Options

in need of some help

Unknown
edited July 2007 in Spyware & Virus Removal
im having troble removing a malwear/virus and if any 1 can help it wood b great full

i have toolbar 888
i have
AVG
AD-ware 2007
XOFTSPY

I AHVE ALSO SERCHED THE WEB AND FOUND A FEW PROGRAMS AND RAN THEM BUT I WONT GET RID OF IT

ITS ALL IN A DLL FILE NAMED
WINBVJ32.DLL LOCATED IN
SYSTEM32 FOLDER

I HAVE TRYED XCLEAN_MICRO AND FOUND A FEW EXTRA WHICH HAVE NOW BEEN DLED BUT KEEP GETTING WRITEN BK ON TO REG FILES

MANY THANKS

GNGNUT

Comments

  • GNGNUT
    edited July 2007
    sorry had the letters wrong way round :)
    GNGNUT wrote:
    WINBJV32.DLL LOCATED IN
    SYSTEM32 FOLDER


    MANY THANKS

    GNGNUT
  • peku006
    edited July 2007
    Hi GNGNUT and welcome to icrontic Spyware & Virus Removal


    Download HJTInstall.exe to your Desktop.
    • Doubleclick HJTInstall.exe to install it.
    • By default it will install to C:\Program Files\Trend Micro\HijackThis .
    • Click on Install.
    • It will create a HijackThis icon on the desktop.
    • Once installed, it will launch Hijackthis.
    • Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
    • Copy/Paste the log to your next reply please.
    Don't use the Analyse This button, its findings are dangerous if misinterpreted.
    Don't have Hijackthis fix anything yet. Most of what it finds will be harmless or even required.
  • GNGNUT
    edited July 2007
    my 1st log :)

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 17:13:50, on 28/07/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal
    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    C:\WINDOWS\system32\cisvc.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\RealVNC\VNC4\WinVNC4.exe
    C:\Program Files\DynDNS Updater\DynDNS.exe
    C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\WINDOWS\system32\RunDLL32.exe
    C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\Program Files\MSN Messenger\usnsvc.exe
    C:\WINDOWS\system32\cidaemon.exe
    C:\PROGRA~1\MICROS~2\Office12\OUTLOOK.EXE
    C:\Program Files\BitComet\BitComet.exe
    C:\Program Files\Shareaza\Shareaza.exe
    C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.exe
    C:\Program Files\Activision\Rome - Total War\RomeTW.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
    O3 - Toolbar: ImageShack Toolbar - {6932D140-ABC4-4073-A44C-D4A541665E35} - C:\WINDOWS\ImageShackToolbar\ImageShackToolbar.dll
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
    O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
    O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
    O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
    O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
    O16 - DPF: {6932D140-ABC4-4073-A44C-D4A541665E35} (ImageShack Toolbar) - http://toolbar.imageshack.us/toolbar/ImageShackToolbar.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{7D4FED7B-F305-43D3-939A-D38C350A00F1}: NameServer = 62.24.252.134 62.24.252.135
    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    O23 - Service: DynDNS Updater Service (DynDNS_Updater_Service) - Kana Solution - C:\Program Files\DynDNS Updater\DynDNS.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe (file missing)
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe
    --
    End of file - 5979 bytes
  • peku006
    edited July 2007
    Hi GNGNUT

    Not seeing anything Suspicious in your Logfile.

    Let us take a deeper look.

    Download Deckard's System Scanner (DSS) to your Desktop.
    Note: You must be logged onto an account with administrator privileges    .
    1. Close all applications and windows.
    2. Double-click on dss.exe to run it, and follow the prompts.
    3. When the scan is complete, two text files will open - main.txt <- this one will be maximized and extra.txt<-this one will be minimized
    4. Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of main.txt and the extra.txt to your post. in your reply
  • GNGNUT
    edited July 2007
    Deckard's System Scanner v20070711.54
    Run by craig on 2007-07-28 at 18:01:34
    Computer is in Normal Mode.
    -- System Restore
    Successfully created a Deckard's System Scanner Restore Point.

    -- Last 5 Restore Point(s) --
    35: 2007-07-28 17:01:36 UTC - RP74 - Deckard's System Scanner Restore Point
    34: 2007-07-28 07:23:15 UTC - RP73 - X-Cleaner: Before removal
    33: 2007-07-27 09:13:24 UTC - RP72 - System Checkpoint
    32: 2007-07-26 08:56:15 UTC - RP71 - Ad-Aware Restore Point 2007-07-26 09:56:13
    31: 2007-07-26 07:26:48 UTC - RP70 - Installed Ad-Aware 2007

    -- First Restore Point --
    1: 2007-07-09 09:23:53 UTC - RP40 - Installed Battlefield 2142 Update v1.25

    Backed up registry hives.
    Performed disk cleanup.

    -- HijackThis (run as craig.exe)
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 18:02:27, on 28/07/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal
    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    C:\WINDOWS\system32\cisvc.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\RealVNC\VNC4\WinVNC4.exe
    C:\Program Files\DynDNS Updater\DynDNS.exe
    C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\WINDOWS\system32\RunDLL32.exe
    C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\Program Files\MSN Messenger\usnsvc.exe
    C:\WINDOWS\system32\cidaemon.exe
    C:\PROGRA~1\MICROS~2\Office12\OUTLOOK.EXE
    C:\Program Files\BitComet\BitComet.exe
    C:\Program Files\Shareaza\Shareaza.exe
    C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.exe
    C:\Program Files\Activision\Rome - Total War\RomeTW.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Documents and Settings\craig\Local Settings\Temporary Internet Files\Content.IE5\MCW0O0IT\dss[1].exe
    C:\PROGRA~1\TRENDM~1\HIJACK~1\craig.exe
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: H - {30EDD4CB-8BC1-4f9f-99A6-A6938E9AACE0} - C:\WINDOWS\system32\down1.dll
    O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.6.14.dll
    O2 - BHO: (no name) - {67475B4D-150D-44A4-B5DD-BC80D4C9361F} - C:\WINDOWS\system32\urqpoli.dll
    O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: (no name) - {A0738CDD-5B40-4396-9CB3-06134EA49A16} - C:\WINDOWS\system32\ssqrr.dll
    O2 - BHO: H - {D0367266-A0E9-4644-A039-0A0CF65FD09A} - ertw1.dll (file missing)
    O2 - BHO: (no name) - {FAE3BD2C-7048-46AA-BA4A-FCEAE95B6D21} - (no file)
    O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
    O3 - Toolbar: ImageShack Toolbar - {6932D140-ABC4-4073-A44C-D4A541665E35} - C:\WINDOWS\ImageShackToolbar\ImageShackToolbar.dll
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
    O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
    O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
    O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
    O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
    O16 - DPF: {6932D140-ABC4-4073-A44C-D4A541665E35} (ImageShack Toolbar) - http://toolbar.imageshack.us/toolbar/ImageShackToolbar.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{7D4FED7B-F305-43D3-939A-D38C350A00F1}: NameServer = 62.24.252.134 62.24.252.135
    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
    O20 - Winlogon Notify: mllmk - C:\WINDOWS\
    O20 - Winlogon Notify: ssqrr - C:\WINDOWS\system32\ssqrr.dll
    O20 - Winlogon Notify: urqpoli - C:\WINDOWS\SYSTEM32\urqpoli.dll
    O20 - Winlogon Notify: winbjv32 - C:\WINDOWS\SYSTEM32\winbjv32.dll
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    O23 - Service: DynDNS Updater Service (DynDNS_Updater_Service) - Kana Solution - C:\Program Files\DynDNS Updater\DynDNS.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe (file missing)
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe
    --
    End of file - 7501 bytes
    -- File Associations
    All associations okay.

    -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled
    R1 SCDEmu - c:\windows\system32\drivers\scdemu.sys <Not Verified; PowerISO Computing, Inc.; scdemu>

    -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled
    R2 aawservice (Ad-Aware 2007 Service) - "c:\program files\lavasoft\ad-aware 2007\aawservice.exe" <Not Verified; Lavasoft AB; Ad-Aware 2007 Service>
    R2 DynDNS_Updater_Service (DynDNS Updater Service) - c:\program files\dyndns updater\dyndns.exe <Not Verified; Kana Solution; DynDNS Updater>
    S2 PnkBstrA - c:\windows\system32\pnkbstra.exe (file missing)
    S3 NBService - c:\program files\nero\nero 7\nero backitup\nbservice.exe
    S4 McProxy (McAfee Proxy Service) - c:\progra~1\common~1\mcafee\mcproxy\mcproxy.exe (file missing)

    -- Scheduled Tasks
    2007-07-28 07:11:34 362 --a
    C:\WINDOWS\Tasks\XoftSpySE.job

    -- Files created between 2007-06-28 and 2007-07-28
    2007-07-28 17:13:39 0 d
    C:\Program Files\Trend Micro
    2007-07-28 07:32:37 0 d--h
    C:\Documents and Settings\Administrator\Templates
    2007-07-28 07:32:37 0 dr
    C:\Documents and Settings\Administrator\Start Menu
    2007-07-28 07:32:37 0 dr-h
    C:\Documents and Settings\Administrator\SendTo
    2007-07-28 07:32:37 0 d--h
    C:\Documents and Settings\Administrator\Recent
    2007-07-28 07:32:37 0 d--h
    C:\Documents and Settings\Administrator\PrintHood
    2007-07-28 07:32:37 786432 --ah
    C:\Documents and Settings\Administrator\NTUSER.DAT
    2007-07-28 07:32:37 0 d--h
    C:\Documents and Settings\Administrator\NetHood
    2007-07-28 07:32:37 0 d
    C:\Documents and Settings\Administrator\My Documents
    2007-07-28 07:32:37 0 d--h
    C:\Documents and Settings\Administrator\Local Settings
    2007-07-28 07:32:37 0 d
    C:\Documents and Settings\Administrator\Favorites
    2007-07-28 07:32:37 0 d
    C:\Documents and Settings\Administrator\Desktop
    2007-07-28 07:32:37 0 d---s---- C:\Documents and Settings\Administrator\Cookies
    2007-07-28 07:32:37 0 dr-h
    C:\Documents and Settings\Administrator\Application Data
    2007-07-28 07:32:37 0 d---s---- C:\Documents and Settings\Administrator\Application Data\Microsoft
    2007-07-28 07:09:11 0 d
    C:\Program Files\XoftSpySE
    2007-07-26 08:58:26 0 dr-h
    C:\$VAULT$.AVG
    2007-07-26 08:26:50 0 d
    C:\Program Files\Lavasoft
    2007-07-26 06:54:28 1059596 ---hs---- C:\WINDOWS\system32\rrqss.bak2
    2007-07-24 18:54:16 1064287 ---hs---- C:\WINDOWS\system32\rrqss.bak1
    2007-07-24 18:54:00 228960 --a
    C:\WINDOWS\system32\ssqrr.dll
    2007-07-24 13:10:42 77312 --a
    C:\WINDOWS\ua2.dll
    2007-07-24 12:46:31 0 d
    C:\Documents and Settings\craig\Application Data\AVG7
    2007-07-24 12:46:23 0 d
    C:\Documents and Settings\LocalService\Application Data\AVG7
    2007-07-24 12:46:14 0 d
    C:\Documents and Settings\All Users\Application Data\Grisoft
    2007-07-24 11:45:43 0 d
    C:\Documents and Settings\craig\Application Data\Ahead
    2007-07-24 11:42:45 0 d
    C:\Program Files\Nero
    2007-07-24 11:42:44 0 d
    C:\Program Files\Common Files\Ahead
    2007-07-24 11:42:44 0 d
    C:\Documents and Settings\All Users\Application Data\Nero
    2007-07-24 11:42:00 6471 ---hs---- C:\WINDOWS\system32\kmllm.bak1
    2007-07-24 11:41:23 10752 --a
    C:\WINDOWS\system32\down1.dll
    2007-07-24 11:41:13 31254 --a
    C:\WINDOWS\system32\ljjhijk.dll
    2007-07-24 11:41:05 31254 --a
    C:\WINDOWS\system32\ddcawtq.dll
    2007-07-24 11:38:47 1 --a
    C:\WINDOWS\system32\ps.dat
    2007-07-24 11:38:47 1 --a
    C:\WINDOWS\system32\cookie.dat
    2007-07-24 11:36:46 31254 --a
    C:\WINDOWS\system32\urqpoli.dll
    2007-07-24 11:36:33 20992
    n--- C:\WINDOWS\system32\winbjv32.dll
    2007-07-24 09:23:07 0 d
    C:\Program Files\Activision
    2007-07-24 08:16:21 0 d
    C:\NVIDIA
    2007-07-24 08:08:36 0 d
    C:\Program Files\SystemRequirementsLab
    2007-07-23 21:53:05 0 d
    C:\WINDOWS\system32\AGEIA
    2007-07-23 21:53:05 0 d
    C:\Program Files\AGEIA Technologies
    2007-07-23 21:45:10 0 d
    C:\Program Files\UBISOFT
    2007-07-23 21:43:52 0 d
    C:\Documents and Settings\craig\Application Data\InstallShield
    2007-07-22 09:39:54 0 d
    C:\Program Files\Engelmann Media
    2007-07-17 18:15:01 0 d
    C:\Documents and Settings\All Users\Application Data\Avg7
    2007-07-17 08:58:08 0 d
    C:\Program Files\Common Files\EasyInfo
    2007-07-12 22:19:47 0 d
    C:\WINDOWS\Sun
    2007-07-11 23:09:51 0 d
    C:\Program Files\Poker
    2007-07-10 23:16:43 0 d
    C:\Documents and Settings\All Users\Application Data\Lavasoft
    2007-07-10 22:40:07 0 d
    C:\WINDOWS\network diagnostic
    2007-07-10 22:36:03 0 d
    C:\b45b2043300abf43b93128522c
    2007-07-08 08:58:40 0 d
    C:\WINDOWS\ImageShackToolbar
    2007-07-08 07:03:01 73728 --a
    C:\WINDOWS\system32\FLKill.exe <Not Verified; USPTO; Project1>
    2007-07-08 07:03:01 0 d
    C:\Program Files\Folder Lock
    2007-07-06 21:03:11 0 d
    C:\My Downloads
    2007-07-06 21:01:38 0 d
    C:\Program Files\BitTorrent Fastest Tool
    2007-07-06 16:27:32 0 d
    C:\Documents and Settings\craig\Application Data\Sun
    2007-07-06 16:25:01 0 d
    C:\Documents and Settings\craig\Application Data\Leadertech
    2007-07-06 12:07:47 0 d
    C:\Program Files\FolderSecurityGuard
    2007-07-05 20:17:42 0 d
    C:\Documents and Settings\craig\Application Data\teamspeak2
    2007-07-05 20:16:40 0 d
    C:\Program Files\Teamspeak2_RC2
    2007-07-05 11:26:20 0 d
    C:\Program Files\RealVNC
    2007-07-05 11:15:31 446464 --a
    C:\WINDOWS\system32\wmvdmoe.dll <Not Verified; Microsoft Corporation; Microsoft® Windows Media Services>
    2007-07-05 11:15:18 0 d
    C:\Documents and Settings\All Users\Application Data\PY_Software
    2007-07-05 11:12:53 434688 --a
    C:\WINDOWS\system32\ss2uinst.exe <Not Verified; Virtualzone.de; SetupStream 2>
    2007-07-03 18:35:28 0 d
    C:\Program Files\TalkTalk
    2007-07-03 18:35:28 0 d
    C:\Documents and Settings\All Users\Application Data\SupportSoft
    2007-07-03 18:35:22 0 d
    C:\Program Files\SupportSoft
    2007-07-03 18:34:39 0 d
    C:\Program Files\Common Files\Wise Installation Wizard
    2007-07-03 18:18:14 0 d
    C:\Program Files\Thomson
    2007-07-02 20:20:25 0 d
    C:\WINDOWS\system32\appmgmt
    2007-07-02 17:31:28 0 d
    C:\Documents and Settings\craig\Application Data\Adobe
    2007-07-02 17:31:18 0 d
    C:\Program Files\Common Files\Adobe
    2007-07-02 17:31:16 0 d
    C:\Documents and Settings\All Users\Application Data\Adobe
    2007-07-02 17:31:12 0 d
    C:\WINDOWS\Downloaded Installations
    2007-07-02 17:30:10 0 d
    C:\Documents and Settings\All Users\Application Data\Google
    2007-07-02 17:30:06 0 d
    C:\Program Files\Google
    2007-07-02 17:21:39 139264 --a
    C:\WINDOWS\system32\SGISAQry.dll <Not Verified; The Sage Group plc; Sage ISAPI Query Engine>
    2007-07-02 17:21:39 335872 --a
    C:\WINDOWS\system32\SGINFMR.dll <Not Verified; The Sage Group plc; Sage Informer Manager>
    2007-07-02 17:21:38 167936 --a
    C:\WINDOWS\system32\SGXMLQry.dll <Not Verified; The Sage Group plc; Sage Query Engine Component>
    2007-07-02 17:21:38 81920 --a
    C:\WINDOWS\system32\SGUserInfo.dll <Not Verified; The Sage Group plc; Sage User Registration Component>
    2007-07-02 17:21:38 126976 --a
    C:\WINDOWS\system32\SGInfProgressBar.dll <Not Verified; The Sage Group plc; Sage MIS Progress Bar>
    2007-07-02 17:19:46 81920 --a
    C:\WINDOWS\system32\SageNatWestOnline.dll <Not Verified; The Sage Group Plc.; SageNatWestOnline Module>
    2007-07-02 17:19:46 86016 --a
    C:\WINDOWS\system32\SageNatWestBankline.dll <Not Verified; The Sage Group Plc.; SageNatWestBankline Module>
    2007-07-02 17:19:46 81920 --a
    C:\WINDOWS\system32\sageebanking.dll <Not Verified; The Sage Group Plc.; SageEBanking Module>
    2007-07-02 17:19:46 81920 --a
    C:\WINDOWS\system32\SageBarclaysOnline.dll <Not Verified; The Sage Group Plc.; SageBarclaysOnline Module>
    2007-07-02 17:19:46 81920 --a
    C:\WINDOWS\system32\SageBarclaysBusinessMasterII.dll <Not Verified; The Sage Group Plc.; SageBarclaysBusinessMasterII Module>
    2007-07-02 17:19:46 192512 --a
    C:\WINDOWS\system32\SageBankReconciliation.dll <Not Verified; The Sage Group Plc.; SageBankReconciliation Module>
    2007-07-02 17:19:46 86016 --a
    C:\WINDOWS\system32\SageBankPayments.dll <Not Verified; The Sage Group Plc.; SageBankPayments Module>
    2007-07-02 17:19:46 69632 --a
    C:\WINDOWS\system32\SageBankBalances.dll <Not Verified; The Sage Group Plc.; SageBankBalances Module>
    2007-07-02 17:19:46 61440 --a
    C:\WINDOWS\system32\BankServiceUtilities.dll <Not Verified; The Sage Group Plc.; BankServiceUtilities Module>
    2007-07-02 17:19:46 0 d
    C:\Program Files\Sage EBanking
    2007-07-02 17:17:48 368696 --a
    C:\WINDOWS\system32\S10DBC32.dll <Not Verified; Sage (UK) Limited; Microsoft Open Database Connectivity>
    2007-07-02 17:16:41 0 d
    C:\Program Files\Common Files\Sage Line50
    2007-07-02 17:16:25 0 d
    C:\Program Files\Sage
    2007-07-02 11:45:36 4212 ---h
    C:\WINDOWS\system32\zllictbl.dat
    2007-07-02 11:45:16 0 d
    C:\WINDOWS\system32\ZoneLabs
    2007-07-02 11:44:47 0 d
    C:\WINDOWS\Internet Logs
    2007-07-02 11:23:13 0 d
    C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
    2007-07-02 11:12:39 0 d
    C:\Program Files\Windows Media Connect 2
    2007-07-02 11:11:17 0 d
    C:\WINDOWS\system32\LogFiles
    2007-07-02 11:11:17 0 d
    C:\WINDOWS\system32\drivers\UMDF
    2007-07-02 09:31:58 0 d
    C:\WINDOWS\system32\Lang
    2007-07-01 19:58:37 0 d
    C:\Documents and Settings\craig\Application Data\CyberLink
    2007-07-01 19:51:29 0 d
    C:\Documents and Settings\All Users\Application Data\CyberLink
    2007-07-01 19:50:57 0 d
    C:\Program Files\CyberLink
    2007-07-01 19:34:25 0 d
    C:\Documents and Settings\craig\Application Data\DivX
    2007-07-01 19:29:03 0 d
    C:\Program Files\DivX
    2007-07-01 00:05:07 0 d
    C:\WINDOWS\pss
    2007-06-30 15:22:54 80 -r-hs---- C:\WINDOWS\system32\DAA9B96763.dll
    2007-06-30 15:22:53 0 d
    C:\Documents and Settings\All Users\Application Data\Protexis
    2007-06-30 15:21:03 306688 --a
    C:\WINDOWS\IsUninst.exe <Not Verified; InstallShield Software Corporation; InstallShield® unInstaller>
    2007-06-30 15:19:19 0 d
    C:\Documents and Settings\All Users\Application Data\Broderbund
    2007-06-29 20:04:01 0 d--h
    C:\WINDOWS\PIF
    2007-06-29 20:00:56 0 d
    C:\Documents and Settings\craig\Contacts
    2007-06-29 20:00:25 0 d
    c- C:\WINDOWS\system32\DRVSTORE
    2007-06-29 20:00:16 0 d
    C:\Program Files\MSN Messenger
    2007-06-28 22:15:46 0 d
    C:\Documents and Settings\craig\Application Data\Command & Conquer 3 Tiberium Wars Demo
    2007-06-28 18:39:14 0 d
    C:\ProgramData
    2007-06-28 18:39:14 0 d
    C:\Program Files\Electronic Arts
    2007-06-28 09:38:01 0 d
    C:\WINDOWS\system32\PreInstall
    2007-06-28 08:16:09 0 d
    C:\Documents and Settings\LocalService\Desktop
    2007-06-28 08:00:55 0 d--h
    C:\WINDOWS\$hf_mig$
    2007-06-28 02:20:35 0 d
    C:\Program Files\Shareaza
    2007-06-28 02:20:35 0 d
    C:\Documents and Settings\craig\Application Data\Shareaza
    2007-06-28 01:38:52 2038 --a
    C:\Documents and Settings\craig\Application Data\SAS7_000.DAT
    2007-06-28 00:22:47 0 d
    C:\Documents and Settings\craig\Application Data\McAfee
    2007-06-28 00:15:32 201 --a
    C:\WINDOWS\nsreg.dat
    2007-06-28 00:10:23 0 d
    C:\Program Files\Common Files\McAfee
    2007-06-28 00:10:00 0 d
    C:\Documents and Settings\All Users\Application Data\McAfee
    2007-06-28 00:08:20 0 d
    C:\Program Files\PowerISO

    -- Find3M Report
    2007-07-28 00:02:49 0 d
    C:\Program Files\DynDNS Updater
    2007-07-24 09:39:21 0 d--h
    C:\Program Files\InstallShield Installation Information
    2007-07-07 13:42:01 0 d
    C:\Program Files\BitComet
    2007-06-28 15:38:50 0 d
    C:\Program Files\Messenger
    2007-06-28 00:33:43 0 d
    C:\Documents and Settings\craig\Application Data\LimeWire
    2007-06-27 22:45:45 2560 --a
    C:\WINDOWS\system32\BitCometRes.dll <Not Verified; BitComet; BitComet BCTP Helper>
    2007-06-27 22:43:37 0 d
    C:\Documents and Settings\craig\Application Data\Macromedia
    2007-06-27 22:27:09 0 d
    C:\Documents and Settings\craig\Application Data\Nuance
    2007-06-27 22:25:14 0 d
    C:\Program Files\Common Files\Scansoft Shared
    2007-06-27 22:25:14 0 d
    C:\Program Files\Common Files\InstallShield
    2007-06-27 22:25:05 0 d
    C:\Program Files\Nuance
    2007-06-27 22:22:06 0 d
    C:\Program Files\DAEMON Tools
    2007-06-27 22:08:54 0 d
    C:\Program Files\Microsoft Works
    2007-06-27 22:08:43 0 d
    C:\Program Files\MSBuild
    2007-06-27 22:07:51 0 d
    C:\Program Files\Common Files\ODBC
    2007-06-27 22:07:49 0 d
    C:\Program Files\Common Files\SpeechEngines
    2007-06-27 22:07:28 62 --ahs---- C:\Documents and Settings\craig\Application Data\desktop.ini
    2007-06-27 22:02:47 0 d
    C:\Documents and Settings\craig\Application Data\Kana Solution
    2007-06-27 22:02:24 0 d
    C:\Documents and Settings\craig\Application Data\WinRAR
    2007-06-27 22:02:07 0 d
    C:\Program Files\Java
    2007-06-27 22:01:12 0 d
    C:\Program Files\Common Files\Java
    2007-06-27 21:40:34 0 d
    C:\Program Files\Common Files\SupportSoft
    2007-06-27 21:29:09 0 d
    C:\Program Files\Realtek Sound Manager
    2007-06-27 21:29:09 0 d
    C:\Program Files\AvRack
    2007-06-27 21:28:22 0 d
    C:\Program Files\AMD
    2007-06-27 21:24:28 502272 --a
    C:\WINDOWS\system32\winlogon.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
    2007-06-27 21:21:06 0 d
    C:\Documents and Settings\craig\Application Data\Identities
    2007-06-27 21:17:18 0 d
    C:\Program Files\microsoft frontpage
    2007-06-27 21:16:55 0 -rahs---- C:\MSDOS.SYS
    2007-06-27 21:16:55 0 -rahs---- C:\IO.SYS
    2007-06-27 21:16:55 0 --a
    C:\CONFIG.SYS
    2007-06-27 21:16:55 0 --a
    C:\AUTOEXEC.BAT
    2007-06-27 21:15:49 0 d--h
    C:\Program Files\WindowsUpdate
    2007-06-27 21:15:10 0 d
    C:\Program Files\Common Files\MSSoap
    2007-06-27 21:15:03 0 d
    C:\Program Files\Movie Maker
    2007-06-27 21:14:20 21640 --a
    C:\WINDOWS\system32\emptyregdb.dat
    2007-06-27 21:13:53 0 d
    C:\Program Files\Online Services
    2007-06-27 21:13:43 0 d
    C:\Program Files\MSN Gaming Zone
    2007-06-27 21:13:37 0 d
    C:\Program Files\Windows NT
    2007-05-31 07:44:55 823296 --a
    C:\WINDOWS\system32\divx_xx07.dll <Not Verified; DivX, Inc.; DivX®>
    2007-05-31 07:44:54 802816 --a
    C:\WINDOWS\system32\divx_xx11.dll <Not Verified; DivX, Inc.; DivX?>
    2007-05-31 07:44:54 823296 --a
    C:\WINDOWS\system32\divx_xx0c.dll <Not Verified; DivX, Inc.; DivX®>
    2007-05-31 07:44:54 740442 --a
    C:\WINDOWS\system32\DivX.dll <Not Verified; DivX, Inc.; DivX®>

    -- Registry Dump
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
    {30EDD4CB-8BC1-4f9f-99A6-A6938E9AACE0} C:\WINDOWS\system32\down1.dll
    {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} C:\Program Files\BitComet\tools\BitCometBHO_1.1.6.14.dll
    {67475B4D-150D-44A4-B5DD-BC80D4C9361F} C:\WINDOWS\system32\urqpoli.dll
    {72853161-30C5-4D22-B7F9-0BBC1D38A37E} C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
    {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    {9030D464-4C02-4ABF-8ECC-5164760863C6} C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    {A0738CDD-5B40-4396-9CB3-06134EA49A16} C:\WINDOWS\system32\ssqrr.dll
    {D0367266-A0E9-4644-A039-0A0CF65FD09A} ertw1.dll [x]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
    "NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
    "nwiz"="nwiz.exe /install"
    "SpeedTouch USB Diagnostics"="\"C:\\Program Files\\Thomson\\SpeedTouch USB\\Dragdiag.exe\" /icon"
    "Zone Labs Client"="\"C:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe\""
    "NvMediaCenter"="RunDLL32.exe NvMCTray.dll,NvTaskbarInit"
    "AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVG7\\avgcc.exe /STARTUP"
    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
    "ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
    "MsnMsgr"="\"C:\\Program Files\\MSN Messenger\\MsnMsgr.Exe\" /background"
    [HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
    "CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE"
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
    "{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"="Groove GFS Stub Execution Hook"
    "{67475B4D-150D-44A4-B5DD-BC80D4C9361F}"=""
    HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\mllmk
    HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ssqrr
    HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\urqpoli
    HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winbjv32
    HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
    Authentication Packages REG_MULTI_SZ msv1_0\0\0
    Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0
    Notification Packages REG_MULTI_SZ scecli\0\0
    HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\aawservice
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder]
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^craig^Start Menu^Programs^Startup^Microsoft Office Groove.lnk]
    "path"="C:\\Documents and Settings\\craig\\Start Menu\\Programs\\Startup\\Microsoft Office Groove.lnk"
    "backup"="C:\\WINDOWS\\pss\\Microsoft Office Groove.lnkStartup"
    "location"="Startup"
    "command"="C:\\PROGRA~1\\MICROS~2\\Office12\\GROOVE.EXE -background"
    "item"="Microsoft Office Groove"
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
    "item"="apdproxy"
    "hkey"="HKLM"
    "command"="\"C:\\Program Files\\Adobe\\Photoshop Album Starter Edition\\3.2\\Apps\\apdproxy.exe\""
    "inimapping"="0"
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
    "item"="Reader_sl"
    "hkey"="HKLM"
    "command"="\"C:\\Program Files\\Adobe\\Reader 8.0\\Reader\\Reader_sl.exe\""
    "inimapping"="0"
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DNS7reminder]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
    "item"="ereg"
    "hkey"="HKLM"
    "command"="\"C:\\Program Files\\Nuance\\NaturallySpeaking9\\Program\\ereg.exe\" -r \"C:\\Program Files\\Nuance\\NaturallySpeaking9\\Program\\ereg.ini\""
    "inimapping"="0"
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EA Core]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
    "item"="Core"
    "hkey"="HKCU"
    "command"="\"C:\\Program Files\\Electronic Arts\\EA Link\\Core.exe\" -silent"
    "inimapping"="0"
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
    "item"="GrooveMonitor"
    "hkey"="HKLM"
    "command"="\"C:\\Program Files\\Microsoft Office\\Office12\\GrooveMonitor.exe\""
    "inimapping"="0"
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
    "item"="ISUSPM"
    "hkey"="HKLM"
    "command"="C:\\PROGRA~1\\COMMON~1\\INSTAL~1\\UPDATE~1\\ISUSPM.exe -startup"
    "inimapping"="0"
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
    "item"="issch"
    "hkey"="HKLM"
    "command"="\"C:\\Program Files\\Common Files\\InstallShield\\UpdateService\\issch.exe\" -start"
    "inimapping"="0"
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
    "item"="NeroCheck"
    "hkey"="HKLM"
    "command"="C:\\Program Files\\Common Files\\Ahead\\Lib\\NeroCheck.exe"
    "inimapping"="0"
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
    "item"="PWRISOVM"
    "hkey"="HKLM"
    "command"="C:\\Program Files\\PowerISO\\PWRISOVM.EXE"
    "inimapping"="0"
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
    "item"="PDVDServ"
    "hkey"="HKLM"
    "command"="\"C:\\Program Files\\CyberLink\\PowerDVD\\PDVDServ.exe\""
    "inimapping"="0"
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Shareaza]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
    "item"="Shareaza"
    "hkey"="HKCU"
    "command"="\"C:\\Program Files\\Shareaza\\Shareaza.exe\" -tray"
    "inimapping"="0"
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SiteAdvisor]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
    "item"="SiteAdv"
    "hkey"="HKLM"
    "command"="C:\\Program Files\\SiteAdvisor\\6066\\SiteAdv.exe"
    "inimapping"="0"
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
    "item"="SOUNDMAN"
    "hkey"="HKLM"
    "command"="SOUNDMAN.EXE"
    "inimapping"="0"
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
    "item"="SSBkgdupdate"
    "hkey"="HKLM"
    "command"="C:\\Program Files\\Common Files\\Scansoft Shared\\SSBkgdUpdate\\SSBkgdupdate.exe -Embedding -boot"
    "inimapping"="0"
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
    "item"="jusched"
    "hkey"="HKLM"
    "command"="\"C:\\Program Files\\Java\\jre1.6.0_01\\bin\\jusched.exe\""
    "inimapping"="0"
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TalkTalk]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
    "item"="sprtcmd"
    "hkey"="HKLM"
    "command"="\"C:\\Program Files\\TalkTalk\\bin\\sprtcmd.exe\" /P TalkTalk"
    "inimapping"="0"
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\winbo32]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
    "item"="winbo32"
    "hkey"="HKLM"
    "command"="winbo32.exe"
    "inimapping"="0"
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zone Labs Client]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
    "item"="zlclient"
    "hkey"="HKLM"
    "command"="\"C:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe\""
    "inimapping"="0"
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "McProxy"=dword:00000002

    [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
    HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
    LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
    NetworkService REG_MULTI_SZ DnsCache\0\0
    DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
    rpcss REG_MULTI_SZ RpcSs\0\0
    imgsvc REG_MULTI_SZ StiSvc\0\0
    termsvcs REG_MULTI_SZ TermService\0\0
    WudfServiceGroup REG_MULTI_SZ WUDFSvc\0\0

    -- End of Deckard's System Scanner: finished at 2007-07-28 at 18:03:38

    many thanks for ur help :):)
  • peku006
    edited July 2007
    Hi GNGNUT

    Please do the following...

    Step 1

    Please download VundoFix.exe to your desktop.
    • Double-click VundoFix.exe to run it.
    • Click the Scan for Vundo button.
    • Once it's done scanning, click the Remove Vundo button.
    • You will receive a prompt asking if you want to remove the files, click YES
    • Once you click yes, your desktop will go blank as it starts removing Vundo.
    • When completed, it will prompt that it will reboot your computer, click OK.
    • Please post the contents of C:\vundofix.txt
    Note: It is possible that VundoFix encountered a file it could not remove.
    In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button." when VundoFix appears at reboot.

    Step 2

    1. Download combofix from one of these links:
    Link1
    Link2
    2. Double click combofix.exe & follow the prompts.
    3. When finished, it shall produce a log for you. Post that log in your next reply
    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall

    Please, post these logs:
    Vundofix.txt
    Combofix.txt
    a fresh hjT log
  • GNGNUT
    edited July 2007
    here is the log for combo fix

    "craig" - 2007-07-29 10:59:09 - ComboFix 07-07-23.6 - Service Pack 2 NTFS

    (((((((((((((((((((((((((((((((((((((((((((( V Log )))))))))))))))))))))))))))))))))))))))))))))))))))))))

    C:\WINDOWS\system32\ddcawtq.dll
    C:\WINDOWS\system32\ljjhijk.dll
    C:\WINDOWS\system32\ddcawtq.dll
    C:\WINDOWS\system32\ljjhijk.dll
    C:\WINDOWS\system32\winbjv32.dll
    C:\WINDOWS\system32\efhkj.bak1
    C:\WINDOWS\system32\efhkj.ini
    C:\WINDOWS\system32\jkhfe.dll
    C:\WINDOWS\system32\urqpoli.dll
    C:\WINDOWS\system32\urqpoli.dll

    * * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

    C:\WINDOWS\system32\cookie.dat

    ((((((((((((((((((((((((( Files Created from 2007-06-28 to 2007-07-29 )))))))))))))))))))))))))))))))

    2007-07-29 09:05 51,200 --a
    C:\WINDOWS\nircmd.exe
    2007-07-29 08:57 <DIR> d
    C:\VundoFix Backups
    2007-07-28 23:49 <DIR> d
    C:\Program Files\Nero
    2007-07-28 23:49 <DIR> d
    C:\Program Files\Common Files\Ahead
    2007-07-28 23:49 <DIR> d
    C:\DOCUME~1\ALLUSE~1\APPLIC~1\Nero
    2007-07-28 18:01 <DIR> d
    C:\Deckard
    2007-07-28 17:13 <DIR> d
    C:\Program Files\Trend Micro
    2007-07-28 07:32 786,432 --ah
    C:\DOCUME~1\ADMINI~1\NTUSER.DAT
    2007-07-28 07:09 <DIR> d
    C:\Program Files\XoftSpySE
    2007-07-26 08:26 <DIR> d
    C:\Program Files\Lavasoft
    2007-07-24 13:10 77,312 --a
    C:\WINDOWS\ua2.dll
    2007-07-24 11:45 <DIR> d
    C:\DOCUME~1\craig\APPLIC~1\Ahead
    2007-07-24 11:42 6,471 --ahs---- C:\WINDOWS\system32\kmllm.bak1
    2007-07-24 11:41 10,752 --a
    C:\WINDOWS\system32\down1.dll
    2007-07-24 11:38 1 --a
    C:\WINDOWS\system32\ps.dat
    2007-07-24 09:23 <DIR> d
    C:\Program Files\Activision
    2007-07-24 08:26 9,728 -ra
    C:\WINDOWS\system32\bdco1.dll
    2007-07-24 08:26 33,536 -ra
    C:\WINDOWS\system32\drivers\NVENETFD.sys
    2007-07-24 08:26 32,256 -ra
    C:\WINDOWS\system32\nvconrm.dll
    2007-07-24 08:26 261,888 -ra
    C:\WINDOWS\system32\drivers\nvnrm.sys
    2007-07-24 08:26 208,256 -ra
    C:\WINDOWS\system32\drivers\nvsnpu.sys
    2007-07-24 08:26 201,728 -ra
    C:\WINDOWS\system32\fdco1.dll
    2007-07-24 08:26 176,128 --a
    C:\WINDOWS\system32\nvunrm.exe
    2007-07-24 08:26 12,928 -ra
    C:\WINDOWS\system32\drivers\nvnetbus.sys
    2007-07-24 08:16 <DIR> d
    C:\NVIDIA
    2007-07-24 08:08 <DIR> d
    C:\Program Files\SystemRequirementsLab
    2007-07-23 21:53 <DIR> d
    C:\WINDOWS\system32\AGEIA
    2007-07-23 21:53 <DIR> d
    C:\Program Files\AGEIA Technologies
    2007-07-23 21:45 <DIR> d
    C:\Program Files\UBISOFT
    2007-07-23 21:43 <DIR> d
    C:\DOCUME~1\craig\APPLIC~1\InstallShield
    2007-07-22 09:39 <DIR> d
    C:\Program Files\Engelmann Media
    2007-07-17 08:58 <DIR> d
    C:\Program Files\Common Files\EasyInfo
    2007-07-11 23:09 <DIR> d
    C:\Program Files\Poker
    2007-07-10 23:16 <DIR> d
    C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
    2007-07-10 22:40 <DIR> d
    C:\WINDOWS\network diagnostic
    2007-07-10 22:36 <DIR> d
    C:\b45b2043300abf43b93128522c
    2007-07-09 09:54 22,328 --a
    C:\WINDOWS\system32\drivers\PnkBstrK.sys
    2007-07-09 09:54 103,736 --a
    C:\WINDOWS\system32\PnkBstrB.exe
    2007-07-08 08:58 <DIR> d
    C:\WINDOWS\ImageShackToolbar
    2007-07-08 07:03 73,728 --a
    C:\WINDOWS\system32\FLKill.exe
    2007-07-08 07:03 <DIR> d
    C:\Program Files\Folder Lock
    2007-07-06 21:03 <DIR> d
    C:\My Downloads
    2007-07-06 21:01 <DIR> d
    C:\Program Files\BitTorrent Fastest Tool
    2007-07-06 16:25 <DIR> d
    C:\DOCUME~1\craig\APPLIC~1\Leadertech
    2007-07-06 12:07 <DIR> d
    C:\Program Files\FolderSecurityGuard
    2007-07-05 20:17 <DIR> d
    C:\DOCUME~1\craig\APPLIC~1\teamspeak2
    2007-07-05 20:16 <DIR> d
    C:\Program Files\Teamspeak2_RC2
    2007-07-05 16:51 85,376 --a
    C:\WINDOWS\system32\drivers\NABTSFEC.sys
    2007-07-05 16:51 5,504 --a
    C:\WINDOWS\system32\drivers\MSTEE.sys
    2007-07-05 16:51 19,328 --a
    C:\WINDOWS\system32\drivers\WSTCODEC.SYS
    2007-07-05 16:51 17,024 --a
    C:\WINDOWS\system32\drivers\CCDECODE.sys
    2007-07-05 16:51 15,360 --a
    C:\WINDOWS\system32\drivers\StreamIP.sys
    2007-07-05 16:51 11,136 --a
    C:\WINDOWS\system32\drivers\SLIP.sys
    2007-07-05 16:51 10,880 --a
    C:\WINDOWS\system32\drivers\NdisIP.sys
    2007-07-05 16:50 78,464 --a
    C:\WINDOWS\system32\drivers\usbvideo.sys
    2007-07-05 16:50 53,760 --a
    C:\WINDOWS\system32\vfwwdm32.dll
    2007-07-05 16:50 5,632 --a
    C:\WINDOWS\system32\ptpusb.dll
    2007-07-05 16:50 159,232 --a
    C:\WINDOWS\system32\ptpusd.dll
    2007-07-05 16:50 15,104 --a
    C:\WINDOWS\system32\drivers\usbscan.sys
    2007-07-05 11:26 <DIR> d
    C:\Program Files\RealVNC
    2007-07-05 11:15 446,464 --a
    C:\WINDOWS\system32\wmvdmoe.dll
    2007-07-05 11:15 <DIR> d
    C:\DOCUME~1\ALLUSE~1\APPLIC~1\PY_Software
    2007-07-05 11:12 434,688 --a
    C:\WINDOWS\system32\ss2uinst.exe
    2007-07-03 18:35 <DIR> d
    C:\Program Files\TalkTalk
    2007-07-03 18:35 <DIR> d
    C:\Program Files\SupportSoft
    2007-07-03 18:35 <DIR> d
    C:\DOCUME~1\ALLUSE~1\APPLIC~1\SupportSoft
    2007-07-03 18:34 <DIR> d
    C:\Program Files\Common Files\Wise Installation Wizard
    2007-07-03 18:18 <DIR> d
    C:\Program Files\Thomson
    2007-07-02 20:20 <DIR> d
    C:\WINDOWS\system32\appmgmt
    2007-07-02 17:31 <DIR> d
    C:\WINDOWS\Downloaded Installations
    2007-07-02 17:30 <DIR> d
    C:\Program Files\Google
    2007-07-02 17:30 <DIR> d
    C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
    2007-07-02 17:21 81,920 --a
    C:\WINDOWS\system32\SGUserInfo.dll
    2007-07-02 17:21 37,224 --a
    C:\WINDOWS\system32\SageStorage.dll
    2007-07-02 17:21 335,872 --a
    C:\WINDOWS\system32\SGINFMR.dll
    2007-07-02 17:21 167,936 --a
    C:\WINDOWS\system32\SGXMLQry.dll
    2007-07-02 17:21 139,264 --a
    C:\WINDOWS\system32\SGISAQry.dll
    2007-07-02 17:21 127,352 --a
    C:\WINDOWS\system32\SageSoftwareUpdate.dll
    2007-07-02 17:21 126,976 --a
    C:\WINDOWS\system32\SGInfProgressBar.dll
    2007-07-02 17:21 119,160 --a
    C:\WINDOWS\system32\SageFolderBrowse.dll
    2007-07-02 17:19 86,016 --a
    C:\WINDOWS\system32\SageNatWestBankline.dll
    2007-07-02 17:19 86,016 --a
    C:\WINDOWS\system32\SageBankPayments.dll
    2007-07-02 17:19 81,920 --a
    C:\WINDOWS\system32\SageNatWestOnline.dll
    2007-07-02 17:19 81,920 --a
    C:\WINDOWS\system32\sageebanking.dll
    2007-07-02 17:19 81,920 --a
    C:\WINDOWS\system32\SageBarclaysOnline.dll
    2007-07-02 17:19 81,920 --a
    C:\WINDOWS\system32\SageBarclaysBusinessMasterII.dll
    2007-07-02 17:19 69,632 --a
    C:\WINDOWS\system32\SageBankBalances.dll
    2007-07-02 17:19 61,440 --a
    C:\WINDOWS\system32\BankServiceUtilities.dll
    2007-07-02 17:19 192,512 --a
    C:\WINDOWS\system32\SageBankReconciliation.dll
    2007-07-02 17:19 <DIR> d
    C:\Program Files\Sage EBanking
    2007-07-02 17:17 368,696 --a
    C:\WINDOWS\system32\S10DBC32.dll
    2007-07-02 17:17 322,832 --a
    C:\WINDOWS\system32\MFC30.DLL
    2007-07-02 17:16 <DIR> d
    C:\Program Files\Sage
    2007-07-02 17:16 <DIR> d
    C:\Program Files\Common Files\Sage Line50
    2007-07-02 11:45 4,212 --ah
    C:\WINDOWS\system32\zllictbl.dat
    2007-07-02 11:45 <DIR> d
    C:\WINDOWS\system32\ZoneLabs
    2007-07-02 11:44 <DIR> d
    C:\WINDOWS\Internet Logs
    2007-07-02 11:23 <DIR> d
    C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
    2007-07-02 11:12 <DIR> d
    C:\Program Files\Windows Media Connect 2
    2007-07-02 11:11 <DIR> d
    C:\WINDOWS\system32\LogFiles

    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    2007-07-29 07:53:30
    d
    w C:\Program Files\BitComet
    2007-07-28 23:02:51
    d
    w C:\Program Files\DynDNS Updater
    2007-07-24 08:40:37 11,973 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
    2007-07-24 08:39:21
    d--h--w C:\Program Files\InstallShield Installation Information
    2007-07-06 17:25:14
    d
    w C:\Program Files\Common Files\McAfee
    2007-07-06 11:48:10 2,038 ----a-w C:\DOCUME~1\craig\APPLIC~1\SAS7_000.DAT
    2007-07-05 19:44:00
    d
    w C:\Program Files\Electronic Arts
    2007-06-30 00:19:28 359,808 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
    2007-06-28 21:18:40
    d
    w C:\DOCUME~1\craig\APPLIC~1\Command & Conquer 3 Tiberium Wars Demo
    2007-06-28 14:38:50
    d
    w C:\Program Files\Messenger
    2007-06-28 01:20:38
    d
    w C:\Program Files\Shareaza
    2007-06-28 01:20:35
    d
    w C:\DOCUME~1\craig\APPLIC~1\Shareaza
    2007-06-27 23:33:43
    d
    w C:\DOCUME~1\craig\APPLIC~1\LimeWire
    2007-06-27 23:22:47
    d
    w C:\DOCUME~1\craig\APPLIC~1\McAfee
    2007-06-27 23:15:32 201 ----a-w C:\WINDOWS\nsreg.dat
    2007-06-27 23:08:20
    d
    w C:\Program Files\PowerISO
    2007-06-27 21:45:45 2,560 ----a-w C:\WINDOWS\system32\BitCometRes.dll
    2007-06-27 21:27:09
    d
    w C:\DOCUME~1\craig\APPLIC~1\Nuance
    2007-06-27 21:25:14
    d
    w C:\Program Files\Common Files\Scansoft Shared
    2007-06-27 21:25:14
    d
    w C:\Program Files\Common Files\InstallShield
    2007-06-27 21:25:05
    d
    w C:\Program Files\Nuance
    2007-06-27 21:22:06
    d
    w C:\Program Files\DAEMON Tools
    2007-06-27 21:09:37 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll
    2007-06-27 21:09:37 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll
    2007-06-27 21:08:54
    d
    w C:\Program Files\Microsoft Works
    2007-06-27 21:08:43
    d
    w C:\Program Files\MSBuild
    2007-06-27 21:08:39 682,232 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
    2007-06-27 21:07:51
    d
    w C:\Program Files\Common Files\ODBC
    2007-06-27 21:07:49
    d
    w C:\Program Files\Common Files\SpeechEngines
    2007-06-27 21:02:47
    d
    w C:\DOCUME~1\craig\APPLIC~1\Kana Solution
    2007-06-27 21:02:24
    d
    w C:\DOCUME~1\craig\APPLIC~1\WinRAR
    2007-06-27 20:40:34
    d
    w C:\Program Files\Common Files\SupportSoft
    2007-06-27 20:29:09
    d
    w C:\Program Files\Realtek Sound Manager
    2007-06-27 20:29:09
    d
    w C:\Program Files\AvRack
    2007-06-27 20:28:22
    d
    w C:\Program Files\AMD
    2007-06-27 20:24:28 502,272 ----a-w C:\WINDOWS\system32\winlogon.exe
    2007-06-27 20:17:18
    d
    w C:\Program Files\microsoft frontpage
    2007-06-27 20:16:55 0 --sha-r C:\MSDOS.SYS
    2007-06-27 20:16:55 0 --sha-r C:\IO.SYS
    2007-06-27 20:16:55 0 ----a-w C:\CONFIG.SYS
    2007-06-27 20:16:55 0 ----a-w C:\AUTOEXEC.BAT
    2007-06-27 20:15:49
    d--h--w C:\Program Files\WindowsUpdate
    2007-06-27 20:15:10
    d
    w C:\Program Files\Common Files\MSSoap
    2007-06-27 20:15:03
    d
    w C:\Program Files\Movie Maker
    2007-06-27 20:14:20 21,640 ----a-w C:\WINDOWS\system32\emptyregdb.dat
    2007-06-27 20:13:53
    d
    w C:\Program Files\Online Services
    2007-06-27 20:13:43
    d
    w C:\Program Files\MSN Gaming Zone
    2007-06-27 20:13:37
    d
    w C:\Program Files\Windows NT
    2007-06-04 14:18:48 9,344 ----a-w C:\WINDOWS\system32\drivers\NSDriver.sys
    2007-06-04 14:17:02 8,320 ----a-w C:\WINDOWS\system32\drivers\AWRTRD.sys
    2007-06-04 14:14:56 6,272 ----a-w C:\WINDOWS\system32\drivers\AWRTPD.sys
    2007-05-31 06:45:07 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
    2007-05-31 06:44:55 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
    2007-05-31 06:44:54 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
    2007-05-31 06:44:54 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
    2007-05-31 06:44:54 740,442 ----a-w C:\WINDOWS\system32\DivX.dll
    2007-05-16 15:12:02 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
    2007-05-15 18:06:58 71,208 ----a-w C:\WINDOWS\system32\PhysXLoader.dll

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


    *Note* empty entries & legit default entries are not shown
    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30EDD4CB-8BC1-4f9f-99A6-A6938E9AACE0}]
    2007-07-24 11:41 10752 --a
    C:\WINDOWS\system32\down1.dll
    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A0738CDD-5B40-4396-9CB3-06134EA49A16}]
    C:\WINDOWS\system32\ssqrr.dll
    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D0367266-A0E9-4644-A039-0A0CF65FD09A}]
    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FAE3BD2C-7048-46AA-BA4A-FCEAE95B6D21}]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "nwiz"="nwiz.exe" [2007-04-19 13:26 C:\WINDOWS\system32\nwiz.exe]
    "SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 11:38]
    "Zone Labs Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2006-08-23 23:38]
    "NvMediaCenter"="NvMCTray.dll" [2007-04-19 13:26 C:\WINDOWS\system32\nvmctray.dll]
    "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-07-24 12:46]
    "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-09 18:53]
    "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-04-19 13:26]
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 13:00]
    "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54]
    "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-03-12 13:49]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\mllmk]
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\aawservice]
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^craig^Start Menu^Programs^Startup^Microsoft Office Groove.lnk]
    path=C:\Documents and Settings\craig\Start Menu\Programs\Startup\Microsoft Office Groove.lnk
    backup=C:\WINDOWS\pss\Microsoft Office Groove.lnkStartup
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
    "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
    "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DNS7reminder]
    "C:\Program Files\Nuance\NaturallySpeaking9\Program\ereg.exe" -r "C:\Program Files\Nuance\NaturallySpeaking9\Program\ereg.ini"
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EA Core]
    "C:\Program Files\Electronic Arts\EA Link\Core.exe" -silent
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
    "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
    C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
    "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
    C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
    C:\Program Files\PowerISO\PWRISOVM.EXE
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
    "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Shareaza]
    "C:\Program Files\Shareaza\Shareaza.exe" -tray
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SiteAdvisor]
    C:\Program Files\SiteAdvisor\6066\SiteAdv.exe
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
    SOUNDMAN.EXE
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate]
    C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe -Embedding -boot
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
    "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TalkTalk]
    "C:\Program Files\TalkTalk\bin\sprtcmd.exe" /P TalkTalk
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\winbo32]
    winbo32.exe
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zone Labs Client]
    "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "McProxy"=2 (0x2)
    R0 srescan;srescan;C:\WINDOWS\system32\ZoneLabs\srescan.sys
    R1 AmdK8;AMD Processor Driver;C:\WINDOWS\system32\DRIVERS\AmdK8.sys
    R1 SCDEmu;SCDEmu;C:\WINDOWS\system32\drivers\SCDEmu.sys
    R2 DynDNS_Updater_Service;DynDNS Updater Service;C:\Program Files\DynDNS Updater\DynDNS.exe
    R3 alcan5wn;SpeedTouch USB ADSL PPP Networking Driver (NDISWAN);C:\WINDOWS\system32\DRIVERS\alcan5wn.sys
    R3 alcaudsl;SpeedTouch ADSL Modem ATM Transport;C:\WINDOWS\system32\DRIVERS\alcaudsl.sys
    R3 irsir;Microsoft Serial Infrared Driver;C:\WINDOWS\system32\DRIVERS\irsir.sys
    S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service;"C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe"
    S3 odserv;Microsoft Office Diagnostics Service;"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE"
    S3 usbvideo;USB Video Device (WDM);C:\WINDOWS\system32\Drivers\usbvideo.sys

    Contents of the 'Scheduled Tasks' folder
    2007-07-29 07:53:13 C:\WINDOWS\tasks\XoftSpySE.job
    **************************************************************************
    catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2007-07-29 11:02:59
    Windows 5.1.2600 Service Pack 2 NTFS
    scanning hidden processes ...
    scanning hidden registry entries ...
    scanning hidden files ...
    scan completed successfully
    hidden files: 0
    **************************************************************************
    Completion time: 2007-07-29 11:04:38 - machine was rebooted
    C:\ComboFix-quarantined-files.txt ... 2007-07-29 11:04
    --- E O F ---

    and the vundo found nothing

    new high jack log

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 11:07:24, on 29/07/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal
    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\WINDOWS\system32\RunDLL32.exe
    C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\RealVNC\VNC4\WinVNC4.exe
    C:\Program Files\DynDNS Updater\DynDNS.exe
    C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
    C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\internet explorer\iexplore.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: H - {30EDD4CB-8BC1-4f9f-99A6-A6938E9AACE0} - C:\WINDOWS\system32\down1.dll
    O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.6.14.dll
    O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: (no name) - {A0738CDD-5B40-4396-9CB3-06134EA49A16} - C:\WINDOWS\system32\ssqrr.dll (file missing)
    O2 - BHO: H - {D0367266-A0E9-4644-A039-0A0CF65FD09A} - ertw1.dll (file missing)
    O2 - BHO: (no name) - {FAE3BD2C-7048-46AA-BA4A-FCEAE95B6D21} - (no file)
    O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
    O3 - Toolbar: ImageShack Toolbar - {6932D140-ABC4-4073-A44C-D4A541665E35} - C:\WINDOWS\ImageShackToolbar\ImageShackToolbar.dll
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
    O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
    O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
    O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
    O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
    O16 - DPF: {6932D140-ABC4-4073-A44C-D4A541665E35} (ImageShack Toolbar) - http://toolbar.imageshack.us/toolbar/ImageShackToolbar.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{7D4FED7B-F305-43D3-939A-D38C350A00F1}: NameServer = 62.24.252.135 62.24.252.134
    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
    O20 - Winlogon Notify: mllmk - C:\WINDOWS\
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    O23 - Service: DynDNS Updater Service (DynDNS_Updater_Service) - Kana Solution - C:\Program Files\DynDNS Updater\DynDNS.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe (file missing)
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe
    --
    End of file - 7282 bytes
  • peku006
    edited July 2007
    Hi GNGNUT
    how is your system running now?

    Please do the following...

    Step 1
    • Run HijackThis
    • Click on the Scan button
    • Put a check beside all of the items listed below (if present):

      O2 - BHO: H - {30EDD4CB-8BC1-4f9f-99A6-A6938E9AACE0} - C:\WINDOWS\system32\down1.dll
      O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
      O2 - BHO: (no name) - {A0738CDD-5B40-4396-9CB3-06134EA49A16} - C:\WINDOWS\system32\ssqrr.dll (file missing)
      O2 - BHO: H - {D0367266-A0E9-4644-A039-0A0CF65FD09A} - ertw1.dll (file missing)
      O2 - BHO: (no name) - {FAE3BD2C-7048-46AA-BA4A-FCEAE95B6D21} - (no file)
      O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
      O20 - Winlogon Notify: mllmk - C:\WINDOWS\
    • Close all open windows and browsers/email, etc...
    • Click on the "Fix Checked" button
    • When completed, close the application.
    Step 2
    Open notepad and copy/paste the text in the quotebox below into it:
    File::
C:\WINDOWS\system32\down1.dll
C:\WINDOWS\system32\ssqrr.dll
C:\WINDOWS\system32\kmllm.bak1

Folder::
C:\b45b2043300abf43b93128522c

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\mllmk] 
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\winbo32]
    Save this as "CFScript"

    CFScript.gif

    This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThislog.
  • GNGNUT
    edited July 2007
    ok my system is still running fine i dont seem to get overwelmed with pop up now i still get 1 - 2 every now and then but befor i was getting every time i open ie and going to differnt sites

    here is fresh combo log

    "craig" - 2007-07-29 18:31:06 - ComboFix 07-07-23.6 - Service Pack 2 NTFS

    ((((((((((((((((((((((((( Files Created from 2007-06-28 to 2007-07-29 )))))))))))))))))))))))))))))))

    2007-07-29 11:09 <DIR> d
    C:\Program Files\MSXML 4.0
    2007-07-29 09:05 51,200 --a
    C:\WINDOWS\nircmd.exe
    2007-07-29 08:57 <DIR> d
    C:\VundoFix Backups
    2007-07-28 23:49 <DIR> d
    C:\Program Files\Nero
    2007-07-28 23:49 <DIR> d
    C:\Program Files\Common Files\Ahead
    2007-07-28 23:49 <DIR> d
    C:\DOCUME~1\ALLUSE~1\APPLIC~1\Nero
    2007-07-28 18:01 <DIR> d
    C:\Deckard
    2007-07-28 17:13 <DIR> d
    C:\Program Files\Trend Micro
    2007-07-28 07:32 786,432 --ah
    C:\DOCUME~1\ADMINI~1\NTUSER.DAT
    2007-07-28 07:09 <DIR> d
    C:\Program Files\XoftSpySE
    2007-07-26 08:26 <DIR> d
    C:\Program Files\Lavasoft
    2007-07-24 13:10 77,312 --a
    C:\WINDOWS\ua2.dll
    2007-07-24 11:45 <DIR> d
    C:\DOCUME~1\craig\APPLIC~1\Ahead
    2007-07-24 11:42 6,471 --ahs---- C:\WINDOWS\system32\kmllm.bak1
    2007-07-24 11:38 1 --a
    C:\WINDOWS\system32\ps.dat
    2007-07-24 09:23 <DIR> d
    C:\Program Files\Activision
    2007-07-24 08:26 9,728 -ra
    C:\WINDOWS\system32\bdco1.dll
    2007-07-24 08:26 33,536 -ra
    C:\WINDOWS\system32\drivers\NVENETFD.sys
    2007-07-24 08:26 32,256 -ra
    C:\WINDOWS\system32\nvconrm.dll
    2007-07-24 08:26 261,888 -ra
    C:\WINDOWS\system32\drivers\nvnrm.sys
    2007-07-24 08:26 208,256 -ra
    C:\WINDOWS\system32\drivers\nvsnpu.sys
    2007-07-24 08:26 201,728 -ra
    C:\WINDOWS\system32\fdco1.dll
    2007-07-24 08:26 176,128 --a
    C:\WINDOWS\system32\nvunrm.exe
    2007-07-24 08:26 12,928 -ra
    C:\WINDOWS\system32\drivers\nvnetbus.sys
    2007-07-24 08:16 <DIR> d
    C:\NVIDIA
    2007-07-24 08:08 <DIR> d
    C:\Program Files\SystemRequirementsLab
    2007-07-23 21:53 <DIR> d
    C:\WINDOWS\system32\AGEIA
    2007-07-23 21:53 <DIR> d
    C:\Program Files\AGEIA Technologies
    2007-07-23 21:45 <DIR> d
    C:\Program Files\UBISOFT
    2007-07-23 21:43 <DIR> d
    C:\DOCUME~1\craig\APPLIC~1\InstallShield
    2007-07-22 09:39 <DIR> d
    C:\Program Files\Engelmann Media
    2007-07-17 08:58 <DIR> d
    C:\Program Files\Common Files\EasyInfo
    2007-07-11 23:09 <DIR> d
    C:\Program Files\Poker
    2007-07-10 23:16 <DIR> d
    C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
    2007-07-10 22:40 <DIR> d
    C:\WINDOWS\network diagnostic
    2007-07-10 22:36 <DIR> d
    C:\b45b2043300abf43b93128522c
    2007-07-09 09:54 22,328 --a
    C:\WINDOWS\system32\drivers\PnkBstrK.sys
    2007-07-09 09:54 103,736 --a
    C:\WINDOWS\system32\PnkBstrB.exe
    2007-07-08 08:58 <DIR> d
    C:\WINDOWS\ImageShackToolbar
    2007-07-08 07:03 73,728 --a
    C:\WINDOWS\system32\FLKill.exe
    2007-07-08 07:03 <DIR> d
    C:\Program Files\Folder Lock
    2007-07-06 21:03 <DIR> d
    C:\My Downloads
    2007-07-06 21:01 <DIR> d
    C:\Program Files\BitTorrent Fastest Tool
    2007-07-06 16:25 <DIR> d
    C:\DOCUME~1\craig\APPLIC~1\Leadertech
    2007-07-06 12:07 <DIR> d
    C:\Program Files\FolderSecurityGuard
    2007-07-05 20:17 <DIR> d
    C:\DOCUME~1\craig\APPLIC~1\teamspeak2
    2007-07-05 20:16 <DIR> d
    C:\Program Files\Teamspeak2_RC2
    2007-07-05 16:51 85,376 --a
    C:\WINDOWS\system32\drivers\NABTSFEC.sys
    2007-07-05 16:51 5,504 --a
    C:\WINDOWS\system32\drivers\MSTEE.sys
    2007-07-05 16:51 19,328 --a
    C:\WINDOWS\system32\drivers\WSTCODEC.SYS
    2007-07-05 16:51 17,024 --a
    C:\WINDOWS\system32\drivers\CCDECODE.sys
    2007-07-05 16:51 15,360 --a
    C:\WINDOWS\system32\drivers\StreamIP.sys
    2007-07-05 16:51 11,136 --a
    C:\WINDOWS\system32\drivers\SLIP.sys
    2007-07-05 16:51 10,880 --a
    C:\WINDOWS\system32\drivers\NdisIP.sys
    2007-07-05 16:50 78,464 --a
    C:\WINDOWS\system32\drivers\usbvideo.sys
    2007-07-05 16:50 53,760 --a
    C:\WINDOWS\system32\vfwwdm32.dll
    2007-07-05 16:50 5,632 --a
    C:\WINDOWS\system32\ptpusb.dll
    2007-07-05 16:50 159,232 --a
    C:\WINDOWS\system32\ptpusd.dll
    2007-07-05 16:50 15,104 --a
    C:\WINDOWS\system32\drivers\usbscan.sys
    2007-07-05 11:26 <DIR> d
    C:\Program Files\RealVNC
    2007-07-05 11:15 446,464 --a
    C:\WINDOWS\system32\wmvdmoe.dll
    2007-07-05 11:15 <DIR> d
    C:\DOCUME~1\ALLUSE~1\APPLIC~1\PY_Software
    2007-07-05 11:12 434,688 --a
    C:\WINDOWS\system32\ss2uinst.exe
    2007-07-03 18:35 <DIR> d
    C:\Program Files\TalkTalk
    2007-07-03 18:35 <DIR> d
    C:\Program Files\SupportSoft
    2007-07-03 18:35 <DIR> d
    C:\DOCUME~1\ALLUSE~1\APPLIC~1\SupportSoft
    2007-07-03 18:34 <DIR> d
    C:\Program Files\Common Files\Wise Installation Wizard
    2007-07-03 18:18 <DIR> d
    C:\Program Files\Thomson
    2007-07-02 20:20 <DIR> d
    C:\WINDOWS\system32\appmgmt
    2007-07-02 17:31 <DIR> d
    C:\WINDOWS\Downloaded Installations
    2007-07-02 17:30 <DIR> d
    C:\Program Files\Google
    2007-07-02 17:30 <DIR> d
    C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
    2007-07-02 17:21 81,920 --a
    C:\WINDOWS\system32\SGUserInfo.dll
    2007-07-02 17:21 37,224 --a
    C:\WINDOWS\system32\SageStorage.dll
    2007-07-02 17:21 335,872 --a
    C:\WINDOWS\system32\SGINFMR.dll
    2007-07-02 17:21 167,936 --a
    C:\WINDOWS\system32\SGXMLQry.dll
    2007-07-02 17:21 139,264 --a
    C:\WINDOWS\system32\SGISAQry.dll
    2007-07-02 17:21 127,352 --a
    C:\WINDOWS\system32\SageSoftwareUpdate.dll
    2007-07-02 17:21 126,976 --a
    C:\WINDOWS\system32\SGInfProgressBar.dll
    2007-07-02 17:21 119,160 --a
    C:\WINDOWS\system32\SageFolderBrowse.dll
    2007-07-02 17:19 86,016 --a
    C:\WINDOWS\system32\SageNatWestBankline.dll
    2007-07-02 17:19 86,016 --a
    C:\WINDOWS\system32\SageBankPayments.dll
    2007-07-02 17:19 81,920 --a
    C:\WINDOWS\system32\SageNatWestOnline.dll
    2007-07-02 17:19 81,920 --a
    C:\WINDOWS\system32\sageebanking.dll
    2007-07-02 17:19 81,920 --a
    C:\WINDOWS\system32\SageBarclaysOnline.dll
    2007-07-02 17:19 81,920 --a
    C:\WINDOWS\system32\SageBarclaysBusinessMasterII.dll
    2007-07-02 17:19 69,632 --a
    C:\WINDOWS\system32\SageBankBalances.dll
    2007-07-02 17:19 61,440 --a
    C:\WINDOWS\system32\BankServiceUtilities.dll
    2007-07-02 17:19 192,512 --a
    C:\WINDOWS\system32\SageBankReconciliation.dll
    2007-07-02 17:19 <DIR> d
    C:\Program Files\Sage EBanking
    2007-07-02 17:17 368,696 --a
    C:\WINDOWS\system32\S10DBC32.dll
    2007-07-02 17:17 322,832 --a
    C:\WINDOWS\system32\MFC30.DLL
    2007-07-02 17:16 <DIR> d
    C:\Program Files\Sage
    2007-07-02 17:16 <DIR> d
    C:\Program Files\Common Files\Sage Line50
    2007-07-02 11:45 4,212 --ah
    C:\WINDOWS\system32\zllictbl.dat
    2007-07-02 11:45 <DIR> d
    C:\WINDOWS\system32\ZoneLabs
    2007-07-02 11:44 <DIR> d
    C:\WINDOWS\Internet Logs
    2007-07-02 11:23 <DIR> d
    C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
    2007-07-02 11:12 <DIR> d
    C:\Program Files\Windows Media Connect 2
    2007-07-02 11:11 <DIR> d
    C:\WINDOWS\system32\LogFiles

    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    2007-07-29 07:53:30
    d
    w C:\Program Files\BitComet
    2007-07-28 23:02:51
    d
    w C:\Program Files\DynDNS Updater
    2007-07-24 08:40:37 11,973 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
    2007-07-24 08:39:21
    d--h--w C:\Program Files\InstallShield Installation Information
    2007-07-06 17:25:14
    d
    w C:\Program Files\Common Files\McAfee
    2007-07-06 11:48:10 2,038 ----a-w C:\DOCUME~1\craig\APPLIC~1\SAS7_000.DAT
    2007-07-05 19:44:00
    d
    w C:\Program Files\Electronic Arts
    2007-06-30 00:19:28 359,808 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
    2007-06-28 21:18:40
    d
    w C:\DOCUME~1\craig\APPLIC~1\Command & Conquer 3 Tiberium Wars Demo
    2007-06-28 14:38:50
    d
    w C:\Program Files\Messenger
    2007-06-28 01:20:38
    d
    w C:\Program Files\Shareaza
    2007-06-28 01:20:35
    d
    w C:\DOCUME~1\craig\APPLIC~1\Shareaza
    2007-06-27 23:33:43
    d
    w C:\DOCUME~1\craig\APPLIC~1\LimeWire
    2007-06-27 23:22:47
    d
    w C:\DOCUME~1\craig\APPLIC~1\McAfee
    2007-06-27 23:15:32 201 ----a-w C:\WINDOWS\nsreg.dat
    2007-06-27 23:08:20
    d
    w C:\Program Files\PowerISO
    2007-06-27 21:45:45 2,560 ----a-w C:\WINDOWS\system32\BitCometRes.dll
    2007-06-27 21:27:09
    d
    w C:\DOCUME~1\craig\APPLIC~1\Nuance
    2007-06-27 21:25:14
    d
    w C:\Program Files\Common Files\Scansoft Shared
    2007-06-27 21:25:14
    d
    w C:\Program Files\Common Files\InstallShield
    2007-06-27 21:25:05
    d
    w C:\Program Files\Nuance
    2007-06-27 21:22:06
    d
    w C:\Program Files\DAEMON Tools
    2007-06-27 21:09:37 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll
    2007-06-27 21:09:37 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll
    2007-06-27 21:08:54
    d
    w C:\Program Files\Microsoft Works
    2007-06-27 21:08:43
    d
    w C:\Program Files\MSBuild
    2007-06-27 21:08:39 682,232 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
    2007-06-27 21:07:51
    d
    w C:\Program Files\Common Files\ODBC
    2007-06-27 21:07:49
    d
    w C:\Program Files\Common Files\SpeechEngines
    2007-06-27 21:02:47
    d
    w C:\DOCUME~1\craig\APPLIC~1\Kana Solution
    2007-06-27 21:02:24
    d
    w C:\DOCUME~1\craig\APPLIC~1\WinRAR
    2007-06-27 20:40:34
    d
    w C:\Program Files\Common Files\SupportSoft
    2007-06-27 20:29:09
    d
    w C:\Program Files\Realtek Sound Manager
    2007-06-27 20:29:09
    d
    w C:\Program Files\AvRack
    2007-06-27 20:28:22
    d
    w C:\Program Files\AMD
    2007-06-27 20:24:28 502,272 ----a-w C:\WINDOWS\system32\winlogon.exe
    2007-06-27 20:17:18
    d
    w C:\Program Files\microsoft frontpage
    2007-06-27 20:16:55 0 --sha-r C:\MSDOS.SYS
    2007-06-27 20:16:55 0 --sha-r C:\IO.SYS
    2007-06-27 20:16:55 0 ----a-w C:\CONFIG.SYS
    2007-06-27 20:16:55 0 ----a-w C:\AUTOEXEC.BAT
    2007-06-27 20:15:49
    d--h--w C:\Program Files\WindowsUpdate
    2007-06-27 20:15:10
    d
    w C:\Program Files\Common Files\MSSoap
    2007-06-27 20:15:03
    d
    w C:\Program Files\Movie Maker
    2007-06-27 20:14:20 21,640 ----a-w C:\WINDOWS\system32\emptyregdb.dat
    2007-06-27 20:13:53
    d
    w C:\Program Files\Online Services
    2007-06-27 20:13:43
    d
    w C:\Program Files\MSN Gaming Zone
    2007-06-27 20:13:37
    d
    w C:\Program Files\Windows NT
    2007-06-04 14:18:48 9,344 ----a-w C:\WINDOWS\system32\drivers\NSDriver.sys
    2007-06-04 14:17:02 8,320 ----a-w C:\WINDOWS\system32\drivers\AWRTRD.sys
    2007-06-04 14:14:56 6,272 ----a-w C:\WINDOWS\system32\drivers\AWRTPD.sys
    2007-05-31 06:45:07 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
    2007-05-31 06:44:55 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
    2007-05-31 06:44:54 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
    2007-05-31 06:44:54 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
    2007-05-31 06:44:54 740,442 ----a-w C:\WINDOWS\system32\DivX.dll
    2007-05-16 15:12:02 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
    2007-05-15 18:06:58 71,208 ----a-w C:\WINDOWS\system32\PhysXLoader.dll

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


    *Note* empty entries & legit default entries are not shown
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "nwiz"="nwiz.exe" [2007-04-19 13:26 C:\WINDOWS\system32\nwiz.exe]
    "SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 11:38]
    "Zone Labs Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2006-08-23 23:38]
    "NvMediaCenter"="NvMCTray.dll" [2007-04-19 13:26 C:\WINDOWS\system32\nvmctray.dll]
    "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-07-24 12:46]
    "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-09 18:53]
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 13:00]
    "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54]
    "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-03-12 13:49]
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\aawservice]
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^craig^Start Menu^Programs^Startup^Microsoft Office Groove.lnk]
    path=C:\Documents and Settings\craig\Start Menu\Programs\Startup\Microsoft Office Groove.lnk
    backup=C:\WINDOWS\pss\Microsoft Office Groove.lnkStartup
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
    "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
    "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DNS7reminder]
    "C:\Program Files\Nuance\NaturallySpeaking9\Program\ereg.exe" -r "C:\Program Files\Nuance\NaturallySpeaking9\Program\ereg.ini"
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EA Core]
    "C:\Program Files\Electronic Arts\EA Link\Core.exe" -silent
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
    "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
    C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
    "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
    C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
    C:\Program Files\PowerISO\PWRISOVM.EXE
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
    "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Shareaza]
    "C:\Program Files\Shareaza\Shareaza.exe" -tray
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SiteAdvisor]
    C:\Program Files\SiteAdvisor\6066\SiteAdv.exe
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
    SOUNDMAN.EXE
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate]
    C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe -Embedding -boot
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
    "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TalkTalk]
    "C:\Program Files\TalkTalk\bin\sprtcmd.exe" /P TalkTalk
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\winbo32]
    winbo32.exe
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zone Labs Client]
    "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "McProxy"=2 (0x2)
    R0 srescan;srescan;C:\WINDOWS\system32\ZoneLabs\srescan.sys
    R1 AmdK8;AMD Processor Driver;C:\WINDOWS\system32\DRIVERS\AmdK8.sys
    R1 SCDEmu;SCDEmu;C:\WINDOWS\system32\drivers\SCDEmu.sys
    R2 DynDNS_Updater_Service;DynDNS Updater Service;C:\Program Files\DynDNS Updater\DynDNS.exe
    R3 alcan5wn;SpeedTouch USB ADSL PPP Networking Driver (NDISWAN);C:\WINDOWS\system32\DRIVERS\alcan5wn.sys
    R3 alcaudsl;SpeedTouch ADSL Modem ATM Transport;C:\WINDOWS\system32\DRIVERS\alcaudsl.sys
    R3 irsir;Microsoft Serial Infrared Driver;C:\WINDOWS\system32\DRIVERS\irsir.sys
    S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service;"C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe"
    S3 odserv;Microsoft Office Diagnostics Service;"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE"
    S3 usbvideo;USB Video Device (WDM);C:\WINDOWS\system32\Drivers\usbvideo.sys
    *Newly Created Service* - CATCHME
    Contents of the 'Scheduled Tasks' folder
    2007-07-29 07:53:13 C:\WINDOWS\tasks\XoftSpySE.job
    **************************************************************************
    catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2007-07-29 18:32:40
    Windows 5.1.2600 Service Pack 2 NTFS
    scanning hidden processes ...
    scanning hidden registry entries ...
    scanning hidden files ...
    scan completed successfully
    hidden files: 0
    **************************************************************************
    Completion time: 2007-07-29 18:33:21
    C:\ComboFix-quarantined-files.txt ... 2007-07-29 18:33
    C:\ComboFix2.txt ... 2007-07-29 11:04
    --- E O F ---


    fresh jack

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 18:36:58, on 29/07/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal
    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\WINDOWS\system32\RunDLL32.exe
    C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\DynDNS Updater\DynDNS.exe
    C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
    C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\MSN Messenger\usnsvc.exe
    C:\Program Files\BitComet\BitComet.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\internet explorer\iexplore.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.6.14.dll
    O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O3 - Toolbar: ImageShack Toolbar - {6932D140-ABC4-4073-A44C-D4A541665E35} - C:\WINDOWS\ImageShackToolbar\ImageShackToolbar.dll
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
    O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
    O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
    O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
    O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
    O16 - DPF: {6932D140-ABC4-4073-A44C-D4A541665E35} (ImageShack Toolbar) - http://toolbar.imageshack.us/toolbar/ImageShackToolbar.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{7D4FED7B-F305-43D3-939A-D38C350A00F1}: NameServer = 62.24.252.135 62.24.252.134
    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    O23 - Service: DynDNS Updater Service (DynDNS_Updater_Service) - Kana Solution - C:\Program Files\DynDNS Updater\DynDNS.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe (file missing)
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe
    --
    End of file - 6710 bytes


    many thanks
    craig
  • peku006
    edited July 2007
    Hi GNGNUT

    Please do the following...

    Open notepad and copy/paste the text in the quotebox below into it:
    File::
C:\WINDOWS\system32\kmllm.bak1

Folder::
C:\b45b2043300abf43b93128522c

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\winbo32]
    Save this as "CFScript"

    CFScript.gif

    Refering to the picture above, drag CFScript.txt into ComboFix.exe

    When finished, it shall produce a log for you, C:\ComboFix.txt. Post that log in your next reply.

    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall

    Please do an online scan with Kaspersky Online Scanner. You will be prompted to install an ActiveX component from Kaspersky, Click Yes.
    • The program will launch and then start to download the latest definition files.
    • Once the scanner is installed and the definitions downloaded, click Next.
    • Now click on Scan Settings
    • In the scan settings make sure that the following are selected:

      o Scan using the following Anti-Virus database:

      + Extended (If available otherwise Standard)

      o Scan Options:

      + Scan Archives
      + Scan Mail Bases
    • Click OK
    • Now under select a target to scan select My Computer
    • The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected.
    • Now click on the Save as Text button
    • Save the file to your desktop.
    • Copy and paste that information in your next post.
    Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%.

    Please, post these logs:

    Kaspersky Online Scan result
    Combofix.txt
  • GNGNUT
    edited July 2007
    log form com

    "craig" - 2007-07-29 20:41:49 - ComboFix 07-07-23.6 - Service Pack 2 NTFS
    Command switches used :: E:\programmes\spywear programs\cfscript.txt

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

    C:\b45b2043300abf43b93128522c
    C:\b45b2043300abf43b93128522c\admparse.dll
    C:\b45b2043300abf43b93128522c\admparse.dll.mui
    C:\b45b2043300abf43b93128522c\advpack.dll
    C:\b45b2043300abf43b93128522c\advpack.dll.mui
    C:\b45b2043300abf43b93128522c\browseui.dll
    C:\b45b2043300abf43b93128522c\corpol.dll
    C:\b45b2043300abf43b93128522c\custsat.dll
    C:\b45b2043300abf43b93128522c\dxtmsft.dll
    C:\b45b2043300abf43b93128522c\dxtrans.dll
    C:\b45b2043300abf43b93128522c\extmgr.dll
    C:\b45b2043300abf43b93128522c\extmgr.dll.mui
    C:\b45b2043300abf43b93128522c\feeddisc.wav
    C:\b45b2043300abf43b93128522c\hmmapi.dll
    C:\b45b2043300abf43b93128522c\hmmapi.dll.mui
    C:\b45b2043300abf43b93128522c\html.iec
    C:\b45b2043300abf43b93128522c\html.iec.mui
    C:\b45b2043300abf43b93128522c\icardie.dll
    C:\b45b2043300abf43b93128522c\icardie.dll.mui
    C:\b45b2043300abf43b93128522c\icrav03.rat
    C:\b45b2043300abf43b93128522c\ie4uinit.exe
    C:\b45b2043300abf43b93128522c\ie4uinit.exe.mui
    C:\b45b2043300abf43b93128522c\ieakeng.dll
    C:\b45b2043300abf43b93128522c\ieakeng.dll.mui
    C:\b45b2043300abf43b93128522c\ieakmmc.chm
    C:\b45b2043300abf43b93128522c\ieaksie.dll
    C:\b45b2043300abf43b93128522c\ieaksie.dll.mui
    C:\b45b2043300abf43b93128522c\ieakui.dll
    C:\b45b2043300abf43b93128522c\ieakui.dll.mui
    C:\b45b2043300abf43b93128522c\ieapfltr.dat
    C:\b45b2043300abf43b93128522c\ieapfltr.dll
    C:\b45b2043300abf43b93128522c\iedkcs32.dll
    C:\b45b2043300abf43b93128522c\iedkcs32.dll.mui
    C:\b45b2043300abf43b93128522c\iedw.exe
    C:\b45b2043300abf43b93128522c\iedw.exe.mui
    C:\b45b2043300abf43b93128522c\ieencode.dll
    C:\b45b2043300abf43b93128522c\ieeula.chm
    C:\b45b2043300abf43b93128522c\ieframe.dll
    C:\b45b2043300abf43b93128522c\ieframe.dll.mui
    C:\b45b2043300abf43b93128522c\iepeers.dll
    C:\b45b2043300abf43b93128522c\iepeers.dll.mui
    C:\b45b2043300abf43b93128522c\ieproxy.dll
    C:\b45b2043300abf43b93128522c\iernonce.dll
    C:\b45b2043300abf43b93128522c\iernonce.dll.mui
    C:\b45b2043300abf43b93128522c\iertutil.dll
    C:\b45b2043300abf43b93128522c\iesetup.dll
    C:\b45b2043300abf43b93128522c\iesetup.dll.mui
    C:\b45b2043300abf43b93128522c\iesupp.chm
    C:\b45b2043300abf43b93128522c\ieudinit.exe
    C:\b45b2043300abf43b93128522c\ieui.dll
    C:\b45b2043300abf43b93128522c\ieui.dll.mui
    C:\b45b2043300abf43b93128522c\ieuinit.inf
    C:\b45b2043300abf43b93128522c\ieunatt.exe.mui
    C:\b45b2043300abf43b93128522c\iexplore.chm
    C:\b45b2043300abf43b93128522c\iexplore.exe
    C:\b45b2043300abf43b93128522c\iexplore.exe.mui
    C:\b45b2043300abf43b93128522c\imgutil.dll
    C:\b45b2043300abf43b93128522c\inetcorp.iem
    C:\b45b2043300abf43b93128522c\inetcpl.cpl
    C:\b45b2043300abf43b93128522c\inetcpl.cpl.mui
    C:\b45b2043300abf43b93128522c\inetres.adm
    C:\b45b2043300abf43b93128522c\inetset.iem
    C:\b45b2043300abf43b93128522c\infobar.wav
    C:\b45b2043300abf43b93128522c\inseng.dll
    C:\b45b2043300abf43b93128522c\inseng.dll.mui
    C:\b45b2043300abf43b93128522c\install.ins
    C:\b45b2043300abf43b93128522c\jscript.dll
    C:\b45b2043300abf43b93128522c\jsproxy.dll
    C:\b45b2043300abf43b93128522c\licmgr10.dll
    C:\b45b2043300abf43b93128522c\licmgr10.dll.mui
    C:\b45b2043300abf43b93128522c\msfeeds.dll
    C:\b45b2043300abf43b93128522c\msfeeds.mof
    C:\b45b2043300abf43b93128522c\msfeedsbs.dll
    C:\b45b2043300abf43b93128522c\msfeedsbs.dll.mui
    C:\b45b2043300abf43b93128522c\msfeedsbs.mof
    C:\b45b2043300abf43b93128522c\msfeedssync.exe
    C:\b45b2043300abf43b93128522c\mshta.exe
    C:\b45b2043300abf43b93128522c\mshta.exe.mui
    C:\b45b2043300abf43b93128522c\mshtml.dll
    C:\b45b2043300abf43b93128522c\mshtml.dll.mui
    C:\b45b2043300abf43b93128522c\mshtml.tlb
    C:\b45b2043300abf43b93128522c\mshtmled.dll
    C:\b45b2043300abf43b93128522c\mshtmled.dll.mui
    C:\b45b2043300abf43b93128522c\mshtmler.dll
    C:\b45b2043300abf43b93128522c\mshtmler.dll.mui
    C:\b45b2043300abf43b93128522c\msls31.dll
    C:\b45b2043300abf43b93128522c\msrating.dll
    C:\b45b2043300abf43b93128522c\msrating.dll.mui
    C:\b45b2043300abf43b93128522c\mstime.dll
    C:\b45b2043300abf43b93128522c\navstart.wav
    C:\b45b2043300abf43b93128522c\occache.dll
    C:\b45b2043300abf43b93128522c\occache.dll.mui
    C:\b45b2043300abf43b93128522c\occache.ini
    C:\b45b2043300abf43b93128522c\pngfilt.dll
    C:\b45b2043300abf43b93128522c\popupblk.wav
    C:\b45b2043300abf43b93128522c\shdocvw.dll
    C:\b45b2043300abf43b93128522c\shlwapi.dll
    C:\b45b2043300abf43b93128522c\spmsg.dll
    C:\b45b2043300abf43b93128522c\spuninst.exe
    C:\b45b2043300abf43b93128522c\spupdsvc.exe
    C:\b45b2043300abf43b93128522c\tdc.ocx
    C:\b45b2043300abf43b93128522c\ticrf.rat
    C:\b45b2043300abf43b93128522c\update\eula.rtf
    C:\b45b2043300abf43b93128522c\update\idndl.exe
    C:\b45b2043300abf43b93128522c\update\ie7.cat
    C:\b45b2043300abf43b93128522c\update\iecustom.dll
    C:\b45b2043300abf43b93128522c\update\iereseticons.exe
    C:\b45b2043300abf43b93128522c\update\iesetup.exe
    C:\b45b2043300abf43b93128522c\update\legitlibm.dll
    C:\b45b2043300abf43b93128522c\update\nlsdl.exe
    C:\b45b2043300abf43b93128522c\update\update.exe
    C:\b45b2043300abf43b93128522c\update\update.exe.manifest
    C:\b45b2043300abf43b93128522c\update\update.inf
    C:\b45b2043300abf43b93128522c\update\update.ver
    C:\b45b2043300abf43b93128522c\update\updspapi.dll
    C:\b45b2043300abf43b93128522c\update\xmllitesetup.exe
    C:\b45b2043300abf43b93128522c\url.dll
    C:\b45b2043300abf43b93128522c\urlmon.dll
    C:\b45b2043300abf43b93128522c\urlmon.dll.mui
    C:\b45b2043300abf43b93128522c\vbscript.dll
    C:\b45b2043300abf43b93128522c\vgx.dll
    C:\b45b2043300abf43b93128522c\webcheck.dll
    C:\b45b2043300abf43b93128522c\webcheck.dll.mui
    C:\b45b2043300abf43b93128522c\webcheck.ini
    C:\b45b2043300abf43b93128522c\winfxdocobj.exe
    C:\b45b2043300abf43b93128522c\winfxdocobj.exe.mui
    C:\b45b2043300abf43b93128522c\wininet.dll
    C:\b45b2043300abf43b93128522c\wininet.dll.mui
    C:\WINDOWS\system32\kmllm.bak1

    ((((((((((((((((((((((((( Files Created from 2007-06-28 to 2007-07-29 )))))))))))))))))))))))))))))))

    2007-07-29 11:09 <DIR> d
    C:\Program Files\MSXML 4.0
    2007-07-29 09:05 51,200 --a
    C:\WINDOWS\nircmd.exe
    2007-07-29 08:57 <DIR> d
    C:\VundoFix Backups
    2007-07-28 23:49 <DIR> d
    C:\Program Files\Nero
    2007-07-28 23:49 <DIR> d
    C:\Program Files\Common Files\Ahead
    2007-07-28 23:49 <DIR> d
    C:\DOCUME~1\ALLUSE~1\APPLIC~1\Nero
    2007-07-28 18:01 <DIR> d
    C:\Deckard
    2007-07-28 17:13 <DIR> d
    C:\Program Files\Trend Micro
    2007-07-28 07:32 786,432 --ah
    C:\DOCUME~1\ADMINI~1\NTUSER.DAT
    2007-07-28 07:09 <DIR> d
    C:\Program Files\XoftSpySE
    2007-07-26 08:26 <DIR> d
    C:\Program Files\Lavasoft
    2007-07-24 13:10 77,312 --a
    C:\WINDOWS\ua2.dll
    2007-07-24 11:45 <DIR> d
    C:\DOCUME~1\craig\APPLIC~1\Ahead
    2007-07-24 11:38 1 --a
    C:\WINDOWS\system32\ps.dat
    2007-07-24 09:23 <DIR> d
    C:\Program Files\Activision
    2007-07-24 08:26 9,728 -ra
    C:\WINDOWS\system32\bdco1.dll
    2007-07-24 08:26 33,536 -ra
    C:\WINDOWS\system32\drivers\NVENETFD.sys
    2007-07-24 08:26 32,256 -ra
    C:\WINDOWS\system32\nvconrm.dll
    2007-07-24 08:26 261,888 -ra
    C:\WINDOWS\system32\drivers\nvnrm.sys
    2007-07-24 08:26 208,256 -ra
    C:\WINDOWS\system32\drivers\nvsnpu.sys
    2007-07-24 08:26 201,728 -ra
    C:\WINDOWS\system32\fdco1.dll
    2007-07-24 08:26 176,128 --a
    C:\WINDOWS\system32\nvunrm.exe
    2007-07-24 08:26 12,928 -ra
    C:\WINDOWS\system32\drivers\nvnetbus.sys
    2007-07-24 08:16 <DIR> d
    C:\NVIDIA
    2007-07-24 08:08 <DIR> d
    C:\Program Files\SystemRequirementsLab
    2007-07-23 21:53 <DIR> d
    C:\WINDOWS\system32\AGEIA
    2007-07-23 21:53 <DIR> d
    C:\Program Files\AGEIA Technologies
    2007-07-23 21:45 <DIR> d
    C:\Program Files\UBISOFT
    2007-07-23 21:43 <DIR> d
    C:\DOCUME~1\craig\APPLIC~1\InstallShield
    2007-07-22 09:39 <DIR> d
    C:\Program Files\Engelmann Media
    2007-07-17 08:58 <DIR> d
    C:\Program Files\Common Files\EasyInfo
    2007-07-11 23:09 <DIR> d
    C:\Program Files\Poker
    2007-07-10 23:16 <DIR> d
    C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
    2007-07-10 22:40 <DIR> d
    C:\WINDOWS\network diagnostic
    2007-07-09 09:54 22,328 --a
    C:\WINDOWS\system32\drivers\PnkBstrK.sys
    2007-07-09 09:54 103,736 --a
    C:\WINDOWS\system32\PnkBstrB.exe
    2007-07-08 08:58 <DIR> d
    C:\WINDOWS\ImageShackToolbar
    2007-07-08 07:03 73,728 --a
    C:\WINDOWS\system32\FLKill.exe
    2007-07-08 07:03 <DIR> d
    C:\Program Files\Folder Lock
    2007-07-06 21:03 <DIR> d
    C:\My Downloads
    2007-07-06 21:01 <DIR> d
    C:\Program Files\BitTorrent Fastest Tool
    2007-07-06 16:25 <DIR> d
    C:\DOCUME~1\craig\APPLIC~1\Leadertech
    2007-07-06 12:07 <DIR> d
    C:\Program Files\FolderSecurityGuard
    2007-07-05 20:17 <DIR> d
    C:\DOCUME~1\craig\APPLIC~1\teamspeak2
    2007-07-05 20:16 <DIR> d
    C:\Program Files\Teamspeak2_RC2
    2007-07-05 16:51 85,376 --a
    C:\WINDOWS\system32\drivers\NABTSFEC.sys
    2007-07-05 16:51 5,504 --a
    C:\WINDOWS\system32\drivers\MSTEE.sys
    2007-07-05 16:51 19,328 --a
    C:\WINDOWS\system32\drivers\WSTCODEC.SYS
    2007-07-05 16:51 17,024 --a
    C:\WINDOWS\system32\drivers\CCDECODE.sys
    2007-07-05 16:51 15,360 --a
    C:\WINDOWS\system32\drivers\StreamIP.sys
    2007-07-05 16:51 11,136 --a
    C:\WINDOWS\system32\drivers\SLIP.sys
    2007-07-05 16:51 10,880 --a
    C:\WINDOWS\system32\drivers\NdisIP.sys
    2007-07-05 16:50 78,464 --a
    C:\WINDOWS\system32\drivers\usbvideo.sys
    2007-07-05 16:50 53,760 --a
    C:\WINDOWS\system32\vfwwdm32.dll
    2007-07-05 16:50 5,632 --a
    C:\WINDOWS\system32\ptpusb.dll
    2007-07-05 16:50 159,232 --a
    C:\WINDOWS\system32\ptpusd.dll
    2007-07-05 16:50 15,104 --a
    C:\WINDOWS\system32\drivers\usbscan.sys
    2007-07-05 11:26 <DIR> d
    C:\Program Files\RealVNC
    2007-07-05 11:15 446,464 --a
    C:\WINDOWS\system32\wmvdmoe.dll
    2007-07-05 11:15 <DIR> d
    C:\DOCUME~1\ALLUSE~1\APPLIC~1\PY_Software
    2007-07-05 11:12 434,688 --a
    C:\WINDOWS\system32\ss2uinst.exe
    2007-07-03 18:35 <DIR> d
    C:\Program Files\TalkTalk
    2007-07-03 18:35 <DIR> d
    C:\Program Files\SupportSoft
    2007-07-03 18:35 <DIR> d
    C:\DOCUME~1\ALLUSE~1\APPLIC~1\SupportSoft
    2007-07-03 18:34 <DIR> d
    C:\Program Files\Common Files\Wise Installation Wizard
    2007-07-03 18:18 <DIR> d
    C:\Program Files\Thomson
    2007-07-02 20:20 <DIR> d
    C:\WINDOWS\system32\appmgmt
    2007-07-02 17:31 <DIR> d
    C:\WINDOWS\Downloaded Installations
    2007-07-02 17:30 <DIR> d
    C:\Program Files\Google
    2007-07-02 17:30 <DIR> d
    C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
    2007-07-02 17:21 81,920 --a
    C:\WINDOWS\system32\SGUserInfo.dll
    2007-07-02 17:21 37,224 --a
    C:\WINDOWS\system32\SageStorage.dll
    2007-07-02 17:21 335,872 --a
    C:\WINDOWS\system32\SGINFMR.dll
    2007-07-02 17:21 167,936 --a
    C:\WINDOWS\system32\SGXMLQry.dll
    2007-07-02 17:21 139,264 --a
    C:\WINDOWS\system32\SGISAQry.dll
    2007-07-02 17:21 127,352 --a
    C:\WINDOWS\system32\SageSoftwareUpdate.dll
    2007-07-02 17:21 126,976 --a
    C:\WINDOWS\system32\SGInfProgressBar.dll
    2007-07-02 17:21 119,160 --a
    C:\WINDOWS\system32\SageFolderBrowse.dll
    2007-07-02 17:19 86,016 --a
    C:\WINDOWS\system32\SageNatWestBankline.dll
    2007-07-02 17:19 86,016 --a
    C:\WINDOWS\system32\SageBankPayments.dll
    2007-07-02 17:19 81,920 --a
    C:\WINDOWS\system32\SageNatWestOnline.dll
    2007-07-02 17:19 81,920 --a
    C:\WINDOWS\system32\sageebanking.dll
    2007-07-02 17:19 81,920 --a
    C:\WINDOWS\system32\SageBarclaysOnline.dll
    2007-07-02 17:19 81,920 --a
    C:\WINDOWS\system32\SageBarclaysBusinessMasterII.dll
    2007-07-02 17:19 69,632 --a
    C:\WINDOWS\system32\SageBankBalances.dll
    2007-07-02 17:19 61,440 --a
    C:\WINDOWS\system32\BankServiceUtilities.dll
    2007-07-02 17:19 192,512 --a
    C:\WINDOWS\system32\SageBankReconciliation.dll
    2007-07-02 17:19 <DIR> d
    C:\Program Files\Sage EBanking
    2007-07-02 17:17 368,696 --a
    C:\WINDOWS\system32\S10DBC32.dll
    2007-07-02 17:17 322,832 --a
    C:\WINDOWS\system32\MFC30.DLL
    2007-07-02 17:16 <DIR> d
    C:\Program Files\Sage
    2007-07-02 17:16 <DIR> d
    C:\Program Files\Common Files\Sage Line50
    2007-07-02 11:45 4,212 --ah
    C:\WINDOWS\system32\zllictbl.dat
    2007-07-02 11:45 <DIR> d
    C:\WINDOWS\system32\ZoneLabs
    2007-07-02 11:44 <DIR> d
    C:\WINDOWS\Internet Logs
    2007-07-02 11:23 <DIR> d
    C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
    2007-07-02 11:12 <DIR> d
    C:\Program Files\Windows Media Connect 2
    2007-07-02 11:11 <DIR> d
    C:\WINDOWS\system32\LogFiles
    2007-07-02 11:11 <DIR> d
    C:\WINDOWS\system32\drivers\UMDF
    2007-07-02 09:31 <DIR> d
    C:\WINDOWS\system32\Lang

    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    2007-07-29 07:53:30
    d
    w C:\Program Files\BitComet
    2007-07-28 23:02:51
    d
    w C:\Program Files\DynDNS Updater
    2007-07-24 08:40:37 11,973 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
    2007-07-24 08:39:21
    d--h--w C:\Program Files\InstallShield Installation Information
    2007-07-06 17:25:14
    d
    w C:\Program Files\Common Files\McAfee
    2007-07-06 11:48:10 2,038 ----a-w C:\DOCUME~1\craig\APPLIC~1\SAS7_000.DAT
    2007-07-05 19:44:00
    d
    w C:\Program Files\Electronic Arts
    2007-06-30 00:19:28 359,808 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
    2007-06-28 21:18:40
    d
    w C:\DOCUME~1\craig\APPLIC~1\Command & Conquer 3 Tiberium Wars Demo
    2007-06-28 14:38:50
    d
    w C:\Program Files\Messenger
    2007-06-28 01:20:38
    d
    w C:\Program Files\Shareaza
    2007-06-28 01:20:35
    d
    w C:\DOCUME~1\craig\APPLIC~1\Shareaza
    2007-06-27 23:33:43
    d
    w C:\DOCUME~1\craig\APPLIC~1\LimeWire
    2007-06-27 23:22:47
    d
    w C:\DOCUME~1\craig\APPLIC~1\McAfee
    2007-06-27 23:15:32 201 ----a-w C:\WINDOWS\nsreg.dat
    2007-06-27 23:08:20
    d
    w C:\Program Files\PowerISO
    2007-06-27 21:45:45 2,560 ----a-w C:\WINDOWS\system32\BitCometRes.dll
    2007-06-27 21:27:09
    d
    w C:\DOCUME~1\craig\APPLIC~1\Nuance
    2007-06-27 21:25:14
    d
    w C:\Program Files\Common Files\Scansoft Shared
    2007-06-27 21:25:14
    d
    w C:\Program Files\Common Files\InstallShield
    2007-06-27 21:25:05
    d
    w C:\Program Files\Nuance
    2007-06-27 21:22:06
    d
    w C:\Program Files\DAEMON Tools
    2007-06-27 21:09:37 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll
    2007-06-27 21:09:37 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll
    2007-06-27 21:08:54
    d
    w C:\Program Files\Microsoft Works
    2007-06-27 21:08:43
    d
    w C:\Program Files\MSBuild
    2007-06-27 21:08:39 682,232 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
    2007-06-27 21:07:51
    d
    w C:\Program Files\Common Files\ODBC
    2007-06-27 21:07:49
    d
    w C:\Program Files\Common Files\SpeechEngines
    2007-06-27 21:02:47
    d
    w C:\DOCUME~1\craig\APPLIC~1\Kana Solution
    2007-06-27 21:02:24
    d
    w C:\DOCUME~1\craig\APPLIC~1\WinRAR
    2007-06-27 20:40:34
    d
    w C:\Program Files\Common Files\SupportSoft
    2007-06-27 20:29:09
    d
    w C:\Program Files\Realtek Sound Manager
    2007-06-27 20:29:09
    d
    w C:\Program Files\AvRack
    2007-06-27 20:28:22
    d
    w C:\Program Files\AMD
    2007-06-27 20:24:28 502,272 ----a-w C:\WINDOWS\system32\winlogon.exe
    2007-06-27 20:17:18
    d
    w C:\Program Files\microsoft frontpage
    2007-06-27 20:16:55 0 --sha-r C:\MSDOS.SYS
    2007-06-27 20:16:55 0 --sha-r C:\IO.SYS
    2007-06-27 20:16:55 0 ----a-w C:\CONFIG.SYS
    2007-06-27 20:16:55 0 ----a-w C:\AUTOEXEC.BAT
    2007-06-27 20:15:49
    d--h--w C:\Program Files\WindowsUpdate
    2007-06-27 20:15:10
    d
    w C:\Program Files\Common Files\MSSoap
    2007-06-27 20:15:03
    d
    w C:\Program Files\Movie Maker
    2007-06-27 20:14:20 21,640 ----a-w C:\WINDOWS\system32\emptyregdb.dat
    2007-06-27 20:13:53
    d
    w C:\Program Files\Online Services
    2007-06-27 20:13:43
    d
    w C:\Program Files\MSN Gaming Zone
    2007-06-27 20:13:37
    d
    w C:\Program Files\Windows NT
    2007-06-04 14:18:48 9,344 ----a-w C:\WINDOWS\system32\drivers\NSDriver.sys
    2007-06-04 14:17:02 8,320 ----a-w C:\WINDOWS\system32\drivers\AWRTRD.sys
    2007-06-04 14:14:56 6,272 ----a-w C:\WINDOWS\system32\drivers\AWRTPD.sys
    2007-05-31 06:45:07 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
    2007-05-31 06:44:55 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
    2007-05-31 06:44:54 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
    2007-05-31 06:44:54 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
    2007-05-31 06:44:54 740,442 ----a-w C:\WINDOWS\system32\DivX.dll
    2007-05-16 15:12:02 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
    2007-05-15 18:06:58 71,208 ----a-w C:\WINDOWS\system32\PhysXLoader.dll

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


    *Note* empty entries & legit default entries are not shown
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "nwiz"="nwiz.exe" [2007-04-19 13:26 C:\WINDOWS\system32\nwiz.exe]
    "SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 11:38]
    "Zone Labs Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2006-08-23 23:38]
    "NvMediaCenter"="NvMCTray.dll" [2007-04-19 13:26 C:\WINDOWS\system32\nvmctray.dll]
    "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-07-24 12:46]
    "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-09 18:53]
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 13:00]
    "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54]
    "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-03-12 13:49]
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\aawservice]
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^craig^Start Menu^Programs^Startup^Microsoft Office Groove.lnk]
    path=C:\Documents and Settings\craig\Start Menu\Programs\Startup\Microsoft Office Groove.lnk
    backup=C:\WINDOWS\pss\Microsoft Office Groove.lnkStartup
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
    "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
    "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DNS7reminder]
    "C:\Program Files\Nuance\NaturallySpeaking9\Program\ereg.exe" -r "C:\Program Files\Nuance\NaturallySpeaking9\Program\ereg.ini"
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EA Core]
    "C:\Program Files\Electronic Arts\EA Link\Core.exe" -silent
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
    "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
    C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
    "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
    C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
    C:\Program Files\PowerISO\PWRISOVM.EXE
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
    "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Shareaza]
    "C:\Program Files\Shareaza\Shareaza.exe" -tray
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SiteAdvisor]
    C:\Program Files\SiteAdvisor\6066\SiteAdv.exe
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
    SOUNDMAN.EXE
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate]
    C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe -Embedding -boot
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
    "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TalkTalk]
    "C:\Program Files\TalkTalk\bin\sprtcmd.exe" /P TalkTalk
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zone Labs Client]
    "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "McProxy"=2 (0x2)
    R0 srescan;srescan;C:\WINDOWS\system32\ZoneLabs\srescan.sys
    R1 AmdK8;AMD Processor Driver;C:\WINDOWS\system32\DRIVERS\AmdK8.sys
    R1 SCDEmu;SCDEmu;C:\WINDOWS\system32\drivers\SCDEmu.sys
    R2 DynDNS_Updater_Service;DynDNS Updater Service;C:\Program Files\DynDNS Updater\DynDNS.exe
    R3 alcan5wn;SpeedTouch USB ADSL PPP Networking Driver (NDISWAN);C:\WINDOWS\system32\DRIVERS\alcan5wn.sys
    R3 alcaudsl;SpeedTouch ADSL Modem ATM Transport;C:\WINDOWS\system32\DRIVERS\alcaudsl.sys
    R3 irsir;Microsoft Serial Infrared Driver;C:\WINDOWS\system32\DRIVERS\irsir.sys
    S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service;"C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe"
    S3 odserv;Microsoft Office Diagnostics Service;"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE"
    S3 usbvideo;USB Video Device (WDM);C:\WINDOWS\system32\Drivers\usbvideo.sys
    *Newly Created Service* - CATCHME
    Contents of the 'Scheduled Tasks' folder
    2007-07-29 07:53:13 C:\WINDOWS\tasks\XoftSpySE.job
    **************************************************************************
    catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2007-07-29 20:43:35
    Windows 5.1.2600 Service Pack 2 NTFS
    scanning hidden processes ...
    scanning hidden registry entries ...
    scanning hidden files ...
    scan completed successfully
    hidden files: 0
    **************************************************************************
    Completion time: 2007-07-29 20:44:10
    C:\ComboFix-quarantined-files.txt ... 2007-07-29 20:44
    --- E O F ---


    log from kas
    KASPERSKY ONLINE SCANNER REPORT
    Sunday, July 29, 2007 11:10:26 PM
    Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
    Kaspersky Online Scanner version: 5.0.93.0
    Kaspersky Anti-Virus database last update: 29/07/2007
    Kaspersky Anti-Virus database records: 369390
    Scan Settings:
    Scan using the following antivirus database: extended
    Scan Archives: true
    Scan Mail Bases: true
    Scan Target - My Computer:
    A:\
    C:\
    D:\
    E:\
    F:\
    G:\
    Scan Statistics:
    Total number of scanned objects: 49800
    Number of viruses found: 5
    Number of infected objects: 21
    Number of suspicious objects: 0
    Duration of the scan process: 02:09:04
    Infected Object Name / Virus Name / Last Action
    C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped
    C:\Documents and Settings\craig\Application Data\Microsoft\Outlook\Outlook.NK2 Object is locked skipped
    C:\Documents and Settings\craig\Application Data\Microsoft\Outlook\Outlook.srs Object is locked skipped
    C:\Documents and Settings\craig\Application Data\Microsoft\Templates\NormalEmail.dotm Object is locked skipped
    C:\Documents and Settings\craig\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\craig\Local Settings\Application Data\Ahead\Nero Home\bl.db Object is locked skipped
    C:\Documents and Settings\craig\Local Settings\Application Data\Ahead\Nero Home\is2.db Object is locked skipped
    C:\Documents and Settings\craig\Local Settings\Application Data\Identities\{0AEF60F0-9206-4BC8-8697-FB4F0B3572C1}\Microsoft\Outlook Express\Folders.dbx Object is locked skipped
    C:\Documents and Settings\craig\Local Settings\Application Data\Identities\{0AEF60F0-9206-4BC8-8697-FB4F0B3572C1}\Microsoft\Outlook Express\Offline.dbx Object is locked skipped
    C:\Documents and Settings\craig\Local Settings\Application Data\Microsoft\Outlook\archive.pst Object is locked skipped
    C:\Documents and Settings\craig\Local Settings\Application Data\Microsoft\Outlook\Outlgngnut@hotmail.com-00000002.pst Object is locked skipped
    C:\Documents and Settings\craig\Local Settings\Application Data\Microsoft\Outlook\Outlook.pst Object is locked skipped
    C:\Documents and Settings\craig\Local Settings\Application Data\Microsoft\Outlook\~archive.pst.tmp Object is locked skipped
    C:\Documents and Settings\craig\Local Settings\Application Data\Microsoft\Outlook\~Outlgngnut@hotmail.com-00000002.pst.tmp Object is locked skipped
    C:\Documents and Settings\craig\Local Settings\Application Data\Microsoft\Outlook\~Outlook.pst.tmp Object is locked skipped
    C:\Documents and Settings\craig\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\craig\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\craig\Local Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\craig\Local Settings\History\History.IE5\MSHist012007072920070730\index.dat Object is locked skipped
    C:\Documents and Settings\craig\Local Settings\Temp\~DFC572.tmp Object is locked skipped
    C:\Documents and Settings\craig\Local Settings\Temp\~DFF152.tmp Object is locked skipped
    C:\Documents and Settings\craig\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\craig\Local Settings\Temporary Internet Files\Content.Word\~WRS{E807BA66-9938-4F8C-8469-0E84B0FE14A6}.tmp Object is locked skipped
    C:\Documents and Settings\craig\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\craig\ntuser.dat.LOG Object is locked skipped
    C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
    C:\Downloads\Fantastic.Four.2 TC.avi.bc! Object is locked skipped
    C:\Downloads\Live.Free.or [Die Hard 4] 2007.DvD.XviD.Ac3-FxM\Live.Free.or [Die Hard 4] 2007.DvD.XviD.Ac3-FxM.avi.bc! Object is locked skipped
    C:\Downloads\Lost.Planet.Extreme.Condition-Unleashed\unl-lpec.r00.bc! Object is locked skipped
    C:\Downloads\Lost.Planet.Extreme.Condition-Unleashed\unl-lpec.r01.bc! Object is locked skipped
    C:\Downloads\Lost.Planet.Extreme.Condition-Unleashed\unl-lpec.r02.bc! Object is locked skipped
    C:\Downloads\Lost.Planet.Extreme.Condition-Unleashed\unl-lpec.r15.bc! Object is locked skipped
    C:\Downloads\Lost.Planet.Extreme.Condition-Unleashed\unl-lpec.r16.bc! Object is locked skipped
    C:\Downloads\Lost.Planet.Extreme.Condition-Unleashed\unl-lpec.r18.bc! Object is locked skipped
    C:\Downloads\Lost.Planet.Extreme.Condition-Unleashed\unl-lpec.r27.bc! Object is locked skipped
    C:\Downloads\Lost.Planet.Extreme.Condition-Unleashed\unl-lpec.r38.bc! Object is locked skipped
    C:\Downloads\Lost.Planet.Extreme.Condition-Unleashed\unl-lpec.r43.bc! Object is locked skipped
    C:\Downloads\Lost.Planet.Extreme.Condition-Unleashed\unl-lpec.r46.bc! Object is locked skipped
    C:\Downloads\Lost.Planet.Extreme.Condition-Unleashed\unl-lpec.r51.bc! Object is locked skipped
    C:\Downloads\Lost.Planet.Extreme.Condition-Unleashed\unl-lpec.r52.bc! Object is locked skipped
    C:\Downloads\Lost.Planet.Extreme.Condition-Unleashed\unl-lpec.r54.bc! Object is locked skipped
    C:\Downloads\Lost.Planet.Extreme.Condition-Unleashed\unl-lpec.r55.bc! Object is locked skipped
    C:\Downloads\Lost.Planet.Extreme.Condition-Unleashed\unl-lpec.r60.bc! Object is locked skipped
    C:\Downloads\Lost.Planet.Extreme.Condition-Unleashed\unl-lpec.r61.bc! Object is locked skipped
    C:\Downloads\Lost.Planet.Extreme.Condition-Unleashed\unl-lpec.r65.bc! Object is locked skipped
    C:\Downloads\Lost.Planet.Extreme.Condition-Unleashed\unl-lpec.r66.bc! Object is locked skipped
    C:\Downloads\Lost.Planet.Extreme.Condition-Unleashed\unl-lpec.r67.bc! Object is locked skipped
    C:\Downloads\Lost.Planet.Extreme.Condition-Unleashed\unl-lpec.r70.bc! Object is locked skipped
    C:\Downloads\Supreme.Commander-HATRED.(osloskop.net).iso.bc! Object is locked skipped
    C:\Downloads\www.bitreactor.to_Ghost.Recon.Advanced.Warfighter.2-SKIDROW\sr-graw2.r07.bc! Object is locked skipped
    C:\Downloads\www.bitreactor.to_Ghost.Recon.Advanced.Warfighter.2-SKIDROW\sr-graw2.r10.bc! Object is locked skipped
    C:\Downloads\www.bitreactor.to_Ghost.Recon.Advanced.Warfighter.2-SKIDROW\sr-graw2.r18.bc! Object is locked skipped
    C:\Downloads\www.bitreactor.to_Ghost.Recon.Advanced.Warfighter.2-SKIDROW\sr-graw2.r19.bc! Object is locked skipped
    C:\Downloads\www.bitreactor.to_Ghost.Recon.Advanced.Warfighter.2-SKIDROW\sr-graw2.r25.bc! Object is locked skipped
    C:\Downloads\www.bitreactor.to_Ghost.Recon.Advanced.Warfighter.2-SKIDROW\sr-graw2.r26.bc! Object is locked skipped
    C:\Downloads\www.bitreactor.to_Ghost.Recon.Advanced.Warfighter.2-SKIDROW\sr-graw2.r29.bc! Object is locked skipped
    C:\Downloads\www.bitreactor.to_Ghost.Recon.Advanced.Warfighter.2-SKIDROW\sr-graw2.r33.bc! Object is locked skipped
    C:\Downloads\www.bitreactor.to_Ghost.Recon.Advanced.Warfighter.2-SKIDROW\sr-graw2.r34.bc! Object is locked skipped
    C:\Downloads\www.bitreactor.to_Ghost.Recon.Advanced.Warfighter.2-SKIDROW\sr-graw2.r36.bc! Object is locked skipped
    C:\Downloads\www.bitreactor.to_Ghost.Recon.Advanced.Warfighter.2-SKIDROW\sr-graw2.r40.bc! Object is locked skipped
    C:\Downloads\www.bitreactor.to_Ghost.Recon.Advanced.Warfighter.2-SKIDROW\sr-graw2.r47.bc! Object is locked skipped
    C:\Downloads\www.bitreactor.to_Ghost.Recon.Advanced.Warfighter.2-SKIDROW\sr-graw2.r53.bc! Object is locked skipped
    C:\Downloads\www.bitreactor.to_Ghost.Recon.Advanced.Warfighter.2-SKIDROW\sr-graw2.r57.bc! Object is locked skipped
    C:\Downloads\www.bitreactor.to_Ghost.Recon.Advanced.Warfighter.2-SKIDROW\sr-graw2.r59.bc! Object is locked skipped
    C:\Downloads\www.bitreactor.to_Ghost.Recon.Advanced.Warfighter.2-SKIDROW\sr-graw2.r60.bc! Object is locked skipped
    C:\Downloads\www.bitreactor.to_Ghost.Recon.Advanced.Warfighter.2-SKIDROW\sr-graw2.r64.bc! Object is locked skipped
    C:\Downloads\www.bitreactor.to_Ghost.Recon.Advanced.Warfighter.2-SKIDROW\sr-graw2.r67.bc! Object is locked skipped
    C:\Downloads\www.bitreactor.to_Ghost.Recon.Advanced.Warfighter.2-SKIDROW\sr-graw2.r68.bc! Object is locked skipped
    C:\Downloads\www.bitreactor.to_Ghost.Recon.Advanced.Warfighter.2-SKIDROW\sr-graw2.rar.bc! Object is locked skipped
    C:\Program Files\RealVNC\VNC4\vncconfig.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 skipped
    C:\Program Files\RealVNC\VNC4\vncviewer.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 skipped
    C:\Program Files\RealVNC\VNC4\winvnc4.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 skipped
    C:\Program Files\RealVNC\VNC4\wm_hooks.dll Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 skipped
    C:\Program Files\Trend Micro\HijackThis\backups\backup-20070729-180435-989.dll Infected: Trojan-Downloader.Win32.Agent.avk skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\ddcawtq.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\ljjhijk.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\urqpoli.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\winbjv32.dll.vir Infected: Trojan.Win32.Dialer.qn skipped
    C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
    C:\System Volume Information\_restore{D77A4584-CCC1-4798-A350-75F6A91C624C}\RP72\A0031219.dll Infected: Trojan-Downloader.Win32.Agent.avk skipped
    C:\System Volume Information\_restore{D77A4584-CCC1-4798-A350-75F6A91C624C}\RP72\A0031258.dll Infected: Trojan.Win32.Dialer.qn skipped
    C:\System Volume Information\_restore{D77A4584-CCC1-4798-A350-75F6A91C624C}\RP76\A0033414.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped
    C:\System Volume Information\_restore{D77A4584-CCC1-4798-A350-75F6A91C624C}\RP76\A0033415.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped
    C:\System Volume Information\_restore{D77A4584-CCC1-4798-A350-75F6A91C624C}\RP76\A0033416.dll Infected: Trojan.Win32.Dialer.qn skipped
    C:\System Volume Information\_restore{D77A4584-CCC1-4798-A350-75F6A91C624C}\RP76\A0033419.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped
    C:\System Volume Information\_restore{D77A4584-CCC1-4798-A350-75F6A91C624C}\RP77\A0033642.dll Infected: Trojan-Downloader.Win32.Agent.avk skipped
    C:\System Volume Information\_restore{D77A4584-CCC1-4798-A350-75F6A91C624C}\RP78\change.log Object is locked skipped
    C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
    C:\WINDOWS\Internet Logs\fwdbglog.txt Object is locked skipped
    C:\WINDOWS\Internet Logs\fwpktlog.txt Object is locked skipped
    C:\WINDOWS\Internet Logs\IAMDB.RDB Object is locked skipped
    C:\WINDOWS\Internet Logs\PERSONAL-2933EB.ldb Object is locked skipped
    C:\WINDOWS\Internet Logs\tvDebug.log Object is locked skipped
    C:\WINDOWS\SchedLgU.Txt Object is locked skipped
    C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
    C:\WINDOWS\Sti_Trace.log Object is locked skipped
    C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
    C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
    C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\default Object is locked skipped
    C:\WINDOWS\system32\config\default.LOG Object is locked skipped
    C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
    C:\WINDOWS\system32\config\ODiag.evt Object is locked skipped
    C:\WINDOWS\system32\config\OSession.evt Object is locked skipped
    C:\WINDOWS\system32\config\SAM Object is locked skipped
    C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\SECURITY Object is locked skipped
    C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
    C:\WINDOWS\system32\config\software Object is locked skipped
    C:\WINDOWS\system32\config\software.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\system Object is locked skipped
    C:\WINDOWS\system32\config\system.LOG Object is locked skipped
    C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped
    C:\WINDOWS\system32\h323log.txt Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
    C:\WINDOWS\Temp\ZLT0286b.TMP Object is locked skipped
    C:\WINDOWS\Temp\ZLT03689.TMP Object is locked skipped
    C:\WINDOWS\wiadebug.log Object is locked skipped
    C:\WINDOWS\wiaservc.log Object is locked skipped
    C:\WINDOWS\WindowsUpdate.log Object is locked skipped
    D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
    D:\System Volume Information\_restore{D77A4584-CCC1-4798-A350-75F6A91C624C}\RP78\change.log Object is locked skipped
    E:\My Documents\My Received Files\vnc-3.3.7-x86_win32.zip/vnc-3.3.7-x86_win32.exe/data0002 Infected: not-a-virus:RemoteAdmin.Win32.WinVNC-based.c skipped
    E:\My Documents\My Received Files\vnc-3.3.7-x86_win32.zip/vnc-3.3.7-x86_win32.exe/data0003 Infected: not-a-virus:RemoteAdmin.Win32.WinVNC-based.c skipped
    E:\My Documents\My Received Files\vnc-3.3.7-x86_win32.zip/vnc-3.3.7-x86_win32.exe/data0004 Infected: not-a-virus:RemoteAdmin.Win32.WinVNC-based.c skipped
    E:\My Documents\My Received Files\vnc-3.3.7-x86_win32.zip/vnc-3.3.7-x86_win32.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC-based.c skipped
    E:\My Documents\My Received Files\vnc-3.3.7-x86_win32.zip ZIP: infected - 4 skipped
    E:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
    E:\System Volume Information\_restore{D77A4584-CCC1-4798-A350-75F6A91C624C}\RP78\change.log Object is locked skipped
    Scan process completed.

    i hope its worth the wait 3 and 1/2 hours lmgao
    :):)

    many thanks craig
  • peku006
    edited July 2007
    Hi GNGNUT
    Looks much better, Is problem away ?

    Please delete this folder:

    C:\QooBox
    • Run HijackThis
    • Click on the Scan button
    • Put a check beside all of the items listed below (if present):

      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
    • Close all open windows and browsers/email, etc...
    • Click on the "Fix Checked" button
    • When completed, close the application.
    Update Java
    Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.
    • Download the latest version of Java Runtime Environment (JRE) 6u2.
    • Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications".
    • Click the "Download" button to the right.
    • Check the box that says: "Accept License Agreement".
    • The page will refresh.
    • Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
    • Close any programs you may have running - especially your web browser.
    • Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
    • Check any item with Java Runtime Environment (JRE or J2SE) in the name.
    • Click the Remove or Change/Remove button.
    • Repeat as many times as necessary to remove each Java versions.
    • Reboot your computer once all Java components are removed.
    • Then from your desktop double-click on the download to install the newest version.
    Please, post a fresh hjT log
  • GNGNUT
    edited July 2007
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 21:46:40, on 30/07/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal
    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\RealVNC\VNC4\WinVNC4.exe
    C:\Program Files\DynDNS Updater\DynDNS.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\WINDOWS\system32\RunDLL32.exe
    C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\Program Files\BitComet\BitComet.exe
    C:\WINDOWS\system32\msiexec.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.6.14.dll
    O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O3 - Toolbar: ImageShack Toolbar - {6932D140-ABC4-4073-A44C-D4A541665E35} - C:\WINDOWS\ImageShackToolbar\ImageShackToolbar.dll
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
    O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
    O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
    O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
    O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll
    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
    O16 - DPF: {6932D140-ABC4-4073-A44C-D4A541665E35} (ImageShack Toolbar) - http://toolbar.imageshack.us/toolbar/ImageShackToolbar.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{7D4FED7B-F305-43D3-939A-D38C350A00F1}: NameServer = 62.24.252.135 62.24.252.134
    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    O23 - Service: DynDNS Updater Service (DynDNS_Updater_Service) - Kana Solution - C:\Program Files\DynDNS Updater\DynDNS.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe (file missing)
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe
    --
    End of file - 6799 bytes

    many thanks
    gngnut
  • peku006
    edited July 2007
    Hi GNGNUT
    Congratulations, your log looks clean!

    Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:
    • Disable and Enable System Restore. - If you are using Windows ME or XP then you should disable and re-enable system restore to make sure there are no infected files found in a restore point.
      You can find instructions on how to enable and reenable system restore here:

      Windows XP System Restore Guide
    Reenable system restore with instructions from tutorial above
    • Make your Internet Explorer more secure - This can be done by following these simple instructions:
    • From within Internet Explorer click on the Tools menu and then click on Options.
    • Click once on the Security tab
    • Click once on the Internet icon so it becomes highlighted.
    • Click once on the Custom Level button.
    • Change the Download signed ActiveX controls to Prompt
    • Change the Download unsigned ActiveX controls to Disable
    • Change the Initialize and script ActiveX controls not marked as safe to Disable
    • Change the Installation of desktop items to Prompt
    • Change the Launching programs and files in an IFRAME to Prompt
    • Change the Navigate sub-frames across different domains to Prompt
    • When all these settings have been made, click on the OK button.
    • If it prompts you as to whether or not you want to save the settings, press the Yes button.
    • Next press the Apply button and then the OK to exit the Internet Properties page.
    • Use an AntiVirus Software - It is very important that your computer has an anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future.
    See this link for a listing of some online & their stand-alone antivirus programs:
    Virus, Spyware, and Malware Protection and Removal Resources
    • Update your AntiVirus Software - It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
    • Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is succeptible to being hacked and taken over. I am very serious about this and see it happen almost every day with my clients. Simply using a Firewall in its default configuration can lower your risk greatly.
      For a tutorial on Firewalls and a listing of some available ones see the link below:
      Understanding and Using Firewalls
    • Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
    • Install Ad-Aware - Install and download Ad-Aware. ou should also scan your computer with program on a regular basis just as you would an antivirus software in conjunction with Spybot.
      A tutorial on installing & using this product can be found here:
      Using Ad-aware to remove Spyware, Malware, & Hijackers from Your Computer
    • Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option.
      This will provide real-time spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an anti virus software. A tutorial on installing & using this product can be found here:
      Instructions for - Spybot S & D and Ad-aware
    • Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.
      A tutorial on installing & using this product can be found here:
      Using SpywareBlaster to protect your computer from Spyware and Malware
    • Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.
    Follow this list and your potential for being infected again will reduce dramatically.
    Here are some additional utilities that will enhance your safety
    • IE/Spyad <= IE/Spyad places over 4000 websites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites.
    • MVPS Hosts file <= The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your coputer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer
    • Google Toolbar <= Get the free google toolbar to help stop pop up windows.
    • Comodo BOCLEAN <= Stop identity thieves from getting personal information. Instantly detects well over 1,000,000 unique, variant and repack malware in total. And it's free.
    • Winpatrol <= Download and install the free version of Winpatrol. a tutorial for this product is located here:
      Using Winpatrol to protect your computer from malicious software
    Stand Up and Be Counted ---> Malware Complaints <--- where you can make difference!
    The site offers people who have been (or are) victims of malware the opportunity to document their story and, in that way, launch a complaint against the malware and the makers of the malware.
    Also, please read this great article by Tony Klein So How Did I Get Infected In First Place
    Happy surfing and stay clean!
  • GNGNUT
    edited July 2007
    thanks you so much peku006 for all the help and advice you have givin me to get me though the problems i haved

    on my system i have
    AVG
    ad wear 2007
    xoftspy
    zone alarm

    are these products any good in you opinion
    again many thanks
    gngnut
  • peku006
    edited July 2007
    Hi GNGNUT

    Yes,
    I have AVG and ZoneAlarm on my system
    ( free for personal use)
  • peku006
    edited July 2007

    Glad I could be of assistance! The help you received here was free. Please read through some of these Prevention Tips that Short-Media offers.

    This topic is now closed. If you wish it reopened, please send a Private Message (PM) to one of the Spyware Mods with a link to your thread.

    Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required.

    If you are not the user who started this thread, you must start a new Thread instead :)

    Would you also be interested to join Short-Media (Team #93) with the Folding@Home Project? More information available here
Sign In or Register to comment.