"Security Tool" virus

TechnoTardTechnoTard
edited November 2009 in Spyware & Virus Removal
When I logged into my computer, this program claiming to be a virus protection program called "security tool" popped up trying to get me to buy it with my credit card.
It kept hiding my desktop icons and it made my internet really slow.
So I went to the file location and deleted the files. The program no longer pops up but my internet is still really slow.

can someone help me with what might still be wrong?
Here's my Hijackthis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:21:04 PM, on 10/5/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18813)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\mobsync.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Intel\IntelDH\CCU\CCU_TrayIcon.exe
C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Windows\sttray.exe
C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Xfire\Xfire.exe
C:\Program Files\Intel\IntelDH\CCU\CCU_Engine.exe
C:\Program Files\Xfire\Xfire.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Windows\system32\taskmgr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\CCleaner\CCleaner.exe
C:\Program Files\trend micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Comcast Toolbar - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\PROGRA~1\COMCAS~1\COMCAS~1.DLL
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\google\BAE.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll
O3 - Toolbar: Comcast Toolbar - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\PROGRA~1\COMCAS~1\COMCAS~1.DLL
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [CCUTRAYICON] C:\Program Files\Intel\IntelDH\CCU\CCU_TrayIcon.exe
O4 - HKLM\..\Run: [NMSSupport] "C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe" /startup
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [ddoctorv2] "C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe" /P ddoctorv2
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [snpstd] C:\Windows\vsnpstd.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] sttray.exe
O4 - HKCU\..\Run: [EasyLinkAdvisor] "C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" /startup
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [gomimarab] Rundll32.exe "c:\progra~2\fasihebu\fasihebu.dll",a
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKUS\S-1-5-18\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'Default user')
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\Xfire.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Filter: x-sdch - (no CLSID) - (no file)
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll C:\Windows\System32\avgrsstx.dll
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: Intel(R) Alert Service (AlertService) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\CCU\AlertService.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: DQLWinService - Unknown owner - C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Intel(R) Software Services Manager (ISSM) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: Intel(R) Viiv(TM) Media Server (M1 Server) - Unknown owner - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe
O23 - Service: Intel(R) Application Tracker (MCLServiceATL) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\McShield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\Windows\system32\GameMon.des.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
O23 - Service: Intel(R) Remoting Service (Remote UI Service) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe
O23 - Service: SupportSoft Sprocket Service (ddoctorv2) (sprtsvc_ddoctorv2) - SupportSoft, Inc. - C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe

--
End of file - 10472 bytes
«1

Comments

  • aktiveaktive
    edited October 2009
    Likely, there are still some malicious files on your computer. Make sure you have removed all files. Detailed manual removal guide:
    http://www.bleepingcomputer.com/virus-removal/remove-security-tool
    and http://www.2-spyware.com/remove-security-tool.html

    Personally I recommend you to download MalwareBytes anti-malware or a free version of Spyware Doctor to remove remains.
    http://www.malwarebytes.org/mbam.php
    http://pack.google.com/intl/en/pack_installer.html (select only Spyware Doctor from the list)

    Good luck!
  • TechnoTardTechnoTard
    edited October 2009
    I don't know how to remove all of them though.
    I only removed what I thought was all of them since it was the only ones that showed up when I went to it's file location.
    I have malwarebytes and i used it while I was in safe mode but it didn't get rid of the problem.
  • TechnoTardTechnoTard
    edited October 2009
    If Malwarebytes didn't automatically update itself, I'll just manually update it and try again, and I'll use Spyware Doctor as well to see if it gets rid of the problem.
  • aktiveaktive
    edited October 2009
    You should definitely use Spyware Doctor as it sometimes detects infections that MalwareBytes misses.
  • TechnoTardTechnoTard
    edited October 2009
    aktive wrote:
    You should definitely use Spyware Doctor as it sometimes detects infections that MalwareBytes misses.

    Ok I used Spyware Doctor and the first quick scan caught a few things.
    Then I used it again for a full scan then deleted everything it missed, but I'm still getting problems and the spyware doctor just picked up some more stuff.

    Can you take a look at my hijackthis log and try to figure out what exactly is infected and getting missed?

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 9:24:24 PM, on 10/9/2009
    Platform: Windows Vista SP2 (WinNT 6.00.1906)
    MSIE: Internet Explorer v8.00 (8.00.6001.18813)
    Boot mode: Normal

    Running processes:
    C:\Windows\System32\smss.exe
    C:\Windows\system32\csrss.exe
    C:\Windows\system32\wininit.exe
    C:\Windows\system32\csrss.exe
    C:\Windows\system32\services.exe
    C:\Windows\system32\lsass.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\winlogon.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\SLsvc.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
    C:\Windows\System32\spoolsv.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\agrsmsvc.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
    C:\Program Files\McAfee\VirusScan\McShield.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\Windows\system32\PnkBstrA.exe
    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
    C:\PROGRA~1\AVG\AVG8\avgnsx.exe
    C:\Windows\system32\svchost.exe
    C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
    C:\Program Files\AVG\AVG8\avgcsrvx.exe
    C:\Program Files\Spyware Doctor\pctsAuxs.exe
    C:\Program Files\Spyware Doctor\pctsSvc.exe
    C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
    C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\WUDFHost.exe
    C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\system32\taskeng.exe
    C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Program Files\Intel\IntelDH\CCU\CCU_TrayIcon.exe
    C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe
    C:\Windows\System32\igfxtray.exe
    C:\Windows\System32\hkcmd.exe
    C:\Windows\System32\igfxpers.exe
    C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
    C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe
    C:\Program Files\AVG\AVG8\avgtray.exe
    C:\Windows\sttray.exe
    C:\Program Files\Windows Media Player\wmpnetwk.exe
    C:\Program Files\Spyware Doctor\pctsTray.exe
    C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\Program Files\Xfire\Xfire.exe
    C:\Program Files\Intel\IntelDH\CCU\CCU_Engine.exe
    C:\Program Files\Intel\IntelDH\CCU\AlertService.exe
    C:\Program Files\Windows Live\Contacts\wlcomm.exe
    C:\Windows\system32\taskmgr.exe
    C:\Program Files\Xfire\Xfire.exe
    C:\Program Files\CCleaner\CCleaner.exe
    C:\Windows\system32\taskeng.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Windows Media Player\wmpnscfg.exe
    C:\Program Files\trend micro\HijackThis\HijackThis.exe
    C:\Windows\system32\wbem\wmiprvse.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
    O1 - Hosts: ::1 localhost
    O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll
    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
    O2 - BHO: Comcast Toolbar - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\PROGRA~1\COMCAS~1\COMCAS~1.DLL
    O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
    O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
    O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll
    O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
    O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\google\BAE.dll
    O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
    O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll
    O3 - Toolbar: Comcast Toolbar - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\PROGRA~1\COMCAS~1\COMCAS~1.DLL
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
    O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
    O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
    O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
    O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
    O4 - HKLM\..\Run: [CCUTRAYICON] C:\Program Files\Intel\IntelDH\CCU\CCU_TrayIcon.exe
    O4 - HKLM\..\Run: [NMSSupport] "C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe" /startup
    O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
    O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
    O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
    O4 - HKLM\..\Run: [ddoctorv2] "C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe" /P ddoctorv2
    O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
    O4 - HKLM\..\Run: [snpstd] C:\Windows\vsnpstd.exe
    O4 - HKLM\..\Run: [SigmatelSysTrayApp] sttray.exe
    O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
    O4 - HKCU\..\Run: [EasyLinkAdvisor] "C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" /startup
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
    O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
    O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
    O4 - HKCU\..\Run: [gomimarab] Rundll32.exe "c:\progra~2\fasihebu\fasihebu.dll",a
    O4 - HKUS\S-1-5-18\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'Default user')
    O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\Xfire.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O13 - Gopher Prefix:
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
    O18 - Filter: x-sdch - (no CLSID) - (no file)
    O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll C:\Windows\System32\avgrsstx.dll
    O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
    O23 - Service: Intel(R) Alert Service (AlertService) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\CCU\AlertService.exe
    O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    O23 - Service: DQLWinService - Unknown owner - C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
    O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: Intel(R) Software Services Manager (ISSM) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe
    O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
    O23 - Service: Intel(R) Viiv(TM) Media Server (M1 Server) - Unknown owner - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe
    O23 - Service: Intel(R) Application Tracker (MCLServiceATL) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe
    O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\McShield.exe
    O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
    O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\Windows\system32\GameMon.des.exe (file missing)
    O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
    O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
    O23 - Service: Intel(R) Remoting Service (Remote UI Service) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe
    O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
    O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
    O23 - Service: SupportSoft Sprocket Service (ddoctorv2) (sprtsvc_ddoctorv2) - SupportSoft, Inc. - C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe

    --
    End of file - 12827 bytes
  • aktiveaktive
    edited October 2009
    The log looks good except these entries:
    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
    O4 - HKCU\..\Run: [gomimarab] Rundll32.exe "c:\progra~2\fasihebu\fasihebu.dll",a
    O18 - Filter: x-sdch - (no CLSID) - (no file)

    Run HijackThis again select boxes near each entry and press "Fix checked". Then run Combofix (free)
    http://www.bleepingcomputer.com/combofix/how-to-use-combofix
  • TechnoTardTechnoTard
    edited October 2009
    Ok, I removed the entries and then I downloaded ComboFix and ran it, but after the scan, I closed the notepad and forgot to copy the log so I can post it here.
    Is there a way for me to get that log again, without having to rescan?
  • aktiveaktive
    edited October 2009
    The log should be in C:\ComboFix.txt
  • TechnoTardTechnoTard
    edited October 2009
    Ok thank you.
    here is my combofix log:

    ComboFix 09-10-11.03 - Nicholas 10/12/2009 15:27.1.2 - NTFSx86
    Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.1013.292 [GMT -7:00]
    Running from: c:\users\Nicholas\Desktop\ComboFix.exe
    SP: Lavasoft Ad-Watch Live! *disabled* (Updated) {67844DAE-4F77-4D69-9457-98E8CFFDAA22}
    SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
    * Resident AV is active

    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\windows\Installer\15e6643.msi
    c:\windows\Installer\fdf8b5.msi
    D:\Autorun.inf

    .
    ((((((((((((((((((((((((( Files Created from 2009-09-12 to 2009-10-12 )))))))))))))))))))))))))))))))
    .

    2009-10-12 22:57 . 2009-10-12 22:57
    d
    w- c:\users\Public\AppData\Local\temp
    2009-10-12 22:57 . 2009-10-12 22:57
    d
    w- c:\users\Nicholas\AppData\Local\temp
    2009-10-12 22:57 . 2009-10-12 22:57
    d
    w- c:\users\IUSR_NMPR\AppData\Local\temp
    2009-10-12 22:57 . 2009-10-12 22:57
    d
    w- c:\users\Guest\AppData\Local\temp
    2009-10-08 05:01 . 2009-10-08 05:01
    d
    w- c:\users\Nicholas\AppData\Roaming\AdobeUM
    2009-10-07 19:04 . 2008-12-11 15:38 159600 ----a-w- c:\windows\system32\drivers\pctgntdi.sys
    2009-10-07 19:04 . 2009-04-03 18:18 130936 ----a-w- c:\windows\system32\drivers\PCTCore.sys
    2009-10-07 19:04 . 2008-12-18 19:16 73840 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys
    2009-10-07 19:03 . 2009-10-07 19:05
    d
    w- c:\program files\Common Files\PC Tools
    2009-10-07 19:03 . 2008-12-10 18:36 64392 ----a-w- c:\windows\system32\drivers\pctplsg.sys
    2009-10-07 19:03 . 2009-10-12 16:44
    d
    w- c:\program files\Spyware Doctor
    2009-10-07 19:03 . 2009-10-07 19:03
    d
    w- c:\users\Nicholas\AppData\Roaming\PC Tools
    2009-10-07 19:03 . 2009-10-07 19:03
    d
    w- c:\programdata\PC Tools
    2009-10-07 19:02 . 2009-10-07 19:13
    d
    w- c:\programdata\Google Updater
    2009-10-04 09:50 . 2009-10-10 19:59
    d
    w- c:\programdata\vifabihu
    2009-10-04 09:50 . 2009-10-10 19:59
    d
    w- c:\programdata\tinibatu
    2009-10-04 09:50 . 2009-10-05 00:52
    d
    w- c:\programdata\ruvekifo
    2009-10-04 09:49 . 2009-10-10 19:56
    d
    w- c:\programdata\hewipali
    2009-10-04 09:49 . 2009-10-04 09:49
    d
    w- c:\programdata\tohedida
    2009-10-04 09:49 . 2009-10-10 19:59
    d
    w- c:\programdata\tevelasa
    2009-10-04 09:49 . 2009-10-08 18:12
    d
    w- c:\programdata\fasihebu
    2009-10-04 09:49 . 2009-10-04 09:49
    d
    w- c:\programdata\rifevowi
    2009-10-04 09:48 . 2009-10-10 19:59
    d
    w- c:\programdata\vuheluji
    2009-10-04 09:48 . 2009-10-10 19:59
    d
    w- c:\programdata\rozenemi
    2009-10-04 09:48 . 2009-10-10 19:56
    d
    w- c:\programdata\jayukara
    2009-10-02 17:47 . 2009-10-01 17:29 195440
    w- c:\windows\system32\MpSigStub.exe
    2009-09-25 22:20 . 2009-09-25 22:20 41872 ----a-w- c:\windows\system32\xfcodec.dll
    2009-09-23 22:41 . 2009-10-09 03:12 45 ----a-w- c:\users\Nicholas\jagex_runescape_preferences2.dat
    2009-09-17 02:42 . 2009-09-17 02:47
    d
    w- c:\windows\system32\ca-ES
    2009-09-17 02:42 . 2009-09-17 02:47
    d
    w- c:\windows\system32\eu-ES
    2009-09-17 02:42 . 2009-09-17 02:47
    d
    w- c:\windows\system32\vi-VN
    2009-09-17 01:16 . 2009-09-17 01:16
    d
    w- c:\windows\system32\EventProviders
    2009-09-17 00:15 . 2009-04-11 06:28 880640 ----a-w- c:\windows\system32\RacEngn.dll
    2009-09-17 00:14 . 2009-04-11 06:32 50664 ----a-w- c:\windows\system32\PSHED.DLL
    2009-09-17 00:13 . 2009-04-11 06:28 313344 ----a-w- c:\windows\system32\thawbrkr.dll
    2009-09-17 00:12 . 2009-04-11 06:28 83968 ----a-w- c:\windows\system32\wbem\wmiutils.dll
    2009-09-17 00:12 . 2009-04-11 06:28 30208 ----a-w- c:\windows\system32\wbem\wbemprox.dll
    2009-09-17 00:12 . 2009-04-11 06:28 744448 ----a-w- c:\windows\system32\wbem\wbemcore.dll
    2009-09-17 00:12 . 2009-04-11 06:28 265728 ----a-w- c:\windows\system32\wbem\repdrvfs.dll
    2009-09-17 00:12 . 2009-04-11 06:28 189440 ----a-w- c:\windows\system32\wbem\mofd.dll
    2009-09-17 00:12 . 2009-04-11 06:28 614912 ----a-w- c:\windows\system32\wbem\fastprox.dll
    2009-09-17 00:12 . 2009-04-11 06:28 265728 ----a-w- c:\windows\system32\wbem\esscli.dll
    2009-09-17 00:12 . 2009-04-11 06:28 705536 ----a-w- c:\windows\system32\SmiEngine.dll
    2009-09-17 00:12 . 2009-04-11 06:28 218624 ----a-w- c:\windows\system32\wdscore.dll
    2009-09-17 00:12 . 2009-04-11 06:27 130560 ----a-w- c:\windows\system32\PkgMgr.exe
    2009-09-17 00:12 . 2009-04-11 06:28 247808 ----a-w- c:\windows\system32\drvstore.dll

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-10-09 03:13 . 2008-07-04 06:45 38 ----a-w- c:\users\Nicholas\jagex_runescape_preferences.dat
    2009-10-08 05:37 . 2009-02-15 22:14
    d
    w- c:\programdata\Xfire
    2009-10-07 23:12 . 2006-12-21 19:29
    d
    w- c:\program files\Microsoft Works
    2009-10-07 19:46 . 2008-08-27 20:47 5568 ----a-w- c:\users\Nicholas\AppData\Local\d3d9caps.dat
    2009-10-07 19:11 . 2009-08-04 00:35
    d
    w- c:\program files\Malwarebytes' Anti-Malware
    2009-10-07 19:02 . 2006-12-21 19:31
    d
    w- c:\program files\Google
    2009-10-04 21:06 . 2008-08-15 07:44
    d
    w- c:\program files\CCleaner
    2009-09-30 02:02 . 2009-02-15 22:14
    d
    w- c:\users\Nicholas\AppData\Roaming\Xfire
    2009-09-29 16:47 . 2009-02-15 22:14
    d
    w- c:\program files\Xfire
    2009-09-22 03:24 . 2009-02-20 04:47 15688 ----a-w- c:\windows\system32\lsdelete.exe
    2009-09-17 08:10 . 2009-05-22 05:04
    d
    w- c:\users\Nicholas\AppData\Roaming\Move Networks
    2009-09-17 02:48 . 2006-11-02 12:37
    d
    w- c:\program files\Windows Calendar
    2009-09-17 02:48 . 2006-11-02 11:18
    d
    w- c:\program files\Windows Mail
    2009-09-17 02:48 . 2006-11-02 12:37
    d
    w- c:\program files\Windows Sidebar
    2009-09-17 02:48 . 2006-11-02 12:37
    d
    w- c:\program files\Windows Collaboration
    2009-09-17 02:48 . 2006-11-02 12:37
    d
    w- c:\program files\Windows Journal
    2009-09-17 02:48 . 2006-11-02 12:37
    d
    w- c:\program files\Windows Photo Gallery
    2009-09-17 02:48 . 2006-11-02 12:37
    d
    w- c:\program files\Windows Defender
    2009-09-10 21:54 . 2009-08-04 00:35 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2009-09-10 21:53 . 2009-08-04 00:35 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
    2009-09-03 18:57 . 2009-09-03 18:56
    d
    w- c:\programdata\Office Genuine Advantage
    2009-09-01 06:35 . 2009-05-11 08:33
    d
    w- c:\programdata\PMB Files
    2009-09-01 06:32 . 2009-09-01 06:32
    d
    w- c:\program files\Pando Networks
    2009-08-29 00:27 . 2009-09-02 22:35 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
    2009-08-29 00:14 . 2009-09-02 22:35 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
    2009-08-23 19:22 . 2009-04-05 08:39 11952 ----a-w- c:\windows\system32\avgrsstx.dll
    2009-08-23 19:22 . 2009-04-05 08:39 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
    2009-08-23 19:22 . 2009-04-05 08:39 335240 ----a-w- c:\windows\system32\drivers\avgldx86.sys
    2009-08-17 06:10 . 2006-11-02 12:37
    d
    w- c:\program files\Microsoft Games
    2009-08-14 16:27 . 2009-09-08 21:07 904776 ----a-w- c:\windows\system32\drivers\tcpip.sys
    2009-08-14 15:53 . 2009-09-08 21:07 17920 ----a-w- c:\windows\system32\netevent.dll
    2009-08-14 13:49 . 2009-09-08 21:07 9728 ----a-w- c:\windows\system32\TCPSVCS.EXE
    2009-08-14 13:49 . 2009-09-08 21:07 17920 ----a-w- c:\windows\system32\ROUTE.EXE
    2009-08-14 13:49 . 2009-09-08 21:07 11264 ----a-w- c:\windows\system32\MRINFO.EXE
    2009-08-14 13:49 . 2009-09-08 21:07 27136 ----a-w- c:\windows\system32\NETSTAT.EXE
    2009-08-14 13:49 . 2009-09-08 21:07 19968 ----a-w- c:\windows\system32\ARP.EXE
    2009-08-14 13:49 . 2009-09-08 21:07 8704 ----a-w- c:\windows\system32\HOSTNAME.EXE
    2009-08-14 13:49 . 2009-09-08 21:07 10240 ----a-w- c:\windows\system32\finger.exe
    2009-08-14 13:48 . 2009-09-08 21:07 30720 ----a-w- c:\windows\system32\drivers\tcpipreg.sys
    2009-08-14 13:48 . 2009-09-08 21:07 105984 ----a-w- c:\windows\system32\netiohlp.dll
    2009-08-03 22:07 . 2009-08-03 22:07 403816 ----a-w- c:\windows\system32\OGACheckControl.dll
    2009-08-03 22:07 . 2009-08-03 22:07 322928 ----a-w- c:\windows\system32\OGAAddin.dll
    2009-08-03 22:07 . 2009-08-03 22:07 230768 ----a-w- c:\windows\system32\OGAEXEC.exe
    2009-07-21 21:52 . 2009-07-28 23:27 915456 ----a-w- c:\windows\system32\wininet.dll
    2009-07-21 21:47 . 2009-07-28 23:27 109056 ----a-w- c:\windows\system32\iesysprep.dll
    2009-07-21 21:47 . 2009-07-28 23:27 71680 ----a-w- c:\windows\system32\iesetup.dll
    2009-07-21 20:13 . 2009-07-28 23:27 133632 ----a-w- c:\windows\system32\ieUnatt.exe
    2009-07-17 13:54 . 2009-08-13 18:26 71680 ----a-w- c:\windows\system32\atl.dll
    2009-07-15 12:40 . 2009-08-13 18:23 8147456 ----a-w- c:\windows\system32\wmploc.DLL
    2009-07-15 12:39 . 2009-08-13 18:23 313344 ----a-w- c:\windows\system32\wmpdxm.dll
    2009-07-15 12:39 . 2009-08-13 18:23 4096 ----a-w- c:\windows\system32\dxmasf.dll
    2009-07-15 12:39 . 2009-08-13 18:23 7680 ----a-w- c:\windows\system32\spwmp.dll
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
    2009-07-24 16:55 1090816 ----a-w- c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    "{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-07-24 1090816]

    [HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
    "{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-07-24 1090816]

    [HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "EasyLinkAdvisor"="c:\program files\Linksys EasyLink Advisor\LinksysAgent.exe" [2007-03-16 454784]
    "MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2009-02-07 3885408]
    "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-04-24 39408]
    "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
    "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184]
    "CCUTRAYICON"="c:\program files\Intel\IntelDH\CCU\CCU_TrayIcon.exe" [2006-11-18 182744]
    "NMSSupport"="c:\program files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe" [2006-09-26 423424]
    "IgfxTray"="c:\windows\system32\igfxtray.exe" [2006-12-12 98304]
    "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2006-12-12 106496]
    "Persistence"="c:\windows\system32\igfxpers.exe" [2006-12-12 81920]
    "Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-09-22 520024]
    "ddoctorv2"="c:\program files\Comcast\Desktop Doctor\bin\sprtcmd.exe" [2008-04-24 202560]
    "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-10-06 2023704]
    "snpstd"="c:\windows\vsnpstd.exe" [2003-12-31 40960]
    "ISTray"="c:\program files\Spyware Doctor\pctsTray.exe" [2008-12-08 1173384]
    "SigmatelSysTrayApp"="sttray.exe" - c:\windows\sttray.exe [2006-11-02 303104]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-07 3885408]

    c:\users\Anita\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2008-10-25 98696]

    c:\users\Guest\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2008-10-25 98696]

    c:\users\Nicholas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    Xfire.lnk - c:\program files\Xfire\Xfire.exe [2009-9-25 3266448]

    c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
    Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "EnableUIADesktopToggle"= 0 (0x0)

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll c:\windows\System32\avgrsstx.dll

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
    SetupExecute REG_MULTI_SZ \0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
    @="Service"

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
    @=""

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
    @=""

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
    @=""

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
    @=""

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
    @="Service"

    [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
    path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
    backup=c:\windows\pss\Adobe Reader Speed Launch.lnk.CommonStartup
    backupExtension=.CommonStartup

    [HKLM\~\startupfolder\C:^Users^Nicholas^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
    path=c:\users\Nicholas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
    backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnk.Startup
    backupExtension=.Startup

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
    "VistaSp2"=hex(b):e2,0c,fb,9c,42,37,ca,01

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-893790205-756398429-41698339-1001]
    "EnableNotificationsRef"=dword:00000002

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-893790205-756398429-41698339-500]
    "EnableNotificationsRef"=dword:00000002

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile\AuthorizedApplications\List]
    "c:\\Program Files\\NCsoft\\Exteel\\System\\Exteel.exe"= c:\program files\NCsoft\Exteel\System\Exteel.exe:*:Enabled:Exteel

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
    "{7DBE1F84-5599-4C03-BF9B-4AC4E76F8C25}"= UDP:Profile=Private|Profile=Public:LocalSubnet:LocalSubnet|c:\program files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.exe:SPCM
    "{5F4FCAC2-B155-4526-806F-DF94DE4B4950}"= TCP:Profile=Private|Profile=Public:LocalSubnet:LocalSubnet|c:\program files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.exe:SPCM
    "{05792EFB-07A8-4469-AE50-9E11BAA89479}"= UDP:Profile=Private|Profile=Public:LocalSubnet:LocalSubnet|c:\program files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe:Intel(R) Remoting Service
    "{A35B00B7-8684-4925-8A6F-39563172078A}"= TCP:Profile=Private|Profile=Public:LocalSubnet:LocalSubnet|c:\program files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe:Intel(R) Remoting Service
    "{C2A54A33-ECC2-4EF9-AAC3-D38DF1973C5C}"= UDP:Profile=Private|Profile=Public:LocalSubnet:LocalSubnet|c:\program files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe:Intel(R) Viiv(TM) Media Server
    "{B41BD006-A18F-4C15-A431-486AF31B0F80}"= TCP:Profile=Private|Profile=Public:LocalSubnet:LocalSubnet|c:\program files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe:Intel(R) Viiv(TM) Media Server
    "{F26E9E42-6E86-4AEF-BCB4-9EE780DB2CD7}"= TCP:Profile=Private|Profile=Public|9442:127.0.0.1:Intel(R) Viiv(TM) Media Server Discovery
    "{694102C7-8727-43F1-AA1D-97631F98C340}"= TCP:Profile=Private|Profile=Public|1900:LocalSubnet:LocalSubnet:Intel(R) Viiv(TM) Media Server UPnP Discovery
    "{F945A3EA-A798-49F3-AD74-B09B88B80FB0}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
    "{0E93AEA5-ED65-427F-95C4-DFC35FB60D88}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
    "{0EFA56C5-4E20-4E1E-AF53-D2B991617C11}"= UDP:c:\program files\Common Files\McAfee\MNA\McNASvc.exe:McAfee Network Agent
    "{9BEEC25E-5B0B-4BD6-BD41-457DB7B7A12E}"= TCP:c:\program files\Common Files\McAfee\MNA\McNASvc.exe:McAfee Network Agent
    "TCP Query User{9A4A3EAD-106D-49D6-A7D8-237264FAB364}c:\\nexon\\maplestory\\maplestory.exe"= UDP:c:\nexon\maplestory\maplestory.exe:MapleStory
    "UDP Query User{74976FDF-3288-4C7E-86F1-EFF02B0E70F3}c:\\nexon\\maplestory\\maplestory.exe"= TCP:c:\nexon\maplestory\maplestory.exe:MapleStory
    "TCP Query User{2E52271D-D948-4D98-BEEC-B2CCA9B3915E}c:\\nexon\\maplestory\\patcher.exe"= UDP:c:\nexon\maplestory\patcher.exe:Patcher MFC ?? ????
    "UDP Query User{167A468C-047C-4F08-9DD9-D5EBE9E5A524}c:\\nexon\\maplestory\\patcher.exe"= TCP:c:\nexon\maplestory\patcher.exe:Patcher MFC ?? ????
    "TCP Query User{1057706D-5C58-4D9B-AA55-22B4E36698F2}c:\\nexon\\maplestory\\newpatcher.exe"= UDP:c:\nexon\maplestory\newpatcher.exe:Patcher MFC ?? ????
    "UDP Query User{5576ACC1-5CC2-4912-B77C-895EC5695D90}c:\\nexon\\maplestory\\newpatcher.exe"= TCP:c:\nexon\maplestory\newpatcher.exe:Patcher MFC ?? ????
    "{A1314A3B-BB91-4ECD-9B43-B675EF68F4DE}"= UDP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
    "{C7969DA7-F782-4099-8AEC-2B87BB347B65}"= TCP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
    "{9FD2F42B-61FE-44AF-B831-CEEC4B21FE0B}"= UDP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
    "{0F9AB27A-5848-4DCD-89AE-409362863007}"= TCP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
    "{D024393A-BDDC-4969-9F81-BEF02C0712F1}"= UDP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
    "{DA985E22-49BA-49B5-8468-17812E97B157}"= TCP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
    "{133A1F4A-BC1D-47D3-AC52-146F7F049714}"= UDP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
    "{A5E5C328-6712-4535-B27B-249BC659BF31}"= TCP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
    "{BF373F7C-B915-4C9A-9879-19867AF30B91}"= UDP:c:\program files\AIM6\aim6.exe:AIM
    "{DF9D034A-2033-43A5-97D1-CAE5F662A9B4}"= TCP:c:\program files\AIM6\aim6.exe:AIM
    "{57E16D26-21C1-4BA4-A4D6-B61FA71DF268}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
    "{8B5A544D-916A-4159-8A87-AC6E71D2CA25}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
    "{A8A214DF-6584-4921-9C16-198E9B5D3B74}"= UDP:c:\users\Nicholas\Desktop\LF2\LF2_v1.9c\lf2.exe:Little Fighter 2
    "{75A493B0-EA93-4308-9080-6857AB95E12F}"= TCP:c:\users\Nicholas\Desktop\LF2\LF2_v1.9c\lf2.exe:Little Fighter 2
    "TCP Query User{7270BFB0-9431-44A0-9BDB-A846C18AC045}c:\\ijji\\english\\u_gunz.exe"= UDP:c:\ijji\english\u_gunz.exe:<ijji Downloader>
    "UDP Query User{8C0FA889-20CC-4183-8856-B996FBBB40C1}c:\\ijji\\english\\u_gunz.exe"= TCP:c:\ijji\english\u_gunz.exe:<ijji Downloader>
    "TCP Query User{5CB57154-B27F-456B-A343-7BCAE24D7FD0}c:\\program files\\vuze\\azureus.exe"= UDP:c:\program files\vuze\azureus.exe:Azureus
    "UDP Query User{37523D96-582A-4125-AD54-2E8A73C93551}c:\\program files\\vuze\\azureus.exe"= TCP:c:\program files\vuze\azureus.exe:Azureus
    "TCP Query User{FF18A9FF-436F-4DCF-B6D2-5485036A3A93}c:\\program files\\microsoft games\\halo trial\\halo.exe"= UDP:c:\program files\microsoft games\halo trial\halo.exe:Halo
    "UDP Query User{A1DE571D-FFEA-42F1-B9B4-4AA885B09C68}c:\\program files\\microsoft games\\halo trial\\halo.exe"= TCP:c:\program files\microsoft games\halo trial\halo.exe:Halo
    "TCP Query User{4D92D9C4-8D48-43E9-AF29-1F5C4F982BA6}c:\\program files\\microsoft games\\halo trial\\halo.exe"= UDP:c:\program files\microsoft games\halo trial\halo.exe:Halo
    "UDP Query User{0E767109-A1CF-409F-ACB1-0F729B5DF2AA}c:\\program files\\microsoft games\\halo trial\\halo.exe"= TCP:c:\program files\microsoft games\halo trial\halo.exe:Halo
    "TCP Query User{06DEA2C6-18EC-4A90-8BD5-BF18CD697E36}c:\\program files\\vuze\\azureus.exe"= UDP:c:\program files\vuze\azureus.exe:Azureus
    "UDP Query User{EFCBBFAA-518A-4932-A955-7CA042AA833B}c:\\program files\\vuze\\azureus.exe"= TCP:c:\program files\vuze\azureus.exe:Azureus
    "{54910296-4793-44CC-AA33-7BFC4B97AB04}"= UDP:c:\program files\Outspark\Project Powder\Run.exe:ProjectPowder
    "{E61AD4FE-6B93-47FF-A5F9-9AB8E88AAA37}"= TCP:c:\program files\Outspark\Project Powder\Run.exe:ProjectPowder
    "TCP Query User{21027AB6-AD3C-45EA-A5C6-224B736D364F}c:\\program files\\xfire\\xfire.exe"= UDP:c:\program files\xfire\xfire.exe:Xfire
    "UDP Query User{DFFE22F9-D9C9-40FF-8C60-9C33607C7583}c:\\program files\\xfire\\xfire.exe"= TCP:c:\program files\xfire\xfire.exe:Xfire
    "{68FE57F4-D547-416F-BE13-0D1158104D70}"= UDP:5353:Adobe CSI CS4
    "{A99E80C6-5400-48AB-99A4-C03E15D1E796}"= UDP:c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:Adobe CSI CS4
    "{766B9C7B-894E-4F1E-975A-39FFB8019237}"= TCP:c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:Adobe CSI CS4
    "{480FC05F-3B47-4FFC-98E6-9A4D5B5D432B}"= c:\program files\Windows Live\Sync\WindowsLiveSync.exe:Windows Live Sync
    "{CB95CEB4-0975-4F93-84B6-BB5B629AF13E}"= c:\program files\AVG\AVG8\avgupd.exe:avgupd.exe
    "{6B06309A-75AC-4B2D-8E3A-604D2DC0DC99}"= c:\program files\AVG\AVG8\avgnsx.exe:avgnsx.exe
    "TCP Query User{33017B88-FCF9-4300-B167-74F2E43E24F0}c:\\program files\\garena\\garena.exe"= UDP:c:\program files\garena\garena.exe:Garena
    "UDP Query User{474563E0-E42F-4AF9-A481-158AC5DC68DC}c:\\program files\\garena\\garena.exe"= TCP:c:\program files\garena\garena.exe:Garena
    "TCP Query User{75E9DCDF-3E01-4408-BC21-8D8BC134C136}c:\\program files\\persona\\persona.exe"= UDP:c:\program files\persona\persona.exe:Persona
    "UDP Query User{C474009D-9AC9-4C3A-ADCF-9A1DC6F21953}c:\\program files\\persona\\persona.exe"= TCP:c:\program files\persona\persona.exe:Persona
    "TCP Query User{B2136412-CB9E-41C8-A8AE-E356AAE41ED0}c:\\program files\\groove games\\land of the dead\\system\\lotd.exe"= UDP:c:\program files\groove games\land of the dead\system\lotd.exe:Land Of The Dead
    "UDP Query User{9EEB81DB-B2D1-467E-9164-7CCD5F74740A}c:\\program files\\groove games\\land of the dead\\system\\lotd.exe"= TCP:c:\program files\groove games\land of the dead\system\lotd.exe:Land Of The Dead
    "TCP Query User{D2E1B468-CA2D-4711-AE5B-2E211EA6FBC9}c:\\ijji\\english\\u_gunz.exe"= UDP:c:\ijji\english\u_gunz.exe:<ijji Downloader>
    "UDP Query User{D948CE72-CFB5-4ADB-B02E-8A18190D82DE}c:\\ijji\\english\\u_gunz.exe"= TCP:c:\ijji\english\u_gunz.exe:<ijji Downloader>
    "TCP Query User{440C2423-A2C0-4A44-BFA3-28355534979C}c:\\ijji\\english\\gunz\\gunz.exe"= UDP:c:\ijji\english\gunz\gunz.exe:Gunz
    "UDP Query User{E990FE37-E38C-4E88-94F9-9A6A50876D9D}c:\\ijji\\english\\gunz\\gunz.exe"= TCP:c:\ijji\english\gunz\gunz.exe:Gunz
    "TCP Query User{AA25569D-E8FA-4140-92DB-E1C8D744DC55}c:\\programdata\\ijjigame\\plauncher.exe"= UDP:c:\programdata\ijjigame\plauncher.exe:PLauncher Application
    "UDP Query User{2398FCCA-11CC-499B-AD9A-6D841E37B549}c:\\programdata\\ijjigame\\plauncher.exe"= TCP:c:\programdata\ijjigame\plauncher.exe:PLauncher Application
    "TCP Query User{F02CEEF2-2881-426D-9CC8-DD7D0B9A21CE}c:\\ijji\\english\\u_sf\\soldierfront.exe"= UDP:c:\ijji\english\u_sf\soldierfront.exe:soldierfront
    "UDP Query User{D5847EAB-41E2-485A-B018-01FF7F5A96D9}c:\\ijji\\english\\u_sf\\soldierfront.exe"= TCP:c:\ijji\english\u_sf\soldierfront.exe:soldierfront
    "{0040AF7F-B7B0-455D-9D07-315AE8A71EA0}"= UDP:c:\ntreev usa\Grand Chase\main.exe:GrandChase
    "{BBD6AEB0-8D7F-4B18-9BE1-BEF5DED05F1A}"= TCP:c:\ntreev usa\Grand Chase\main.exe:GrandChase
    "TCP Query User{AE9DF44A-B058-4AC5-BA09-DD3AB3C2A512}c:\\program files\\xfire\\xfire.exe"= UDP:c:\program files\xfire\xfire.exe:Xfire
    "UDP Query User{21777488-00F6-4C50-8565-C557B2DC301A}c:\\program files\\xfire\\xfire.exe"= TCP:c:\program files\xfire\xfire.exe:Xfire
    "{E22C6F58-E3BB-4D66-B84D-D45FC14B1045}"= UDP:c:\program files\Pando Networks\Media Booster\PMB.exe:Pando Media Booster
    "{6DC5CB9A-FC20-468E-AA3B-EEAA73443796}"= TCP:c:\program files\Pando Networks\Media Booster\PMB.exe:Pando Media Booster
    "{A38E852A-54F1-49EF-B631-D8463C18B577}"= UDP:c:\program files\Pando Networks\Media Booster\PMB.exe:Pando Media Booster
    "{FBFCF1D0-35C0-4CB0-A96E-29FCCD4C2CEA}"= TCP:c:\program files\Pando Networks\Media Booster\PMB.exe:Pando Media Booster
    "{A617A247-24B9-4635-A718-D4F0A179A6E1}"= c:\program files\Pando Networks\Media Booster\PMB.exe:Pando Media Booster

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
    "c:\\Program Files\\NCsoft\\Exteel\\System\\Exteel.exe"= c:\program files\NCsoft\Exteel\System\Exteel.exe:*:Enabled:Exteel
    "c:\\Program Files\\Persona\\Persona.exe"= c:\program files\Persona\Persona.exe:*:Enabled:Persona

    R0 Lbd;Lbd;c:\windows\System32\drivers\Lbd.sys [4/24/2009 9:58 AM 64160]
    R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\drivers\avgldx86.sys [4/5/2009 1:39 AM 335240]
    R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\System32\drivers\avgtdix.sys [4/5/2009 1:39 AM 108552]
    R2 nmsgopro;GoProto Protocol Driver for NMS;c:\windows\System32\drivers\nmsgopro.sys [9/27/2006 5:37 PM 28672]
    R2 nmsunidr;UniDriver for NMS;c:\windows\System32\drivers\nmsunidr.sys [10/19/2006 4:49 PM 7424]
    R3 IntelDH;IntelDH Driver;c:\windows\System32\drivers\IntelDH.sys [12/21/2006 12:19 PM 5504]
    S3 NETw2v32;Intel(R) PRO/Wireless 2200BG Network Connection Driver for Windows Vista;c:\windows\System32\drivers\NETw2v32.sys [11/2/2006 3:25 AM 2589184]

    --- Other Services/Drivers In Memory ---

    *Deregistered* - mchInjDrv

    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
    "c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
    .
    Contents of the 'Scheduled Tasks' folder

    2009-10-09 c:\windows\Tasks\Ad-Aware Update (Weekly).job
    - c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-18 03:24]

    2009-10-12 c:\windows\Tasks\Google Software Updater.job
    - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-02-02 19:02]

    2009-09-15 c:\windows\Tasks\McDefragTask.job
    - c:\program files\mcafee\mqc\QcConsol.exe [2008-06-04 20:32]

    2009-09-01 c:\windows\Tasks\McQcTask.job
    - c:\program files\mcafee\mqc\QcConsol.exe [2008-06-04 20:32]
    .
    .
    Supplementary Scan
    .
    mStart Page = hxxp://www.comcast.net/
    mWindow Title = Windows Internet Explorer provided by Comcast
    uInternet Settings,ProxyOverride = *.local
    IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
    FF - ProfilePath - c:\users\Nicholas\AppData\Roaming\Mozilla\Firefox\Profiles\0pkdhaf4.default\
    FF - prefs.js: browser.search.selectedEngine - Google
    FF - prefs.js: keyword.URL - hxxp://us.yhs.search.yahoo.com/avg/search?fr=yhs-avgb&type=yahoo_avg_hs2-tb-web_us&p=
    FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
    FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils2.dll
    FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll
    FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll
    FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\xpavgtbapi.dll
    FF - component: c:\program files\SiteAdvisor\6261\FF\components\FFHook.dll
    FF - component: c:\users\Nicholas\AppData\Roaming\Mozilla\Firefox\Profiles\0pkdhaf4.default\extensions\capturefoxmovie@advancity.net\components\capturefoxxpi_win32.dll
    FF - plugin: c:\program files\Google\Google Updater\2.4.1698.5652\npCIDetect13.dll
    FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava11.dll
    FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava12.dll
    FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava13.dll
    FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava14.dll
    FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava32.dll
    FF - plugin: c:\program files\Java\jre1.6.0\bin\npjpi160.dll
    FF - plugin: c:\program files\Java\jre1.6.0\bin\npoji610.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npCouponPrinter.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npmusicn.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npPandoWebInst.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\NPTURNMED.dll
    FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
    FF - plugin: c:\users\Nicholas\AppData\Roaming\Move Networks\plugins\npqmp071504000001.dll
    FF - plugin: c:\users\Nicholas\AppData\Roaming\Move Networks\plugins\npqmp071505000010.dll
    FF - plugin: c:\users\Nicholas\Program Files\DNA\plugins\npbtdna.dll
    FF - plugin: c:\windows\system32\C2MP\npdivx32.dll
    FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
    .

    **************************************************************************
    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files:

    **************************************************************************

    [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\GarenaPEngine]
    "ImagePath"="\??\c:\users\Nicholas\AppData\Local\Temp\LBW863F.tmp"

    [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\npggsvc]
    "ImagePath"="c:\windows\system32\GameMon.des -service"
    .
    LOCKED REGISTRY KEYS

    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    "MSCurrentCountry"=dword:000000b5
    .
    Completion time: 2009-10-12 16:04
    ComboFix-quarantined-files.txt 2009-10-12 23:04

    Pre-Run: 176,152,244,224 bytes free
    Post-Run: 175,266,070,528 bytes free

    357 --- E O F --- 2009-10-12 16:39
  • TechnoTardTechnoTard
    edited October 2009
    Up above is my combofix log, from 17 days ago.
    I'll just post up a new hijackthis log in case something might have changed in the past 2 and a half weeks.

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 9:03:43 PM, on 10/30/2009
    Platform: Windows Vista SP2 (WinNT 6.00.1906)
    MSIE: Internet Explorer v8.00 (8.00.6001.18828)
    Boot mode: Normal

    Running processes:
    C:\Windows\System32\smss.exe
    C:\Windows\system32\csrss.exe
    C:\Windows\system32\wininit.exe
    C:\Windows\system32\csrss.exe
    C:\Windows\system32\services.exe
    C:\Windows\system32\lsass.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\winlogon.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\SLsvc.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
    C:\Windows\System32\spoolsv.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\agrsmsvc.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
    C:\Program Files\McAfee\VirusScan\McShield.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\Windows\system32\PnkBstrA.exe
    C:\Windows\system32\svchost.exe
    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
    C:\PROGRA~1\AVG\AVG8\avgnsx.exe
    C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
    C:\Program Files\Spyware Doctor\pctsAuxs.exe
    C:\Program Files\Spyware Doctor\pctsSvc.exe
    C:\Program Files\AVG\AVG8\avgcsrvx.exe
    C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
    C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\WUDFHost.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\System32\mobsync.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
    C:\Program Files\Intel\IntelDH\CCU\CCU_TrayIcon.exe
    C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe
    C:\Windows\System32\igfxtray.exe
    C:\Windows\System32\hkcmd.exe
    C:\Windows\System32\igfxpers.exe
    C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
    C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe
    C:\Program Files\AVG\AVG8\avgtray.exe
    C:\Windows\sttray.exe
    C:\Program Files\Spyware Doctor\pctsTray.exe
    C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\Program Files\Windows Media Player\wmpnetwk.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\Program Files\Xfire\Xfire.exe
    C:\Program Files\Intel\IntelDH\CCU\CCU_Engine.exe
    C:\Program Files\Intel\IntelDH\CCU\AlertService.exe
    C:\Windows\system32\taskmgr.exe
    C:\Program Files\Windows Live\Contacts\wlcomm.exe
    C:\Program Files\Xfire\Xfire.exe
    C:\Program Files\Windows Media Player\wmpnscfg.exe
    C:\Program Files\CCleaner\CCleaner.exe
    C:\Windows\system32\taskeng.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Microsoft Office\Office10\EXCEL.EXE
    c:\program files\OGPlanet\rumblefighter\RUMBLEFIGHTER.EXE
    C:\Program Files\trend micro\HijackThis\HijackThis.exe
    C:\Windows\system32\wbem\wmiprvse.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
    O1 - Hosts: ::1 localhost
    O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll
    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
    O2 - BHO: Comcast Toolbar - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\PROGRA~1\COMCAS~1\COMCAS~1.DLL
    O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
    O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
    O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll
    O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
    O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\google\BAE.dll
    O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
    O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll
    O3 - Toolbar: Comcast Toolbar - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\PROGRA~1\COMCAS~1\COMCAS~1.DLL
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
    O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
    O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
    O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
    O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
    O4 - HKLM\..\Run: [CCUTRAYICON] C:\Program Files\Intel\IntelDH\CCU\CCU_TrayIcon.exe
    O4 - HKLM\..\Run: [NMSSupport] "C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe" /startup
    O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
    O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
    O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
    O4 - HKLM\..\Run: [ddoctorv2] "C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe" /P ddoctorv2
    O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
    O4 - HKLM\..\Run: [snpstd] C:\Windows\vsnpstd.exe
    O4 - HKLM\..\Run: [SigmatelSysTrayApp] sttray.exe
    O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
    O4 - HKCU\..\Run: [EasyLinkAdvisor] "C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" /startup
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
    O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
    O4 - HKCU\..\Run: [Pando Media Booster] C:\Program Files\Pando Networks\Media Booster\PMB.exe
    O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
    O4 - HKUS\S-1-5-18\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'Default user')
    O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\Xfire.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
    O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll C:\Windows\System32\avgrsstx.dll
    O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
    O23 - Service: Intel(R) Alert Service (AlertService) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\CCU\AlertService.exe
    O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    O23 - Service: DQLWinService - Unknown owner - C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
    O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: Intel(R) Software Services Manager (ISSM) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe
    O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
    O23 - Service: Intel(R) Viiv(TM) Media Server (M1 Server) - Unknown owner - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe
    O23 - Service: Intel(R) Application Tracker (MCLServiceATL) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe
    O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\McShield.exe
    O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
    O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\Windows\system32\GameMon.des.exe (file missing)
    O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
    O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
    O23 - Service: Intel(R) Remoting Service (Remote UI Service) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe
    O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
    O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
    O23 - Service: SupportSoft Sprocket Service (ddoctorv2) (sprtsvc_ddoctorv2) - SupportSoft, Inc. - C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe

    --
    End of file - 12821 bytes
  • chiazchiaz
    edited November 2009
    Hi TechnoTard,

    A few things before we start....
    1. Please Read All Instructions Carefully.
    2. If you don't understand something, stop and ask! Don't keep going on.
    3. Please do not run any other tools or scans whilst I am helping you.
    4. If you have to go away for an extended period of time, let me know.
    5. Please continue to respond until I give you the "All Clear".
    (Just because you can't see a problem doesn't mean it isn't there)

    =========

    Please copy this page to *Notepad* and save to your desktop for reference as you will not have any browsers open while you are carrying out portions of these instructions.

    It's IMPORTANT to carry out the instructions in the sequence listed below.
    1. Close any open browsers.
    2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

    Open *notepad* and copy/paste the text in the quotebox below into it:
    File::
c:\windows\system32\drivers\ae711e63.sys
Folder::
c:\programdata\vifabihu
c:\programdata\tinibatu
c:\programdata\ruvekifo
c:\programdata\hewipali
c:\programdata\tohedida
c:\programdata\tevelasa
c:\programdata\fasihebu
c:\programdata\rifevowi
c:\programdata\vuheluji
c:\programdata\rozenemi
c:\programdata\jayukara

    Save this as CFScript.txt, in the same location as ComboFix.exe which is on the Desktop.


    CFScript.gif

    Refering to the picture above, drag CFScript.txt into ComboFix.exe


    When finished, it shall produce a log for you at C:\ComboFix.txt

    Please copy and paste the ComboFix.txt and a new HijackThis log in your new reply.

    *Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall. Altering this script in any way could damage your computer.*
  • TechnoTardTechnoTard
    edited November 2009
    After the combofix scan was over it said it found "rootkit" or something like that and then said that it needed to restart so I clicked ok and it restarted.
    After the restart I entered "C:\ComboFix.txt" and it says that it can't find it.
    Did it end up not making a log since it restarted?

    Here is my hijackthis log:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 5:48:29 PM, on 11/1/2009
    Platform: Windows Vista SP2 (WinNT 6.00.1906)
    MSIE: Internet Explorer v8.00 (8.00.6001.18828)
    Boot mode: Normal

    Running processes:
    C:\Windows\System32\smss.exe
    C:\Windows\system32\csrss.exe
    C:\Windows\system32\wininit.exe
    C:\Windows\system32\csrss.exe
    C:\Windows\system32\services.exe
    C:\Windows\system32\lsass.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\winlogon.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\SLsvc.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
    C:\Windows\System32\spoolsv.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\agrsmsvc.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
    C:\Program Files\McAfee\VirusScan\McShield.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\Windows\system32\PnkBstrA.exe
    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
    C:\PROGRA~1\AVG\AVG8\avgnsx.exe
    C:\Windows\system32\svchost.exe
    C:\Program Files\AVG\AVG8\avgcsrvx.exe
    C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
    C:\Program Files\Spyware Doctor\pctsAuxs.exe
    C:\Program Files\Spyware Doctor\pctsSvc.exe
    C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
    C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\WUDFHost.exe
    C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\system32\taskeng.exe
    C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Program Files\Intel\IntelDH\CCU\CCU_TrayIcon.exe
    C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe
    C:\Windows\System32\igfxtray.exe
    C:\Windows\System32\hkcmd.exe
    C:\Windows\System32\igfxpers.exe
    C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe
    C:\Program Files\AVG\AVG8\avgtray.exe
    C:\Windows\sttray.exe
    C:\Program Files\Spyware Doctor\pctsTray.exe
    C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\Program Files\Windows Media Player\wmpnscfg.exe
    C:\Program Files\Windows Media Player\wmpnetwk.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\Windows\ehome\ehtray.exe
    C:\Program Files\Pando Networks\Media Booster\PMB.exe
    C:\Program Files\Xfire\Xfire.exe
    C:\Windows\ehome\ehmsas.exe
    C:\Program Files\Intel\IntelDH\CCU\CCU_Engine.exe
    C:\Program Files\Intel\IntelDH\CCU\AlertService.exe
    C:\Windows\system32\taskmgr.exe
    C:\Program Files\Windows Live\Contacts\wlcomm.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Xfire\Xfire.exe
    C:\Program Files\trend micro\HijackThis\HijackThis.exe
    C:\Windows\system32\wbem\wmiprvse.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
    O1 - Hosts: ::1 localhost
    O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll
    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
    O2 - BHO: Comcast Toolbar - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\PROGRA~1\COMCAS~1\COMCAS~1.DLL
    O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
    O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
    O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll
    O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
    O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\google\BAE.dll
    O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
    O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll
    O3 - Toolbar: Comcast Toolbar - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\PROGRA~1\COMCAS~1\COMCAS~1.DLL
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
    O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
    O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
    O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
    O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
    O4 - HKLM\..\Run: [CCUTRAYICON] C:\Program Files\Intel\IntelDH\CCU\CCU_TrayIcon.exe
    O4 - HKLM\..\Run: [NMSSupport] "C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe" /startup
    O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
    O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
    O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
    O4 - HKLM\..\Run: [ddoctorv2] "C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe" /P ddoctorv2
    O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
    O4 - HKLM\..\Run: [snpstd] C:\Windows\vsnpstd.exe
    O4 - HKLM\..\Run: [SigmatelSysTrayApp] sttray.exe
    O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
    O4 - HKLM\..\Run: [combofix] "C:\ComboFix\CF1626.exe" /c "C:\ComboFix\C.bat"
    O4 - HKCU\..\Run: [EasyLinkAdvisor] "C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" /startup
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
    O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
    O4 - HKCU\..\Run: [Pando Media Booster] C:\Program Files\Pando Networks\Media Booster\PMB.exe
    O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
    O4 - HKUS\S-1-5-18\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'Default user')
    O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\Xfire.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
    O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll C:\Windows\System32\avgrsstx.dll
    O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
    O23 - Service: Intel(R) Alert Service (AlertService) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\CCU\AlertService.exe
    O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    O23 - Service: DQLWinService - Unknown owner - C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
    O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: Intel(R) Software Services Manager (ISSM) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe
    O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
    O23 - Service: Intel(R) Viiv(TM) Media Server (M1 Server) - Unknown owner - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe
    O23 - Service: Intel(R) Application Tracker (MCLServiceATL) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe
    O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\McShield.exe
    O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
    O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\Windows\system32\GameMon.des.exe (file missing)
    O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
    O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
    O23 - Service: Intel(R) Remoting Service (Remote UI Service) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe
    O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
    O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
    O23 - Service: SupportSoft Sprocket Service (ddoctorv2) (sprtsvc_ddoctorv2) - SupportSoft, Inc. - C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe

    --
    End of file - 12792 bytes
  • chiazchiaz
    edited November 2009
    Please go HERE to run Panda ActiveScan 2.0
    • Click the big green Scan now button
    • If it wants to install an ActiveX component allow it
    • It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
    • Once the scan is completed, please hit the notepad icon next to the text Export to:
    • Save it to a convenient location such as your Desktop
    • Post the contents of the ActiveScan.txt in your next reply.
  • TechnoTardTechnoTard
    edited November 2009
    ;***********************************************************************************************************************************************************************************
    ANALYSIS: 2009-11-02 06:56:00
    PROTECTIONS: 1
    MALWARE: 3
    SUSPECTS: 2
    ;***********************************************************************************************************************************************************************************
    PROTECTIONS
    Description Version Active Updated
    ;===================================================================================================================================================================================
    AVG Anti-Virus Free No Yes
    ;===================================================================================================================================================================================
    MALWARE
    Id Description Type Active Severity Disinfectable Disinfected Location
    ;===================================================================================================================================================================================
    00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No c:\users\nicholas\appdata\roaming\microsoft\windows\cookies\nicholas@atdmt[2].txt
    04538823 Trj/Monder.AO Virus/Trojan No 0 Yes No c:\programdata\rifevowi\rifevowi.dll
    04613562 Generic Trojan Virus/Trojan No 0 Yes No c:\programdata\tohedida\tohedida.dll
    ;===================================================================================================================================================================================
    SUSPECTS
    Sent Location
    ;===================================================================================================================================================================================
    No c:\users\dad\appdata\roaming\microsoft\windows\start menu\programs\macromedia studio 8 full edition.(flash dreamweaver fireworks)+keygen\data\contribute3installer-en.zip[contribute_3.11_installer.exe]
    No c:\users\dad\desktop\temp\macromedia studio 8 full edition.(flash dreamweaver fireworks)+keygen\data\contribute3installer-en.zip[contribute_3.11_installer.exe]
    ;===================================================================================================================================================================================
    VULNERABILITIES
    Id Severity Description
    ;===================================================================================================================================================================================
    ;===================================================================================================================================================================================
  • chiazchiaz
    edited November 2009
    OK it looked like the CFScript either did not work, or did not get rid of them all.

    I notice that you mentioned you have MalwareBytes. Update it, then run a full scan. Post the generated log in your reply, along with a fresh Panda ActiveScan log.

    I'll keep my fingers crossed this time. :)
  • TechnoTardTechnoTard
    edited November 2009
    Alright, the scan took 6 hours @_@

    Malwarebytes' Anti-Malware 1.41
    Database version: 3094
    Windows 6.0.6002 Service Pack 2

    11/3/2009 8:52:00 PM
    mbam-log-2009-11-03 (20-52-00).txt

    Scan type: Full Scan (C:\|D:\|)
    Objects scanned: 378194
    Time elapsed: 6 hour(s), 34 minute(s), 18 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 0

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    (No malicious items detected)
  • chiazchiaz
    edited November 2009
    OK let's see a new Panda ActiveScan log.
  • TechnoTardTechnoTard
    edited November 2009
    ;***********************************************************************************************************************************************************************************
    ANALYSIS: 2009-11-04 02:06:20
    PROTECTIONS: 1
    MALWARE: 2
    SUSPECTS: 3
    ;***********************************************************************************************************************************************************************************
    PROTECTIONS
    Description Version Active Updated
    ;===================================================================================================================================================================================
    AVG Anti-Virus Free No Yes
    ;===================================================================================================================================================================================
    MALWARE
    Id Description Type Active Severity Disinfectable Disinfected Location
    ;===================================================================================================================================================================================
    04538823 Trj/Monder.AO Virus/Trojan No 0 Yes No c:\programdata\rifevowi\rifevowi.dll
    04613562 Generic Trojan Virus/Trojan No 0 Yes No c:\programdata\tohedida\tohedida.dll
    ;===================================================================================================================================================================================
    SUSPECTS
    Sent Location
    ;===================================================================================================================================================================================
    No c:\program files\ogplanet\lostsaga\lsuninstall.exe
    No c:\users\dad\appdata\roaming\microsoft\windows\start menu\programs\macromedia studio 8 full edition.(flash dreamweaver fireworks)+keygen\data\contribute3installer-en.zip[contribute_3.11_installer.exe]
    No c:\users\dad\desktop\temp\macromedia studio 8 full edition.(flash dreamweaver fireworks)+keygen\data\contribute3installer-en.zip[contribute_3.11_installer.exe]
    ;===================================================================================================================================================================================
    VULNERABILITIES
    Id Severity Description
    ;===================================================================================================================================================================================
    ;===================================================================================================================================================================================
  • chiazchiaz
    edited November 2009
    OK,

    I need you to follow the instructions on post #12 once more, and to the letter:
    http://icrontic.com/forum/showpost.php?p=719057&postcount=12

    See if you are able to get the ComboFix.txt.
  • TechnoTardTechnoTard
    edited November 2009
    Ok so after the scan had finished, it went to the "Preparing a log yada yada yada, Don't run any programs until ComboFix is finished"

    an hour and a half went be so I thought that because I had already asked it to look for those files in the CFScript, asking it to look for it a second time must have caused it to freeze and stuff.

    so I restarted the computer -_-

    I feel like I shouldn't have been so impatient and now I feel like I must have corrupted the scan or something.

    what should I do now?
    Should I run it again and wait how ever long it takes now?
  • chiazchiaz
    edited November 2009
    Let's aim for a clean start.

    Go to to Start > Run
    Type in box

    combofix /u

    Note: the space between the X and the /u

    Press Enter.

    Next restart your PC, and download a fresh copy of ComboFix.

    Then perform the same instructions in post #12 again.
  • TechnoTardTechnoTard
    edited November 2009
    Alright, I think that worked. Here it is.

    ComboFix 09-11-06.03 - Nicholas 11/06/2009 21:58.1.2 - NTFSx86
    Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.1013.262 [GMT -8:00]
    Running from: c:\users\Nicholas\Desktop\ComboFix.exe
    Command switches used :: c:\users\Nicholas\Desktop\CFScript.txt
    SP: Lavasoft Ad-Watch Live! *disabled* (Updated) {67844DAE-4F77-4D69-9457-98E8CFFDAA22}
    SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
    * Resident AV is active


    FILE ::
    "c:\windows\system32\drivers\ae711e63.sys"
    .

    ((((((((((((((((((((((((( Files Created from 2009-10-07 to 2009-11-07 )))))))))))))))))))))))))))))))
    .

    2009-11-07 06:41 . 2009-11-07 06:41
    d
    w- c:\users\Public\AppData\Local\temp
    2009-11-07 06:41 . 2009-11-07 06:41
    d
    w- c:\users\IUSR_NMPR\AppData\Local\temp
    2009-11-07 06:41 . 2009-11-07 06:41
    d
    w- c:\users\Guest\AppData\Local\temp
    2009-11-07 06:41 . 2009-11-07 06:41
    d
    w- c:\users\Default\AppData\Local\temp
    2009-11-07 06:41 . 2009-11-07 06:41
    d
    w- c:\users\Dad\AppData\Local\temp
    2009-11-07 06:41 . 2009-11-07 06:41
    d
    w- c:\users\Anita\AppData\Local\temp
    2009-11-07 06:41 . 2009-11-07 06:41
    d
    w- c:\users\Anita P\AppData\Local\temp
    2009-11-05 20:47 . 2009-11-05 20:50 4096 d
    w- c:\program files\SpywareGuard
    2009-11-05 20:42 . 2009-11-05 20:41 38208 ----a-w- c:\users\Default\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
    2009-11-05 20:39 . 2009-11-05 20:39
    d
    w- c:\users\Nicholas\AppData\Roaming\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
    2009-11-05 20:39 . 2009-11-05 20:41 38208 ----a-w- c:\users\Nicholas\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
    2009-11-05 20:39 . 2009-11-05 20:42
    d
    w- c:\program files\Common Files\Adobe AIR
    2009-11-05 20:35 . 2009-11-05 20:39
    d
    w- c:\program files\SpywareBlaster
    2009-11-05 06:35 . 2009-11-05 06:35 93360 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
    2009-11-05 06:35 . 2009-11-05 06:35 93360 ----a-w- c:\programdata\Lavasoft\Ad-Aware\update\Drivers\SBREDrv.sys
    2009-11-05 06:35 . 2009-11-05 06:35 554280 ----a-w- c:\programdata\Lavasoft\Ad-Aware\update\sbap.dll
    2009-11-05 06:35 . 2009-11-05 06:35 212480 ----a-w- c:\programdata\Lavasoft\Ad-Aware\update\VipreBridge.dll
    2009-11-05 06:35 . 2009-11-05 06:35 283944 ----a-w- c:\programdata\Lavasoft\Ad-Aware\update\Vipre.dll
    2009-11-05 06:35 . 2009-11-05 06:35 1223976 ----a-w- c:\programdata\Lavasoft\Ad-Aware\update\SBTE.dll
    2009-11-05 06:35 . 2009-11-05 06:35 242984 ----a-w- c:\programdata\Lavasoft\Ad-Aware\update\SBRE.dll
    2009-11-04 00:29 . 2009-08-07 02:24 44768 ----a-w- c:\windows\system32\wups2.dll
    2009-11-04 00:29 . 2009-08-07 02:24 53472 ----a-w- c:\windows\system32\wuauclt.exe
    2009-11-04 00:29 . 2009-08-07 01:45 2421760 ----a-w- c:\windows\system32\wucltux.dll
    2009-11-04 00:29 . 2009-08-07 02:23 1929952 ----a-w- c:\windows\system32\wuaueng.dll
    2009-11-04 00:27 . 2009-08-07 02:24 35552 ----a-w- c:\windows\system32\wups.dll
    2009-11-04 00:27 . 2009-08-07 01:44 87552 ----a-w- c:\windows\system32\wudriver.dll
    2009-11-04 00:27 . 2009-08-07 02:23 575704 ----a-w- c:\windows\system32\wuapi.dll
    2009-11-04 00:26 . 2009-08-07 03:23 171608 ----a-w- c:\windows\system32\wuwebv.dll
    2009-11-04 00:26 . 2009-08-07 02:44 33792 ----a-w- c:\windows\system32\wuapp.exe
    2009-11-02 07:55 . 2009-06-30 18:37 28552 ----a-w- c:\windows\system32\drivers\pavboot.sys
    2009-11-02 07:55 . 2009-11-02 07:55
    d
    w- c:\program files\Panda Security
    2009-11-02 00:52 . 2006-11-02 09:51 232040 ----a-w- c:\windows\system32\drivers\iastorv.sys
    2009-11-02 00:52 . 2006-09-29 19:59 250368 ----a-w- c:\windows\system32\drivers\iaStor.sys
    2009-10-27 18:39 . 2009-09-10 14:58 310784 ----a-w- c:\windows\system32\unregmp2.exe
    2009-10-22 05:34 . 2009-09-23 12:55 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys
    2009-10-22 05:33 . 2009-11-05 06:35 537576 ----a-w- c:\programdata\Lavasoft\Ad-Aware\update\aawapi.dll
    2009-10-22 05:18 . 2009-10-22 05:18
    dc-h--w- c:\programdata\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6}
    2009-10-22 05:18 . 2009-10-03 08:15 2924848 -c--a-w- c:\programdata\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6}\Ad-AwareInstallation.exe
    2009-10-19 08:56 . 2009-10-19 08:56
    d
    w- c:\users\Nicholas\AppData\Roaming\NeopleLauncherDFO
    2009-10-19 06:28 . 2009-10-19 06:28 90112 ----a-w- c:\programdata\NexonUS\NGM\npNxGameUS.dll
    2009-10-19 06:27 . 2009-10-19 06:27 118784 ----a-w- c:\programdata\NexonUS\NGM\nxgameus.dll
    2009-10-19 06:27 . 2009-10-19 06:27 393216 ----a-w- c:\programdata\NexonUS\NGM\NGMResource.dll
    2009-10-19 06:27 . 2009-10-19 06:27 258352 ----a-w- c:\programdata\NexonUS\NGM\unicows.dll
    2009-10-19 06:27 . 2009-10-19 06:27 561152 ----a-w- c:\programdata\NexonUS\NGM\NGMDll.dll
    2009-10-19 06:27 . 2009-10-19 06:27 167936 ----a-w- c:\programdata\NexonUS\NGM\NGM.exe
    2009-10-19 06:27 . 2009-10-19 06:27
    d
    w- c:\programdata\NexonUS
    2009-10-14 23:58 . 2009-10-14 23:58 41872 ----a-w- c:\windows\system32\xfcodec.dll
    2009-10-13 19:36 . 2009-10-13 19:36
    d-sh--w- c:\windows\system32\%APPDATA%
    2009-10-13 19:16 . 2009-09-04 11:41 60928 ----a-w- c:\windows\system32\msasn1.dll
    2009-10-13 19:16 . 2009-09-10 16:48 218624 ----a-w- c:\windows\system32\msv1_0.dll
    2009-10-13 19:16 . 2009-08-04 12:34 3548216 ----a-w- c:\windows\system32\ntoskrnl.exe
    2009-10-13 19:16 . 2009-08-04 12:34 3600456 ----a-w- c:\windows\system32\ntkrnlpa.exe
    2009-10-13 19:12 . 2009-08-27 05:22 916480 ----a-w- c:\windows\system32\wininet.dll
    2009-10-13 19:11 . 2009-08-27 03:42 133632 ----a-w- c:\windows\system32\ieUnatt.exe
    2009-10-13 19:11 . 2009-08-27 05:17 109056 ----a-w- c:\windows\system32\iesysprep.dll
    2009-10-13 19:11 . 2009-08-27 05:17 71680 ----a-w- c:\windows\system32\iesetup.dll
    2009-10-13 19:11 . 2009-09-14 09:29 144896 ----a-w- c:\windows\system32\drivers\srv2.sys
    2009-10-13 19:10 . 2009-05-08 12:53 604672 ----a-w- c:\windows\system32\WMSPDMOD.DLL
    2009-10-12 23:04 . 2009-11-07 06:42 299008 d
    w- c:\users\Nicholas\AppData\Local\temp

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-11-07 05:10 . 2009-02-15 22:14
    d
    w- c:\users\Nicholas\AppData\Roaming\Xfire
    2009-11-06 07:22 . 2009-10-07 19:03 40960 d
    w- c:\program files\Spyware Doctor
    2009-11-05 06:34 . 2009-06-23 03:24 1638104 ----a-w- c:\programdata\Lavasoft\Ad-Aware\update\Ad-Aware.exe
    2009-11-05 06:34 . 2009-06-23 03:24 788368 ----a-w- c:\programdata\Lavasoft\Ad-Aware\update\AAWTray.exe
    2009-11-05 06:34 . 2009-06-23 03:24 1179232 ----a-w- c:\programdata\Lavasoft\Ad-Aware\update\AAWService.exe
    2009-11-05 06:00 . 2009-02-15 22:14 4096 d
    w- c:\programdata\Xfire
    2009-11-02 18:52 . 2009-09-23 22:41 63 ----a-w- c:\users\Nicholas\jagex_runescape_preferences2.dat
    2009-11-02 18:51 . 2008-07-04 06:45 38 ----a-w- c:\users\Nicholas\jagex_runescape_preferences.dat
    2009-10-31 23:05 . 2008-09-11 22:56
    d
    w- c:\program files\OGPlanet
    2009-10-20 05:16 . 2009-02-15 22:14 8192 d
    w- c:\program files\Xfire
    2009-10-19 06:00 . 2009-05-11 08:33
    d
    w- c:\programdata\PMB Files
    2009-10-13 20:06 . 2006-11-02 11:18
    d
    w- c:\program files\Windows Mail
    2009-10-13 19:44 . 2006-12-21 19:28
    d
    w- c:\programdata\Microsoft Help
    2009-10-13 19:40 . 2006-12-21 19:29 28672 d
    w- c:\program files\Microsoft Works
    2009-10-13 19:05 . 2008-02-13 07:55 4096 d
    w- c:\program files\Windows Live
    2009-10-08 05:01 . 2009-10-08 05:01
    d
    w- c:\users\Nicholas\AppData\Roaming\AdobeUM
    2009-10-07 19:46 . 2008-08-27 20:47 5568 ----a-w- c:\users\Nicholas\AppData\Local\d3d9caps.dat
    2009-10-07 19:13 . 2009-10-07 19:02 4096 d
    w- c:\programdata\Google Updater
    2009-10-07 19:11 . 2009-08-04 00:35
    d
    w- c:\program files\Malwarebytes' Anti-Malware
    2009-10-07 19:10 . 2009-10-07 19:10 4045528 ----a-w- c:\programdata\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
    2009-10-07 19:05 . 2009-10-07 19:03
    d
    w- c:\program files\Common Files\PC Tools
    2009-10-07 19:03 . 2009-10-07 19:03
    d
    w- c:\users\Nicholas\AppData\Roaming\PC Tools
    2009-10-07 19:03 . 2009-10-07 19:03
    d
    w- c:\programdata\PC Tools
    2009-10-07 19:02 . 2006-12-21 19:31 4096 d
    w- c:\program files\Google
    2009-10-05 04:49 . 2009-10-05 04:49 746760 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
    2009-10-04 21:06 . 2008-08-15 07:44 4096 d
    w- c:\program files\CCleaner
    2009-10-01 17:29 . 2009-10-02 17:47 195440
    w- c:\windows\system32\MpSigStub.exe
    2009-09-22 03:24 . 2009-02-20 04:47 15688 ----a-w- c:\windows\system32\lsdelete.exe
    2009-09-22 03:24 . 2009-09-22 03:24 17632 ----a-w- c:\programdata\Lavasoft\Ad-Aware\update\WSCUpdate.dll
    2009-09-22 03:24 . 2009-03-06 04:23 68640 ----a-w- c:\programdata\Lavasoft\Ad-Aware\update\Drivers\64\lbd.sys
    2009-09-22 03:24 . 2009-03-06 04:23 303976 ----a-w- c:\programdata\Lavasoft\Ad-Aware\update\Drivers\64\AAWDriverTool.exe
    2009-09-22 03:24 . 2009-06-23 03:24 640760 ----a-w- c:\programdata\Lavasoft\Ad-Aware\update\AAWWSC.exe
    2009-09-17 08:10 . 2009-05-22 05:04 126970 ----a-w- c:\users\Nicholas\AppData\Roaming\Move Networks\uninstall.exe
    2009-09-17 08:10 . 2009-08-03 21:48 4187512 ----a-w- c:\users\Nicholas\AppData\Roaming\Move Networks\plugins\npqmp071505000010.dll
    2009-09-17 08:10 . 2009-05-22 05:04
    d
    w- c:\users\Nicholas\AppData\Roaming\Move Networks
    2009-09-17 02:48 . 2006-11-02 12:37
    d
    w- c:\program files\Windows Calendar
    2009-09-17 02:48 . 2006-11-02 12:37 4096 d
    w- c:\program files\Windows Sidebar
    2009-09-17 02:48 . 2006-11-02 12:37
    d
    w- c:\program files\Windows Collaboration
    2009-09-17 02:48 . 2006-11-02 12:37
    d
    w- c:\program files\Windows Journal
    2009-09-17 02:48 . 2006-11-02 12:37
    d
    w- c:\program files\Windows Photo Gallery
    2009-09-17 02:48 . 2006-11-02 12:37 4096 d
    w- c:\program files\Windows Defender
    2009-09-17 02:41 . 2006-11-02 10:25 665600 ----a-w- c:\windows\inf\drvindex.dat
    2009-09-10 21:54 . 2009-08-04 00:35 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2009-09-10 21:53 . 2009-08-04 00:35 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
    2009-08-29 00:27 . 2009-09-02 22:35 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
    2009-08-29 00:14 . 2009-09-02 22:35 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
    2009-08-26 16:50 . 2009-09-08 01:47 517120 ----a-w- c:\users\Nicholas\AppData\Roaming\Mozilla\Firefox\Profiles\0pkdhaf4.default\extensions\capturefoxmovie@advancity.net\components\capturefoxxpi_win32.dll
    2009-08-23 19:22 . 2009-04-05 08:39 11952 ----a-w- c:\windows\system32\avgrsstx.dll
    2009-08-23 19:22 . 2009-04-05 08:39 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
    2009-08-23 19:22 . 2009-04-05 08:39 335240 ----a-w- c:\windows\system32\drivers\avgldx86.sys
    2009-08-18 06:33 . 2009-08-18 06:33 1193832 ----a-w- c:\windows\system32\FM20.DLL
    2009-08-14 16:27 . 2009-09-08 21:07 904776 ----a-w- c:\windows\system32\drivers\tcpip.sys
    2009-08-14 15:53 . 2009-09-08 21:07 17920 ----a-w- c:\windows\system32\netevent.dll
    2009-08-14 13:49 . 2009-09-08 21:07 9728 ----a-w- c:\windows\system32\TCPSVCS.EXE
    2009-08-14 13:49 . 2009-09-08 21:07 17920 ----a-w- c:\windows\system32\ROUTE.EXE
    2009-08-14 13:49 . 2009-09-08 21:07 11264 ----a-w- c:\windows\system32\MRINFO.EXE
    2009-08-14 13:49 . 2009-09-08 21:07 27136 ----a-w- c:\windows\system32\NETSTAT.EXE
    2009-08-14 13:49 . 2009-09-08 21:07 19968 ----a-w- c:\windows\system32\ARP.EXE
    2009-08-14 13:49 . 2009-09-08 21:07 8704 ----a-w- c:\windows\system32\HOSTNAME.EXE
    2009-08-14 13:49 . 2009-09-08 21:07 10240 ----a-w- c:\windows\system32\finger.exe
    2009-08-14 13:48 . 2009-09-08 21:07 30720 ----a-w- c:\windows\system32\drivers\tcpipreg.sys
    2009-08-14 13:48 . 2009-09-08 21:07 105984 ----a-w- c:\windows\system32\netiohlp.dll
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
    2009-07-24 16:55 1090816 ----a-w- c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    "{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-07-24 1090816]

    [HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
    "{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-07-24 1090816]

    [HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "EasyLinkAdvisor"="c:\program files\Linksys EasyLink Advisor\LinksysAgent.exe" [2007-03-16 454784]
    "MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2009-07-26 3883856]
    "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-04-24 39408]
    "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
    "Pando Media Booster"="c:\program files\Pando Networks\Media Booster\PMB.exe" [2009-10-19 2920632]
    "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184]
    "CCUTRAYICON"="c:\program files\Intel\IntelDH\CCU\CCU_TrayIcon.exe" [2006-11-18 182744]
    "NMSSupport"="c:\program files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe" [2006-09-26 423424]
    "IgfxTray"="c:\windows\system32\igfxtray.exe" [2006-12-12 98304]
    "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2006-12-12 106496]
    "Persistence"="c:\windows\system32\igfxpers.exe" [2006-12-12 81920]
    "Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-11-05 788368]
    "ddoctorv2"="c:\program files\Comcast\Desktop Doctor\bin\sprtcmd.exe" [2008-04-24 202560]
    "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-11-02 2028312]
    "snpstd"="c:\windows\vsnpstd.exe" [2003-12-31 40960]
    "ISTray"="c:\program files\Spyware Doctor\pctsTray.exe" [2008-12-08 1173384]
    "SigmatelSysTrayApp"="sttray.exe" - c:\windows\sttray.exe [2006-11-02 303104]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]

    c:\users\Anita\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2008-10-25 98696]

    c:\users\Guest\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2008-10-25 98696]

    c:\users\Nicholas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    SpywareGuard.lnk - c:\program files\SpywareGuard\sgmain.exe [2003-8-29 360448]
    Xfire.lnk - c:\program files\Xfire\Xfire.exe [2009-10-14 3141008]

    c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
    Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "EnableUIADesktopToggle"= 0 (0x0)

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll c:\windows\System32\avgrsstx.dll

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
    SetupExecute REG_MULTI_SZ \0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
    @=&quot;Service"

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
    @=&quot;"

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
    @=&quot;"

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
    @=&quot;"

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
    @=&quot;"

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
    @=&quot;Service"

    [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
    path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
    backup=c:\windows\pss\Adobe Reader Speed Launch.lnk.CommonStartup
    backupExtension=.CommonStartup

    [HKLM\~\startupfolder\C:^Users^Nicholas^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
    path=c:\users\Nicholas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
    backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnk.Startup
    backupExtension=.Startup

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
    "VistaSp2"=hex(b):e2,0c,fb,9c,42,37,ca,01

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-893790205-756398429-41698339-1001]
    "EnableNotificationsRef"=dword:00000002

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-893790205-756398429-41698339-500]
    "EnableNotificationsRef"=dword:00000002

    R0 Lbd;Lbd;c:\windows\System32\drivers\Lbd.sys [10/21/2009 9:34 PM 64288]
    R0 pavboot;pavboot;c:\windows\System32\drivers\pavboot.sys [11/1/2009 11:55 PM 28552]
    R0 PCTCore;PCTools KDS;c:\windows\System32\drivers\PCTCore.sys [10/7/2009 11:04 AM 130936]
    R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\drivers\avgldx86.sys [4/5/2009 12:39 AM 335240]
    R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\System32\drivers\avgtdix.sys [4/5/2009 12:39 AM 108552]
    R2 nmsgopro;GoProto Protocol Driver for NMS;c:\windows\System32\drivers\nmsgopro.sys [9/27/2006 4:37 PM 28672]
    R2 nmsunidr;UniDriver for NMS;c:\windows\System32\drivers\nmsunidr.sys [10/19/2006 3:49 PM 7424]
    R3 IntelDH;IntelDH Driver;c:\windows\System32\drivers\IntelDH.sys [12/21/2006 11:19 AM 5504]
    S3 NETw2v32;Intel(R) PRO/Wireless 2200BG Network Connection Driver for Windows Vista;c:\windows\System32\drivers\NETw2v32.sys [11/2/2006 2:25 AM 2589184]

    --- Other Services/Drivers In Memory ---

    *Deregistered* - mbr
    *Deregistered* - mchInjDrv
    *Deregistered* - PROCEXP113
    .
    Contents of the 'Scheduled Tasks' folder

    2009-11-07 c:\windows\Tasks\Ad-Aware Update (Weekly).job
    - c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 06:35]

    2009-11-07 c:\windows\Tasks\Google Software Updater.job
    - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-02-02 19:02]

    2009-09-15 c:\windows\Tasks\McDefragTask.job
    - c:\program files\mcafee\mqc\QcConsol.exe [2008-06-04 20:32]

    2009-11-01 c:\windows\Tasks\McQcTask.job
    - c:\program files\mcafee\mqc\QcConsol.exe [2008-06-04 20:32]
    .
    .
    Supplementary Scan
    .
    mStart Page = hxxp://www.comcast.net/
    mWindow Title = Windows Internet Explorer provided by Comcast
    IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
    FF - ProfilePath - c:\users\Nicholas\AppData\Roaming\Mozilla\Firefox\Profiles\0pkdhaf4.default\
    FF - prefs.js: browser.search.selectedEngine - Google
    FF - prefs.js: keyword.URL - hxxp://us.yhs.search.yahoo.com/avg/search?fr=yhs-avgb&type=yahoo_avg_hs2-tb-web_us&p=
    FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
    FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils2.dll
    FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll
    FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll
    FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\xpavgtbapi.dll
    FF - component: c:\program files\SiteAdvisor\6261\FF\components\FFHook.dll
    FF - component: c:\users\Nicholas\AppData\Roaming\Mozilla\Firefox\Profiles\0pkdhaf4.default\extensions\capturefoxmovie@advancity.net\components\capturefoxxpi_win32.dll
    FF - plugin: c:\program files\Google\Google Updater\2.4.1698.5652\npCIDetect13.dll
    FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava11.dll
    FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava12.dll
    FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava13.dll
    FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava14.dll
    FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava32.dll
    FF - plugin: c:\program files\Java\jre1.6.0\bin\npjpi160.dll
    FF - plugin: c:\program files\Java\jre1.6.0\bin\npoji610.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npCouponPrinter.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npmusicn.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npOGPPlugin.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npPandoWebInst.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\NPTURNMED.dll
    FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
    FF - plugin: c:\programdata\NexonUS\NGM\npNxGameUS.dll
    FF - plugin: c:\users\Nicholas\AppData\Roaming\Move Networks\plugins\npqmp071504000001.dll
    FF - plugin: c:\users\Nicholas\AppData\Roaming\Move Networks\plugins\npqmp071505000010.dll
    FF - plugin: c:\users\Nicholas\Program Files\DNA\plugins\npbtdna.dll
    FF - plugin: c:\windows\system32\C2MP\npdivx32.dll
    FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

    ---- FIREFOX POLICIES ----
    c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
    .

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-11-06 22:42
    Windows 6.0.6002 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...


    c:\users\Nicholas\AppData\Local\Temp\catchme.dll 53248 bytes executable

    scan completed successfully
    hidden files: 1

    **************************************************************************

    Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

    device: opened successfully
    user: MBR read successfully
    called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll >>UNKNOWN [0x84B071F8]<<
    kernel: MBR read successfully
    detected MBR rootkit hooks:
    \Driver\atapi -> 0x84b071f8
    Warning: possible MBR rootkit infection !
    user & kernel MBR OK
    Use "Recovery Console" command "fixmbr" to clear infection !

    **************************************************************************

    [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\GarenaPEngine]
    "ImagePath"="\??\c:\users\Nicholas\AppData\Local\Temp\LBW863F.tmp"

    [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\npggsvc]
    "ImagePath"="c:\windows\system32\GameMon.des -service"
    .
    LOCKED REGISTRY KEYS

    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    "MSCurrentCountry"=dword:000000b5
    .
    Completion time: 2009-11-07 23:04
    ComboFix-quarantined-files.txt 2009-11-07 07:03

    Pre-Run: 168,243,343,360 bytes free
    Post-Run: 168,189,943,808 bytes free

    Current=1 Default=1 Failed=0 LastKnownGood=9 Sets=1,2,3,4,5,6,7,8,9
    - - End Of File - - ABA4C598D27D8981FFF8DE3A8C2EDD3C
  • chiazchiaz
    edited November 2009
    Do you have your Vista disc with you?
  • TechnoTardTechnoTard
    edited November 2009
    I do not at this moment, I moved recently so I can't find it among all the stuff.
    Are you going to suggest that I reformat my computer?
  • chiazchiaz
    edited November 2009
    Nope, but we need the Vista disc to repair the master boot record (MBR) as an infection may have compromised it.

    Can you try locating the Vista disc? If you can't find it, let me know and I will think of something.
  • TechnoTardTechnoTard
    edited November 2009
    I just went looking for it in the only place I could think of, which is the crawl space where most of the stuff that we brought over from the old house is placed.
    It's pretty hard to find with all the boxes and things inside.
    I can ask my father on this upcoming Wednesday to help me find where it is but until then I probably won't be able to find it.
  • TechnoTardTechnoTard
    edited November 2009
    OK I HAVE IT NOW! :D
    I GOT IT!
    It's the Operating System Disc right?
  • TechnoTardTechnoTard
    edited November 2009
    Ok I don't have a "Vista Disc"
    My dad said that everything was already installed when he bought the computer ._.
  • chiazchiaz
    edited November 2009
    I'm a little confused here. So what's the disc that you said you have?
  • TechnoTardTechnoTard
    edited November 2009
    Ok, the only discs I have is the "Operating System Disc", for reformatting I assume.
    and the "Windows Anytime Upgrade" disc.

    I don't know what this Vista Disc your referring to is. Is it the dis that is used to install Vista on this computer? because Vista was already pre-installed when we bought the computer.
Sign In or Register to comment.