worm.win32.netsky!

Unknown
edited January 2008 in Spyware & Virus Removal
Hello, i had tried using SmitfraudFix to delete the worm but it seems like it is working.. the pop up will only stop showing for a hour after the scanning and deleting.

i need help desperatly, the pop-ups are annoying the hell out of me.

your help is much appreciated.


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:12:28 PM, on 12/27/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\ZoomingHook.exe
C:\Program Files\Toshiba\Tvs\TvsTray.exe
C:\WINDOWS\system32\TPSMain.exe
C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
C:\WINDOWS\system32\TPSBattM.exe
C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
C:\WINDOWS\system32\TCtrlIOHook.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\Protector Suite QL\psqltray.exe
C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\RAMASST.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\iTunes\iTunes.exe
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: BDEX System - {C2DE4340-CB68-450F-90CD-9BE1A26739D7} - C:\WINDOWS\domnftwmnf.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: The emlkdvo - {47906C8A-7A72-45A8-AA59-0CEC20BD3B36} - C:\WINDOWS\emlkdvo.dll
O4 - HKLM\..\Run: [ZoomingHook] ZoomingHook.exe
O4 - HKLM\..\Run: [Tvs] C:\Program Files\Toshiba\Tvs\TvsTray.exe
O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
O4 - HKLM\..\Run: [TPNF] C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
O4 - HKLM\..\Run: [TDispVol] TDispVol.exe
O4 - HKLM\..\Run: [TCtryIOHook] TCtrlIOHook.exe
O4 - HKLM\..\Run: [SVPWUTIL] C:\Program Files\Toshiba\Windows Utilities\SVPWUTIL.exe SVPwUTIL
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [PSQLLauncher] "C:\Program Files\Protector Suite QL\launcher.exe" /startup
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
O4 - HKLM\..\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [HWSetup] C:\Program Files\TOSHIBA\TOSHIBA Applet\HWSetup.exe hwSetUP
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [CFSServ.exe] CFSServ.exe -NoClient
O4 - HKLM\..\Run: [CeEKEY] C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [AdobeVersionCue] C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [POSTRBT] C:\Program Files\Norton AntiVirus\Navw32.exe /REMEDIATE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [POSTRBT] C:\Program Files\Norton AntiVirus\Navw32.exe /REMEDIATE (User 'Default user')
O4 - Global Startup: Bluetooth Monitor.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-sg\msntabres.dll.mui/229?f3ecfba7ed224c3da266ba2f54c4db56
O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-sg\msntabres.dll.mui/230?f3ecfba7ed224c3da266ba2f54c4db56
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {CD259AEC-23E6-4E64-8138-7E28D56666D7} (SQFViewer10X Element) - http://www.natuerlich-birkenstock.de/v1/SQFViewer10.ocx
O17 - HKLM\System\CCS\Services\Tcpip\..\{5D5E162B-9583-41AD-8E3C-5977AB92A85D}: NameServer = 192.168.1.1,218.186.1.38
O21 - SSODL: bvtqfvx - {92CD4E22-437D-433A-8B87-0472990739C5} - C:\WINDOWS\bvtqfvx.dll
O21 - SSODL: alxvdvm - {5B2996FB-4F01-4327-AC0F-0A62AAE26FE3} - C:\WINDOWS\alxvdvm.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AdobeVersionCue - Adobe Sytems - C:\Program Files\Adobe\Adobe Version Cue\service\VersionCue.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: DVD-RAM_Service - Matsu****a Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Unknown owner - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe (file missing)
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

--
End of file - 15256 bytes

Comments

  • Baabiouz
    edited December 2007
    Hi Deelist!

    Let's run Smitfraudfix Option 1 first.


    Please download SmitfraudFix

    Double-click SmitfraudFix.exe
    Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present).
    Please copy/paste the content of that report into your next reply.

    Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.
    http://www.beyondlogic.org/consulting/proc...processutil.htm
  • deelist
    edited December 2007
    SmitFraudFix v2.274

    Scan done at 0:53:32.21, Fri 12/28/2007
    Run from C:\Documents and Settings\dilys woo\Desktop\SmitfraudFix
    OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
    The filesystem type is NTFS
    Fix run in normal mode

    »»»»»»»»»»»»»»»»»»»»»»»» Process

    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
    C:\WINDOWS\system32\DVDRAMSV.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Canon\CAL\CALMAIN.exe
    C:\WINDOWS\system32\ZoomingHook.exe
    C:\Program Files\Toshiba\Tvs\TvsTray.exe
    C:\WINDOWS\system32\TPSMain.exe
    C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
    C:\WINDOWS\system32\TPSBattM.exe
    C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
    C:\WINDOWS\system32\TCtrlIOHook.exe
    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
    C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\PowerISO\PWRISOVM.EXE
    C:\Program Files\Protector Suite QL\psqltray.exe
    C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
    C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
    C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
    C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
    C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\System32\DLA\DLACTRLW.EXE
    C:\Program Files\TOSHIBA\ConfigFree\CFSServ.exe
    C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\Apoint2K\Apoint.exe
    C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
    C:\WINDOWS\AGRSMMSG.exe
    C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Apoint2K\Apntex.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\WINDOWS\system32\RAMASST.exe
    C:\Program Files\WinZip\WZQKPICK.EXE
    C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
    C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
    C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
    C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\MSN Messenger\usnsvc.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\WINDOWS\system32\cmd.exe

    »»»»»»»»»»»»»»»»»»»»»»»» hosts


    »»»»»»»»»»»»»»»»»»»»»»»» C:\


    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


    »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\dilys woo


    »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\dilys woo\Application Data


    »»»»»»»»»»»»»»»»»»»»»»»» Start Menu


    »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\DILYSW~1\FAVORI~1


    »»»»»»»»»»»»»»»»»»»»»»»» Desktop


    »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


    »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


    »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components



    »»»»»»»»»»»»»»»»»»»»»»»» IEDFix
    !!!Attention, following keys are not inevitably infected!!!

    IEDFix.exe by S!Ri


    »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
    !!!Attention, following keys are not inevitably infected!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll


    »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
    !!!Attention, following keys are not inevitably infected!!!

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
    "AppInit_DLLs"=""


    »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
    !!!Attention, following keys are not inevitably infected!!!

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
    "System"=""


    »»»»»»»»»»»»»»»»»»»»»»»» Rustock



    »»»»»»»»»»»»»»»»»»»»»»»» DNS

    Description: Intel(R) PRO/Wireless 3945ABG Network Connection - Packet Scheduler Miniport
    DNS Server Search Order: 218.186.1.38
    DNS Server Search Order: 202.156.1.68
    DNS Server Search Order: 202.156.1.48

    HKLM\SYSTEM\CCS\Services\Tcpip\..\{5D5E162B-9583-41AD-8E3C-5977AB92A85D}: NameServer=192.168.1.1,218.186.1.38
    HKLM\SYSTEM\CCS\Services\Tcpip\..\{BDA6B74F-ABAA-4C81-AC1E-A54F2C869903}: DhcpNameServer=218.186.1.38 202.156.1.68 202.156.1.48
    HKLM\SYSTEM\CS1\Services\Tcpip\..\{5D5E162B-9583-41AD-8E3C-5977AB92A85D}: NameServer=192.168.1.1,218.186.1.38
    HKLM\SYSTEM\CS1\Services\Tcpip\..\{BDA6B74F-ABAA-4C81-AC1E-A54F2C869903}: DhcpNameServer=218.186.1.38 202.156.1.68 202.156.1.48
    HKLM\SYSTEM\CS3\Services\Tcpip\..\{5D5E162B-9583-41AD-8E3C-5977AB92A85D}: NameServer=192.168.1.1,218.186.1.38
    HKLM\SYSTEM\CS3\Services\Tcpip\..\{BDA6B74F-ABAA-4C81-AC1E-A54F2C869903}: DhcpNameServer=218.186.1.38 202.156.1.68 202.156.1.48
    HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=218.186.1.38 202.156.1.68 202.156.1.48
    HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=218.186.1.38 202.156.1.68 202.156.1.48
    HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=218.186.1.38 202.156.1.68 202.156.1.48


    »»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection


    »»»»»»»»»»»»»»»»»»»»»»»» End
  • Baabiouz
    edited December 2007
    Hi!

    Step 1

    Before we start fixing anything you should print out these instructions or copy them to a NotePad file so they will be accessible. Some steps will require you to disconnect from the Internet or use Safe Mode and you will not have access to this page.

    Please download SDFix by AndyManchesta and save it to your desktop.
    When using this tool, you must use the Administrator's account or an account with "Administrative rights"
    • Double click SDFix.exe and it will extract the files to %systemdrive%
    • (this is the drive that contains the Windows Directory, typically C:\SDFix).
    • DO NOT use it just yet.
    Reboot your computer in "Safe Mode" using the F8 method. To do this, restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly. A menu will appear with several options. Use the arrow keys to navigate and select the option to run Windows in "Safe Mode".

    Open the SDFix folder and double click RunThis.bat to start the script.
    • Type Y to begin the cleanup process.
    • It will remove any Trojan Services or Registry Entries found then prompt you to press any key to Reboot.
    • Press any Key and it will restart the PC.
    • When the PC restarts, the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
    • Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt.
    • Copy and paste the contents of the results file Report.txt in your next replyalong with a new HijackThis log.
    -- If this error message is displayed when running SDFix: "The command prompt has been disabled by your administrator. Press any key to continue..."
    Please go to Start Menu > Run > and copy/paste the following line:
    %systemdrive%\SDFix\apps\swreg IMPORT %systemdrive%\SDFix\apps\Enable_Command_Prompt.reg
    Press Ok and then run SDFix again.

    -- If the Command Prompt window flashes on then off again on XP or Win 2000, please go to Start Menu > Run > and copy/paste the following line:
    %systemdrive%\SDFix\apps\FixPath.exe /Q
    Reboot and then run SDFix again.

    -- If SDFix still does not run, check the %comspec% variable. Right-click My Computer > click Properties > Advanced > Environment Variables and check that the ComSpec variable points to cmd.exe.
    %SystemRoot%\system32\cmd.exe

    Step 2

    Please download ComboFix to your Desktop.
    • Double click on Combofix.exe & follow the prompts.
    • When the scan has finished, it shall produce a log for you. Post that log in your next reply

    Do not mouseclick combofix's window whilst it's running. That may cause it to stall

    Step 3

    Please post a frehs HijackThis log, Combofix log and Sdfix log back here :)
  • deelist
    edited December 2007
    SDFix: Version 1.119

    Run by dilys woo on Fri 12/28/2007 at 03:04 AM

    Microsoft Windows XP [Version 5.1.2600]

    Running From: C:\SDFix

    Safe Mode:
    Checking Services:


    Restoring Windows Registry Values
    Restoring Windows Default Hosts File

    Rebooting...


    Normal Mode:
    Checking Files:

    Trojan Files Found:

    C:\WINDOWS\SYSTEM32\NSPRS.DLL - Deleted
    C:\WINDOWS\SYSTEM32\SERAUTH1.DLL - Deleted
    C:\WINDOWS\SYSTEM32\SERAUTH2.DLL - Deleted
    C:\WINDOWS\SYSTEM32\SSPRS.DLL - Deleted
    C:\WINDOWS\alxvdvm.dll - Deleted
    C:\WINDOWS\bvtqfvx.dll - Deleted
    C:\WINDOWS\dat.txt - Deleted
    C:\WINDOWS\domnftwmnf.dll - Deleted
    C:\WINDOWS\emlkdvo.dll - Deleted
    C:\WINDOWS\fvkwdrt.exe - Deleted
    C:\WINDOWS\rs.txt - Deleted


    Could Not Remove C:\autorun.inf
    Could Not Remove C:\autorun.inf


    Removing Temp Files...

    ADS Check:

    C:\WINDOWS
    No streams found.

    C:\WINDOWS\system32
    No streams found.

    C:\WINDOWS\system32\svchost.exe
    No streams found.

    C:\WINDOWS\system32\ntoskrnl.exe
    No streams found.



    Final Check:

    catchme 0.3.1333.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2007-12-28 03:19:18
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden services & system hive ...

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\00037a126e8b]
    "000eedf0b77b"=hex:9b,c2,6c,eb,57,d2,5b,85,51,8a,45,88,0e,52,87,6b
    "0014a48cf5a5"=hex:e5,0d,41,62,ce,69,b3,ee,72,e4,4a,6e,64,62,ac,21
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\00037a126e8b]
    "000eedf0b77b"=hex:9b,c2,6c,eb,57,d2,5b,85,51,8a,45,88,0e,52,87,6b
    "0014a48cf5a5"=hex:e5,0d,41,62,ce,69,b3,ee,72,e4,4a,6e,64,62,ac,21

    scanning hidden registry entries ...

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Reporting\EventCache\7971f918-a847-4430-9279-4a52d1efe18d]
    "CurrentCacheFile"="C:\WINDOWS\SoftwareDistribution\EventCache\{AAF42ABB-6A8B-446E-BCCA-CD0DF5FA0927}.bin"

    scanning hidden files ...


    scan completed successfully
    hidden processes: 0
    hidden services: 0
    hidden files: 118


    Remaining Services:



    Authorized Application Key Export:

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
    "C:\\Program Files\\BitTorrent_DNA\\dna.exe"="C:\\Program Files\\BitTorrent_DNA\\dna.exe:*:Enabled:BitTorrent DNA"
    "C:\\Program Files\\BitTorrent\\bittorrent.exe"="C:\\Program Files\\BitTorrent\\bittorrent.exe:*:Enabled:BitTorrent"
    "C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:æTorrent"

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

    Remaining Files:
    C:\autorun.inf Found
    C:\autorun.inf Found

    File Backups: - C:\SDFix\backups\backups.zip

    Files with Hidden Attributes:

    Fri 20 Jul 2007 74 A.SH. --- "C:\WINDOWS\system32\aabgtgnb.tmp"
    Thu 4 Jan 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
    Tue 16 Oct 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\0089cd1ec7c03d0a52caa6b6ea801507\BIT96.tmp"
    Mon 24 Dec 2007 37,038,096 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\5b662b7887793c36c7b10d29ea0e0cdc\BIT205.tmp"
    Fri 21 Sep 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\cf7ced0e70c80a1e476f1abf49afecb1\BIT204.tmp"
    Thu 7 Dec 2006 3,096,576 A..H. --- "C:\Documents and Settings\dilys woo\Application Data\U3\temp\Launchpad Removal.exe"

    Finished!

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 3:33:04 AM, on 12/28/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
    C:\WINDOWS\system32\DVDRAMSV.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Canon\CAL\CALMAIN.exe
    C:\WINDOWS\system32\ZoomingHook.exe
    C:\Program Files\Toshiba\Tvs\TvsTray.exe
    C:\WINDOWS\system32\TPSMain.exe
    C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
    C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
    C:\WINDOWS\system32\TPSBattM.exe
    C:\WINDOWS\system32\TCtrlIOHook.exe
    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
    C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\PowerISO\PWRISOVM.EXE
    C:\Program Files\Protector Suite QL\psqltray.exe
    C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
    C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
    C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
    C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
    C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\System32\DLA\DLACTRLW.EXE
    C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
    C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\Apoint2K\Apoint.exe
    C:\WINDOWS\AGRSMMSG.exe
    C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Apoint2K\Apntex.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\WINDOWS\system32\RAMASST.exe
    C:\Program Files\WinZip\WZQKPICK.EXE
    C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
    C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
    C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
    C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
    C:\WINDOWS\system32\wbem\wmiapsrv.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\MSN Messenger\usnsvc.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\WINDOWS\system32\NOTEPAD.EXE

    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O4 - HKLM\..\Run: [ZoomingHook] ZoomingHook.exe
    O4 - HKLM\..\Run: [Tvs] C:\Program Files\Toshiba\Tvs\TvsTray.exe
    O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
    O4 - HKLM\..\Run: [TPNF] C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
    O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
    O4 - HKLM\..\Run: [TDispVol] TDispVol.exe
    O4 - HKLM\..\Run: [TCtryIOHook] TCtrlIOHook.exe
    O4 - HKLM\..\Run: [SVPWUTIL] C:\Program Files\Toshiba\Windows Utilities\SVPWUTIL.exe SVPwUTIL
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
    O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
    O4 - HKLM\..\Run: [PSQLLauncher] "C:\Program Files\Protector Suite QL\launcher.exe" /startup
    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
    O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
    O4 - HKLM\..\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
    O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
    O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
    O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
    O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
    O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKLM\..\Run: [HWSetup] C:\Program Files\TOSHIBA\TOSHIBA Applet\HWSetup.exe hwSetUP
    O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
    O4 - HKLM\..\Run: [CFSServ.exe] CFSServ.exe -NoClient
    O4 - HKLM\..\Run: [CeEKEY] C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
    O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
    O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
    O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
    O4 - HKLM\..\Run: [AdobeVersionCue] C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
    O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKUS\S-1-5-18\..\RunOnce: [POSTRBT] C:\Program Files\Norton AntiVirus\Navw32.exe /REMEDIATE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\RunOnce: [POSTRBT] C:\Program Files\Norton AntiVirus\Navw32.exe /REMEDIATE (User 'Default user')
    O4 - Global Startup: Bluetooth Monitor.lnk = ?
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
    O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
    O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
    O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
    O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
    O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-sg\msntabres.dll.mui/229?f3ecfba7ed224c3da266ba2f54c4db56
    O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-sg\msntabres.dll.mui/230?f3ecfba7ed224c3da266ba2f54c4db56
    O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
    O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {CD259AEC-23E6-4E64-8138-7E28D56666D7} (SQFViewer10X Element) - http://www.natuerlich-birkenstock.de/v1/SQFViewer10.ocx
    O17 - HKLM\System\CCS\Services\Tcpip\..\{5D5E162B-9583-41AD-8E3C-5977AB92A85D}: NameServer = 192.168.1.1,218.186.1.38
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: AdobeVersionCue - Adobe Sytems - C:\Program Files\Adobe\Adobe Version Cue\service\VersionCue.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
    O23 - Service: DVD-RAM_Service - Matsu****a Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
    O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Unknown owner - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe (file missing)
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
    O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
    O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
    O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
    O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

    --
    End of file - 14792 bytes

    ComboFix 07-12-21.4 - dilys woo 2007-12-28 14:11:59.4 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.44.1033.18.355 [GMT 8:00]
    Running from: C:\Documents and Settings\dilys woo\Desktop\ComboFix.exe
    * Created a new restore point
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\Documents and Settings\dilys woo\Application Data\macromedia\Flash Player\#SharedObjects\VW5CEU7M\www.inter-focus.cn
    C:\Documents and Settings\dilys woo\Application Data\macromedia\Flash Player\#SharedObjects\VW5CEU7M\www.inter-focus.cn\IFFLASHAD_PLAYER.sol
    C:\Documents and Settings\dilys woo\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.inter-focus.cn
    C:\Documents and Settings\dilys woo\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.inter-focus.cn\settings.sol

    .
    ((((((((((((((((((((((((( Files Created from 2007-11-28 to 2007-12-28 )))))))))))))))))))))))))))))))
    .

    2007-12-28 02:43 . 2007-12-28 02:43 <DIR> d
    C:\WINDOWS\ERUNT
    2007-12-27 22:12 . 2007-12-27 22:12 <DIR> d
    C:\Program Files\Trend Micro
    2007-12-25 17:18 . 2007-12-28 00:53 6,228 --a
    C:\WINDOWS\system32\tmp.reg
    2007-12-25 17:17 . 2007-09-05 23:22 289,144 --a
    C:\WINDOWS\system32\VCCLSID.exe
    2007-12-25 17:17 . 2006-04-27 16:49 288,417 --a
    C:\WINDOWS\system32\SrchSTS.exe
    2007-12-25 17:17 . 2007-12-20 23:11 81,920 --a
    C:\WINDOWS\system32\IEDFix.exe
    2007-12-25 17:17 . 2003-06-05 20:13 53,248 --a
    C:\WINDOWS\system32\Process.exe
    2007-12-25 17:17 . 2004-07-31 17:50 51,200 --a
    C:\WINDOWS\system32\dumphive.exe
    2007-12-25 17:17 . 2007-10-03 23:36 25,600 --a
    C:\WINDOWS\system32\WS2Fix.exe
    2007-12-25 17:07 . 2007-12-25 17:08 <DIR> d
    C:\Documents and Settings\dilys woo\Application Data\PrevxCSI
    2007-12-25 17:07 . 2007-12-25 17:07 <DIR> d
    C:\Documents and Settings\All Users\Application Data\Prevx
    2007-12-25 12:00 . 2007-12-25 12:00 <DIR> d
    C:\Documents and Settings\dilys woo\Application Data\SysCleaner
    2007-12-25 11:59 . 2007-12-25 16:59 <DIR> d
    C:\Program Files\SysCleaner
    2007-12-24 13:00 . 2007-12-25 11:45 <DIR> d
    C:\Program Files\MediaVideoCodec
    2007-12-16 12:57 . 2003-03-16 00:15 90,112 --a
    C:\WINDOWS\unvise32.exe
    2007-12-16 12:55 . 2007-12-16 12:57 <DIR> d
    C:\Program Files\Mall Of America Tycoon
    2007-12-16 12:26 . 2007-12-16 12:26 70 --a
    C:\WINDOWS\nltpth.nlt
    2007-12-16 12:25 . 2007-12-16 12:25 <DIR> d
    C:\Program Files\Activision Value
    2007-12-16 12:12 . 2007-12-16 12:15 <DIR> d
    C:\Program Files\Holiday World Tycoon
    2007-12-01 08:40 . 2007-12-01 08:40 <DIR> d
    C:\Program Files\Windows Live Favorites

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2007-12-27 06:37
    d
    w C:\Documents and Settings\dilys woo\Application Data\toshiba
    2007-12-22 13:31
    d
    w C:\Program Files\Common Files\Symantec Shared
    2007-12-09 14:17
    d
    w C:\Program Files\Common Files\Adobe
    2007-12-05 15:12
    d
    w C:\Documents and Settings\dilys woo\Application Data\uTorrent
    2007-12-01 00:41
    d
    w C:\Program Files\Windows Live Toolbar
    2007-11-17 04:30
    d
    w C:\Program Files\PowerISO
    2007-11-17 03:09
    d
    w C:\Documents and Settings\All Users\Application Data\ALM
    2007-11-17 03:07
    d
    w C:\Program Files\Adobe CS3
    2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
    2007-11-09 14:44
    d
    w C:\Program Files\Bonjour
    2007-11-09 14:31
    d
    w C:\Program Files\Common Files\Macrovision Shared
    2007-11-09 14:14
    d
    w C:\Program Files\Windows Installer Clean Up
    2007-11-09 14:14
    d
    w C:\Program Files\MSECACHE
    2007-11-09 12:18
    d
    w C:\Program Files\BitTorrent
    2007-11-09 11:30
    d
    w C:\Documents and Settings\dilys woo\Application Data\BitTorrent
    2007-11-09 11:23 359,808 ----a-w C:\WINDOWS\system32\drivers\TCPIP.SYS.ORIGINAL
    2007-11-09 11:23 359,808 ----a-w C:\WINDOWS\system32\drivers\TCPIP.SYS
    2007-11-09 11:18
    d
    w C:\Program Files\uTorrent
    2007-11-02 13:03
    d--h--w C:\Program Files\InstallShield Installation Information
    2007-04-08 10:32 37,860,928 ----a-w C:\Program Files\iTunesSetup.exe
    2007-03-13 22:46 20,607 ----a-w C:\Program Files\Illustrator CS3 Read Me.html
    2006-02-18 19:28 12,288 ----a-w C:\WINDOWS\Fonts\RandFont.dll
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" []
    "TOSCDSPD"="C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe" [2004-12-30 16:32]
    "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54]
    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 20:00]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ZoomingHook"="ZoomingHook.exe" [2005-06-07 01:58 C:\WINDOWS\system32\ZoomingHook.exe]
    "Tvs"="C:\Program Files\Toshiba\Tvs\TvsTray.exe" [2005-12-01 04:25]
    "TPSMain"="TPSMain.exe" [2005-06-01 09:16 C:\WINDOWS\system32\TPSMain.exe]
    "TPNF"="C:\Program Files\TOSHIBA\TouchPad\TPTray.exe" [2005-12-14 08:28]
    "TFncKy"="TFncKy.exe" []
    "TDispVol"="TDispVol.exe" [2005-12-28 08:34 C:\WINDOWS\system32\TDispVol.exe]
    "TCtryIOHook"="TCtrlIOHook.exe" [2005-12-06 06:50 C:\WINDOWS\system32\TCtrlIOHook.exe]
    "SVPWUTIL"="C:\Program Files\Toshiba\Windows Utilities\SVPWUTIL.exe" [2004-05-02 05:45]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]
    "SmoothView"="C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe" [2005-04-27 08:13]
    "RTHDCPL"="RTHDCPL.EXE" [2005-12-09 15:49 C:\WINDOWS\RTHDCPL.exe]
    "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-16 10:54]
    "PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2007-08-07 08:05]
    "PSQLLauncher"="C:\Program Files\Protector Suite QL\launcher.exe" [2005-12-16 15:32]
    "PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 20:00]
    "PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 20:00]
    "PCSuiteTrayApplication"="C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.exe" [2006-06-15 12:36]
    "PadTouch"="C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe" [2005-07-16 02:52]
    "NDSTray.exe"="NDSTray.exe" []
    "MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 20:00]
    "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-03-14 19:05]
    "IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [2005-12-05 12:37]
    "IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2005-11-28 11:41]
    "IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-04 20:00]
    "igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-11-28 13:55]
    "igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-11-28 13:55]
    "igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-11-28 13:52]
    "HWSetup"="C:\Program Files\TOSHIBA\TOSHIBA Applet\HWSetup.exe" [2004-05-02 05:45]
    "DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2005-10-06 21:20]
    "CFSServ.exe"="CFSServ.exe" []
    "CeEKEY"="C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe" [2005-12-02 03:13]
    "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-03-23 16:43]
    "BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 00:56 C:\WINDOWS\system32\bthprops.cpl]
    "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2005-08-13 06:43]
    "Apoint"="C:\Program Files\Apoint2K\Apoint.exe" [2004-03-23 22:40]
    "AGRSMMSG"="AGRSMMSG.exe" [2005-10-15 06:29 C:\WINDOWS\agrsmmsg.exe]
    "AdobeVersionCue"="C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe" [2003-10-13 16:24]
    "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51]
    "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 02:41]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    "POSTRBT"="C:\Program Files\Norton AntiVirus\Navw32.exe" [2006-02-05 01:03]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    Bluetooth Monitor.lnk - C:\Program Files\TOSHIBA\Bluetooth Monitor\BtMon2.exe [2006-05-02 18:20:28]
    HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 04:21:22]
    HP Photosmart Premier Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2006-02-10 07:56:20]
    RAMASST.lnk - C:\WINDOWS\system32\RAMASST.exe [2005-12-22 10:00:05]
    WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE [2006-04-23 14:51:26]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus]
    psqlpwd.dll 2005-12-16 15:46 40448 C:\WINDOWS\system32\psqlpwd.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^dilys woo^Start Menu^Programs^Startup^RollerCoaster Tycoon 3 Registration.lnk]
    path=C:\Documents and Settings\dilys woo\Start Menu\Programs\Startup\RollerCoaster Tycoon 3 Registration.lnk
    backup=C:\WINDOWS\pss\RollerCoaster Tycoon 3 Registration.lnkStartup

    R1 TPwSav;Common Driver;C:\WINDOWS\system32\Drivers\TPwSav.sys [2005-12-02 02:55]
    R2 FdRedir;FdRedir;C:\Program Files\Common Files\Protector Suite QL\Drivers\FdRedir.sys [2005-12-16 16:00]
    R2 FileDisk2;FileDisk Protector Kernel Driver;C:\Program Files\Common Files\Protector Suite QL\Drivers\filedisk.sys [2005-12-16 16:00]
    R2 smihlp;SMI helper driver;C:\Program Files\Protector Suite QL\smihlp.sys [2005-12-16 15:28]
    R3 TcUsb;TC USB Kernel Driver;C:\WINDOWS\system32\Drivers\tcusb.sys [2005-12-16 15:40]
    R3 tosrfec;Bluetooth ACPI from TOSHIBA;C:\WINDOWS\system32\DRIVERS\tosrfec.sys [2004-05-17 15:18]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{246a5cc8-91d7-11dc-9f47-00037a126e8b}]
    \Shell\Auto\command - sal.xls.exe
    \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL sal.xls.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3c39eaff-8240-11dc-9f24-00037a126e8b}]
    \Shell\AutoRun\command - I:\ntdelect.com
    \Shell\explore\Command - I:\ntdelect.com
    \Shell\open\Command - I:\ntdelect.com

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4aac5ccc-6f76-11dc-9efa-00037a126e8b}]
    \Shell\Auto\command - E:\sal.xls.exe
    \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL sal.xls.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{54e65db4-7014-11dc-9efb-00037a126e8b}]
    \Shell\Auto\command - sal.xls.exe
    \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL sal.xls.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{93b6022b-0f26-11dc-9e54-00037a126e8b}]
    \Shell\AutoRun\command - I:\LaunchU3.exe -a

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{93b60230-0f26-11dc-9e54-00037a126e8b}]
    \Shell\AutoRun\command - F:\SGP2006.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b87b6e08-09b7-11dc-9e47-00037a126e8b}]
    \Shell\Auto\command - e:\QQzone.exe
    \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL e:\QQzone.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d807c69e-7f4f-11db-9d69-00037a126e8b}]
    \Shell\AutoRun\command - E:\LaunchU3.exe -a

    .
    Contents of the 'Scheduled Tasks' folder
    "2007-04-20 23:26:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
    "2007-12-28 06:15:04 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
    - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
    "2007-11-16 19:53:54 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - dilys woo.job"
    - C:\PROGRA~1\NORTON~1\Navw32.exeh/TASK:
    .
    **************************************************************************

    catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2007-12-28 14:20:04
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    **************************************************************************
    .
    Completion time: 2007-12-28 14:24:07 - machine was rebooted
    C:\ComboFix2.txt ... 2007-10-28 13:29
    C:\ComboFix3.txt ... 2007-10-25 21:13
    .
    2007-12-22 13:38:40 --- E O F ---
  • Baabiouz
    edited December 2007
    Hi!

    Please visit Virustotal
    * Click the Browse... button
    * Navigate to the file C:\WINDOWS\unvise32.exe

    * Click the Open button
    * Click the Send button
    * Copy and paste the results back here

    Do also the same thing for this file:
    C:\WINDOWS\nltpth.nlt


    Copy and paste the results back here ;)
  • deelist
    edited December 2007
    Antivirus Version Last Update Result AhnLab-V32007.12.28.122007.12.28-AntiVir7.6.0.462007.12.28-Authentium4.93.82007.12.28-Avast4.7.1098.02007.12.27-AVG7.5.0.5162007.12.28-BitDefender7.22007.12.28-CAT-QuickHeal9.002007.12.28-ClamAV0.91.22007.12.28-DrWeb4.44.0.091702007.12.28-eSafe7.0.15.02007.12.27-eTrust-Vet31.3.54082007.12.28-Ewido4.02007.12.28-FileAdvisor12007.12.28-Fortinet3.14.0.02007.12.28-F-Prot4.4.2.542007.12.28-F-Secure6.70.13030.02007.12.28-IkarusT3.1.1.152007.12.28-Kaspersky7.0.0.1252007.12.28-McAfee51942007.12.27-Microsoft1.31092007.12.28-NOD32v227532007.12.28-Norman5.80.022007.12.28-Panda9.0.0.42007.12.27-Prevx1V22007.12.28-Rising20.24.42.002007.12.28-Sophos4.24.02007.12.28-Sunbelt2.2.907.02007.12.28-Symantec102007.12.28-TheHacker6.2.9.1722007.12.27-VBA323.12.2.52007.12.26-VirusBuster4.3.26:92007.12.28-Webwasher-Gateway6.6.22007.12.28- Additional information File size: 90112 bytesMD5: 2df12458ae83e3f19723cf48866b21d4SHA1: 2c4255716108bde9151571e70d35a22e0b0fce3aPEiD: Armadillo v1.71


    AhnLab-V32007.12.28.122007.12.28-AntiVir7.6.0.462007.12.28-Authentium4.93.82007.12.28-Avast4.7.1098.02007.12.27-AVG7.5.0.5162007.12.28-BitDefender7.22007.12.28-CAT-QuickHeal9.002007.12.28-ClamAV0.91.22007.12.28-DrWeb4.44.0.091702007.12.28-eSafe7.0.15.02007.12.27-eTrust-Vet31.3.54082007.12.28-Ewido4.02007.12.28-FileAdvisor12007.12.28-Fortinet3.14.0.02007.12.28-F-Prot4.4.2.542007.12.28-F-Secure6.70.13030.02007.12.28-IkarusT3.1.1.152007.12.28-Kaspersky7.0.0.1252007.12.28-McAfee51942007.12.27-Microsoft1.31092007.12.28-NOD32v227532007.12.28-Norman5.80.022007.12.28-Panda9.0.0.42007.12.27-Prevx1V22007.12.28-Rising20.24.42.002007.12.28-Sophos4.24.02007.12.28-Sunbelt2.2.907.02007.12.28-Symantec102007.12.28-TheHacker6.2.9.1722007.12.27-VBA323.12.2.52007.12.26-VirusBuster4.3.26:92007.12.28-Webwasher-Gateway6.6.22007.12.28- Additional information File size: 70 bytesMD5: 11d8147e076f7b6b6eef8d358ef47602SHA1: 0bf50eb174cc83fb75e20d86b16b03aaa3a61eeePEiD: -
  • Baabiouz
    edited December 2007
    Hi!

    Step #1

    Open notepad and copy/paste the text in the quotebox below into it:
    File::
e:\QQzone.exe
F:\SGP2006.exe
C:\WINDOWS\system32\aabgtgnb.tmp

Registry::
[HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{246a5cc8-91d7-11dc-9f47-00037a126e8b}]
[-HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{3c39eaff-8240-11dc-9f24-00037a126e8b}]
[-HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{4aac5ccc-6f76-11dc-9efa-00037a126e8b}]
[-HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{54e65db4-7014-11dc-9efb-00037a126e8b}]
[-HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{93b60230-0f26-11dc-9e54-00037a126e8b}]

    Save this as CFScript.txt

    CFScript.gif

    Refering to the picture above, drag CFScript.txt into ComboFix.exe

    When finished, it shall produce a log for you, C:\ComboFix.txt. Post that log in your next reply.


    Step #2


    Please do the following...

    Download ATF (Atribune Temp File) Cleaner© by Atribune to your desktop.
    This program is for XP and Windows 2000 only!

    Double-click ATF Cleaner.exe to open it.

    Under Main select the following:
    • Windows Temp
    • Current User Temp
    • All Users Temp
    • Temporary Internet Files
    • Prefetch
    • Java Cache
    *The other boxes are optional*
    Then click the Empty Selected button.

    Click Exit on the Main menu to close the program.

    Please download AVG Anti-Spyware to your Desktop or to your usual Download Folder.
    AVG Anti-Spyware
    • Install AVG Anti-Spyware by double clicking the installer.
    • Follow the prompts. Make sure that Launch AVG Anti-Spyware is checked.
    • On the main screen under Your Computer's security.
      • Click on Change state next to Resident shield. It should now change to inactive.
      • Click on Change state next to Automatic updates. It should now change to inactive.
      • Next to Last Update, click on Update now. (You will need an active internet connection to perform this)
      • Wait until you see the Update succesfull message.
    • Right-click the AVG Anti-Spyware Tray Icon and uncheck Start with Windows.
    • Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.
    If you are having problems with the updater, you can use this link to manually update ewido.
    AVG Anti-Spyware manual updates.
    Download the Full database to your Desktop or to your usual Download Folder and install it by double clicking the file. Make sure that AVG Anti-Spyware is closed before installing the update.

    Reboot your computer in Safe Mode.
    • If the computer is running, shut down Windows, and then turn off the power.
    • Wait 30 seconds, and then turn the computer on.
    • Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
    • Ensure that the Safe Mode option is selected.
    • Press Enter. The computer then begins to start in Safe mode.
    • Login on your usual account.
    Once in Safe Mode:

    Close ALL open Windows / Programs / Folders. Please start AVG Anti-Spyware and run a full scan.
    • Click on Scanner on the toolbar.
    • Click on the Settings tab.
      • Under How to act?
        • Click on Recommended Action and choose Quarantine from the popup menu.
      • Under How to scan?
        • All checkboxes should be ticked.
      • Under Possibly unwanted software:
        • All checkboxes should be ticked.
      • Under Reports:
        • Select Do not automatically generate reports and uncheck Only if threats were found.
      • Under What to scan?
        • Select Scan every file.
    • Click on the Scan tab.
    • Click on Complete System Scan to start the scan process.
    • Let the program scan the machine.
    • When the scan has finished, follow the instructions below.
      IMPORTANT : Don't click on the "Save Scan Report" button before you did hit the "Apply all Actions" button.
      • Make sure that Set all elements to: shows Quarantine (1), if not click on the link and choose Quarantine from the popup menu. (2)
      • At the bottom of the window click on the Apply all Actions button. (3)
        scanavgjk2.jpg
    • When done, click the Save Scan Report button. (4)
      • Click the Save Report as button.
      • Save the report to your Desktop.
    • Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.
    Reboot back into Normal Mode, and post a new HJT log, along with the AVG Anti-Spyware log.


    Step #3

    Please post a fresh HijackThis log, Combofix log and AVG Anti-Spyware results back here :)
  • deelist
    edited December 2007
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 9:56:38 AM, on 12/30/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
    C:\WINDOWS\system32\DVDRAMSV.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Canon\CAL\CALMAIN.exe
    C:\WINDOWS\system32\ZoomingHook.exe
    C:\Program Files\Toshiba\Tvs\TvsTray.exe
    C:\WINDOWS\system32\TPSMain.exe
    C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
    C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
    C:\WINDOWS\system32\TCtrlIOHook.exe
    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
    C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
    C:\WINDOWS\system32\TPSBattM.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\PowerISO\PWRISOVM.EXE
    C:\Program Files\Protector Suite QL\psqltray.exe
    C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
    C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
    C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
    C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
    C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\System32\DLA\DLACTRLW.EXE
    C:\Program Files\TOSHIBA\ConfigFree\CFSServ.exe
    C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\Apoint2K\Apoint.exe
    C:\WINDOWS\AGRSMMSG.exe
    C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe
    C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Apoint2K\Apntex.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\WINDOWS\system32\RAMASST.exe
    C:\Program Files\WinZip\WZQKPICK.EXE
    C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
    C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
    C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
    C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
    C:\WINDOWS\system32\wbem\wmiapsrv.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\Messenger\msmsgs.exe

    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O4 - HKLM\..\Run: [ZoomingHook] ZoomingHook.exe
    O4 - HKLM\..\Run: [Tvs] C:\Program Files\Toshiba\Tvs\TvsTray.exe
    O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
    O4 - HKLM\..\Run: [TPNF] C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
    O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
    O4 - HKLM\..\Run: [TDispVol] TDispVol.exe
    O4 - HKLM\..\Run: [TCtryIOHook] TCtrlIOHook.exe
    O4 - HKLM\..\Run: [SVPWUTIL] C:\Program Files\Toshiba\Windows Utilities\SVPWUTIL.exe SVPwUTIL
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
    O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
    O4 - HKLM\..\Run: [PSQLLauncher] "C:\Program Files\Protector Suite QL\launcher.exe" /startup
    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
    O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
    O4 - HKLM\..\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
    O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
    O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
    O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
    O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
    O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKLM\..\Run: [HWSetup] C:\Program Files\TOSHIBA\TOSHIBA Applet\HWSetup.exe hwSetUP
    O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
    O4 - HKLM\..\Run: [CFSServ.exe] CFSServ.exe -NoClient
    O4 - HKLM\..\Run: [CeEKEY] C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
    O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
    O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
    O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
    O4 - HKLM\..\Run: [AdobeVersionCue] C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
    O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKUS\S-1-5-18\..\RunOnce: [POSTRBT] C:\Program Files\Norton AntiVirus\Navw32.exe /REMEDIATE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\RunOnce: [POSTRBT] C:\Program Files\Norton AntiVirus\Navw32.exe /REMEDIATE (User 'Default user')
    O4 - Global Startup: Bluetooth Monitor.lnk = ?
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
    O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
    O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
    O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
    O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
    O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-sg\msntabres.dll.mui/229?f3ecfba7ed224c3da266ba2f54c4db56
    O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-sg\msntabres.dll.mui/230?f3ecfba7ed224c3da266ba2f54c4db56
    O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
    O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {CD259AEC-23E6-4E64-8138-7E28D56666D7} (SQFViewer10X Element) - http://www.natuerlich-birkenstock.de/v1/SQFViewer10.ocx
    O17 - HKLM\System\CCS\Services\Tcpip\..\{5D5E162B-9583-41AD-8E3C-5977AB92A85D}: NameServer = 192.168.1.1,218.186.1.38
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: AdobeVersionCue - Adobe Sytems - C:\Program Files\Adobe\Adobe Version Cue\service\VersionCue.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
    O23 - Service: DVD-RAM_Service - Matsu****a Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
    O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Unknown owner - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe (file missing)
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
    O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
    O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
    O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
    O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

    --
    End of file - 14883 bytes


    ComboFix 07-12-21.4 - dilys woo 2007-12-29 23:56:59.5 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.44.1033.18.252 [GMT 8:00]
    Running from: C:\Documents and Settings\dilys woo\Desktop\ComboFix.exe
    Command switches used :: C:\Documents and Settings\dilys woo\Desktop\CFScript.txt
    * Created a new restore point

    FILE
    C:\WINDOWS\system32\aabgtgnb.tmp
    e:\QQzone.exe
    F:\SGP2006.exe
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\WINDOWS\system32\aabgtgnb.tmp

    .
    ((((((((((((((((((((((((( Files Created from 2007-11-28 to 2007-12-29 )))))))))))))))))))))))))))))))
    .

    2007-12-28 18:58 . 2007-12-28 18:58 <DIR> d
    C:\Program Files\Common Files\Control Panels
    2007-12-28 02:43 . 2007-12-28 02:43 <DIR> d
    C:\WINDOWS\ERUNT
    2007-12-27 22:12 . 2007-12-27 22:12 <DIR> d
    C:\Program Files\Trend Micro
    2007-12-25 17:18 . 2007-12-28 00:53 6,228 --a
    C:\WINDOWS\system32\tmp.reg
    2007-12-25 17:17 . 2007-09-05 23:22 289,144 --a
    C:\WINDOWS\system32\VCCLSID.exe
    2007-12-25 17:17 . 2006-04-27 16:49 288,417 --a
    C:\WINDOWS\system32\SrchSTS.exe
    2007-12-25 17:17 . 2007-12-20 23:11 81,920 --a
    C:\WINDOWS\system32\IEDFix.exe
    2007-12-25 17:17 . 2003-06-05 20:13 53,248 --a
    C:\WINDOWS\system32\Process.exe
    2007-12-25 17:17 . 2004-07-31 17:50 51,200 --a
    C:\WINDOWS\system32\dumphive.exe
    2007-12-25 17:17 . 2007-10-03 23:36 25,600 --a
    C:\WINDOWS\system32\WS2Fix.exe
    2007-12-25 17:07 . 2007-12-25 17:08 <DIR> d
    C:\Documents and Settings\dilys woo\Application Data\PrevxCSI
    2007-12-25 17:07 . 2007-12-25 17:07 <DIR> d
    C:\Documents and Settings\All Users\Application Data\Prevx
    2007-12-25 12:00 . 2007-12-25 12:00 <DIR> d
    C:\Documents and Settings\dilys woo\Application Data\SysCleaner
    2007-12-25 11:59 . 2007-12-25 16:59 <DIR> d
    C:\Program Files\SysCleaner
    2007-12-24 13:00 . 2007-12-25 11:45 <DIR> d
    C:\Program Files\MediaVideoCodec
    2007-12-16 12:57 . 2003-03-16 00:15 90,112 --a
    C:\WINDOWS\unvise32.exe
    2007-12-16 12:55 . 2007-12-16 12:57 <DIR> d
    C:\Program Files\Mall Of America Tycoon
    2007-12-16 12:26 . 2007-12-16 12:26 70 --a
    C:\WINDOWS\nltpth.nlt
    2007-12-16 12:25 . 2007-12-16 12:25 <DIR> d
    C:\Program Files\Activision Value
    2007-12-16 12:12 . 2007-12-16 12:15 <DIR> d
    C:\Program Files\Holiday World Tycoon
    2007-12-01 08:40 . 2007-12-01 08:40 <DIR> d
    C:\Program Files\Windows Live Favorites

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2007-12-28 10:58
    d
    w C:\Program Files\Common Files\Adobe
    2007-12-27 06:37
    d
    w C:\Documents and Settings\dilys woo\Application Data\toshiba
    2007-12-22 13:31
    d
    w C:\Program Files\Common Files\Symantec Shared
    2007-12-05 15:12
    d
    w C:\Documents and Settings\dilys woo\Application Data\uTorrent
    2007-12-01 00:41
    d
    w C:\Program Files\Windows Live Toolbar
    2007-11-17 04:30
    d
    w C:\Program Files\PowerISO
    2007-11-17 03:09
    d
    w C:\Documents and Settings\All Users\Application Data\ALM
    2007-11-17 03:07
    d
    w C:\Program Files\Adobe CS3
    2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
    2007-11-09 14:44
    d
    w C:\Program Files\Bonjour
    2007-11-09 14:31
    d
    w C:\Program Files\Common Files\Macrovision Shared
    2007-11-09 14:14
    d
    w C:\Program Files\Windows Installer Clean Up
    2007-11-09 14:14
    d
    w C:\Program Files\MSECACHE
    2007-11-09 12:18
    d
    w C:\Program Files\BitTorrent
    2007-11-09 11:30
    d
    w C:\Documents and Settings\dilys woo\Application Data\BitTorrent
    2007-11-09 11:23 359,808 ----a-w C:\WINDOWS\system32\drivers\TCPIP.SYS.ORIGINAL
    2007-11-09 11:23 359,808 ----a-w C:\WINDOWS\system32\drivers\TCPIP.SYS
    2007-11-09 11:18
    d
    w C:\Program Files\uTorrent
    2007-11-02 13:03
    d--h--w C:\Program Files\InstallShield Installation Information
    2007-10-29 22:43 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
    2007-10-27 09:40 222,720 ----a-w C:\WINDOWS\system32\wmasf.dll
    2007-04-08 10:32 37,860,928 ----a-w C:\Program Files\iTunesSetup.exe
    2007-03-13 22:46 20,607 ----a-w C:\Program Files\Illustrator CS3 Read Me.html
    2006-02-18 19:28 12,288 ----a-w C:\WINDOWS\Fonts\RandFont.dll
    .

    ((((((((((((((((((((((((((((( snapshot@2007-12-28_14.21.39.56 )))))))))))))))))))))))))))))))))))))))))
    .
    - 2007-12-24 03:40:39 1,701,928 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT
    + 2007-12-29 13:31:21 1,701,960 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" []
    "TOSCDSPD"="C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe" [2004-12-30 16:32]
    "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54]
    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 20:00]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ZoomingHook"="ZoomingHook.exe" [2005-06-07 01:58 C:\WINDOWS\system32\ZoomingHook.exe]
    "Tvs"="C:\Program Files\Toshiba\Tvs\TvsTray.exe" [2005-12-01 04:25]
    "TPSMain"="TPSMain.exe" [2005-06-01 09:16 C:\WINDOWS\system32\TPSMain.exe]
    "TPNF"="C:\Program Files\TOSHIBA\TouchPad\TPTray.exe" [2005-12-14 08:28]
    "TFncKy"="TFncKy.exe" []
    "TDispVol"="TDispVol.exe" [2005-12-28 08:34 C:\WINDOWS\system32\TDispVol.exe]
    "TCtryIOHook"="TCtrlIOHook.exe" [2005-12-06 06:50 C:\WINDOWS\system32\TCtrlIOHook.exe]
    "SVPWUTIL"="C:\Program Files\Toshiba\Windows Utilities\SVPWUTIL.exe" [2004-05-02 05:45]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]
    "SmoothView"="C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe" [2005-04-27 08:13]
    "RTHDCPL"="RTHDCPL.EXE" [2005-12-09 15:49 C:\WINDOWS\RTHDCPL.exe]
    "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-16 10:54]
    "PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2007-08-07 08:05]
    "PSQLLauncher"="C:\Program Files\Protector Suite QL\launcher.exe" [2005-12-16 15:32]
    "PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 20:00]
    "PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 20:00]
    "PCSuiteTrayApplication"="C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.exe" [2006-06-15 12:36]
    "PadTouch"="C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe" [2005-07-16 02:52]
    "NDSTray.exe"="NDSTray.exe" []
    "MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 20:00]
    "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-03-14 19:05]
    "IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [2005-12-05 12:37]
    "IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2005-11-28 11:41]
    "IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-04 20:00]
    "igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-11-28 13:55]
    "igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-11-28 13:55]
    "igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-11-28 13:52]
    "HWSetup"="C:\Program Files\TOSHIBA\TOSHIBA Applet\HWSetup.exe" [2004-05-02 05:45]
    "DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2005-10-06 21:20]
    "CFSServ.exe"="CFSServ.exe" []
    "CeEKEY"="C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe" [2005-12-02 03:13]
    "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-03-23 16:43]
    "BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 00:56 C:\WINDOWS\system32\bthprops.cpl]
    "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2005-08-13 06:43]
    "Apoint"="C:\Program Files\Apoint2K\Apoint.exe" [2004-03-23 22:40]
    "AGRSMMSG"="AGRSMMSG.exe" [2005-10-15 06:29 C:\WINDOWS\agrsmmsg.exe]
    "AdobeVersionCue"="C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe" [2003-10-13 16:24]
    "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51]
    "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 02:41]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    "POSTRBT"="C:\Program Files\Norton AntiVirus\Navw32.exe" [2006-02-05 01:03]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    Bluetooth Monitor.lnk - C:\Program Files\TOSHIBA\Bluetooth Monitor\BtMon2.exe [2006-05-02 18:20:28]
    HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 04:21:22]
    HP Photosmart Premier Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2006-02-10 07:56:20]
    RAMASST.lnk - C:\WINDOWS\system32\RAMASST.exe [2005-12-22 10:00:05]
    WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE [2006-04-23 14:51:26]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus]
    psqlpwd.dll 2005-12-16 15:46 40448 C:\WINDOWS\system32\psqlpwd.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^dilys woo^Start Menu^Programs^Startup^RollerCoaster Tycoon 3 Registration.lnk]
    path=C:\Documents and Settings\dilys woo\Start Menu\Programs\Startup\RollerCoaster Tycoon 3 Registration.lnk
    backup=C:\WINDOWS\pss\RollerCoaster Tycoon 3 Registration.lnkStartup

    R1 TPwSav;Common Driver;C:\WINDOWS\system32\Drivers\TPwSav.sys [2005-12-02 02:55]
    R2 FdRedir;FdRedir;C:\Program Files\Common Files\Protector Suite QL\Drivers\FdRedir.sys [2005-12-16 16:00]
    R2 FileDisk2;FileDisk Protector Kernel Driver;C:\Program Files\Common Files\Protector Suite QL\Drivers\filedisk.sys [2005-12-16 16:00]
    R2 smihlp;SMI helper driver;C:\Program Files\Protector Suite QL\smihlp.sys [2005-12-16 15:28]
    R3 TcUsb;TC USB Kernel Driver;C:\WINDOWS\system32\Drivers\tcusb.sys [2005-12-16 15:40]
    R3 tosrfec;Bluetooth ACPI from TOSHIBA;C:\WINDOWS\system32\DRIVERS\tosrfec.sys [2004-05-17 15:18]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{246a5cc8-91d7-11dc-9f47-00037a126e8b}]
    \Shell\Auto\command - sal.xls.exe
    \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL sal.xls.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3c39eaff-8240-11dc-9f24-00037a126e8b}]
    \Shell\AutoRun\command - I:\ntdelect.com
    \Shell\explore\Command - I:\ntdelect.com
    \Shell\open\Command - I:\ntdelect.com

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4aac5ccc-6f76-11dc-9efa-00037a126e8b}]
    \Shell\Auto\command - E:\sal.xls.exe
    \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL sal.xls.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{54e65db4-7014-11dc-9efb-00037a126e8b}]
    \Shell\Auto\command - sal.xls.exe
    \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL sal.xls.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{93b6022b-0f26-11dc-9e54-00037a126e8b}]
    \Shell\AutoRun\command - I:\LaunchU3.exe -a

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{93b60230-0f26-11dc-9e54-00037a126e8b}]
    \Shell\AutoRun\command - F:\SGP2006.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b87b6e08-09b7-11dc-9e47-00037a126e8b}]
    \Shell\Auto\command - e:\QQzone.exe
    \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL e:\QQzone.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d807c69e-7f4f-11db-9d69-00037a126e8b}]
    \Shell\AutoRun\command - E:\LaunchU3.exe -a

    .
    Contents of the 'Scheduled Tasks' folder
    "2007-04-20 23:26:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
    "2007-12-29 15:15:01 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
    - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
    "2007-11-16 19:53:54 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - dilys woo.job"
    - C:\PROGRA~1\NORTON~1\Navw32.exeh/TASK:
    .
    **************************************************************************

    catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2007-12-30 00:01:20
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2007-12-30 0:02:11
    C:\ComboFix2.txt ... 2007-12-28 14:24
    C:\ComboFix3.txt ... 2007-10-28 13:29
    .
    2007-12-22 13:38:40 --- E O F ---
  • deelist
    edited December 2007
    AVG Anti-Spyware - Scan Report

    + Created at: 9:49:37 AM 12/30/2007

    + Scan result:



    C:\SDFix\backups_old1\domnftwmnf.dll -> Not-A-Virus.Adware.Vapsup : Ignored.
    C:\SDFix\backups_old1\emlkdvo.dll -> Not-A-Virus.Adware.Vapsup : Ignored.
    C:\System Volume Information\_restore{0F60396B-0F5E-4E50-B649-25D2D5E11E35}\RP2\A0000299.dll -> Not-A-Virus.Adware.Vapsup : Ignored.
    C:\System Volume Information\_restore{0F60396B-0F5E-4E50-B649-25D2D5E11E35}\RP2\A0000300.dll -> Not-A-Virus.Adware.Vapsup : Ignored.
    :mozilla.294:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.295:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.296:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.297:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.298:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.299:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.300:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.301:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.302:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.303:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.304:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.607:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.715:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.719:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.782:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.918:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.935:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
    :mozilla.936:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
    :mozilla.121:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
    :mozilla.122:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
    :mozilla.123:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
    :mozilla.124:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
    :mozilla.125:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
    :mozilla.126:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
    :mozilla.127:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
    :mozilla.128:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
    :mozilla.484:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Adtech : Cleaned.
    :mozilla.360:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
    :mozilla.361:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
    :mozilla.362:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
    :mozilla.363:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
    :mozilla.364:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
    :mozilla.164:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned.
    :mozilla.46:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Bfast : Cleaned.
    :mozilla.788:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Bluestreak : Cleaned.
    :mozilla.189:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
    :mozilla.190:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
    :mozilla.191:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
    :mozilla.337:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
    :mozilla.338:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
    :mozilla.339:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
    :mozilla.340:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
    :mozilla.341:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
    :mozilla.342:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
    :mozilla.343:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
    :mozilla.344:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
    :mozilla.345:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
    :mozilla.346:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
    :mozilla.166:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned.
    :mozilla.588:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned.
    :mozilla.589:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned.
    :mozilla.590:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned.
    :mozilla.591:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned.
    :mozilla.328:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
    :mozilla.329:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
    :mozilla.330:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
    :mozilla.331:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
    :mozilla.332:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
    :mozilla.333:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
    :mozilla.334:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
    :mozilla.335:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
    :mozilla.78:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned.
    :mozilla.396:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
    :mozilla.397:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
    :mozilla.398:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
    :mozilla.433:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
    :mozilla.627:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
    :mozilla.628:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
    :mozilla.629:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
    :mozilla.630:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
    :mozilla.631:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
    :mozilla.632:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
    :mozilla.643:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
    :mozilla.644:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
    :mozilla.368:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Hitslink : Cleaned.
    :mozilla.431:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Imrworldwide : Cleaned.
    :mozilla.432:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Imrworldwide : Cleaned.
    :mozilla.575:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned.
    :mozilla.820:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned.
    :mozilla.165:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned.
    :mozilla.569:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Netflame : Cleaned.
    :mozilla.592:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
    :mozilla.593:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
    :mozilla.594:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
    :mozilla.595:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
    :mozilla.596:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
    :mozilla.597:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
    :mozilla.598:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
    :mozilla.599:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
    :mozilla.600:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
    :mozilla.129:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
    :mozilla.130:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
    :mozilla.147:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
    :mozilla.148:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
    :mozilla.152:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
    :mozilla.153:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
    :mozilla.154:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
    :mozilla.155:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
    :mozilla.157:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
    :mozilla.158:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
    :mozilla.159:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
    :mozilla.160:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
    :mozilla.161:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
    :mozilla.162:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
    :mozilla.163:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
    :mozilla.391:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned.
    :mozilla.392:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned.
    :mozilla.393:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned.
    :mozilla.402:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
    :mozilla.403:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
    :mozilla.404:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
    :mozilla.405:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
    :mozilla.406:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
    :mozilla.407:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
    :mozilla.408:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
    :mozilla.215:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.216:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.217:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.218:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.219:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.220:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.221:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.222:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.223:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.224:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.225:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.226:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.227:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.228:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.229:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.230:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.231:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.232:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.233:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.234:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.235:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.236:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.237:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.238:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.239:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.240:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.241:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.242:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.243:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.244:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.245:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.246:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.247:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.248:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.249:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.250:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.251:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.252:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.253:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.254:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.255:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.256:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.257:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.258:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.259:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.260:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.261:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.262:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.263:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.264:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.144:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
    :mozilla.145:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
    :mozilla.146:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
    :mozilla.150:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
    :mozilla.151:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
    :mozilla.359:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
    :mozilla.110:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
    :mozilla.111:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
    :mozilla.531:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Webtrends : Cleaned.
    :mozilla.372:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned.
    :mozilla.584:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Yadro : Cleaned.
    :mozilla.279:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
    :mozilla.280:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
    :mozilla.281:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
    :mozilla.282:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
    :mozilla.283:C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.


    ::Report end
  • Baabiouz
    edited December 2007
    Hi!

    Step #1
    Please click on Start > Control Panel > Add/Remove Programs and uninstall the following programs(if present):

    MediaVideoCodec

    SysCleaner

    Reboot your computer

    Step #2
    Open notepad and copy/paste the text in the quotebox below into it:
    File::
I:\ntdelect.com
E:\sal.xls.exe
F:\SGP2006.exe
e:\QQzone.exe

Folder::
C:\Program Files\MediaVideoCodec
C:\Program Files\SysCleaner

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{246a5cc8-91d7-11dc-9f47-00037a126e8b}]
[-HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{4aac5ccc-6f76-11dc-9efa-00037a126e8b}]
[-HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{54e65db4-7014-11dc-9efb-00037a126e8b}]
[-HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{93b60230-0f26-11dc-9e54-00037a126e8b}]
[-HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{b87b6e08-09b7-11dc-9e47-00037a126e8b}]

    Save this as CFScript.txt

    CFScript.gif

    Refering to the picture above, drag CFScript.txt into ComboFix.exe

    When finished, it shall produce a log for you, C:\ComboFix.txt. Post that log in your next reply.

    Step #3
    Please post a fresh Hijackthis log and Combofix log back here :)
  • deelist
    edited December 2007
    ComboFix 07-12-31.4 - dilys woo 2007-12-31 13:53:40.6 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.44.1033.18.176 [GMT 8:00]
    Running from: C:\Documents and Settings\dilys woo\Desktop\ComboFix.exe
    Command switches used :: C:\Documents and Settings\dilys woo\Desktop\CFScript.txt
    * Created a new restore point

    FILE
    e:\QQzone.exe
    E:\sal.xls.exe
    F:\SGP2006.exe
    I:\ntdelect.com
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\Program Files\MediaVideoCodec
    C:\Program Files\SysCleaner
    C:\WINDOWS\system32\bbqndash.ini
    C:\WINDOWS\system32\btdmyirk.ini
    C:\WINDOWS\system32\cdkbxpwy.ini
    C:\WINDOWS\system32\djkyvsgj.ini
    C:\WINDOWS\system32\dujkqrph.ini
    C:\WINDOWS\system32\fllrvvbh.ini
    C:\WINDOWS\system32\fqjxocxk.ini
    C:\WINDOWS\system32\gkxxvisd.ini
    C:\WINDOWS\system32\grlabpxd.ini
    C:\WINDOWS\system32\huwmscej.ini
    C:\WINDOWS\system32\ijmmcvnv.ini
    C:\WINDOWS\system32\jterltsa.ini
    C:\WINDOWS\system32\jueerypp.ini
    C:\WINDOWS\system32\lnfprffc.ini
    C:\WINDOWS\system32\mbgamtwr.ini
    C:\WINDOWS\system32\mdmfdshj.ini
    C:\WINDOWS\system32\pcdkvfdj.ini
    C:\WINDOWS\system32\pnebfwrt.ini
    C:\WINDOWS\system32\qifyhkjg.ini
    C:\WINDOWS\system32\qvmdqorp.ini
    C:\WINDOWS\system32\rrvqrurw.ini
    C:\WINDOWS\system32\rrxrulop.ini
    C:\WINDOWS\system32\rwjrvbly.ini
    C:\WINDOWS\system32\tetotuqn.ini
    C:\WINDOWS\system32\vdbkyuyy.ini
    C:\WINDOWS\system32\wiyxltdm.ini
    C:\WINDOWS\system32\wsrihtdj.ini

    .
    ((((((((((((((((((((((((( Files Created from 2007-11-28 to 2007-12-31 )))))))))))))))))))))))))))))))
    .

    2007-12-31 13:52 . 2000-08-31 08:00 51,200 --a
    C:\WINDOWS\NirCmd.exe
    2007-12-30 21:53 . 2007-12-30 21:53 54,156 --ah
    C:\WINDOWS\QTFont.qfn
    2007-12-30 21:53 . 2007-12-30 21:53 1,409 --a
    C:\WINDOWS\QTFont.for
    2007-12-30 00:21 . 2005-12-22 11:56 <DIR> d
    C:\Documents and Settings\Administrator\WINDOWS
    2007-12-30 00:21 . 2005-12-22 11:22 <DIR> d
    C:\Documents and Settings\Administrator\Application Data\toshiba
    2007-12-30 00:21 . 2006-04-10 11:47 <DIR> d
    C:\Documents and Settings\Administrator\Application Data\Intel
    2007-12-30 00:21 . 2005-12-22 08:55 <DIR> d
    C:\Documents and Settings\Administrator\Application Data\ATI
    2007-12-28 18:58 . 2007-12-28 18:58 <DIR> d
    C:\Program Files\Common Files\Control Panels
    2007-12-28 02:43 . 2007-12-28 02:43 <DIR> d
    C:\WINDOWS\ERUNT
    2007-12-27 22:12 . 2007-12-27 22:12 <DIR> d
    C:\Program Files\Trend Micro
    2007-12-25 17:18 . 2007-12-28 00:53 6,228 --a
    C:\WINDOWS\system32\tmp.reg
    2007-12-25 17:17 . 2007-09-05 23:22 289,144 --a
    C:\WINDOWS\system32\VCCLSID.exe
    2007-12-25 17:17 . 2006-04-27 16:49 288,417 --a
    C:\WINDOWS\system32\SrchSTS.exe
    2007-12-25 17:17 . 2007-12-20 23:11 81,920 --a
    C:\WINDOWS\system32\IEDFix.exe
    2007-12-25 17:17 . 2003-06-05 20:13 53,248 --a
    C:\WINDOWS\system32\Process.exe
    2007-12-25 17:17 . 2004-07-31 17:50 51,200 --a
    C:\WINDOWS\system32\dumphive.exe
    2007-12-25 17:17 . 2007-10-03 23:36 25,600 --a
    C:\WINDOWS\system32\WS2Fix.exe
    2007-12-25 17:07 . 2007-12-25 17:08 <DIR> d
    C:\Documents and Settings\dilys woo\Application Data\PrevxCSI
    2007-12-25 17:07 . 2007-12-25 17:07 <DIR> d
    C:\Documents and Settings\All Users\Application Data\Prevx
    2007-12-25 12:00 . 2007-12-25 12:00 <DIR> d
    C:\Documents and Settings\dilys woo\Application Data\SysCleaner
    2007-12-16 12:57 . 2003-03-16 00:15 90,112 --a
    C:\WINDOWS\unvise32.exe
    2007-12-16 12:55 . 2007-12-16 12:57 <DIR> d
    C:\Program Files\Mall Of America Tycoon
    2007-12-16 12:26 . 2007-12-16 12:26 70 --a
    C:\WINDOWS\nltpth.nlt
    2007-12-16 12:25 . 2007-12-16 12:25 <DIR> d
    C:\Program Files\Activision Value
    2007-12-16 12:12 . 2007-12-16 12:15 <DIR> d
    C:\Program Files\Holiday World Tycoon
    2007-12-01 08:40 . 2007-12-01 08:40 <DIR> d
    C:\Program Files\Windows Live Favorites
    2007-11-17 12:30 . 2007-11-17 12:30 <DIR> d
    C:\Program Files\PowerISO
    2007-11-17 11:09 . 2007-11-17 11:09 <DIR> d
    C:\Documents and Settings\All Users\Application Data\ALM
    2007-11-17 11:04 . 2007-11-17 11:07 <DIR> d
    C:\Program Files\Adobe CS3
    2007-11-09 22:44 . 2007-11-09 22:44 <DIR> d
    C:\Program Files\Bonjour
    2007-11-09 22:31 . 2007-11-09 22:31 <DIR> d
    C:\Program Files\Common Files\Macrovision Shared
    2007-11-09 22:14 . 2007-11-09 22:14 <DIR> d
    C:\Program Files\Windows Installer Clean Up
    2007-11-09 22:14 . 2007-11-09 22:14 <DIR> d
    C:\Program Files\MSECACHE
    2007-11-09 19:23 . 2007-11-09 19:23 359,808 --a
    C:\WINDOWS\system32\drivers\TCPIP.SYS.ORIGINAL
    2007-11-09 19:18 . 2007-11-09 19:18 <DIR> d
    C:\Program Files\uTorrent
    2007-11-09 19:18 . 2007-12-05 23:12 <DIR> d
    C:\Documents and Settings\dilys woo\Application Data\uTorrent
    2007-11-08 20:01 . 2007-11-08 20:01 <DIR> d
    C:\Documents and Settings\dilys woo\.DownloadManager

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2007-12-28 10:58
    d
    w C:\Program Files\Common Files\Adobe
    2007-12-27 06:37
    d
    w C:\Documents and Settings\dilys woo\Application Data\toshiba
    2007-12-22 13:31
    d
    w C:\Program Files\Common Files\Symantec Shared
    2007-12-01 00:41
    d
    w C:\Program Files\Windows Live Toolbar
    2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
    2007-11-09 12:18
    d
    w C:\Program Files\BitTorrent
    2007-11-09 11:30
    d
    w C:\Documents and Settings\dilys woo\Application Data\BitTorrent
    2007-11-09 11:23 359,808 ----a-w C:\WINDOWS\system32\drivers\TCPIP.SYS
    2007-11-02 13:03
    d--h--w C:\Program Files\InstallShield Installation Information
    2007-10-29 22:43 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
    2007-10-27 09:40 222,720 ----a-w C:\WINDOWS\system32\wmasf.dll
    2007-04-08 10:32 37,860,928 ----a-w C:\Program Files\iTunesSetup.exe
    2007-03-13 22:46 20,607 ----a-w C:\Program Files\Illustrator CS3 Read Me.html
    2006-02-18 19:28 12,288 ----a-w C:\WINDOWS\Fonts\RandFont.dll
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [ ]
    "TOSCDSPD"="C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe" [2004-12-30 16:32 65536]
    "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54 5674352]
    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 20:00 15360]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ZoomingHook"="ZoomingHook.exe" [2005-06-07 01:58 24576 C:\WINDOWS\system32\ZoomingHook.exe]
    "Tvs"="C:\Program Files\Toshiba\Tvs\TvsTray.exe" [2005-12-01 04:25 73728]
    "TPSMain"="TPSMain.exe" [2005-06-01 09:16 282624 C:\WINDOWS\system32\TPSMain.exe]
    "TPNF"="C:\Program Files\TOSHIBA\TouchPad\TPTray.exe" [2005-12-14 08:28 53248]
    "TFncKy"="TFncKy.exe" []
    "TDispVol"="TDispVol.exe" [2005-12-28 08:34 73728 C:\WINDOWS\system32\TDispVol.exe]
    "TCtryIOHook"="TCtrlIOHook.exe" [2005-12-06 06:50 28672 C:\WINDOWS\system32\TCtrlIOHook.exe]
    "SVPWUTIL"="C:\Program Files\Toshiba\Windows Utilities\SVPWUTIL.exe" [2004-05-02 05:45 65536]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
    "SmoothView"="C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe" [2005-04-27 08:13 122880]
    "RTHDCPL"="RTHDCPL.EXE" [2005-12-09 15:49 15691264 C:\WINDOWS\RTHDCPL.exe]
    "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-16 10:54 282624]
    "PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2007-08-07 08:05 200704]
    "PSQLLauncher"="C:\Program Files\Protector Suite QL\launcher.exe" [2005-12-16 15:32 30208]
    "PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 20:00 455168]
    "PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 20:00 455168]
    "PCSuiteTrayApplication"="C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.exe" [2006-06-15 12:36 229376]
    "PadTouch"="C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe" [2005-07-16 02:52 1077322]
    "NDSTray.exe"="NDSTray.exe" []
    "MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 20:00 59392]
    "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-03-14 19:05 257088]
    "IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [2005-12-05 12:37 667718]
    "IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2005-11-28 11:41 602182]
    "IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-04 20:00 208952]
    "igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-11-28 13:55 98304]
    "igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-11-28 13:55 118784]
    "igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-11-28 13:52 77824]
    "HWSetup"="C:\Program Files\TOSHIBA\TOSHIBA Applet\HWSetup.exe" [2004-05-02 05:45 28672]
    "DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2005-10-06 21:20 122940]
    "CFSServ.exe"="CFSServ.exe" []
    "CeEKEY"="C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe" [2005-12-02 03:13 671744]
    "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-03-23 16:43 53408]
    "BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 00:56 110592 C:\WINDOWS\system32\bthprops.cpl]
    "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2005-08-13 06:43 45056]
    "Apoint"="C:\Program Files\Apoint2K\Apoint.exe" [2004-03-23 22:40 196608]
    "AGRSMMSG"="AGRSMMSG.exe" [2005-10-15 06:29 88203 C:\WINDOWS\agrsmmsg.exe]
    "AdobeVersionCue"="C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe" [2003-10-13 16:24 1732608]
    "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]
    "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 02:41 49152]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    "POSTRBT"="C:\Program Files\Norton AntiVirus\Navw32.exe" [2006-02-05 01:03 173728]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    Bluetooth Monitor.lnk - C:\Program Files\TOSHIBA\Bluetooth Monitor\BtMon2.exe [2006-05-02 18:20:28]
    HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 04:21:22]
    HP Photosmart Premier Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2006-02-10 07:56:20]
    RAMASST.lnk - C:\WINDOWS\system32\RAMASST.exe [2005-12-22 10:00:05]
    WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE [2006-04-23 14:51:26]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus]
    psqlpwd.dll 2005-12-16 15:46 40448 C:\WINDOWS\system32\psqlpwd.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^dilys woo^Start Menu^Programs^Startup^RollerCoaster Tycoon 3 Registration.lnk]
    path=C:\Documents and Settings\dilys woo\Start Menu\Programs\Startup\RollerCoaster Tycoon 3 Registration.lnk
    backup=C:\WINDOWS\pss\RollerCoaster Tycoon 3 Registration.lnkStartup

    R1 TPwSav;Common Driver;C:\WINDOWS\system32\Drivers\TPwSav.sys [2005-12-02 02:55]
    R2 FdRedir;FdRedir;C:\Program Files\Common Files\Protector Suite QL\Drivers\FdRedir.sys [2005-12-16 16:00]
    R2 FileDisk2;FileDisk Protector Kernel Driver;C:\Program Files\Common Files\Protector Suite QL\Drivers\filedisk.sys [2005-12-16 16:00]
    R2 smihlp;SMI helper driver;C:\Program Files\Protector Suite QL\smihlp.sys [2005-12-16 15:28]
    R3 TcUsb;TC USB Kernel Driver;C:\WINDOWS\system32\Drivers\tcusb.sys [2005-12-16 15:40]
    R3 tosrfec;Bluetooth ACPI from TOSHIBA;C:\WINDOWS\system32\DRIVERS\tosrfec.sys [2004-05-17 15:18]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{246a5cc8-91d7-11dc-9f47-00037a126e8b}]
    \Shell\Auto\command - sal.xls.exe
    \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL sal.xls.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3c39eaff-8240-11dc-9f24-00037a126e8b}]
    \Shell\AutoRun\command - I:\ntdelect.com
    \Shell\explore\Command - I:\ntdelect.com
    \Shell\open\Command - I:\ntdelect.com

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4aac5ccc-6f76-11dc-9efa-00037a126e8b}]
    \Shell\Auto\command - E:\sal.xls.exe
    \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL sal.xls.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{54e65db4-7014-11dc-9efb-00037a126e8b}]
    \Shell\Auto\command - sal.xls.exe
    \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL sal.xls.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{93b6022b-0f26-11dc-9e54-00037a126e8b}]
    \Shell\AutoRun\command - I:\LaunchU3.exe -a

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{93b60230-0f26-11dc-9e54-00037a126e8b}]
    \Shell\AutoRun\command - F:\SGP2006.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b87b6e08-09b7-11dc-9e47-00037a126e8b}]
    \Shell\Auto\command - e:\QQzone.exe
    \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL e:\QQzone.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d807c69e-7f4f-11db-9d69-00037a126e8b}]
    \Shell\AutoRun\command - E:\LaunchU3.exe -a

    .
    Contents of the 'Scheduled Tasks' folder
    "2007-04-20 23:26:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
    - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
    "2007-12-30 16:15:03 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
    - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
    "2007-11-16 19:53:54 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - dilys woo.job"
    - C:\PROGRA~1\NORTON~1\Navw32.exeh/TASK:
    .
    **************************************************************************

    catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2007-12-31 14:00:17
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2007-12-31 14:01:53
    C:\qoobox\ComboFix-quarantined-files.txt 2007-12-31 06:01:50
    C:\qoobox\ComboFix2.txt 2007-12-29 16:02:14
    C:\qoobox\ComboFix3.txt 2007-12-28 06:24:08
    C:\qoobox\ComboFix4.txt 2007-10-28 05:29:07
    .
    2007-12-22 13:38:40 --- E O F ---


    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 2:02:39 PM, on 12/31/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
    C:\WINDOWS\system32\DVDRAMSV.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Canon\CAL\CALMAIN.exe
    C:\WINDOWS\system32\ZoomingHook.exe
    C:\Program Files\Toshiba\Tvs\TvsTray.exe
    C:\WINDOWS\system32\TPSMain.exe
    C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
    C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
    C:\WINDOWS\system32\TCtrlIOHook.exe
    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
    C:\WINDOWS\system32\TPSBattM.exe
    C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\PowerISO\PWRISOVM.EXE
    C:\Program Files\Protector Suite QL\psqltray.exe
    C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
    C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
    C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
    C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
    C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\System32\DLA\DLACTRLW.EXE
    C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
    C:\Program Files\Apoint2K\Apoint.exe
    C:\WINDOWS\AGRSMMSG.exe
    C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\Program Files\Apoint2K\Apntex.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\WINDOWS\system32\RAMASST.exe
    C:\Program Files\WinZip\WZQKPICK.EXE
    C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
    C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
    C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
    C:\Program Files\MSN Messenger\usnsvc.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\iTunes\iTunes.exe
    C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
    C:\Program Files\Adobe\Adobe Photoshop CS3\Photoshop.exe
    C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O4 - HKLM\..\Run: [ZoomingHook] ZoomingHook.exe
    O4 - HKLM\..\Run: [Tvs] C:\Program Files\Toshiba\Tvs\TvsTray.exe
    O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
    O4 - HKLM\..\Run: [TPNF] C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
    O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
    O4 - HKLM\..\Run: [TDispVol] TDispVol.exe
    O4 - HKLM\..\Run: [TCtryIOHook] TCtrlIOHook.exe
    O4 - HKLM\..\Run: [SVPWUTIL] C:\Program Files\Toshiba\Windows Utilities\SVPWUTIL.exe SVPwUTIL
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
    O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
    O4 - HKLM\..\Run: [PSQLLauncher] "C:\Program Files\Protector Suite QL\launcher.exe" /startup
    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
    O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
    O4 - HKLM\..\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
    O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
    O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
    O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
    O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
    O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKLM\..\Run: [HWSetup] C:\Program Files\TOSHIBA\TOSHIBA Applet\HWSetup.exe hwSetUP
    O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
    O4 - HKLM\..\Run: [CFSServ.exe] CFSServ.exe -NoClient
    O4 - HKLM\..\Run: [CeEKEY] C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
    O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
    O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
    O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
    O4 - HKLM\..\Run: [AdobeVersionCue] C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
    O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKUS\S-1-5-18\..\RunOnce: [POSTRBT] C:\Program Files\Norton AntiVirus\Navw32.exe /REMEDIATE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\RunOnce: [POSTRBT] C:\Program Files\Norton AntiVirus\Navw32.exe /REMEDIATE (User 'Default user')
    O4 - Global Startup: Bluetooth Monitor.lnk = ?
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
    O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
    O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
    O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
    O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
    O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-sg\msntabres.dll.mui/229?f3ecfba7ed224c3da266ba2f54c4db56
    O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-sg\msntabres.dll.mui/230?f3ecfba7ed224c3da266ba2f54c4db56
    O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
    O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {CD259AEC-23E6-4E64-8138-7E28D56666D7} (SQFViewer10X Element) - http://www.natuerlich-birkenstock.de/v1/SQFViewer10.ocx
    O17 - HKLM\System\CCS\Services\Tcpip\..\{5D5E162B-9583-41AD-8E3C-5977AB92A85D}: NameServer = 192.168.1.1,218.186.1.38
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: AdobeVersionCue - Adobe Sytems - C:\Program Files\Adobe\Adobe Version Cue\service\VersionCue.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
    O23 - Service: DVD-RAM_Service - Matsu****a Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
    O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Unknown owner - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe (file missing)
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
    O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
    O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
    O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
    O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

    --
    End of file - 14961 bytes
  • Baabiouz
    edited December 2007
    Hi!


    Step #1

    Please visit Virustotal
    * Click the Browse... button
    * Navigate to the file C:\WINDOWS\QTFont.qfn
    * Click the Open button
    * Click the Send button
    * Copy and paste the results back here


    Step #2

    Backup Your Registry with ERUNT
    • Please use the following link and scroll down to ERUNT and download it.
      http://aumha.org/freeware/freeware.php
    • For version with the Installer:
      Use the setup program to install ERUNT on your computer
    • For the zipped version:
      Unzip all the files into a folder of your choice.
    Click Erunt.exe to backup your registry to the folder of your choice.

    Note: to restore your registry, go to the folder and start ERDNT.exe

    Please run Notepad and paste the following text into a new file:
    REGEDIT4

    [-HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{246a5cc8-91d7-11dc-9f47-00037a126e8b}]
    [-HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{4aac5ccc-6f76-11dc-9efa-00037a126e8b}]
    [-HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{54e65db4-7014-11dc-9efb-00037a126e8b}]
    [-HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{93b60230-0f26-11dc-9e54-00037a126e8b}]
    [-HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{b87b6e08-09b7-11dc-9e47-00037a126e8b}]

    Save the file to the desktop as fix.reg and make sure the "Save as Type" field says "All Files". Then please go to the desktop and double-click on fix.reg, and click Yes to merge it with the registry.


    Step #3

    Please download OTMoveIt by OldTimer:
    http://download.bleepingcomputer.com/oldtimer/OTMoveIt.exe

    Save it to your desktop.
    Please double-click OTMoveIt.exe to run it.
    Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose 'Copy'):

    I:\ntdelect.com
    E:\sal.xls.exe
    e:\QQzone.exe


    Return to OTMoveIt, right click on the "Paste List of Files/Folders to be moved" window and choose Paste.
    Click the red Moveit! button Clipboard01moveit.gif

    Copy everything on the 'Results' window to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose 'Copy'), and paste it into your next reply.
    Close OTMoveIt

    If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process.
    If you are asked to reboot the machine choose Yes.


    Step #4

    Please run again Combofix.


    Step #5

    Please post a fresh Hijackthis log, Combofix log and OtmoveIt log :)
  • deelist
    edited January 2008
    hello, i did not manage to find the QTFont.qfn

    i cannot move the
    I:\ntdelect.com
    E:\sal.xls.exe
    e:\QQzone.exe
    as it cannot be found..
  • Baabiouz
    edited January 2008
    Hi Deelist!

    It's ok. Please post Combofix log and frehs Hijackthis log back here :)
  • deelist
    edited January 2008
    ComboFix 07-12-31.4 - dilys woo 2008-01-05 20:40:46.7 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.44.1033.18.194 [GMT 8:00]
    Running from: C:\Documents and Settings\dilys woo\Desktop\ComboFix.exe
    .

    ((((((((((((((((((((((((( Files Created from 2007-12-05 to 2008-01-05 )))))))))))))))))))))))))))))))
    .

    2007-12-31 13:52 . 2000-08-31 08:00 51,200 --a
    C:\WINDOWS\NirCmd.exe
    2007-12-30 00:21 . 2005-12-22 11:56 <DIR> d
    C:\Documents and Settings\Administrator\WINDOWS
    2007-12-30 00:21 . 2005-12-22 11:22 <DIR> d
    C:\Documents and Settings\Administrator\Application Data\toshiba
    2007-12-30 00:21 . 2006-04-10 11:47 <DIR> d
    C:\Documents and Settings\Administrator\Application Data\Intel
    2007-12-30 00:21 . 2005-12-22 08:55 <DIR> d
    C:\Documents and Settings\Administrator\Application Data\ATI
    2007-12-28 18:58 . 2007-12-28 18:58 <DIR> d
    C:\Program Files\Common Files\Control Panels
    2007-12-28 02:43 . 2007-12-28 02:43 <DIR> d
    C:\WINDOWS\ERUNT
    2007-12-27 22:12 . 2007-12-27 22:12 <DIR> d
    C:\Program Files\Trend Micro
    2007-12-25 17:18 . 2007-12-28 00:53 6,228 --a
    C:\WINDOWS\system32\tmp.reg
    2007-12-25 17:17 . 2007-09-05 23:22 289,144 --a
    C:\WINDOWS\system32\VCCLSID.exe
    2007-12-25 17:17 . 2006-04-27 16:49 288,417 --a
    C:\WINDOWS\system32\SrchSTS.exe
    2007-12-25 17:17 . 2007-12-20 23:11 81,920 --a
    C:\WINDOWS\system32\IEDFix.exe
    2007-12-25 17:17 . 2003-06-05 20:13 53,248 --a
    C:\WINDOWS\system32\Process.exe
    2007-12-25 17:17 . 2004-07-31 17:50 51,200 --a
    C:\WINDOWS\system32\dumphive.exe
    2007-12-25 17:17 . 2007-10-03 23:36 25,600 --a
    C:\WINDOWS\system32\WS2Fix.exe
    2007-12-25 17:07 . 2007-12-25 17:08 <DIR> d
    C:\Documents and Settings\dilys woo\Application Data\PrevxCSI
    2007-12-25 17:07 . 2007-12-25 17:07 <DIR> d
    C:\Documents and Settings\All Users\Application Data\Prevx
    2007-12-25 12:00 . 2007-12-25 12:00 <DIR> d
    C:\Documents and Settings\dilys woo\Application Data\SysCleaner
    2007-12-16 12:57 . 2003-03-16 00:15 90,112 --a
    C:\WINDOWS\unvise32.exe
    2007-12-16 12:55 . 2007-12-16 12:57 <DIR> d
    C:\Program Files\Mall Of America Tycoon
    2007-12-16 12:26 . 2007-12-16 12:26 70 --a
    C:\WINDOWS\nltpth.nlt
    2007-12-16 12:25 . 2007-12-16 12:25 <DIR> d
    C:\Program Files\Activision Value
    2007-12-16 12:12 . 2007-12-16 12:15 <DIR> d
    C:\Program Files\Holiday World Tycoon

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2007-12-31 09:43
    d
    w C:\Program Files\MSECACHE
    2007-12-28 10:58
    d
    w C:\Program Files\Common Files\Adobe
    2007-12-27 06:37
    d
    w C:\Documents and Settings\dilys woo\Application Data\toshiba
    2007-12-22 13:31
    d
    w C:\Program Files\Common Files\Symantec Shared
    2007-12-05 15:12
    d
    w C:\Documents and Settings\dilys woo\Application Data\uTorrent
    2007-12-01 00:41
    d
    w C:\Program Files\Windows Live Toolbar
    2007-12-01 00:40
    d
    w C:\Program Files\Windows Live Favorites
    2007-11-17 04:30
    d
    w C:\Program Files\PowerISO
    2007-11-17 03:09
    d
    w C:\Documents and Settings\All Users\Application Data\ALM
    2007-11-17 03:07
    d
    w C:\Program Files\Adobe CS3
    2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
    2007-11-09 14:44
    d
    w C:\Program Files\Bonjour
    2007-11-09 14:31
    d
    w C:\Program Files\Common Files\Macrovision Shared
    2007-11-09 14:14
    d
    w C:\Program Files\Windows Installer Clean Up
    2007-11-09 12:18
    d
    w C:\Program Files\BitTorrent
    2007-11-09 11:30
    d
    w C:\Documents and Settings\dilys woo\Application Data\BitTorrent
    2007-11-09 11:23 359,808 ----a-w C:\WINDOWS\system32\drivers\TCPIP.SYS.ORIGINAL
    2007-11-09 11:23 359,808 ----a-w C:\WINDOWS\system32\drivers\TCPIP.SYS
    2007-11-09 11:18
    d
    w C:\Program Files\uTorrent
    2007-10-29 22:43 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
    2007-10-27 09:40 222,720 ----a-w C:\WINDOWS\system32\wmasf.dll
    2007-04-08 10:32 37,860,928 ----a-w C:\Program Files\iTunesSetup.exe
    2007-03-13 22:46 20,607 ----a-w C:\Program Files\Illustrator CS3 Read Me.html
    2006-02-18 19:28 12,288 ----a-w C:\WINDOWS\Fonts\RandFont.dll
    .

    ((((((((((((((((((((((((((((( snapshot@2007-12-31_14.01.30.75 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2007-12-31 09:44:19 38,240 ----a-r C:\WINDOWS\Installer\{90120000-0020-0409-0000-0000000FF1CE}\O12ConvIcon.exe
    - 2007-12-29 13:31:21 1,701,960 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT
    + 2007-12-31 17:06:04 1,719,800 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT
    + 2005-09-22 15:48:08 479,232 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\msvcm80.dll
    + 2005-09-22 15:48:08 548,864 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\msvcp80.dll
    + 2005-09-22 15:48:06 626,688 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\msvcr80.dll
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [ ]
    "TOSCDSPD"="C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe" [2004-12-30 16:32 65536]
    "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54 5674352]
    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 20:00 15360]
    "AdobeUpdater"="C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-02-28 23:06 2321600]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ZoomingHook"="ZoomingHook.exe" [2005-06-07 01:58 24576 C:\WINDOWS\system32\ZoomingHook.exe]
    "Tvs"="C:\Program Files\Toshiba\Tvs\TvsTray.exe" [2005-12-01 04:25 73728]
    "TPSMain"="TPSMain.exe" [2005-06-01 09:16 282624 C:\WINDOWS\system32\TPSMain.exe]
    "TPNF"="C:\Program Files\TOSHIBA\TouchPad\TPTray.exe" [2005-12-14 08:28 53248]
    "TFncKy"="TFncKy.exe" []
    "TDispVol"="TDispVol.exe" [2005-12-28 08:34 73728 C:\WINDOWS\system32\TDispVol.exe]
    "TCtryIOHook"="TCtrlIOHook.exe" [2005-12-06 06:50 28672 C:\WINDOWS\system32\TCtrlIOHook.exe]
    "SVPWUTIL"="C:\Program Files\Toshiba\Windows Utilities\SVPWUTIL.exe" [2004-05-02 05:45 65536]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
    "SmoothView"="C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe" [2005-04-27 08:13 122880]
    "RTHDCPL"="RTHDCPL.EXE" [2005-12-09 15:49 15691264 C:\WINDOWS\RTHDCPL.exe]
    "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-16 10:54 282624]
    "PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2007-08-07 08:05 200704]
    "PSQLLauncher"="C:\Program Files\Protector Suite QL\launcher.exe" [2005-12-16 15:32 30208]
    "PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 20:00 455168]
    "PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 20:00 455168]
    "PCSuiteTrayApplication"="C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.exe" [2006-06-15 12:36 229376]
    "PadTouch"="C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe" [2005-07-16 02:52 1077322]
    "NDSTray.exe"="NDSTray.exe" []
    "MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 20:00 59392]
    "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-03-14 19:05 257088]
    "IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [2005-12-05 12:37 667718]
    "IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2005-11-28 11:41 602182]
    "IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-04 20:00 208952]
    "igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-11-28 13:55 98304]
    "igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-11-28 13:55 118784]
    "igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-11-28 13:52 77824]
    "HWSetup"="C:\Program Files\TOSHIBA\TOSHIBA Applet\HWSetup.exe" [2004-05-02 05:45 28672]
    "DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2005-10-06 21:20 122940]
    "CFSServ.exe"="CFSServ.exe" []
    "CeEKEY"="C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe" [2005-12-02 03:13 671744]
    "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-03-23 16:43 53408]
    "BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 00:56 110592 C:\WINDOWS\system32\bthprops.cpl]
    "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2005-08-13 06:43 45056]
    "Apoint"="C:\Program Files\Apoint2K\Apoint.exe" [2004-03-23 22:40 196608]
    "AGRSMMSG"="AGRSMMSG.exe" [2005-10-15 06:29 88203 C:\WINDOWS\agrsmmsg.exe]
    "AdobeVersionCue"="C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe" [2003-10-13 16:24 1732608]
    "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]
    "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 02:41 49152]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    "POSTRBT"="C:\Program Files\Norton AntiVirus\Navw32.exe" [2006-02-05 01:03 173728]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    Bluetooth Monitor.lnk - C:\Program Files\TOSHIBA\Bluetooth Monitor\BtMon2.exe [2006-05-02 18:20:28]
    HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 04:21:22]
    HP Photosmart Premier Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2006-02-10 07:56:20]
    RAMASST.lnk - C:\WINDOWS\system32\RAMASST.exe [2005-12-22 10:00:05]
    WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE [2006-04-23 14:51:26]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus]
    psqlpwd.dll 2005-12-16 15:46 40448 C:\WINDOWS\system32\psqlpwd.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^dilys woo^Start Menu^Programs^Startup^RollerCoaster Tycoon 3 Registration.lnk]
    path=C:\Documents and Settings\dilys woo\Start Menu\Programs\Startup\RollerCoaster Tycoon 3 Registration.lnk
    backup=C:\WINDOWS\pss\RollerCoaster Tycoon 3 Registration.lnkStartup

    R1 TPwSav;Common Driver;C:\WINDOWS\system32\Drivers\TPwSav.sys [2005-12-02 02:55]
    R2 FdRedir;FdRedir;C:\Program Files\Common Files\Protector Suite QL\Drivers\FdRedir.sys [2005-12-16 16:00]
    R2 FileDisk2;FileDisk Protector Kernel Driver;C:\Program Files\Common Files\Protector Suite QL\Drivers\filedisk.sys [2005-12-16 16:00]
    R2 smihlp;SMI helper driver;C:\Program Files\Protector Suite QL\smihlp.sys [2005-12-16 15:28]
    R3 TcUsb;TC USB Kernel Driver;C:\WINDOWS\system32\Drivers\tcusb.sys [2005-12-16 15:40]
    R3 tosrfec;Bluetooth ACPI from TOSHIBA;C:\WINDOWS\system32\DRIVERS\tosrfec.sys [2004-05-17 15:18]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{246a5cc8-91d7-11dc-9f47-00037a126e8b}]
    \Shell\Auto\command - sal.xls.exe
    \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL sal.xls.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3c39eaff-8240-11dc-9f24-00037a126e8b}]
    \Shell\AutoRun\command - I:\ntdelect.com
    \Shell\explore\Command - I:\ntdelect.com
    \Shell\open\Command - I:\ntdelect.com

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4aac5ccc-6f76-11dc-9efa-00037a126e8b}]
    \Shell\Auto\command - E:\sal.xls.exe
    \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL sal.xls.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{54e65db4-7014-11dc-9efb-00037a126e8b}]
    \Shell\Auto\command - sal.xls.exe
    \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL sal.xls.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{66944783-ef9c-11da-9c69-00037a126e8b}]
    \Shell\Auto\command - e:\QQzone.exe
    \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL e:\QQzone.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{93b6022b-0f26-11dc-9e54-00037a126e8b}]
    \Shell\AutoRun\command - I:\LaunchU3.exe -a

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{93b60230-0f26-11dc-9e54-00037a126e8b}]
    \Shell\AutoRun\command - F:\SGP2006.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b87b6e08-09b7-11dc-9e47-00037a126e8b}]
    \Shell\Auto\command - e:\QQzone.exe
    \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL e:\QQzone.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d807c69e-7f4f-11db-9d69-00037a126e8b}]
    \Shell\AutoRun\command - E:\LaunchU3.exe -a

    .
    Contents of the 'Scheduled Tasks' folder
    "2007-04-20 23:26:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
    - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
    "2008-01-04 15:15:02 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
    - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
    "2008-01-04 12:25:17 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - dilys woo.job"
    - C:\PROGRA~1\NORTON~1\Navw32.exeh/TASK:
    .
    **************************************************************************

    catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-01-05 20:47:20
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2008-01-05 20:49:53
    C:\qoobox\ComboFix-quarantined-files.txt 2008-01-05 12:49:28
    C:\qoobox\ComboFix2.txt 2007-12-31 06:01:54
    C:\qoobox\ComboFix3.txt 2007-12-29 16:02:14
    C:\qoobox\ComboFix4.txt 2007-12-28 06:24:08
    C:\qoobox\ComboFix5.txt 2007-10-28 05:29:07
    .
    2007-12-22 13:38:40 --- E O F ---


    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 8:50:36 PM, on 1/5/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
    C:\WINDOWS\system32\DVDRAMSV.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Canon\CAL\CALMAIN.exe
    C:\WINDOWS\system32\ZoomingHook.exe
    C:\Program Files\Toshiba\Tvs\TvsTray.exe
    C:\WINDOWS\system32\TPSMain.exe
    C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
    C:\WINDOWS\system32\TPSBattM.exe
    C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
    C:\WINDOWS\system32\TCtrlIOHook.exe
    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
    C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\PowerISO\PWRISOVM.EXE
    C:\Program Files\Protector Suite QL\psqltray.exe
    C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
    C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
    C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
    C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
    C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\System32\DLA\DLACTRLW.EXE
    C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
    C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\Apoint2K\Apoint.exe
    C:\WINDOWS\AGRSMMSG.exe
    C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Apoint2K\Apntex.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\WINDOWS\system32\RAMASST.exe
    C:\Program Files\WinZip\WZQKPICK.EXE
    C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
    C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
    C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
    C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\MSN Messenger\usnsvc.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Adobe\Adobe Photoshop CS3\Photoshop.exe
    C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\WINDOWS\explorer.exe
    C:\WINDOWS\system32\notepad.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O4 - HKLM\..\Run: [ZoomingHook] ZoomingHook.exe
    O4 - HKLM\..\Run: [Tvs] C:\Program Files\Toshiba\Tvs\TvsTray.exe
    O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
    O4 - HKLM\..\Run: [TPNF] C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
    O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
    O4 - HKLM\..\Run: [TDispVol] TDispVol.exe
    O4 - HKLM\..\Run: [TCtryIOHook] TCtrlIOHook.exe
    O4 - HKLM\..\Run: [SVPWUTIL] C:\Program Files\Toshiba\Windows Utilities\SVPWUTIL.exe SVPwUTIL
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
    O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
    O4 - HKLM\..\Run: [PSQLLauncher] "C:\Program Files\Protector Suite QL\launcher.exe" /startup
    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
    O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
    O4 - HKLM\..\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
    O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
    O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
    O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
    O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
    O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKLM\..\Run: [HWSetup] C:\Program Files\TOSHIBA\TOSHIBA Applet\HWSetup.exe hwSetUP
    O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
    O4 - HKLM\..\Run: [CFSServ.exe] CFSServ.exe -NoClient
    O4 - HKLM\..\Run: [CeEKEY] C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
    O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
    O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
    O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
    O4 - HKLM\..\Run: [AdobeVersionCue] C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
    O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
    O4 - HKUS\S-1-5-18\..\RunOnce: [POSTRBT] C:\Program Files\Norton AntiVirus\Navw32.exe /REMEDIATE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\RunOnce: [POSTRBT] C:\Program Files\Norton AntiVirus\Navw32.exe /REMEDIATE (User 'Default user')
    O4 - Global Startup: Bluetooth Monitor.lnk = ?
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
    O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
    O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
    O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
    O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
    O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-sg\msntabres.dll.mui/229?f3ecfba7ed224c3da266ba2f54c4db56
    O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-sg\msntabres.dll.mui/230?f3ecfba7ed224c3da266ba2f54c4db56
    O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
    O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {CD259AEC-23E6-4E64-8138-7E28D56666D7} (SQFViewer10X Element) - http://www.natuerlich-birkenstock.de/v1/SQFViewer10.ocx
    O17 - HKLM\System\CCS\Services\Tcpip\..\{5D5E162B-9583-41AD-8E3C-5977AB92A85D}: NameServer = 192.168.1.1,218.186.1.38
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: AdobeVersionCue - Adobe Sytems - C:\Program Files\Adobe\Adobe Version Cue\service\VersionCue.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
    O23 - Service: DVD-RAM_Service - Matsu****a Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
    O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Unknown owner - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe (file missing)
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
    O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
    O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
    O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
    O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

    --
    End of file - 14997 bytes
  • Baabiouz
    edited January 2008
    Hi Deelist!

    Step #1
    Backup Your Registry with ERUNT
    • Please use the following link and scroll down to ERUNT and download it.
      http://aumha.org/freeware/freeware.php
    • For version with the Installer:
      Use the setup program to install ERUNT on your computer
    • For the zipped version:
      Unzip all the files into a folder of your choice.
    Click Erunt.exe to backup your registry to the folder of your choice.

    Note: to restore your registry, go to the folder and start ERDNT.exe

    Step #2
    Please download Deelist-fix.zip from here to your desktop.
    Extract it to your desktop.

    Please Doubleclick Fix.reg, and click Yes to merge it with the registry.

    Reboot your computer

    Step #3
    Please run Combofix again and post Combofix log back here :)
  • deelist
    edited January 2008
    ComboFix 07-12-31.4 - dilys woo 2008-01-06 12:12:20.8 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.44.1033.18.215 [GMT 8:00]
    Running from: C:\Documents and Settings\dilys woo\Desktop\ComboFix.exe
    .

    ((((((((((((((((((((((((( Files Created from 2007-12-06 to 2008-01-06 )))))))))))))))))))))))))))))))
    .

    2008-01-05 21:05 . 2008-01-05 21:05 54,156 --ah
    C:\WINDOWS\QTFont.qfn
    2008-01-05 21:05 . 2008-01-05 21:05 1,409 --a
    C:\WINDOWS\QTFont.for
    2007-12-31 13:52 . 2000-08-31 08:00 51,200 --a
    C:\WINDOWS\NirCmd.exe
    2007-12-30 00:21 . 2005-12-22 11:56 <DIR> d
    C:\Documents and Settings\Administrator\WINDOWS
    2007-12-30 00:21 . 2005-12-22 11:22 <DIR> d
    C:\Documents and Settings\Administrator\Application Data\toshiba
    2007-12-30 00:21 . 2006-04-10 11:47 <DIR> d
    C:\Documents and Settings\Administrator\Application Data\Intel
    2007-12-30 00:21 . 2005-12-22 08:55 <DIR> d
    C:\Documents and Settings\Administrator\Application Data\ATI
    2007-12-28 18:58 . 2007-12-28 18:58 <DIR> d
    C:\Program Files\Common Files\Control Panels
    2007-12-28 02:43 . 2007-12-28 02:43 <DIR> d
    C:\WINDOWS\ERUNT
    2007-12-27 22:12 . 2007-12-27 22:12 <DIR> d
    C:\Program Files\Trend Micro
    2007-12-25 17:18 . 2007-12-28 00:53 6,228 --a
    C:\WINDOWS\system32\tmp.reg
    2007-12-25 17:17 . 2007-09-05 23:22 289,144 --a
    C:\WINDOWS\system32\VCCLSID.exe
    2007-12-25 17:17 . 2006-04-27 16:49 288,417 --a
    C:\WINDOWS\system32\SrchSTS.exe
    2007-12-25 17:17 . 2007-12-20 23:11 81,920 --a
    C:\WINDOWS\system32\IEDFix.exe
    2007-12-25 17:17 . 2003-06-05 20:13 53,248 --a
    C:\WINDOWS\system32\Process.exe
    2007-12-25 17:17 . 2004-07-31 17:50 51,200 --a
    C:\WINDOWS\system32\dumphive.exe
    2007-12-25 17:17 . 2007-10-03 23:36 25,600 --a
    C:\WINDOWS\system32\WS2Fix.exe
    2007-12-25 17:07 . 2007-12-25 17:08 <DIR> d
    C:\Documents and Settings\dilys woo\Application Data\PrevxCSI
    2007-12-25 17:07 . 2007-12-25 17:07 <DIR> d
    C:\Documents and Settings\All Users\Application Data\Prevx
    2007-12-25 12:00 . 2007-12-25 12:00 <DIR> d
    C:\Documents and Settings\dilys woo\Application Data\SysCleaner
    2007-12-16 12:57 . 2003-03-16 00:15 90,112 --a
    C:\WINDOWS\unvise32.exe
    2007-12-16 12:55 . 2007-12-16 12:57 <DIR> d
    C:\Program Files\Mall Of America Tycoon
    2007-12-16 12:26 . 2007-12-16 12:26 70 --a
    C:\WINDOWS\nltpth.nlt
    2007-12-16 12:25 . 2007-12-16 12:25 <DIR> d
    C:\Program Files\Activision Value
    2007-12-16 12:12 . 2007-12-16 12:15 <DIR> d
    C:\Program Files\Holiday World Tycoon

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2007-12-31 09:43
    d
    w C:\Program Files\MSECACHE
    2007-12-28 10:58
    d
    w C:\Program Files\Common Files\Adobe
    2007-12-27 06:37
    d
    w C:\Documents and Settings\dilys woo\Application Data\toshiba
    2007-12-22 13:31
    d
    w C:\Program Files\Common Files\Symantec Shared
    2007-12-05 15:12
    d
    w C:\Documents and Settings\dilys woo\Application Data\uTorrent
    2007-12-01 00:41
    d
    w C:\Program Files\Windows Live Toolbar
    2007-12-01 00:40
    d
    w C:\Program Files\Windows Live Favorites
    2007-11-17 04:30
    d
    w C:\Program Files\PowerISO
    2007-11-17 03:09
    d
    w C:\Documents and Settings\All Users\Application Data\ALM
    2007-11-17 03:07
    d
    w C:\Program Files\Adobe CS3
    2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
    2007-11-09 14:44
    d
    w C:\Program Files\Bonjour
    2007-11-09 14:31
    d
    w C:\Program Files\Common Files\Macrovision Shared
    2007-11-09 14:14
    d
    w C:\Program Files\Windows Installer Clean Up
    2007-11-09 12:18
    d
    w C:\Program Files\BitTorrent
    2007-11-09 11:30
    d
    w C:\Documents and Settings\dilys woo\Application Data\BitTorrent
    2007-11-09 11:23 359,808 ----a-w C:\WINDOWS\system32\drivers\TCPIP.SYS.ORIGINAL
    2007-11-09 11:23 359,808 ----a-w C:\WINDOWS\system32\drivers\TCPIP.SYS
    2007-11-09 11:18
    d
    w C:\Program Files\uTorrent
    2007-10-29 22:43 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
    2007-10-27 09:40 222,720 ----a-w C:\WINDOWS\system32\wmasf.dll
    2007-04-08 10:32 37,860,928 ----a-w C:\Program Files\iTunesSetup.exe
    2007-03-13 22:46 20,607 ----a-w C:\Program Files\Illustrator CS3 Read Me.html
    2006-02-18 19:28 12,288 ----a-w C:\WINDOWS\Fonts\RandFont.dll
    .

    ((((((((((((((((((((((((((((( snapshot@2007-12-31_14.01.30.75 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2005-10-20 04:02:28 163,328 ----a-w C:\WINDOWS\erdnt\1-6-2008\ERDNT.EXE
    + 2008-01-06 04:08:07 8,945,664 ----a-w C:\WINDOWS\erdnt\1-6-2008\Users\00000001\NTUSER.DAT
    + 2008-01-06 04:08:08 192,512 ----a-w C:\WINDOWS\erdnt\1-6-2008\Users\00000002\UsrClass.dat
    + 2007-12-31 09:44:19 38,240 ----a-r C:\WINDOWS\Installer\{90120000-0020-0409-0000-0000000FF1CE}\O12ConvIcon.exe
    - 2007-12-29 13:31:21 1,701,960 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT
    + 2007-12-31 17:06:04 1,719,800 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT
    + 2005-09-22 15:48:08 479,232 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\msvcm80.dll
    + 2005-09-22 15:48:08 548,864 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\msvcp80.dll
    + 2005-09-22 15:48:06 626,688 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\msvcr80.dll
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [ ]
    "TOSCDSPD"="C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe" [2004-12-30 16:32 65536]
    "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54 5674352]
    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 20:00 15360]
    "AdobeUpdater"="C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-02-28 23:06 2321600]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ZoomingHook"="ZoomingHook.exe" [2005-06-07 01:58 24576 C:\WINDOWS\system32\ZoomingHook.exe]
    "Tvs"="C:\Program Files\Toshiba\Tvs\TvsTray.exe" [2005-12-01 04:25 73728]
    "TPSMain"="TPSMain.exe" [2005-06-01 09:16 282624 C:\WINDOWS\system32\TPSMain.exe]
    "TPNF"="C:\Program Files\TOSHIBA\TouchPad\TPTray.exe" [2005-12-14 08:28 53248]
    "TFncKy"="TFncKy.exe" []
    "TDispVol"="TDispVol.exe" [2005-12-28 08:34 73728 C:\WINDOWS\system32\TDispVol.exe]
    "TCtryIOHook"="TCtrlIOHook.exe" [2005-12-06 06:50 28672 C:\WINDOWS\system32\TCtrlIOHook.exe]
    "SVPWUTIL"="C:\Program Files\Toshiba\Windows Utilities\SVPWUTIL.exe" [2004-05-02 05:45 65536]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
    "SmoothView"="C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe" [2005-04-27 08:13 122880]
    "RTHDCPL"="RTHDCPL.EXE" [2005-12-09 15:49 15691264 C:\WINDOWS\RTHDCPL.exe]
    "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-16 10:54 282624]
    "PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2007-08-07 08:05 200704]
    "PSQLLauncher"="C:\Program Files\Protector Suite QL\launcher.exe" [2005-12-16 15:32 30208]
    "PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 20:00 455168]
    "PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 20:00 455168]
    "PCSuiteTrayApplication"="C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.exe" [2006-06-15 12:36 229376]
    "PadTouch"="C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe" [2005-07-16 02:52 1077322]
    "NDSTray.exe"="NDSTray.exe" []
    "MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 20:00 59392]
    "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-03-14 19:05 257088]
    "IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [2005-12-05 12:37 667718]
    "IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2005-11-28 11:41 602182]
    "IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-04 20:00 208952]
    "igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-11-28 13:55 98304]
    "igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-11-28 13:55 118784]
    "igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-11-28 13:52 77824]
    "HWSetup"="C:\Program Files\TOSHIBA\TOSHIBA Applet\HWSetup.exe" [2004-05-02 05:45 28672]
    "DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2005-10-06 21:20 122940]
    "CFSServ.exe"="CFSServ.exe" []
    "CeEKEY"="C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe" [2005-12-02 03:13 671744]
    "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-03-23 16:43 53408]
    "BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 00:56 110592 C:\WINDOWS\system32\bthprops.cpl]
    "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2005-08-13 06:43 45056]
    "Apoint"="C:\Program Files\Apoint2K\Apoint.exe" [2004-03-23 22:40 196608]
    "AGRSMMSG"="AGRSMMSG.exe" [2005-10-15 06:29 88203 C:\WINDOWS\agrsmmsg.exe]
    "AdobeVersionCue"="C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe" [2003-10-13 16:24 1732608]
    "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]
    "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 02:41 49152]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    "POSTRBT"="C:\Program Files\Norton AntiVirus\Navw32.exe" [2006-02-05 01:03 173728]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    Bluetooth Monitor.lnk - C:\Program Files\TOSHIBA\Bluetooth Monitor\BtMon2.exe [2006-05-02 18:20:28]
    HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 04:21:22]
    HP Photosmart Premier Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2006-02-10 07:56:20]
    RAMASST.lnk - C:\WINDOWS\system32\RAMASST.exe [2005-12-22 10:00:05]
    WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE [2006-04-23 14:51:26]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus]
    psqlpwd.dll 2005-12-16 15:46 40448 C:\WINDOWS\system32\psqlpwd.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^dilys woo^Start Menu^Programs^Startup^RollerCoaster Tycoon 3 Registration.lnk]
    path=C:\Documents and Settings\dilys woo\Start Menu\Programs\Startup\RollerCoaster Tycoon 3 Registration.lnk
    backup=C:\WINDOWS\pss\RollerCoaster Tycoon 3 Registration.lnkStartup

    R1 TPwSav;Common Driver;C:\WINDOWS\system32\Drivers\TPwSav.sys [2005-12-02 02:55]
    R2 FdRedir;FdRedir;C:\Program Files\Common Files\Protector Suite QL\Drivers\FdRedir.sys [2005-12-16 16:00]
    R2 FileDisk2;FileDisk Protector Kernel Driver;C:\Program Files\Common Files\Protector Suite QL\Drivers\filedisk.sys [2005-12-16 16:00]
    R2 smihlp;SMI helper driver;C:\Program Files\Protector Suite QL\smihlp.sys [2005-12-16 15:28]
    R3 TcUsb;TC USB Kernel Driver;C:\WINDOWS\system32\Drivers\tcusb.sys [2005-12-16 15:40]
    R3 tosrfec;Bluetooth ACPI from TOSHIBA;C:\WINDOWS\system32\DRIVERS\tosrfec.sys [2004-05-17 15:18]

    .
    Contents of the 'Scheduled Tasks' folder
    "2007-04-20 23:26:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
    - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
    "2008-01-06 04:15:04 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
    - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
    "2008-01-04 12:25:17 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - dilys woo.job"
    - C:\PROGRA~1\NORTON~1\Navw32.exeh/TASK:
    .
    **************************************************************************

    catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-01-06 12:18:06
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2008-01-06 12:19:56
    C:\qoobox\ComboFix-quarantined-files.txt 2008-01-06 04:19:51
    C:\qoobox\ComboFix2.txt 2008-01-05 12:49:54
    C:\qoobox\ComboFix3.txt 2007-12-31 06:01:54
    C:\qoobox\ComboFix4.txt 2007-12-29 16:02:14
    C:\qoobox\ComboFix5.txt 2007-12-28 06:24:08
    .
    2007-12-22 13:38:40 --- E O F ---
  • Baabiouz
    edited January 2008
    Yep, looks better :)

    Please do an online scan with Kaspersky WebScanner

    Click on Kaspersky Online Scanner

    You will be prompted to install an ActiveX component from Kaspersky, Click Yes.
    • The program will launch and then begin downloading the latest definition files:
    • Once the files have been downloaded click on NEXT
    • Now click on Scan Settings
    • In the scan settings make that the following are selected:
      • Scan using the following Anti-Virus database:
        Extended (if available otherwise Standard)
      • Scan Options:
        Scan Archives
        Scan Mail Bases

        [*]Click OK
        [*]Now under select a target to scan:
          Select
        My Computer

        [*]This will program will start and scan your system.
        [*]The scan will take a while so be patient and let it run.
        [*]Once the scan is complete it will display if your system has been infected.
        • Now click on the Save as Text button:
        [*]Save the file to your desktop.
        [*]Copy and paste that information in your next post.


        Please post a fresh HijackThis log and Kaspersky results :)
      • deelist
        edited January 2008
        KASPERSKY ONLINE SCANNER REPORT Sunday, January 06, 2008 10:53:55 PM
        Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
        Kaspersky Online Scanner version: 5.0.98.0
        Kaspersky Anti-Virus database last update: 6/01/2008
        Kaspersky Anti-Virus database records: 503089

        Scan Settings Scan using the following antivirus database extended Scan Archives true Scan Mail Bases true
        Scan Target My Computer C:\
        D:\
        E:\
        F:\
        G:\
        Scan Statistics Total number of scanned objects 155210 Number of viruses found 17 Number of infected objects 73 Number of suspicious objects 0 Duration of the scan process 02:15:18
        Infected Object Name Virus Name Last Action C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
        C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
        C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat Object is locked skipped
        C:\Documents and Settings\All Users\Application Data\Symantec\HPPAppActivity.log Object is locked skipped
        C:\Documents and Settings\All Users\Application Data\Symantec\HPPHomePageActivity.log Object is locked skipped
        C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\2008-01-06_Log.ALUSchedulerSvc.LiveUpdate Object is locked skipped
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\028828B4 Infected: Trojan-Downloader.Win32.Tiny.id skipped
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\03715F42 Infected: Trojan-Downloader.Win32.Tiny.id skipped
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\05B366C6 Infected: Trojan-Downloader.Win32.Tiny.id skipped
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\0961339E Infected: Trojan-Downloader.Win32.Tiny.id skipped
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\0A452632.tmp Infected: Trojan-Downloader.Win32.Agent.dlu skipped
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\0EB54EE4.dll Infected: Trojan-Downloader.Win32.Small.ddp skipped
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\15BF16E5 Infected: Trojan-Downloader.Win32.Tiny.id skipped
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\17CC7EFA Infected: Trojan-Downloader.Win32.Tiny.id skipped
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\1BA716B9 Infected: Trojan-Downloader.Win32.Tiny.id skipped
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\1CF1045A Infected: Trojan-Downloader.Win32.Tiny.id skipped
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\1D832E98.exe Infected: Worm.Win32.Agent.cs skipped
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\1E2B60DE.dll Infected: Trojan-Downloader.Win32.Agent.dlu skipped
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\1E8C1F7E Infected: Trojan-Downloader.Win32.Tiny.id skipped
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\210355DF Infected: Trojan-Downloader.Win32.Tiny.id skipped
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\25496670 Infected: Trojan-Downloader.Win32.Tiny.id skipped
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\27602CB6.com Infected: Packed.Win32.NSAnti.r skipped
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\29854D23 Infected: Trojan-Downloader.Win32.Tiny.id skipped
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\2A1F79DC Infected: Trojan-Downloader.Win32.Tiny.id skipped
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\2CEC3320 Infected: Trojan-Downloader.Win32.Tiny.id skipped
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\2CF730EB.dll Infected: Trojan-Downloader.Win32.Small.ddp skipped
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\2EC62838 Infected: Trojan-Downloader.Win32.Tiny.id skipped
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\31156D19 Infected: Trojan-Downloader.Win32.Tiny.id skipped
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\31A57AE0 Infected: Trojan-Downloader.HTML.Agent.ij skipped
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\36D47F72.pif Infected: Trojan.Win32.Pakes.c skipped
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3B1013C5 Infected: Trojan-Downloader.Win32.Tiny.id skipped
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3CAD79B7.tmp Infected: Trojan-Downloader.Win32.Small.ddp skipped
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3D8963A8 Infected: Trojan-Downloader.Win32.Tiny.id skipped
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3F4F3119 Infected: Trojan-Downloader.Win32.Tiny.id skipped
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\450D05FF Infected: Trojan-Downloader.Win32.Tiny.id skipped
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\4AF8636B.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.vc skipped
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\4AFA53FB.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.vc skipped
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\4F4F407E.exe Infected: Virus.Win32.AutoRun.zi skipped
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\52EC65AD.exe Infected: Trojan-Downloader.Win32.Agent.dlu skipped
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\538B2B37 Infected: Trojan-Downloader.Win32.Tiny.id skipped
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\54A409C8.dll Infected: Trojan-Downloader.Win32.Agent.dlu skipped
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\566F1F11 Infected: Trojan-Downloader.Win32.Tiny.id skipped
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\56A768D3 Infected: Trojan-Downloader.Win32.Tiny.id skipped
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\588C397C.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.hb skipped
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\5A4615C9 Infected: Trojan-Downloader.Win32.Tiny.id skipped
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\5A5D22BE Infected: Trojan-Downloader.Win32.Tiny.id skipped
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\5A8D2C8F.exe Infected: IM-Worm.Win32.Agent.x skipped
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\5CDD6EA3 Infected: Trojan-Downloader.Win32.Tiny.id skipped
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\5CE2431C Infected: Trojan-Downloader.Win32.Tiny.id skipped
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\5D824C6C Infected: Trojan-Downloader.Win32.Tiny.id skipped
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\5DE424E2.exe Infected: Worm.Win32.VB.el skipped
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\5E3C5F39.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.hb skipped
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\5E721E40.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.kr skipped
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\5E787239.dll Infected: Trojan.Win32.BHO.bd skipped
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\63323E8E Infected: Trojan-Downloader.Win32.Tiny.id skipped
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\64B22D6D Infected: Trojan-Downloader.Win32.Tiny.id skipped
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\6B766A0F Infected: Trojan-Downloader.Win32.Tiny.id skipped
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\6E1B08E1 Infected: Trojan-Downloader.Win32.Tiny.id skipped
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\6F5A0291 Infected: Trojan-Downloader.Win32.Tiny.id skipped
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\6FE52E7E Infected: Trojan-Downloader.Win32.Tiny.id skipped
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\706C45B3 Infected: Trojan-Downloader.Win32.Tiny.id skipped
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\713A0CC6 Infected: Trojan-Downloader.Win32.Tiny.id skipped
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\72EB0D2A Infected: Trojan-Downloader.Win32.Tiny.id skipped
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\75F30986.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.kr skipped
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\76475131 Infected: Trojan-Downloader.Win32.Tiny.id skipped
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\771B46AC Infected: Trojan-Downloader.Win32.Tiny.id skipped
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\773E0861.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.hb skipped
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\78B37A86 Infected: Trojan-Downloader.Win32.Tiny.id skipped
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\7C217954.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.avg skipped
        C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\cert8.db Object is locked skipped
        C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\formhistory.dat Object is locked skipped
        C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\history.dat Object is locked skipped
        C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\key3.db Object is locked skipped
        C:\Documents and Settings\dilys woo\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\parent.lock Object is locked skipped
        C:\Documents and Settings\dilys woo\Application Data\Symantec\PendingAlertsQueue.log Object is locked skipped
        C:\Documents and Settings\dilys woo\Cookies\index.dat Object is locked skipped
        C:\Documents and Settings\dilys woo\Desktop\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
        C:\Documents and Settings\dilys woo\Desktop\SmitfraudFix.exe/data.rar/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
        C:\Documents and Settings\dilys woo\Desktop\SmitfraudFix.exe/data.rar Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
        C:\Documents and Settings\dilys woo\Desktop\SmitfraudFix.exe RarSFX: infected - 2 skipped
        C:\Documents and Settings\dilys woo\Local Settings\Application Data\ApplicationHistory\cli.exe.c88dbd71.ini.inuse Object is locked skipped
        C:\Documents and Settings\dilys woo\Local Settings\Application Data\ApplicationHistory\hpqimzone.exe.3204510e.ini.inuse Object is locked skipped
        C:\Documents and Settings\dilys woo\Local Settings\Application Data\HP\Digital Imaging\db\administrativeInfo.dbf Object is locked skipped
        C:\Documents and Settings\dilys woo\Local Settings\Application Data\HP\Digital Imaging\db\albumImagesTable.cdx Object is locked skipped
        C:\Documents and Settings\dilys woo\Local Settings\Application Data\HP\Digital Imaging\db\albumImagesTable.dbf Object is locked skipped
        C:\Documents and Settings\dilys woo\Local Settings\Application Data\HP\Digital Imaging\db\albumTable.cdx Object is locked skipped
        C:\Documents and Settings\dilys woo\Local Settings\Application Data\HP\Digital Imaging\db\albumTable.dbf Object is locked skipped
        C:\Documents and Settings\dilys woo\Local Settings\Application Data\HP\Digital Imaging\db\CB_Server_Errors.txt Object is locked skipped
        C:\Documents and Settings\dilys woo\Local Settings\Application Data\HP\Digital Imaging\db\EXIFTable.cdx Object is locked skipped
        C:\Documents and Settings\dilys woo\Local Settings\Application Data\HP\Digital Imaging\db\EXIFTable.dbf Object is locked skipped
        C:\Documents and Settings\dilys woo\Local Settings\Application Data\HP\Digital Imaging\db\imageTable.cdx Object is locked skipped
        C:\Documents and Settings\dilys woo\Local Settings\Application Data\HP\Digital Imaging\db\imageTable.dbf Object is locked skipped
        C:\Documents and Settings\dilys woo\Local Settings\Application Data\HP\Digital Imaging\db\imageTable.fpt Object is locked skipped
        C:\Documents and Settings\dilys woo\Local Settings\Application Data\HP\Digital Imaging\db\keywordImagesTable.cdx Object is locked skipped
        C:\Documents and Settings\dilys woo\Local Settings\Application Data\HP\Digital Imaging\db\keywordImagesTable.dbf Object is locked skipped
        C:\Documents and Settings\dilys woo\Local Settings\Application Data\HP\Digital Imaging\db\keywordTable.cdx Object is locked skipped
        C:\Documents and Settings\dilys woo\Local Settings\Application Data\HP\Digital Imaging\db\keywordTable.dbf Object is locked skipped
        C:\Documents and Settings\dilys woo\Local Settings\Application Data\HP\Digital Imaging\db\managedFolderTable.dbf Object is locked skipped
        C:\Documents and Settings\dilys woo\Local Settings\Application Data\HP\Digital Imaging\db\pathnameTable.cdx Object is locked skipped
        C:\Documents and Settings\dilys woo\Local Settings\Application Data\HP\Digital Imaging\db\pathnameTable.dbf Object is locked skipped
        C:\Documents and Settings\dilys woo\Local Settings\Application Data\HP\Digital Imaging\db\propertiesTable.cdx Object is locked skipped
        C:\Documents and Settings\dilys woo\Local Settings\Application Data\HP\Digital Imaging\db\propertiesTable.dbf Object is locked skipped
        C:\Documents and Settings\dilys woo\Local Settings\Application Data\HP\Digital Imaging\db\ROFImagesTable.cdx Object is locked skipped
        C:\Documents and Settings\dilys woo\Local Settings\Application Data\HP\Digital Imaging\db\ROFImagesTable.dbf Object is locked skipped
        C:\Documents and Settings\dilys woo\Local Settings\Application Data\HP\Digital Imaging\db\ROFTable.cdx Object is locked skipped
        C:\Documents and Settings\dilys woo\Local Settings\Application Data\HP\Digital Imaging\db\ROFTable.dbf Object is locked skipped
        C:\Documents and Settings\dilys woo\Local Settings\Application Data\Microsoft\Messenger\dilysss@gmail.com\SharingMetadata\Logs\Dfsr00005.log Object is locked skipped
        C:\Documents and Settings\dilys woo\Local Settings\Application Data\Microsoft\Messenger\dilysss@gmail.com\SharingMetadata\pending.dat Object is locked skipped
        C:\Documents and Settings\dilys woo\Local Settings\Application Data\Microsoft\Messenger\dilysss@gmail.com\SharingMetadata\Working\database_3288_937A_8893_3B75\dfsr.db Object is locked skipped
        C:\Documents and Settings\dilys woo\Local Settings\Application Data\Microsoft\Messenger\dilysss@gmail.com\SharingMetadata\Working\database_3288_937A_8893_3B75\fsr.log Object is locked skipped
        C:\Documents and Settings\dilys woo\Local Settings\Application Data\Microsoft\Messenger\dilysss@gmail.com\SharingMetadata\Working\database_3288_937A_8893_3B75\fsrtmp.log Object is locked skipped
        C:\Documents and Settings\dilys woo\Local Settings\Application Data\Microsoft\Messenger\dilysss@gmail.com\SharingMetadata\Working\database_3288_937A_8893_3B75\tmp.edb Object is locked skipped
        C:\Documents and Settings\dilys woo\Local Settings\Application Data\Microsoft\Movie Maker\MEDIATAB0.DAT Object is locked skipped
        C:\Documents and Settings\dilys woo\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
        C:\Documents and Settings\dilys woo\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
        C:\Documents and Settings\dilys woo\Local Settings\Application Data\Microsoft\Windows Live Contacts\dilysss@gmail.com\real\members.stg Object is locked skipped
        C:\Documents and Settings\dilys woo\Local Settings\Application Data\Microsoft\Windows Live Contacts\dilysss@gmail.com\shadow\members.stg Object is locked skipped
        C:\Documents and Settings\dilys woo\Local Settings\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\Cache\_CACHE_001_ Object is locked skipped
        C:\Documents and Settings\dilys woo\Local Settings\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\Cache\_CACHE_002_ Object is locked skipped
        C:\Documents and Settings\dilys woo\Local Settings\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\Cache\_CACHE_003_ Object is locked skipped
        C:\Documents and Settings\dilys woo\Local Settings\Application Data\Mozilla\Firefox\Profiles\qzma4kfa.default\Cache\_CACHE_MAP_ Object is locked skipped
        C:\Documents and Settings\dilys woo\Local Settings\History\History.IE5\index.dat Object is locked skipped
        C:\Documents and Settings\dilys woo\Local Settings\History\History.IE5\MSHist012008010620080107\index.dat Object is locked skipped
        C:\Documents and Settings\dilys woo\Local Settings\Temp\hpodvd09.log Object is locked skipped
        C:\Documents and Settings\dilys woo\Local Settings\Temp\Perflib_Perfdata_1200.dat Object is locked skipped
        C:\Documents and Settings\dilys woo\Local Settings\Temp\Perflib_Perfdata_1208.dat Object is locked skipped
        C:\Documents and Settings\dilys woo\Local Settings\Temp\Perflib_Perfdata_240.dat Object is locked skipped
        C:\Documents and Settings\dilys woo\Local Settings\Temp\~DF1182.tmp Object is locked skipped
        C:\Documents and Settings\dilys woo\Local Settings\Temp\~DF8E1A.tmp Object is locked skipped
        C:\Documents and Settings\dilys woo\Local Settings\Temp\~DF954A.tmp Object is locked skipped
        C:\Documents and Settings\dilys woo\Local Settings\Temp\~DF95BF.tmp Object is locked skipped
        C:\Documents and Settings\dilys woo\Local Settings\Temp\~DFA0B2.tmp Object is locked skipped
        C:\Documents and Settings\dilys woo\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
        C:\Documents and Settings\dilys woo\My Documents\My Music\iTunes\iTunes Library.itl Object is locked skipped
        C:\Documents and Settings\dilys woo\NTUSER.DAT Object is locked skipped
        C:\Documents and Settings\dilys woo\ntuser.dat.LOG Object is locked skipped
        C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
        C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
        C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
        C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
        C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
        C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
        C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
        C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
        C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
        C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
        C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
        C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcrst.dll Object is locked skipped
        C:\Program Files\Common Files\Symantec Shared\eengine\EPERSIST.DAT Object is locked skipped
        C:\Program Files\Common Files\Symantec Shared\SNDALRT.log Object is locked skipped
        C:\Program Files\Common Files\Symantec Shared\SNDCON.log Object is locked skipped
        C:\Program Files\Common Files\Symantec Shared\SNDDBG.log Object is locked skipped
        C:\Program Files\Common Files\Symantec Shared\SNDFW.log Object is locked skipped
        C:\Program Files\Common Files\Symantec Shared\SNDIDS.log Object is locked skipped
        C:\Program Files\Common Files\Symantec Shared\SNDSYS.log Object is locked skipped
        C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBConfig.log Object is locked skipped
        C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBDebug.log Object is locked skipped
        C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBDetect.log Object is locked skipped
        C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBNotify.log Object is locked skipped
        C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBRefr.log Object is locked skipped
        C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetCfg.log Object is locked skipped
        C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetCfg2.log Object is locked skipped
        C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetDev.log Object is locked skipped
        C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetLoc.log Object is locked skipped
        C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetUsr.log Object is locked skipped
        C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSMNot.log Object is locked skipped
        C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSMReg.log Object is locked skipped
        C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSMRSt.log Object is locked skipped
        C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBStHash.log Object is locked skipped
        C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBStMSI.log Object is locked skipped
        C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBValid.log Object is locked skipped
        C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPPolicy.log Object is locked skipped
        C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPStart.log Object is locked skipped
        C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPStop.log Object is locked skipped
        C:\Program Files\Mozilla Firefox\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
        C:\Program Files\Norton AntiVirus\AVApp.log Object is locked skipped
        C:\Program Files\Norton AntiVirus\AVError.log Object is locked skipped
        C:\Program Files\Norton AntiVirus\AVVirus.log Object is locked skipped
        C:\Program Files\Norton AntiVirus\Savrt\0929NAV~.TMP Object is locked skipped
        C:\Program Files\Norton AntiVirus\Savrt\0957NAV~.TMP Object is locked skipped
        C:\SDFix\backups_old1\alxvdvm.dll Infected: not-a-virus:AdWare.Win32.Vapsup.tz skipped
        C:\SDFix\backups_old1\bvtqfvx.dll Infected: not-a-virus:AdWare.Win32.Vapsup.tz skipped
        C:\SDFix\backups_old1\domnftwmnf.dll Infected: not-a-virus:AdWare.Win32.Vapsup.tz skipped
        C:\SDFix\backups_old1\emlkdvo.dll Infected: not-a-virus:AdWare.Win32.Vapsup.tz skipped
        C:\SDFix\backups_old1\fvkwdrt.exe Infected: not-a-virus:AdWare.Win32.Vapsup.tz skipped
        C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
        C:\System Volume Information\_restore{0F60396B-0F5E-4E50-B649-25D2D5E11E35}\RP11\change.log Object is locked skipped
        C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
        C:\WINDOWS\SchedLgU.Txt Object is locked skipped
        C:\WINDOWS\SoftwareDistribution\EventCache\{FD78A8A0-9905-4320-AA10-762CD7400BF8}.bin Object is locked skipped
        C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
        C:\WINDOWS\Sti_Trace.log Object is locked skipped
        C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
        C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
        C:\WINDOWS\system32\config\ACEEvent.evt Object is locked skipped
        C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
        C:\WINDOWS\system32\config\default Object is locked skipped
        C:\WINDOWS\system32\config\default.LOG Object is locked skipped
        C:\WINDOWS\system32\config\SAM Object is locked skipped
        C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
        C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
        C:\WINDOWS\system32\config\SECURITY Object is locked skipped
        C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
        C:\WINDOWS\system32\config\software Object is locked skipped
        C:\WINDOWS\system32\config\software.LOG Object is locked skipped
        C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
        C:\WINDOWS\system32\config\system Object is locked skipped
        C:\WINDOWS\system32\config\system.LOG Object is locked skipped
        C:\WINDOWS\system32\h323log.txt Object is locked skipped
        C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
        C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
        C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
        C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
        C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
        C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
        C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
        C:\WINDOWS\wiadebug.log Object is locked skipped
        C:\WINDOWS\wiaservc.log Object is locked skipped
        C:\WINDOWS\WindowsUpdate.log Object is locked skipped
        Scan process completed.
      • deelist
        edited January 2008
        Logfile of Trend Micro HijackThis v2.0.2
        Scan saved at 10:54:58 PM, on 1/6/2008
        Platform: Windows XP SP2 (WinNT 5.01.2600)
        MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
        Boot mode: Normal

        Running processes:
        C:\WINDOWS\System32\smss.exe
        C:\WINDOWS\system32\winlogon.exe
        C:\WINDOWS\system32\services.exe
        C:\WINDOWS\system32\lsass.exe
        C:\WINDOWS\system32\Ati2evxx.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\System32\svchost.exe
        C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
        C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
        C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
        C:\WINDOWS\system32\Ati2evxx.exe
        C:\WINDOWS\Explorer.EXE
        C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
        C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
        C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
        C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
        C:\WINDOWS\system32\spoolsv.exe
        C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
        C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
        C:\Program Files\Bonjour\mDNSResponder.exe
        C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
        C:\WINDOWS\system32\DVDRAMSV.exe
        C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
        C:\Program Files\Norton AntiVirus\navapsvc.exe
        C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
        C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
        C:\WINDOWS\system32\svchost.exe
        C:\Program Files\Canon\CAL\CALMAIN.exe
        C:\WINDOWS\system32\ZoomingHook.exe
        C:\Program Files\Toshiba\Tvs\TvsTray.exe
        C:\WINDOWS\system32\TPSMain.exe
        C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
        C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
        C:\WINDOWS\system32\TCtrlIOHook.exe
        C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
        C:\WINDOWS\system32\TPSBattM.exe
        C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
        C:\WINDOWS\RTHDCPL.EXE
        C:\Program Files\QuickTime\qttask.exe
        C:\Program Files\PowerISO\PWRISOVM.EXE
        C:\Program Files\Protector Suite QL\psqltray.exe
        C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
        C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
        C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
        C:\Program Files\iTunes\iTunesHelper.exe
        C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
        C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
        C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
        C:\Program Files\iPod\bin\iPodService.exe
        C:\WINDOWS\System32\DLA\DLACTRLW.EXE
        C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
        C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
        C:\Program Files\Common Files\Symantec Shared\ccApp.exe
        C:\WINDOWS\system32\rundll32.exe
        C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
        C:\Program Files\Apoint2K\Apoint.exe
        C:\WINDOWS\AGRSMMSG.exe
        C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe
        C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
        C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
        C:\Program Files\MSN Messenger\MsnMsgr.Exe
        C:\WINDOWS\system32\ctfmon.exe
        C:\Program Files\Apoint2K\Apntex.exe
        C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
        C:\WINDOWS\system32\RAMASST.exe
        C:\Program Files\WinZip\WZQKPICK.EXE
        C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
        C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
        C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
        C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
        C:\Program Files\MSN Messenger\usnsvc.exe
        C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
        C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
        C:\Program Files\iTunes\iTunes.exe
        C:\Program Files\Mozilla Firefox\firefox.exe
        C:\Program Files\internet explorer\iexplore.exe
        C:\WINDOWS\system32\wbem\wmiapsrv.exe
        C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

        R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
        O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
        O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
        O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
        O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
        O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
        O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
        O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
        O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
        O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
        O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
        O4 - HKLM\..\Run: [ZoomingHook] ZoomingHook.exe
        O4 - HKLM\..\Run: [Tvs] C:\Program Files\Toshiba\Tvs\TvsTray.exe
        O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
        O4 - HKLM\..\Run: [TPNF] C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
        O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
        O4 - HKLM\..\Run: [TDispVol] TDispVol.exe
        O4 - HKLM\..\Run: [TCtryIOHook] TCtrlIOHook.exe
        O4 - HKLM\..\Run: [SVPWUTIL] C:\Program Files\Toshiba\Windows Utilities\SVPWUTIL.exe SVPwUTIL
        O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
        O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
        O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
        O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
        O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
        O4 - HKLM\..\Run: [PSQLLauncher] "C:\Program Files\Protector Suite QL\launcher.exe" /startup
        O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
        O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
        O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
        O4 - HKLM\..\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
        O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
        O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
        O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
        O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
        O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
        O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
        O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
        O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
        O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
        O4 - HKLM\..\Run: [HWSetup] C:\Program Files\TOSHIBA\TOSHIBA Applet\HWSetup.exe hwSetUP
        O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
        O4 - HKLM\..\Run: [CFSServ.exe] CFSServ.exe -NoClient
        O4 - HKLM\..\Run: [CeEKEY] C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
        O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
        O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
        O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
        O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
        O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
        O4 - HKLM\..\Run: [AdobeVersionCue] C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe
        O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
        O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
        O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
        O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
        O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
        O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
        O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
        O4 - HKLM\..\Policies\Explorer\Run: []
        O4 - HKUS\S-1-5-18\..\RunOnce: [POSTRBT] C:\Program Files\Norton AntiVirus\Navw32.exe /REMEDIATE (User 'SYSTEM')
        O4 - HKUS\.DEFAULT\..\RunOnce: [POSTRBT] C:\Program Files\Norton AntiVirus\Navw32.exe /REMEDIATE (User 'Default user')
        O4 - Global Startup: Bluetooth Monitor.lnk = ?
        O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
        O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
        O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
        O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
        O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
        O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
        O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
        O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
        O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
        O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
        O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
        O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-sg\msntabres.dll.mui/229?f3ecfba7ed224c3da266ba2f54c4db56
        O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-sg\msntabres.dll.mui/230?f3ecfba7ed224c3da266ba2f54c4db56
        O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
        O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
        O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
        O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
        O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
        O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
        O16 - DPF: {CD259AEC-23E6-4E64-8138-7E28D56666D7} (SQFViewer10X Element) - http://www.natuerlich-birkenstock.de/v1/SQFViewer10.ocx
        O17 - HKLM\System\CCS\Services\Tcpip\..\{5D5E162B-9583-41AD-8E3C-5977AB92A85D}: NameServer = 192.168.1.1,218.186.1.38
        O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
        O23 - Service: AdobeVersionCue - Adobe Sytems - C:\Program Files\Adobe\Adobe Version Cue\service\VersionCue.exe
        O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
        O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
        O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
        O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
        O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
        O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
        O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
        O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
        O23 - Service: DVD-RAM_Service - Matsu****a Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
        O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
        O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
        O23 - Service: InstallDriver Table Manager (IDriverT) - Unknown owner - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe (file missing)
        O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
        O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
        O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
        O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
        O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
        O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
        O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
        O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
        O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
        O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
        O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
        O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
        O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

        --
        End of file - 15088 bytes
      • Baabiouz
        edited January 2008
        Hi!

        Next we remove all used tools.
        Please download OTMoveIt and save it to desktop.
        • Double-click OTMoveIt.exe.
        • Click the CleanUp! button.
        • Select Yes when the "Begin cleanup Process?" prompt appears.
        • If you are prompted to Reboot during the cleanup, select Yes.
        • The tool will delete itself once it finishes, if not delete it by yourself.
        Note: If you receive a warning from your firewall or other security programs regarding OTMoveIt attempting to contact the internet, please allow it to do so.
        ________________________________

        Log looks clean...great job!

        Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:
        1. Disable and Enable System Restore. - If you are using Windows ME or XP then you should disable and reenable system restore to make sure there are no infected files found in a restore point.

          You can find instructions on how to enable and reenable system restore here:

          Managing Windows Millenium System Restore

          or

          Windows XP System Restore Guide

          Renable system restore with instructions from tutorial above

        2. Make your Internet Explorer more secure - This can be done by following these simple instructions:
          1. From within Internet Explorer click on the Tools menu and then click on Options.
          2. Click once on the Security tab
          3. Click once on the Internet icon so it becomes highlighted.
          4. Click once on the Custom Level button.
            1. Change the Download signed ActiveX controls to Prompt
            2. Change the Download unsigned ActiveX controls to Disable
            3. Change the Initialize and script ActiveX controls not marked as safe to Disable
            4. Change the Installation of desktop items to Prompt
            5. Change the Launching programs and files in an IFRAME to Prompt
            6. Change the Navigate sub-frames across different domains to Prompt
            7. When all these settings have been made, click on the OK button.
            8. If it prompts you as to whether or not you want to save the settings, press the Yes button.
          5. Next press the Apply button and then the OK to exit the Internet Properties page.
        3. Use an AntiVirus Software - It is very important that your computer has an anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future.

          See this link for a listing of some online & their stand-alone antivirus programs:

          Virus, Spyware, and Malware Protection and Removal Resources

        4. Update your AntiVirus Software - It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.

        5. Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is succeptible to being hacked and taken over. I am very serious about this and see it happen almost every day with my clients. Simply using a Firewall in its default configuration can lower your risk greatly.

          For a tutorial on Firewalls and a listing of some available ones see the link below:

          Understanding and Using Firewalls

        6. Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

        7. Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an antivirus software.

          A tutorial on installing & using this product can be found here:

          Using Spybot - Search & Destroy to remove Spyware , Malware, and Hijackers

        8. Install Ad-Aware - Install and download Ad-Aware. ou should also scan your computer with program on a regular basis just as you would an antivirus software in conjunction with Spybot.

          A tutorial on installing & using this product can be found here:

          Using Ad-aware to remove Spyware, Malware, & Hijackers from Your Computer

        9. Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.

          A tutorial on installing & using this product can be found here:

          Using SpywareBlaster to protect your computer from Spyware and Malware

        10. Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.
        Follow this list and your potential for being infected again will reduce dramatically.

        Glad I was able to help.
      • deelist
        edited January 2008
        a very big thank you to you!:bigggrin:
      • Baabiouz
        edited January 2008
        You're welcome :)
      This discussion has been closed.