPKDID.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{46DE8921-1D39-44D2-A9E9-64119261F211}\RP5\A0003040.DLL

Malware.LocusSoftware Inc/BestSellerAntivirus
C:\DOCUMENTS AND SETTINGS\DARLINGTON OMENI\LOCAL SETTINGS\TEMP\QRJATYDI.EXE

Malware.Ultimate Defender
C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\LIDKFQKV\LIDKFQKV1.EXE.VIR
C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\LIDKFQKV\LIDKFQKV2.EXE.VIR
C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\LIDKFQKV\LIDKFQKV3.EXE.VIR
C:\SYSTEM VOLUME INFORMATION\_RESTORE{46DE8921-1D39-44D2-A9E9-64119261F211}\RP7\A0004406.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{46DE8921-1D39-44D2-A9E9-64119261F211}\RP7\A0004407.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{46DE8921-1D39-44D2-A9E9-64119261F211}\RP7\A0004408.EXE

Trojan.Downloader-Gen/BigTkt
C:\SYSTEM VOLUME INFORMATION\_RESTORE{46DE8921-1D39-44D2-A9E9-64119261F211}\RP2\A0002263.DLL
C:\VUNDOFIX BACKUPS\DRVXADR.DLL.BAD

Trojan.Downloader-FakeRX
C:\SYSTEM VOLUME INFORMATION\_RESTORE{46DE8921-1D39-44D2-A9E9-64119261F211}\RP5\A0003024.DLL

Adware.Vundo Variant/Rel
C:\WINDOWS\SYSTEM32\NQSTV.BAK1
C:\WINDOWS\SYSTEM32\NQSTV.INI


and here is the HJT log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:20:05 PM, on 11/3/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\Program Files\Whizzo\SpyJacker\SpyFound.exe
C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Trend Micro\Internet Security 14\TMAS_OE\TMAS_OEMon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\dmoney.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PccUpdUI.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - URLSearchHook: (no name) - {0A94B116-4504-4e26-AB05-E61E474AA38B} - C:\Program Files\AskPBar\SrchAstt\1.bin\A9SRCHAS.DLL
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Ask Search Assistant BHO - {0A94B111-4504-4e26-AB05-E61E474AA38B} - C:\Program Files\AskPBar\SrchAstt\1.bin\A9SRCHAS.DLL
O2 - BHO: {ef401621-a02b-07f9-41d4-14460edebc44} - {44cbede0-6441-4d14-9f70-b20a126104fe} - C:\WINDOWS\system32\orhqbldt.dll (file missing)
O2 - BHO: (no name) - {50666B8E-6CBD-4471-9E85-96B41D9BBCD3} - C:\WINDOWS\system32\wvuvuus.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {8248EA61-FBC6-446D-A63F-971D1F6D156B} - (no file)
O2 - BHO: (no name) - {FDC5DC98-E868-4EA1-83AA-23042B473FFB} - C:\WINDOWS\system32\vtsqn.dll (file missing)
O3 - Toolbar: (no name) - {F4D76F09-7896-458a-890F-E1F05C46069F} - (no file)
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [OE_OEM] "C:\Program Files\Trend Micro\Internet Security 14\TMAS_OE\TMAS_OEMon.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/webplayer/stage6/windows/AutoDLDivXWebPlayerInstaller.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: twtvxtrd - twtvxtrd.dll (file missing)
O20 - Winlogon Notify: wvuvuus - C:\WINDOWS\SYSTEM32\wvuvuus.dll
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
O23 - Service: SpyJacker (_Service_SpyJacker) - CompanyName - C:\Program Files\Whizzo\SpyJacker\SpyFound.exe

--
End of file - 7145 bytes

 

[darlinho]

pop ups stopped showing up last night then this morning it started coming again and theres a caution sign with an exclamation sign on my icons next to my clock what do i do now? i thought it was gone

 

[Cheeseball81]

No, we're not done.
Please rerun Combofix and post the results.
Then we can proceed with removal.

 

[darlinho]

sorry for the long delay my cuzzing came and rebooted my computer ... everything is fine now (but i lost alot of stuff). thank you so much though... sorry for wasting your time

 

[Cheeseball81]

No problem Have a good day