How to get rid of zedo popups

Unknown
edited October 2007 in Spyware & Virus Removal
I got spyware doctor, popups blockers nothing seems to get rid of these annoying popups. Please help to exam my hjt log and tell me what to do.


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:04:17 AM, on 8/29/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
C:\PROGRA~1\Yahoo!\YOP\yop.exe
C:\Program Files\Yahoo!\Antivirus\CAVTray.exe
C:\Program Files\Yahoo!\Antivirus\CAVRID.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\WINDOWS\plite731.exe
C:\Program Files\Messenger\rygovap22011.exe
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\Program Files\Yahoo!\Antivirus\ISafe.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Yahoo!\browser\ybrowser.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Documents and Settings\Eric\Desktop\HiJackThis(2).exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ie/defaults/sb/sbcydsl/*http://www.yahoo.com/search/ie.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Yahoo!
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {57D6708C-88E2-4CAB-9FA4-78BB8CA3A3C4} - C:\WINDOWS\system32\tuvuvut.dll (file missing)
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [YBrowser] C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [YOP] C:\PROGRA~1\Yahoo!\YOP\yop.exe /autostart
O4 - HKLM\..\Run: [CaAvTray] "C:\Program Files\Yahoo!\Antivirus\CAVTray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\Yahoo!\Antivirus\CAVRID.exe"
O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [YPC] C:\PROGRA~1\Yahoo!\PARENT~1\ypc.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [{9C-C0-06-65-ZN}] c:\windows\system32\dwdsregt.exe CHD003
O4 - HKLM\..\Run: [plite731] C:\WINDOWS\plite731.exe
O4 - HKLM\..\Run: [rygovap] C:\Program Files\Messenger\rygovap22011.exe
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKLM\..\Run: [{ZN}] C:\WINDOWS\TISKY002.exe SKY002
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: AT&T Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper2007261.dll
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo.com/ocx/us/yexplorer1_9us.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O20 - Winlogon Notify: tuvuvut - tuvuvut.dll (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\ISafe.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: Spyware Doctor Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE
--
End of file - 7941 bytes

Comments

  • NuppiNuppi South Ostrobothnia (Finland)
    edited August 2007
    Hi bunja,

    And welcome to icrontic :D


    Please Download ComboFix from Here or Here to your Desktop.
    • Double click combofix.exe and follow the prompts.
    • When finished, it shall produce a log for you. Post that log and a HiJackthis log in your next reply
    Note: Do not mouseclick combofix's window while its running. That may cause it to stall
  • bunja
    edited August 2007
    Hello Nuppi,

    Thanks for such great website, full with lots of great info. I wanted to say I am greatly appreciate your help. I did exactly what you said and below is ComboFix and HiJackThis log files. By the way, I'll be away from the pc for a few days. I won't be able to response right away. Please just post what I need to do next, I'll do it when I get back.

    Thanks again.
    bunja

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 10:42:50 PM, on 8/30/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16512)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\SpywareBot\SpywareBotSrv.srv.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Yahoo!\Antivirus\ISafe.exe
    C:\WINDOWS\system32\CTsvcCDA.EXE
    C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    C:\Program Files\Spyware Doctor\svcntaux.exe
    C:\Program Files\Spyware Doctor\swdsvc.exe
    C:\WINDOWS\system32\wdfmgr.exe
    C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
    C:\WINDOWS\system32\MsPMSPSv.exe
    C:\WINDOWS\System32\alg.exe
    C:\WINDOWS\Explorer.EXE
    C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
    C:\PROGRA~1\Yahoo!\YOP\yop.exe
    C:\Program Files\Yahoo!\Antivirus\CAVTray.exe
    C:\Program Files\Yahoo!\Antivirus\CAVRID.exe
    C:\WINDOWS\system32\Rundll32.exe
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
    C:\WINDOWS\system32\dla\tfswctrl.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\WINDOWS\plite731.exe
    C:\Program Files\Spyware Doctor\SDTrayApp.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Google\Google Updater\GoogleUpdater.exe
    C:\WINDOWS\System32\svchost.exe
    C:\PROGRA~1\Yahoo!\browser\ycommon.exe
    C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
    C:\WINDOWS\system32\notepad.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Documents and Settings\Eric\Desktop\HiJackThis(2).exe
    C:\WINDOWS\system32\wbem\wmiprvse.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ie/defaults/sb/sbcydsl/*http://www.yahoo.com/search/ie.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
    O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O4 - HKLM\..\Run: [YBrowser] C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
    O4 - HKLM\..\Run: [YOP] C:\PROGRA~1\Yahoo!\YOP\yop.exe /autostart
    O4 - HKLM\..\Run: [CaAvTray] "C:\Program Files\Yahoo!\Antivirus\CAVTray.exe"
    O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\Yahoo!\Antivirus\CAVRID.exe"
    O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
    O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
    O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
    O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
    O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
    O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
    O4 - HKLM\..\Run: [YPC] C:\PROGRA~1\Yahoo!\PARENT~1\ypc.exe
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [{9C-C0-06-65-ZN}] c:\windows\system32\dwdsregt.exe CHD003
    O4 - HKLM\..\Run: [plite731] C:\WINDOWS\plite731.exe
    O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
    O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [SpywareBot] C:\Program Files\SpywareBot\SpywareBot.exe -boot
    O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
    O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
    O9 - Extra button: AT&T Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper2007261.dll
    O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo.com/ocx/us/yexplorer1_9us.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O20 - Winlogon Notify: tuvuvut - tuvuvut.dll (file missing)
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\ISafe.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
    O23 - Service: Spyware Doctor Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
    O23 - Service: SpywareBot Scanning Engine (SpywareBotSrv) - Unknown owner - C:\Program Files\SpywareBot\SpywareBotSrv.srv.exe
    O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
    O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE

    --
    End of file - 7729 bytes



    ComboFix 07-08-30.3 - "Eric" 2007-08-30 22:25:46.1 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1593 [GMT -7:00]
    * Created a new restore point


    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


    C:\Program Files\Messenger\rygovap22011.exe
    C:\Temp\1cb
    C:\Temp\1cb\syscheck.log
    C:\Temp\fse
    C:\Temp\fse\tmpZTF.log
    C:\WINDOWS\system32\_000110_.tmp.dll
    C:\WINDOWS\system32\f02WtR
    C:\WINDOWS\system32\winpfz32.sys


    ((((((((((((((((((((((((( Files Created from 2007-07-28 to 2007-08-31 )))))))))))))))))))))))))))))))


    2007-08-30 22:23 51,200 --a
    C:\WINDOWS\nircmd.exe
    2007-08-29 01:18 18,672 --a
    C:\WINDOWS\system32\drivers\antispyfilter.sys
    2007-08-29 01:18 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
    2007-08-29 01:18 <DIR> d
    C:\Program Files\SpywareBot
    2007-08-29 01:18 <DIR> d
    C:\DOCUME~1\Eric\APPLIC~1\SpywareBot
    2007-08-29 00:27 <DIR> d
    C:\DOCUME~1\Eric\APPLIC~1\Talkback
    2007-08-24 12:42 83,024 --a
    C:\WINDOWS\system32\drivers\iksyssec.sys
    2007-08-24 12:42 57,424 --a
    C:\WINDOWS\system32\drivers\iksysflt.sys
    2007-08-24 12:42 53,840 --a
    C:\WINDOWS\system32\drivers\ikfilesec.sys
    2007-08-24 12:42 39,376 --a
    C:\WINDOWS\system32\drivers\ikfileflt.sys
    2007-08-24 12:42 29,264 --a
    C:\WINDOWS\system32\drivers\kcom.sys
    2007-08-24 12:42 <DIR> d
    C:\Program Files\Spyware Doctor
    2007-08-21 22:05 <DIR> d
    C:\DOCUME~1\ALLUSE~1\APPLIC~1\PC Tools
    2007-08-20 17:16 192,622 --a
    C:\WINDOWS\system32\swinqmdt.exe
    2007-08-16 14:33 49,152 --a
    C:\WINDOWS\TISKY002.exe
    2007-08-16 14:33 41 --a
    C:\WINDOWS\plite731_uninstaller_.bat
    2007-08-16 14:33 13,824 --a
    C:\WINDOWS\plite731.exe
    2007-08-16 14:33 <DIR> d
    C:\WINDOWS\system32\syschks22
    2007-08-16 14:33 <DIR> d
    C:\WINDOWS\system32\SS1
    2007-08-16 14:33 <DIR> d
    C:\WINDOWS\system32\ICM2
    2007-08-16 14:33 <DIR> d
    C:\WINDOWS\system32\chkfig5
    2007-08-15 12:04 <DIR> d
    C:\DOCUME~1\Andrew\APPLIC~1\Yahoo!
    2007-08-15 12:03 <DIR> d
    C:\DOCUME~1\Andrew\APPLIC~1\Real
    2007-08-02 22:59 <DIR> d
    C:\DOCUME~1\Kaelin\APPLIC~1\Sonic
    2007-08-02 22:58 <DIR> d
    C:\DOCUME~1\Kaelin\APPLIC~1\Real
    2007-08-02 22:25 <DIR> d
    C:\DOCUME~1\Mason\APPLIC~1\Real
    2007-07-27 18:02 <DIR> d
    C:\WINDOWS\CAVTemp
    2007-07-21 00:09 <DIR> d
    C:\DOCUME~1\Eric\APPLIC~1\Google
    2007-07-21 00:07 <DIR> d
    C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google Updater
    2007-07-20 23:33 626,688 --a
    C:\WINDOWS\system32\msvcr80.dll
    2007-07-20 23:33 <DIR> d
    C:\DOCUME~1\Eric\APPLIC~1\PC Tools
    2007-07-20 23:32 <DIR> d
    C:\Program Files\Real
    2007-07-20 23:32 <DIR> d
    C:\Program Files\Common Files\xing shared
    2007-07-20 23:32 <DIR> d
    C:\Program Files\Common Files\Real
    2007-07-20 23:32 <DIR> d
    C:\DOCUME~1\Eric\APPLIC~1\Real
    2007-07-20 23:30 <DIR> d
    C:\Program Files\Google
    2007-07-20 23:11 <DIR> d
    C:\DOCUME~1\Eric\APPLIC~1\WinRAR
    2007-07-16 22:55 <DIR> d
    C:\DOCUME~1\Andrew\APPLIC~1\Sonic
    2007-07-13 09:34 <DIR> d
    C:\DOCUME~1\Eric\APPLIC~1\Sonic
    2007-07-13 09:31 <DIR> d
    C:\DOCUME~1\Mason\APPLIC~1\Sonic
    2007-07-12 22:12 <DIR> d
    C:\Program Files\Common Files\Sonic
    2007-07-12 22:11 108,544 --a
    C:\WINDOWS\system32\pxcpyi64.exe
    2007-07-12 22:11 104,960 --a
    C:\WINDOWS\system32\pxinsi64.exe
    2007-07-12 22:10 98,358 --a
    C:\WINDOWS\dla.exe
    2007-07-12 22:10 87,136 --a
    C:\WINDOWS\system32\drivers\drvmcdb.sys
    2007-07-12 22:10 61,498 --a
    C:\WINDOWS\system32\tfswapi.dll
    2007-07-12 22:10 5,627 --a
    C:\WINDOWS\system32\drivers\sscdbhk5.sys
    2007-07-12 22:10 40,544 --a
    C:\WINDOWS\system32\drivers\drvnddm.sys
    2007-07-12 22:10 23,545 --a
    C:\WINDOWS\system32\drivers\ssrtln.sys
    2007-07-12 22:10 <DIR> d
    C:\WINDOWS\system32\dla
    2007-07-12 22:10 <DIR> d
    C:\Program Files\Sonic
    2007-07-12 22:10 <DIR> d
    C:\Program Files\Common Files\Sonic Shared
    2007-07-12 22:08 <DIR> d
    C:\Program Files\CyberLink
    2007-07-10 23:05 <DIR> d
    C:\Program Files\PokerStars
    2007-07-10 11:12 <DIR> d
    C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo! Companion
    2007-07-05 22:38 <DIR> d
    C:\Program Files\Common Files\NSV
    2007-07-05 22:33 <DIR> d
    C:\Program Files\Winamp


    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

    2007-08-26 15:54
    d
    C:\DOCUME~1\Kaelin\APPLIC~1\Yahoo!
    2007-08-24 22:45
    dr-h
    C:\DOCUME~1\Eric\APPLIC~1\yahoo!
    2007-08-20 08:58
    d
    C:\DOCUME~1\Mason\APPLIC~1\Yahoo!
    2007-08-19 20:46
    d
    C:\Program Files\Yahoo!
    2007-08-15 13:24 6648 --a
    C:\DOCUME~1\ALLUSE~1\APPLIC~1\ypinfo.bin
    2007-07-30 19:19 92504 --a
    C:\WINDOWS\system32\cdm.dll
    2007-07-30 19:19 549720 --a
    C:\WINDOWS\system32\wuapi.dll
    2007-07-30 19:19 53080 --a
    C:\WINDOWS\system32\wuauclt.exe
    2007-07-30 19:19 43352 --a
    C:\WINDOWS\system32\wups2.dll
    2007-07-30 19:19 325976 --a
    C:\WINDOWS\system32\wucltui.dll
    2007-07-30 19:19 203096 --a
    C:\WINDOWS\system32\wuweb.dll
    2007-07-30 19:19 1712984 --a
    C:\WINDOWS\system32\wuaueng.dll
    2007-07-30 19:18 33624 --a
    C:\WINDOWS\system32\wups.dll
    2007-07-23 11:00 879832 --a
    C:\WINDOWS\system32\drivers\VetEFile.sys
    2007-07-23 11:00 108360 --a
    C:\WINDOWS\system32\drivers\VetEBoot.sys
    2007-07-12 22:08
    d--h
    C:\Program Files\InstallShield Installation Information
    2007-06-30 00:16
    d
    C:\Program Files\ATI Technologies
    2007-06-29 23:30
    d
    C:\DOCUME~1\ALLUSE~1\APPLIC~1\yahoo!
    2007-06-29 23:15
    d
    C:\Program Files\Intel
    2007-06-29 21:17
    d
    C:\Program Files\Creative
    2007-06-29 19:45
    d
    C:\DOCUME~1\Eric\APPLIC~1\Motive
    2007-06-29 19:32 74864 --a
    C:\WINDOWS\system32\VetRedir.dll
    2007-06-29 19:32 26787 --a
    C:\WINDOWS\system32\drivers\vetmonnt.sys
    2007-06-29 19:32 21031 --a
    C:\WINDOWS\system32\drivers\Vet-Filt.sys
    2007-06-29 19:32 15735 --a
    C:\WINDOWS\system32\drivers\VetFDDNT.sys
    2007-06-29 19:32 15478 --a
    C:\WINDOWS\system32\drivers\Vet-Rec.sys
    2007-06-29 19:32 115824 --a
    C:\WINDOWS\UnVet32.exe
    2007-06-29 19:32 111728 --a
    C:\WINDOWS\AVShlExt.dll
    2007-06-29 19:32
    d
    C:\Program Files\Common Files\Scanner
    2007-06-29 19:32
    d
    C:\DOCUME~1\ALLUSE~1\APPLIC~1\CA
    2007-06-29 19:15
    d
    C:\Program Files\SBC
    2007-06-29 19:14
    d
    C:\Program Files\SBC Yahoo!
    2007-06-29 19:01
    d
    C:\Program Files\Common Files\InstallShield
    2007-06-29 19:01
    d
    C:\Program Files\Broadcom
    2007-06-29 02:00
    d
    C:\Program Files\microsoft frontpage
    2007-06-25 23:08 1104896 --a
    C:\WINDOWS\system32\msxml3.dll
    2007-06-19 06:31 282112 --a
    C:\WINDOWS\system32\gdi32.dll
    2007-06-13 03:23 1033216 --a
    C:\WINDOWS\explorer.exe


    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


    *Note* empty entries & legit default entries are not shown

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "YBrowser"="C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe" [2006-07-21 16:19]
    "YOP"="C:\PROGRA~1\Yahoo!\YOP\yop.exe" [2006-07-21 10:43]
    "CaAvTray"="C:\Program Files\Yahoo!\Antivirus\CAVTray.exe" [2007-06-29 19:32]
    "CAVRID"="C:\Program Files\Yahoo!\Antivirus\CAVRID.exe" [2007-06-29 19:32]
    "P17Helper"="P17.dll" [2004-06-10 09:51 C:\WINDOWS\system32\P17.dll]
    "UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 01:00]
    "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-05 21:05]
    "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-05-14 15:22]
    "DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-10-12 16:54]
    "dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-08-13 01:05]
    "UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2004-01-07 01:01]
    "YPC"="C:\PROGRA~1\Yahoo!\PARENT~1\ypc.exe" [2005-02-11 18:14]
    "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-07-20 23:32]
    "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
    "{9C-C0-06-65-ZN}"="c:\windows\system32\dwdsregt.exe" []
    "plite731"="C:\WINDOWS\plite731.exe" [2007-08-16 14:33]
    "SDTray"="C:\Program Files\Spyware Doctor\SDTrayApp.exe" [2007-05-29 15:41]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [2007-06-07 14:08]
    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-12 06:56]
    "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-21 00:07]
    "SpywareBot"="C:\Program Files\SpywareBot\SpywareBot.exe" [2007-08-10 13:08]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tuvuvut]
    tuvuvut.dll

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice"

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice"

    R1 AntiSpyFilter;AntiSpyFilter;C:\WINDOWS\system32\DRIVERS\antispyfilter.sys
    R2 SpywareBotSrv;SpywareBot Scanning Engine;"C:\Program Files\SpywareBot\SpywareBotSrv.srv.exe"
    R3 P17;Sound Blaster Live! 24-bit;C:\WINDOWS\system32\drivers\P17.sys

    *Newly Created Service* - HTTPFILTER

    Contents of the 'Scheduled Tasks' folder
    2007-08-31 05:34:21 C:\WINDOWS\Tasks\SpywareBot Scheduled Scan.job - C:\Program Files\SpywareBot\SpywareBot.exe

    **************************************************************************

    catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2007-08-30 22:34:13
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************

    Completion time: 2007-08-30 22:39:20 - machine was rebooted
    C:\ComboFix-quarantined-files.txt ... 2007-08-30 22:39

    --- E O F ---
  • bunja
    edited August 2007
    Hi Nuppi,

    I just downloaded ad-aware 2007 and did a scan on my pc, here the latest HiJackThis log.
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 12:20:32 AM, on 8/31/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16512)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Yahoo!\Antivirus\ISafe.exe
    C:\WINDOWS\system32\CTsvcCDA.EXE
    C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    C:\WINDOWS\system32\wdfmgr.exe
    C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
    C:\WINDOWS\system32\MsPMSPSv.exe
    C:\PROGRA~1\Yahoo!\YOP\yop.exe
    C:\Program Files\Yahoo!\Antivirus\CAVTray.exe
    C:\Program Files\Yahoo!\Antivirus\CAVRID.exe
    C:\WINDOWS\system32\Rundll32.exe
    C:\PROGRA~1\Yahoo!\browser\ycommon.exe
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
    C:\WINDOWS\system32\dla\tfswctrl.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\WINDOWS\plite731.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
    C:\Program Files\Google\Google Updater\GoogleUpdater.exe
    C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
    C:\WINDOWS\System32\alg.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Spyware Doctor\swdsvc.exe
    C:\Program Files\Spyware Doctor\SDTrayApp.exe
    C:\Program Files\Spyware Doctor\svcntaux.exe
    C:\Documents and Settings\Eric\Desktop\AntiVirus\HiJackThis(2).exe
    C:\WINDOWS\system32\wbem\wmiprvse.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ie/defaults/sb/sbcydsl/*http://www.yahoo.com/search/ie.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
    O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O4 - HKLM\..\Run: [YBrowser] C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
    O4 - HKLM\..\Run: [YOP] C:\PROGRA~1\Yahoo!\YOP\yop.exe /autostart
    O4 - HKLM\..\Run: [CaAvTray] "C:\Program Files\Yahoo!\Antivirus\CAVTray.exe"
    O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\Yahoo!\Antivirus\CAVRID.exe"
    O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
    O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
    O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
    O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
    O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
    O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
    O4 - HKLM\..\Run: [YPC] C:\PROGRA~1\Yahoo!\PARENT~1\ypc.exe
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [{9C-C0-06-65-ZN}] c:\windows\system32\dwdsregt.exe CHD003
    O4 - HKLM\..\Run: [plite731] C:\WINDOWS\plite731.exe
    O4 - HKLM\..\Run: [AAWTray] C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
    O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
    O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
    O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
    O9 - Extra button: AT&T Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper2007261.dll
    O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo.com/ocx/us/yexplorer1_9us.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O20 - Winlogon Notify: tuvuvut - tuvuvut.dll (file missing)
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\ISafe.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
    O23 - Service: Spyware Doctor Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
    O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
    O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE

    --
    End of file - 7713 bytes



    Thanks
  • NuppiNuppi South Ostrobothnia (Finland)
    edited August 2007
    Hi,

    Download ATF-Cleaner by Atribune to your desktop.

    Do not run it yet.

    Run ATF Cleaner Under Main choose: Select All
    Click the Empty Selected button.

    If you use Firefox browser Click Firefox at the top and choose: Select All
    Click the Empty Selected button.
    NOTE: If you would like to keep your saved passwords, please click No at the prompt.

    If you use Opera browser Click Opera at the top and choose: Select All
    Click the Empty Selected button.
    NOTE: If you would like to keep your saved passwords, please click No at the prompt.

    Click Exit on the Main menu to close the program.



    Please download AVG Anti-Spyware to your Desktop or to your usual Download Folder.
    http://www.ewido.net/en/download/
    • Install AVG Anti-Spyware by double clicking the installer.
    • Follow the prompts. Make sure that Launch AVG Anti-Spyware is checked.
    • On the main screen under Your Computer's security.
      • Click on Change state next to Resident shield. It should now change to inactive.
      • Click on Change state next to Automatic updates. It should now change to inactive.
      • Next to Last Update, click on Update now. (You will need an active internet connection to perform this)
      • Wait until you see the Update succesfull message.
    • Right-click the AVG Anti-Spyware Tray Icon and uncheck Start with Windows.
    • Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.
    If you are having problems with the updater, you can use this link to manually update ewido.
    AVG Anti-Spyware manual updates.
    Download the Full database to your Desktop or to your usual Download Folder and install it by double clicking the file. Make sure that AVG Anti-Spyware is closed before installing the update.


    Please Open Notepad and copy and paste quote boxes text:
    File::
    c:\windows\system32\dwdsregt.exe
    C:\WINDOWS\TISKY002.exe
    C:\WINDOWS\plite731_uninstaller_.bat
    C:\WINDOWS\plite731.exe

    Registry::
    [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tuvuvut]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
    "{9C-C0-06-65-ZN}"=-
    "plite731"=-

    Save to nameCFScript

    Then drag and drop CFScript to ComboFix.exe As shows below.

    CFScript.gif

    Combofix will start to reming and scanning

    Note: Do not mouseclick combofix's window while its running. That may cause it to stall


    Reboot your computer in Safe Mode.
    • If the computer is running, shut down Windows, and then turn off the power.
    • Wait 30 seconds, and then turn the computer on.
    • Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
    • Ensure that the Safe Mode option is selected.
    • Press Enter. The computer then begins to start in Safe mode.
    • Login on your usual account.
    Once in Safe Mode:

    Close ALL open Windows / Programs / Folders. Please start AVG Anti-Spyware and run a full scan.
    • Click on Scanner on the toolbar.
    • Click on the Settings tab.
      • Under How to act?
        • Click on Recommended Action and choose Quarantine from the popup menu.
      • Under How to scan?
        • All checkboxes should be ticked.
      • Under Possibly unwanted software:
        • All checkboxes should be ticked.
      • Under Reports:
        • DEselect Automatically generate report after every scan and uncheck Only if threats were found.
      • Under What to scan?
        • Select Scan every file.
    • Click on the Scan tab.
    • Click on Complete System Scan to start the scan process.
    • Let the program scan the machine.
    • When the scan has finished, follow the instructions below.
      IMPORTANT : Don't click on the "Save Scan Report" button before you did hit the "Apply all Actions" button.
      • Make sure that Set all elements to: shows Quarantine (1), if not click on the link and choose Quarantine from the popup menu. (2)
      • At the bottom of the window click on the Apply all Actions button. (3)
        scanavgjk2.jpg
    • When done, click the Save Scan Report button. (4)
      • Click the Save Report as button.
      • Save the report to your Desktop.
    • Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.
    Reboot back into Normal Mode, and post a new HJT log, along with the AVG Anti-Spyware report.

    Send contens off combofix.txt file to responce.
    Send a fresh hijackthis log too :D
  • bunja
    edited September 2007
    Hi Nuppi,

    I did everything except The following, which I couldn't figure it out:

    If you use Firefox browser Click Firefox at the top and choose: Select All
    Click the Empty Selected button.
    NOTE: If you would like to keep your saved passwords, please click No at the prompt.

    I am using Mozilla Firefox v 2.0.06..where is select all at the top??

    By the way, I attached below all the logs that you need:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 10:12:44 PM, on 9/4/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16512)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Program Files\Yahoo!\Antivirus\ISafe.exe
    C:\WINDOWS\system32\CTsvcCDA.EXE
    C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    C:\Program Files\Spyware Doctor\svcntaux.exe
    C:\Program Files\Spyware Doctor\swdsvc.exe
    C:\WINDOWS\system32\wdfmgr.exe
    C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
    C:\WINDOWS\system32\MsPMSPSv.exe
    C:\WINDOWS\System32\alg.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\Explorer.EXE
    C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
    C:\PROGRA~1\Yahoo!\YOP\yop.exe
    C:\Program Files\Yahoo!\Antivirus\CAVTray.exe
    C:\Program Files\Yahoo!\Antivirus\CAVRID.exe
    C:\WINDOWS\system32\Rundll32.exe
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
    C:\WINDOWS\system32\dla\tfswctrl.exe
    C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
    C:\Program Files\Spyware Doctor\SDTrayApp.exe
    C:\PROGRA~1\Yahoo!\browser\ycommon.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Google\Google Updater\GoogleUpdater.exe
    C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
    C:\Program Files\Windows NT\Accessories\WORDPAD.EXE
    C:\Documents and Settings\Eric\Desktop\AntiVirus\HiJackThis(2).exe
    C:\WINDOWS\system32\wbem\wmiprvse.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ie/defaults/sb/sbcydsl/*http://www.yahoo.com/search/ie.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
    O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O4 - HKLM\..\Run: [YBrowser] C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
    O4 - HKLM\..\Run: [YOP] C:\PROGRA~1\Yahoo!\YOP\yop.exe /autostart
    O4 - HKLM\..\Run: [CaAvTray] "C:\Program Files\Yahoo!\Antivirus\CAVTray.exe"
    O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\Yahoo!\Antivirus\CAVRID.exe"
    O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
    O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
    O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
    O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
    O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
    O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
    O4 - HKLM\..\Run: [YPC] C:\PROGRA~1\Yahoo!\PARENT~1\ypc.exe
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [{9C-C0-06-65-ZN}] c:\windows\system32\dwdsregt.exe CHD003
    O4 - HKLM\..\Run: [plite731] C:\WINDOWS\plite731.exe
    O4 - HKLM\..\Run: [AAWTray] C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
    O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
    O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
    O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
    O9 - Extra button: AT&T Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper2007261.dll
    O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo.com/ocx/us/yexplorer1_9us.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\ISafe.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
    O23 - Service: Spyware Doctor Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
    O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
    O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE

    --
    End of file - 8002 bytes

    ComboFix Log:
    ComboFix 07-08-30.3 - "Eric" 2007-09-04 21:26:56.2 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1552 [GMT -7:00]
    Command switches used :: C:\Documents and Settings\Eric\Desktop\AntiVirus\CFScript.txt
    * Created a new restore point

    FILE::
    c:\windows\system32\dwdsregt.exe
    C:\WINDOWS\TISKY002.exe
    C:\WINDOWS\plite731_uninstaller_.bat
    C:\WINDOWS\plite731.exe


    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


    C:\WINDOWS\plite731.exe
    C:\WINDOWS\plite731_uninstaller_.bat
    C:\WINDOWS\TISKY002.exe


    ((((((((((((((((((((((((( Files Created from 2007-08-05 to 2007-09-05 )))))))))))))))))))))))))))))))


    2007-09-04 21:14 10,872 --a
    C:\WINDOWS\system32\drivers\AvgAsCln.sys
    2007-08-31 00:57 83,024 --a
    C:\WINDOWS\system32\drivers\iksyssec.sys
    2007-08-31 00:57 57,424 --a
    C:\WINDOWS\system32\drivers\iksysflt.sys
    2007-08-31 00:57 53,840 --a
    C:\WINDOWS\system32\drivers\ikfilesec.sys
    2007-08-31 00:57 39,376 --a
    C:\WINDOWS\system32\drivers\ikfileflt.sys
    2007-08-31 00:57 29,264 --a
    C:\WINDOWS\system32\drivers\kcom.sys
    2007-08-31 00:57 <DIR> d
    C:\Program Files\Spyware Doctor
    2007-08-31 00:53 335 --a
    C:\WINDOWS\mozregistry.dat
    2007-08-31 00:51 1,156 --a
    C:\WINDOWS\mozver.dat
    2007-08-31 00:36 0 --a
    C:\WINDOWS\nsreg.dat
    2007-08-31 00:36 <DIR> d
    C:\DOCUME~1\Mason\APPLIC~1\Talkback
    2007-08-30 23:06 <DIR> d
    C:\Program Files\Lavasoft
    2007-08-30 23:06 <DIR> d
    C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
    2007-08-30 23:05 <DIR> d
    C:\Program Files\Common Files\Wise Installation Wizard
    2007-08-30 22:23 51,200 --a
    C:\WINDOWS\nircmd.exe
    2007-08-29 01:18 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
    2007-08-29 01:18 <DIR> d
    C:\Program Files\SpywareBot
    2007-08-29 01:18 <DIR> d
    C:\DOCUME~1\Eric\APPLIC~1\SpywareBot
    2007-08-29 00:27 <DIR> d
    C:\DOCUME~1\Eric\APPLIC~1\Talkback
    2007-08-21 22:05 <DIR> d
    C:\DOCUME~1\ALLUSE~1\APPLIC~1\PC Tools
    2007-08-20 17:16 192,622 --a
    C:\WINDOWS\system32\swinqmdt.exe
    2007-08-16 14:33 <DIR> d
    C:\WINDOWS\system32\syschks22
    2007-08-16 14:33 <DIR> d
    C:\WINDOWS\system32\SS1
    2007-08-16 14:33 <DIR> d
    C:\WINDOWS\system32\ICM2
    2007-08-16 14:33 <DIR> d
    C:\WINDOWS\system32\chkfig5
    2007-08-15 12:04 <DIR> d
    C:\DOCUME~1\Andrew\APPLIC~1\Yahoo!
    2007-08-15 12:03 <DIR> d
    C:\DOCUME~1\Andrew\APPLIC~1\Real
    2007-08-07 13:58 8,320 --a
    C:\WINDOWS\system32\drivers\AWRTRD.sys
    2007-08-07 13:56 9,344 --a
    C:\WINDOWS\system32\drivers\NSDriver.sys


    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

    2007-09-03 21:37
    d
    C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google Updater
    2007-08-31 00:00
    d
    C:\Program Files\PokerStars
    2007-08-26 15:54
    d
    C:\DOCUME~1\Kaelin\APPLIC~1\Yahoo!
    2007-08-24 22:45
    dr-h
    C:\DOCUME~1\Eric\APPLIC~1\yahoo!
    2007-08-20 08:58
    d
    C:\DOCUME~1\Mason\APPLIC~1\Yahoo!
    2007-08-19 20:47
    d
    C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo! Companion
    2007-08-19 20:46
    d
    C:\Program Files\Yahoo!
    2007-08-15 13:24 6648 --a
    C:\DOCUME~1\ALLUSE~1\APPLIC~1\ypinfo.bin
    2007-08-02 22:59
    d
    C:\DOCUME~1\Kaelin\APPLIC~1\Sonic
    2007-08-02 22:58
    d
    C:\DOCUME~1\Kaelin\APPLIC~1\Real
    2007-08-02 22:25
    d
    C:\DOCUME~1\Mason\APPLIC~1\Real
    2007-07-30 19:19 92504 --a
    C:\WINDOWS\system32\cdm.dll
    2007-07-30 19:19 549720 --a
    C:\WINDOWS\system32\wuapi.dll
    2007-07-30 19:19 53080 --a
    C:\WINDOWS\system32\wuauclt.exe
    2007-07-30 19:19 43352 --a
    C:\WINDOWS\system32\wups2.dll
    2007-07-30 19:19 325976 --a
    C:\WINDOWS\system32\wucltui.dll
    2007-07-30 19:19 203096 --a
    C:\WINDOWS\system32\wuweb.dll
    2007-07-30 19:19 1712984 --a
    C:\WINDOWS\system32\wuaueng.dll
    2007-07-30 19:18 33624 --a
    C:\WINDOWS\system32\wups.dll
    2007-07-23 11:00 879832 --a
    C:\WINDOWS\system32\drivers\VetEFile.sys
    2007-07-23 11:00 108360 --a
    C:\WINDOWS\system32\drivers\VetEBoot.sys
    2007-07-21 20:59
    d
    C:\DOCUME~1\Eric\APPLIC~1\Real
    2007-07-21 00:10
    d
    C:\DOCUME~1\Eric\APPLIC~1\Google
    2007-07-21 00:09
    d
    C:\Program Files\Google
    2007-07-20 23:33
    d
    C:\DOCUME~1\Eric\APPLIC~1\PC Tools
    2007-07-20 23:32
    d
    C:\Program Files\Real
    2007-07-20 23:32
    d
    C:\Program Files\Common Files\xing shared
    2007-07-20 23:32
    d
    C:\Program Files\Common Files\Real
    2007-07-20 23:11
    d
    C:\DOCUME~1\Eric\APPLIC~1\WinRAR
    2007-07-16 22:55
    d
    C:\DOCUME~1\Andrew\APPLIC~1\Sonic
    2007-07-13 09:34
    d
    C:\DOCUME~1\Eric\APPLIC~1\Sonic
    2007-07-13 09:31
    d
    C:\DOCUME~1\Mason\APPLIC~1\Sonic
    2007-07-12 22:12
    d
    C:\Program Files\Common Files\Sonic
    2007-07-12 22:11 108544 --a
    C:\WINDOWS\system32\pxcpyi64.exe
    2007-07-12 22:11 104960 --a
    C:\WINDOWS\system32\pxinsi64.exe
    2007-07-12 22:10
    d
    C:\Program Files\Sonic
    2007-07-12 22:10
    d
    C:\Program Files\Common Files\Sonic Shared
    2007-07-12 22:08
    d--h
    C:\Program Files\InstallShield Installation Information
    2007-07-12 22:08
    d
    C:\Program Files\CyberLink
    2007-07-11 14:37 6272 --a
    C:\WINDOWS\system32\drivers\AWRTPD.sys
    2007-07-05 23:00
    d
    C:\Program Files\Winamp
    2007-07-05 22:38
    d
    C:\Program Files\Common Files\NSV
    2007-06-29 19:32 74864 --a
    C:\WINDOWS\system32\VetRedir.dll
    2007-06-29 19:32 115824 --a
    C:\WINDOWS\UnVet32.exe
    2007-06-29 19:32 111728 --a
    C:\WINDOWS\AVShlExt.dll
    2007-06-25 23:08 1104896 --a
    C:\WINDOWS\system32\msxml3.dll
    2007-06-19 06:31 282112 --a
    C:\WINDOWS\system32\gdi32.dll
    2007-06-13 03:23 1033216 --a
    C:\WINDOWS\explorer.exe


    ((((((((((((((((((((((((((((( snapshot_2007-08-30_223727.06 )))))))))))))))))))))))))))))))))))))))))

    ----a-r 1,038,336 2007-08-31 06:06:34 C:\WINDOWS\Installer\{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}\Icon0E6AB9FC.exe
    ----a-r 178,688 2007-08-31 06:06:34 C:\WINDOWS\Installer\{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}\Icon0E6AB9FC1.exe
    ----a-w 14,048 2007-03-06 01:22:36 C:\WINDOWS\SoftwareDistribution\Download\fbd74e253a9131770d5798b356214bc9\spmsg.dll
    ----a-w 213,216 2007-03-06 01:22:41 C:\WINDOWS\SoftwareDistribution\Download\fbd74e253a9131770d5798b356214bc9\spuninst.exe
    ----a-w 124,928 2007-06-27 14:39:42 C:\WINDOWS\SoftwareDistribution\Download\fbd74e253a9131770d5798b356214bc9\sp2qfe\advpack.dll
    ----a-w 132,608 2007-06-27 14:39:42 C:\WINDOWS\SoftwareDistribution\Download\fbd74e253a9131770d5798b356214bc9\sp2qfe\extmgr.dll
    ----a-w 63,488 2007-06-27 09:16:27 C:\WINDOWS\SoftwareDistribution\Download\fbd74e253a9131770d5798b356214bc9\sp2qfe\ie4uinit.exe
    ----a-w 153,088 2007-06-27 14:39:42 C:\WINDOWS\SoftwareDistribution\Download\fbd74e253a9131770d5798b356214bc9\sp2qfe\ieakeng.dll
    ----a-w 230,400 2007-06-27 14:39:43 C:\WINDOWS\SoftwareDistribution\Download\fbd74e253a9131770d5798b356214bc9\sp2qfe\ieaksie.dll
    ----a-w 161,792 2007-06-27 07:07:01 C:\WINDOWS\SoftwareDistribution\Download\fbd74e253a9131770d5798b356214bc9\sp2qfe\ieakui.dll
    ----a-w 384,512 2007-06-27 14:39:44 C:\WINDOWS\SoftwareDistribution\Download\fbd74e253a9131770d5798b356214bc9\sp2qfe\iedkcs32.dll
    ----a-w 6,059,008 2007-06-27 14:39:51 C:\WINDOWS\SoftwareDistribution\Download\fbd74e253a9131770d5798b356214bc9\sp2qfe\ieframe.dll
    ----a-w 44,544 2007-06-27 14:39:51 C:\WINDOWS\SoftwareDistribution\Download\fbd74e253a9131770d5798b356214bc9\sp2qfe\iernonce.dll
    ----a-w 267,776 2007-06-27 14:39:52 C:\WINDOWS\SoftwareDistribution\Download\fbd74e253a9131770d5798b356214bc9\sp2qfe\iertutil.dll
    ----a-w 13,824 2007-06-27 09:16:27 C:\WINDOWS\SoftwareDistribution\Download\fbd74e253a9131770d5798b356214bc9\sp2qfe\ieudinit.exe
    ----a-w 625,152 2007-06-27 09:16:52 C:\WINDOWS\SoftwareDistribution\Download\fbd74e253a9131770d5798b356214bc9\sp2qfe\iexplore.exe
    ----a-w 27,648 2007-06-27 14:39:54 C:\WINDOWS\SoftwareDistribution\Download\fbd74e253a9131770d5798b356214bc9\sp2qfe\jsproxy.dll
    ----a-w 459,264 2007-06-27 14:39:55 C:\WINDOWS\SoftwareDistribution\Download\fbd74e253a9131770d5798b356214bc9\sp2qfe\msfeeds.dll
    ----a-w 52,224 2007-06-27 14:39:55 C:\WINDOWS\SoftwareDistribution\Download\fbd74e253a9131770d5798b356214bc9\sp2qfe\msfeedsbs.dll
    ----a-w 477,696 2007-06-27 14:40:00 C:\WINDOWS\SoftwareDistribution\Download\fbd74e253a9131770d5798b356214bc9\sp2qfe\mshtmled.dll
    ----a-w 193,024 2007-06-27 14:40:01 C:\WINDOWS\SoftwareDistribution\Download\fbd74e253a9131770d5798b356214bc9\sp2qfe\msrating.dll
    ----a-w 671,232 2007-06-27 14:40:01 C:\WINDOWS\SoftwareDistribution\Download\fbd74e253a9131770d5798b356214bc9\sp2qfe\mstime.dll
    ----a-w 102,400 2007-06-27 14:40:01 C:\WINDOWS\SoftwareDistribution\Download\fbd74e253a9131770d5798b356214bc9\sp2qfe\occache.dll
    ----a-w 105,984 2007-06-27 14:40:01 C:\WINDOWS\SoftwareDistribution\Download\fbd74e253a9131770d5798b356214bc9\sp2qfe\url.dll
    ----a-w 1,154,048 2007-06-27 14:40:02 C:\WINDOWS\SoftwareDistribution\Download\fbd74e253a9131770d5798b356214bc9\sp2qfe\urlmon.dll
    ----a-w 232,960 2007-06-27 14:40:02 C:\WINDOWS\SoftwareDistribution\Download\fbd74e253a9131770d5798b356214bc9\sp2qfe\webcheck.dll
    ----a-w 824,320 2007-06-27 14:40:03 C:\WINDOWS\SoftwareDistribution\Download\fbd74e253a9131770d5798b356214bc9\sp2qfe\wininet.dll
    ----a-w 22,752 2007-03-06 01:22:34 C:\WINDOWS\SoftwareDistribution\Download\fbd74e253a9131770d5798b356214bc9\update\spcustom.dll
    ----a-w 716,000 2007-03-06 01:22:59 C:\WINDOWS\SoftwareDistribution\Download\fbd74e253a9131770d5798b356214bc9\update\update.exe
    ----a-w 371,424 2007-03-06 01:23:51 C:\WINDOWS\SoftwareDistribution\Download\fbd74e253a9131770d5798b356214bc9\update\updspapi.dll
    ----a-w 7,680 2007-04-13 22:19:52 C:\WINDOWS\system32\lsdelete.exe
    ----a-w 2,115,816 2007-06-11 20:34:00 C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
    ----a-w 190,696 2007-06-11 20:34:00 C:\WINDOWS\system32\Macromed\Flash\NPSWF32_FlashUtil.exe


    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


    *Note* empty entries & legit default entries are not shown

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "YBrowser"="C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe" [2006-07-21 16:19]
    "YOP"="C:\PROGRA~1\Yahoo!\YOP\yop.exe" [2006-07-21 10:43]
    "CaAvTray"="C:\Program Files\Yahoo!\Antivirus\CAVTray.exe" [2007-06-29 19:32]
    "CAVRID"="C:\Program Files\Yahoo!\Antivirus\CAVRID.exe" [2007-06-29 19:32]
    "P17Helper"="P17.dll" [2004-06-10 09:51 C:\WINDOWS\system32\P17.dll]
    "UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 01:00]
    "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-05 21:05]
    "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-05-14 15:22]
    "DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-10-12 16:54]
    "dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-08-13 01:05]
    "UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2004-01-07 01:01]
    "YPC"="C:\PROGRA~1\Yahoo!\PARENT~1\ypc.exe" [2005-02-11 18:14]
    "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-07-20 23:32]
    "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
    "{9C-C0-06-65-ZN}"="c:\windows\system32\dwdsregt.exe" []
    "plite731"="C:\WINDOWS\plite731.exe" []
    "AAWTray"="C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe" [2007-08-08 15:53]
    "SDTray"="C:\Program Files\Spyware Doctor\SDTrayApp.exe" [2007-05-29 15:41]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [2007-06-07 14:08]
    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-12 06:56]
    "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-21 00:07]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice"

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice"

    R3 P17;Sound Blaster Live! 24-bit;C:\WINDOWS\system32\drivers\P17.sys

    *Newly Created Service* - AVG_ANTI-SPYWARE_DRIVER
    *Newly Created Service* - AVG_ANTI-SPYWARE_GUARD

    Contents of the 'Scheduled Tasks' folder
    2007-08-31 10:00:00 C:\WINDOWS\Tasks\SpywareBot Scheduled Scan.job - C:\Program Files\SpywareBot\SpywareBot.exe

    **************************************************************************

    catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2007-09-04 21:29:26
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************

    Completion time: 2007-09-04 21:31:20
    C:\ComboFix-quarantined-files.txt ... 2007-09-04 21:31
    C:\ComboFix2.txt ... 2007-08-30 22:39

    --- E O F ---

    AVG Scan Report
    AVG Anti-Spyware - Scan Report

    + Created at: 10:07:34 PM 9/4/2007

    + Scan result:



    C:\System Volume Information\_restore{952F3780-3E97-4627-882D-A3568B1A5DA0}\RP105\A0036646.exe -> Adware.ZenoSearch : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\swinqmdt.exe -> Adware.ZenoSearch : Cleaned with backup (quarantined).
    C:\qoobox\Quarantine\C\WINDOWS\TISKY002.exe.vir -> Adware.ZenoSearch : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{952F3780-3E97-4627-882D-A3568B1A5DA0}\RP101\A0032523.exe -> Downloader.VB.awj : Cleaned with backup (quarantined).
    :mozilla.19:C:\Documents and Settings\Mason\Application Data\Mozilla\Firefox\Profiles\7fapu5fy.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
    :mozilla.20:C:\Documents and Settings\Mason\Application Data\Mozilla\Firefox\Profiles\7fapu5fy.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
    :mozilla.21:C:\Documents and Settings\Mason\Application Data\Mozilla\Firefox\Profiles\7fapu5fy.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
    :mozilla.22:C:\Documents and Settings\Mason\Application Data\Mozilla\Firefox\Profiles\7fapu5fy.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
    :mozilla.23:C:\Documents and Settings\Mason\Application Data\Mozilla\Firefox\Profiles\7fapu5fy.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
    :mozilla.24:C:\Documents and Settings\Mason\Application Data\Mozilla\Firefox\Profiles\7fapu5fy.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
    :mozilla.43:C:\Documents and Settings\Eric\Application Data\Mozilla\Firefox\Profiles\mddma6sv.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned.
    :mozilla.38:C:\Documents and Settings\Eric\Application Data\Mozilla\Firefox\Profiles\mddma6sv.default\cookies.txt -> TrackingCookie.Bridgetrack : Cleaned.
    :mozilla.39:C:\Documents and Settings\Eric\Application Data\Mozilla\Firefox\Profiles\mddma6sv.default\cookies.txt -> TrackingCookie.Bridgetrack : Cleaned.
    :mozilla.109:C:\Documents and Settings\Eric\Application Data\Mozilla\Firefox\Profiles\mddma6sv.default\cookies.txt -> TrackingCookie.Clickbank : Cleaned.
    C:\Program Files\Yahoo!\YPSR\Quarantine\ppq40.tmp -> TrackingCookie.Cpvfeed : Cleaned.
    :mozilla.48:C:\Documents and Settings\Eric\Application Data\Mozilla\Firefox\Profiles\mddma6sv.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned.
    :mozilla.7:C:\Documents and Settings\Mason\Application Data\Mozilla\Firefox\Profiles\7fapu5fy.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned.
    :mozilla.26:C:\Documents and Settings\Mason\Application Data\Mozilla\Firefox\Profiles\7fapu5fy.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
    :mozilla.27:C:\Documents and Settings\Mason\Application Data\Mozilla\Firefox\Profiles\7fapu5fy.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
    :mozilla.28:C:\Documents and Settings\Mason\Application Data\Mozilla\Firefox\Profiles\7fapu5fy.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
    :mozilla.29:C:\Documents and Settings\Mason\Application Data\Mozilla\Firefox\Profiles\7fapu5fy.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
    C:\Program Files\Yahoo!\YPSR\Quarantine\ppq41.tmp -> TrackingCookie.Findwhat : Cleaned.
    :mozilla.110:C:\Documents and Settings\Eric\Application Data\Mozilla\Firefox\Profiles\mddma6sv.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned.
    :mozilla.111:C:\Documents and Settings\Eric\Application Data\Mozilla\Firefox\Profiles\mddma6sv.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned.
    :mozilla.67:C:\Documents and Settings\Eric\Application Data\Mozilla\Firefox\Profiles\mddma6sv.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned.
    :mozilla.97:C:\Documents and Settings\Eric\Application Data\Mozilla\Firefox\Profiles\mddma6sv.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned.
    C:\Program Files\Yahoo!\YPSR\Quarantine\ppq42.tmp -> TrackingCookie.Hitbox : Cleaned.
    C:\Program Files\Yahoo!\YPSR\Quarantine\ppq43.tmp -> TrackingCookie.Hitbox : Cleaned.
    :mozilla.68:C:\Documents and Settings\Eric\Application Data\Mozilla\Firefox\Profiles\mddma6sv.default\cookies.txt -> TrackingCookie.Information : Cleaned.
    C:\Program Files\Yahoo!\YPSR\Quarantine\ppq1D.tmp -> TrackingCookie.Information : Cleaned.
    :mozilla.59:C:\Documents and Settings\Eric\Application Data\Mozilla\Firefox\Profiles\mddma6sv.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned.
    :mozilla.20:C:\Documents and Settings\Eric\Application Data\Mozilla\Firefox\Profiles\mddma6sv.default\cookies.txt -> TrackingCookie.Netflame : Cleaned.
    :mozilla.133:C:\Documents and Settings\Eric\Application Data\Mozilla\Firefox\Profiles\mddma6sv.default\cookies.txt -> TrackingCookie.Paypal : Cleaned.
    :mozilla.80:C:\Documents and Settings\Eric\Application Data\Mozilla\Firefox\Profiles\mddma6sv.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
    :mozilla.81:C:\Documents and Settings\Eric\Application Data\Mozilla\Firefox\Profiles\mddma6sv.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
    :mozilla.82:C:\Documents and Settings\Eric\Application Data\Mozilla\Firefox\Profiles\mddma6sv.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
    :mozilla.83:C:\Documents and Settings\Eric\Application Data\Mozilla\Firefox\Profiles\mddma6sv.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
    :mozilla.49:C:\Documents and Settings\Eric\Application Data\Mozilla\Firefox\Profiles\mddma6sv.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned.
    :mozilla.50:C:\Documents and Settings\Eric\Application Data\Mozilla\Firefox\Profiles\mddma6sv.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned.
    :mozilla.51:C:\Documents and Settings\Eric\Application Data\Mozilla\Firefox\Profiles\mddma6sv.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned.
    :mozilla.13:C:\Documents and Settings\Mason\Application Data\Mozilla\Firefox\Profiles\7fapu5fy.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
    :mozilla.14:C:\Documents and Settings\Mason\Application Data\Mozilla\Firefox\Profiles\7fapu5fy.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
    :mozilla.15:C:\Documents and Settings\Mason\Application Data\Mozilla\Firefox\Profiles\7fapu5fy.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
    :mozilla.16:C:\Documents and Settings\Mason\Application Data\Mozilla\Firefox\Profiles\7fapu5fy.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
    :mozilla.17:C:\Documents and Settings\Mason\Application Data\Mozilla\Firefox\Profiles\7fapu5fy.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
    :mozilla.18:C:\Documents and Settings\Mason\Application Data\Mozilla\Firefox\Profiles\7fapu5fy.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
    C:\Program Files\Yahoo!\YPSR\Quarantine\ppq1C.tmp -> TrackingCookie.Specificclick : Cleaned.
    C:\Program Files\Yahoo!\YPSR\Quarantine\ppq22.tmp -> TrackingCookie.Specificclick : Cleaned.
    :mozilla.100:C:\Documents and Settings\Eric\Application Data\Mozilla\Firefox\Profiles\mddma6sv.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
    :mozilla.101:C:\Documents and Settings\Eric\Application Data\Mozilla\Firefox\Profiles\mddma6sv.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
    :mozilla.98:C:\Documents and Settings\Eric\Application Data\Mozilla\Firefox\Profiles\mddma6sv.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
    :mozilla.99:C:\Documents and Settings\Eric\Application Data\Mozilla\Firefox\Profiles\mddma6sv.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
    C:\Program Files\Yahoo!\YPSR\Quarantine\ppq23.tmp -> TrackingCookie.Tacoda : Cleaned.
    :mozilla.30:C:\Documents and Settings\Mason\Application Data\Mozilla\Firefox\Profiles\7fapu5fy.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
    :mozilla.31:C:\Documents and Settings\Mason\Application Data\Mozilla\Firefox\Profiles\7fapu5fy.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
    :mozilla.32:C:\Documents and Settings\Mason\Application Data\Mozilla\Firefox\Profiles\7fapu5fy.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
    :mozilla.33:C:\Documents and Settings\Mason\Application Data\Mozilla\Firefox\Profiles\7fapu5fy.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
    :mozilla.34:C:\Documents and Settings\Mason\Application Data\Mozilla\Firefox\Profiles\7fapu5fy.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
    :mozilla.35:C:\Documents and Settings\Mason\Application Data\Mozilla\Firefox\Profiles\7fapu5fy.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
    :mozilla.36:C:\Documents and Settings\Mason\Application Data\Mozilla\Firefox\Profiles\7fapu5fy.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
    :mozilla.37:C:\Documents and Settings\Mason\Application Data\Mozilla\Firefox\Profiles\7fapu5fy.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
    :mozilla.25:C:\Documents and Settings\Mason\Application Data\Mozilla\Firefox\Profiles\7fapu5fy.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
    C:\Program Files\Yahoo!\YPSR\Quarantine\ppq44.tmp -> TrackingCookie.Tribalfusion : Cleaned.
    :mozilla.56:C:\Documents and Settings\Eric\Application Data\Mozilla\Firefox\Profiles\mddma6sv.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
    :mozilla.57:C:\Documents and Settings\Eric\Application Data\Mozilla\Firefox\Profiles\mddma6sv.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
    :mozilla.58:C:\Documents and Settings\Eric\Application Data\Mozilla\Firefox\Profiles\mddma6sv.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
    C:\Program Files\Yahoo!\YPSR\Quarantine\ppq45.tmp -> TrackingCookie.Zedo : Cleaned.


    ::Report end


    Let me know what else that you need me to do.

    Thanks, bunja
  • NuppiNuppi South Ostrobothnia (Finland)
    edited September 2007
    Hi

    Please rescan with hijack and check :

    O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
    O4 - HKLM\..\Run: [{9C-C0-06-65-ZN}] c:\windows\system32\dwdsregt.exe CHD003
    O4 - HKLM\..\Run: [plite731] C:\WINDOWS\plite731.exe

    Close all programs exept hijackthis and click fix checked :D

    Boot comp,

    Send a fresh hijack log :D
  • bunja
    edited September 2007
    did as you said. Here is the new hijackthis log. Let me know what you think. Thanks bunja

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 8:40:38 PM, on 9/7/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16512)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
    C:\PROGRA~1\Yahoo!\YOP\yop.exe
    C:\Program Files\Yahoo!\Antivirus\CAVTray.exe
    C:\Program Files\Yahoo!\Antivirus\CAVRID.exe
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
    C:\WINDOWS\system32\dla\tfswctrl.exe
    C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
    C:\Program Files\Spyware Doctor\SDTrayApp.exe
    C:\PROGRA~1\Yahoo!\browser\ycommon.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Google\Google Updater\GoogleUpdater.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Program Files\Yahoo!\Antivirus\ISafe.exe
    C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
    C:\WINDOWS\system32\CTsvcCDA.EXE
    C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    C:\Program Files\Spyware Doctor\svcntaux.exe
    C:\Program Files\Spyware Doctor\swdsvc.exe
    C:\WINDOWS\system32\wdfmgr.exe
    C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
    C:\WINDOWS\system32\MsPMSPSv.exe
    C:\WINDOWS\System32\alg.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\system32\wbem\wmiprvse.exe
    C:\Documents and Settings\Eric\Desktop\AntiVirus\HiJackThis(2).exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ie/defaults/sb/sbcydsl/*http://www.yahoo.com/search/ie.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
    O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O4 - HKLM\..\Run: [YBrowser] C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
    O4 - HKLM\..\Run: [YOP] C:\PROGRA~1\Yahoo!\YOP\yop.exe /autostart
    O4 - HKLM\..\Run: [CaAvTray] "C:\Program Files\Yahoo!\Antivirus\CAVTray.exe"
    O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\Yahoo!\Antivirus\CAVRID.exe"
    O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
    O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
    O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
    O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
    O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
    O4 - HKLM\..\Run: [YPC] C:\PROGRA~1\Yahoo!\PARENT~1\ypc.exe
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [AAWTray] C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
    O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
    O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
    O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
    O9 - Extra button: AT&T Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper2007261.dll
    O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo.com/ocx/us/yexplorer1_9us.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\ISafe.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
    O23 - Service: Spyware Doctor Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
    O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
    O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE

    --
    End of file - 7691 bytes
  • NuppiNuppi South Ostrobothnia (Finland)
    edited September 2007
    Hi Bunja,

    I'm sorry to your waiting :(

    Your log looks good. Is problem away ?
  • bunja
    edited September 2007
    I don't see the pop ups any more...yeeeehaaaa! You can close this thread as resolved.

    Another happy member ;-))) thanks so much Nuppi!!!
  • NuppiNuppi South Ostrobothnia (Finland)
    edited September 2007
    Hi

    Glad that it helps. I'll keep this thread open a few days more :D
  • NuppiNuppi South Ostrobothnia (Finland)
    edited October 2007
    Glad we could be of assistance! The help you received here was free.

    This topic is now closed. If you wish it reopened, please send a Private Message to Trogan with a link to your thread.

    If you are not the user who started this thread, you must start your own Thread instead :)
    _______________________________
    Have we helped you with any issues you have had with your PC's or other items? If so you can now help us by Joining Team 93 and fold for a cure.
This discussion has been closed.