Jump to content

pdukey

Honorary Members
 View Profile  See their activity

  • Posts

    55

  • Joined

  • Last visited

 Content Type 

Posts posted by pdukey

    doctor issue and scared to exit safe mode

    in Resolved Malware Removal Logs

    Posted

    working from a clean computer. mbam found infected files/cleaned files/rebooted only to return.

    running infected pc now in safe mode. ran mbam again found 8 files related to malware doctor. did not reboot (too scared to exit safe mode).

    GMER is running now. will post soon. (ran earlier but did not save file)

    here is dds files: (from safe mode)

    DDS (Ver_10-03-17.01) - NTFSx86 MINIMAL

    Run by Thomas Family at 17:28:53.25 on Tue 07/13/2010

    Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.5.0_12

    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.252 [GMT -4:00]

    AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

    ============== Running Processes ===============

    C:\WINDOWS\system32\svchost -k DcomLaunch

    svchost.exe

    C:\WINDOWS\system32\svchost.exe -k netsvcs

    C:\Program Files\AVG\AVG9\avgchsvx.exe

    C:\WINDOWS\Explorer.EXE

    G:\Malwarebytes' Anti-Malware\mbam.exe

    C:\WINDOWS\system32\rundll32.exe

    C:\Documents and Settings\Thomas Family\Desktop\dds.scr

    ============== Pseudo HJT Report ===============

    uStart Page = www.hotmail.com/

    uInternet Settings,ProxyServer = http=127.0.0.1:5643

    uInternet Settings,ProxyOverride = <local>

    uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

    BHO: c:\windows\system32\r1y36id52v.dll: {c2ba40a2-75f1-51bd-f413-04b15a2c8950} - c:\windows\system32\r1y36id52v.dll

    EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File

    uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background

    uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

    uRun: [070700Setup.exe] c:\documents and settings\thomas family\application data\5d4060bfb33473261383692f5d70e05f\070700Setup.exe

    uRun: [uiha98uiohf873yuiadnhgjesgregas] c:\docume~1\thomas~1\locals~1\temp\f8ilr.exe

    mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup

    mRun: [nwiz] nwiz.exe /install

    mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit

    mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe

    mRun: [WINDVDPatch] CTHELPER.EXE

    mRun: [updReg] c:\windows\UpdReg.EXE

    mRun: [Jet Detection] "c:\program files\creative\sblive\program\ADGJDet.exe"

    mRun: [share-to-Web Namespace Daemon] c:\program files\hewlett-packard\hp share-to-web\hpgs2wnd.exe

    mRun: [HP Software Update] c:\program files\hewlett-packard\hp software update\HPWuSchd2.exe

    mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime

    mRun: [ulead Quick-Drop] "c:\program files\ulead systems\ulead dvd moviefactory 5 plus\ulead dvd moviefactory 5\Quick-Drop.exe" WINDOWCALL

    mRun: [sunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"

    mRun: [ulead AutoDetector] c:\program files\common files\ulead systems\autodetector\Monitor.exe

    mRun: [ulead Calendar Checker] f:\ulead\CalCheck.exe

    mRun: [AVG9_TRAY] c:\progra~1\avg\avg9\avgtray.exe

    mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"

    mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

    mRun: [Malwarebytes Anti-Malware (reboot)] "g:\malwarebytes' anti-malware\mbam.exe" /runcleanupscript

    mExplorerRun: [z7b6s8] c:\docume~1\thomas~1\locals~1\temp\r3ghaz.exe

    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hewlett-packard\digital imaging\bin\hpqtra08.exe

    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office\OSA9.EXE

    mPolicies-system: EnableLUA = 0 (0x0)

    IE: Add to AMV Convert Tool... - c:\program files\mp3 player utilities 4.00\amvconverter\grab.html

    IE: Add to Media Manager... - c:\program files\mp3 player utilities 4.00\mediamanager\grab.html

    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

    DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab

    DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab

    DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://www.apple.com/qtactivex/qtplugin.cab

    DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab

    DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

    DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204

    DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

    DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} - hxxp://photos.walmart.com/WalmartActivia.cab

    DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://gfx1.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab

    DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1169328104353

    DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab

    DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab

    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab

    DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab

    DPF: {CAFEEFAC-0015-0000-0012-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_12-windows-i586.cab

    DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab

    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab

    DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

    DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} - hxxp://gfx1.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab

    DPF: {EFD1E13D-1CB3-4545-B754-CA410FE7734F} - hxxp://samsclubus.pnimedia.com/upload/activex/v3_0_0_2/PhotoCenter_ActiveX_Control.cab

    TCP: NameServer = 93.188.162.61,93.188.161.201

    TCP: {F261DAF4-1254-4056-8919-3B3D29CAC9E4} = 93.188.162.61,93.188.161.201

    Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll

    Notify: avgrsstarter - avgrsstx.dll

    SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

    STS: c:\windows\system32\r1y36id52v.dll: {c2ba40a2-75f1-51bd-f413-04b15a2c8950} - c:\windows\system32\r1y36id52v.dll

    ============= SERVICES / DRIVERS ===============

    S1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-7-29 216200]

    S1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-7-29 29584]

    S1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2010-2-19 242896]

    S2 avg9emc;AVG Free E-mail Scanner;c:\program files\avg\avg9\avgemc.exe [2010-3-17 916760]

    S2 avg9wd;AVG Free WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2010-3-17 308064]

    =============== Created Last 30 ================

    2010-07-13 13:52:35 30000 ----a-w- c:\windows\system32\r1y36id52v.dll

    2010-07-13 13:51:43 0 d-----w- c:\docume~1\thomas~1\applic~1\5D4060BFB33473261383692F5D70E05F

    ==================== Find3M ====================

    2010-06-02 13:19:36 242896 ----a-w- c:\windows\system32\drivers\avgtdix.sys

    2010-05-06 10:41:53 916480 ----a-w- c:\windows\system32\wininet.dll

    2010-05-02 05:22:50 1851264 ----a-w- c:\windows\system32\win32k.sys

    2010-04-20 05:30:08 285696 ----a-w- c:\windows\system32\atmfd.dll

    2006-05-03 09:06:54 163328 --sh--r- c:\windows\system32\flvDX.dll

    2007-02-21 10:47:16 31232 -csh--r- c:\windows\system32\msfDX.dll

    2009-11-27 01:40:23 245760 --sha-w- c:\windows\system32\config\systemprofile\ietldcache\index.dat

    ============= FINISH: 17:30:36.46 ===============

    attach1.zip

    The Doctor is Back!!!

    in Resolved Malware Removal Logs

    Posted

    Hello, I was hijacked by the Dr. loaded mbam to a flash drive with update from a clean PC. Started infected PC in Safe Mode and ran mbam (12 infected files) and rebooted. Upon reboot the Antimalware Doctor was (re?)installed with something else running in the background as windows was unstable and locked-up. I restarted PC under safe mode and ran mbam again with infections found but concerned to reboot again fearing same results. So I am still in safe mode.

    What I can find is:

    Under add/remove programs Antimalware Doctor and Security Update for Windows Media Encoder(KB954156) are new to me.

    Also Java has created a log file to my desktop noting a fatal error.

    The PC is staying in safe mode until I am directed what is next.

    Thank you.

    3rd attempt for help

    in Resolved Malware Removal Logs

    Posted

    Thank you Melboy for all of the help!

    should I cahnge my passwords? if so use this pc or another one?

    thanks again

    Malwarebytes' Anti-Malware 1.41

    Database version: 3277

    Windows 5.1.2600 Service Pack 3

    12/2/2009 10:37:48 AM

    mbam-log-2009-12-02 (10-37-48).txt

    Scan type: Quick Scan

    Objects scanned: 112788

    Time elapsed: 16 minute(s), 58 second(s)

    Memory Processes Infected: 0

    Memory Modules Infected: 0

    Registry Keys Infected: 0

    Registry Values Infected: 0

    Registry Data Items Infected: 0

    Folders Infected: 0

    Files Infected: 0

    Memory Processes Infected:

    (No malicious items detected)

    Memory Modules Infected:

    (No malicious items detected)

    Registry Keys Infected:

    (No malicious items detected)

    Registry Values Infected:

    (No malicious items detected)

    Registry Data Items Infected:

    (No malicious items detected)

    Folders Infected:

    (No malicious items detected)

    Files Infected:

    (No malicious items detected)

    3rd attempt for help

    in Resolved Malware Removal Logs

    Posted

    i.e. is working well no more redirects. I will not be able to be on this pc again until late Weds.

    thanks

    ESETSmartInstaller@High as CAB hook log:

    OnlineScanner.ocx - registred OK

    # version=7

    # IEXPLORE.EXE=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)

    # OnlineScanner.ocx=1.0.0.6211

    # api_version=3.0.2

    # EOSSerial=f59c6551dac66b489788b033d104e13f

    # end=finished

    # remove_checked=false

    # archives_checked=true

    # unwanted_checked=true

    # unsafe_checked=true

    # antistealth_checked=true

    # utc_time=2009-12-01 03:11:43

    # local_time=2009-11-30 10:11:43 (-0500, Eastern Standard Time)

    # country="United States"

    # lang=1033

    # osver=5.1.2600 NT Service Pack 3

    # compatibility_mode=512 16777215 100 0 2611091 2611091 0 0

    # compatibility_mode=1024 16777191 100 0 9821281 9821281 0 0

    # compatibility_mode=8192 67108863 100 0 0 0 0 0

    # scanned=113179

    # found=1

    # cleaned=0

    # scan_time=6322

    C:\System Volume Information\_restore{498103B2-0F54-4F78-9C2B-CF360A3DF4B5}\RP1011\A0058896.dll a variant of Win32/Kryptik.BAC trojan 00000000000000000000000000000000 I

    3rd attempt for help

    in Resolved Malware Removal Logs

    Posted

    Logfile of random's system information tool 1.06 (written by random/random)

    Run by Thomas Family at 2009-11-29 13:06:18

    Microsoft Windows XP Home Edition Service Pack 3

    System drive C: has 5 GB (14%) free of 38 GB

    Total RAM: 511 MB (35% free)

    Logfile of Trend Micro HijackThis v2.0.2

    Scan saved at 1:06:23 PM, on 11/29/2009

    Platform: Windows XP SP3 (WinNT 5.01.2600)

    MSIE: Internet Explorer v8.00 (8.00.6001.18702)

    Boot mode: Normal

    Running processes:

    C:\WINDOWS\System32\smss.exe

    C:\WINDOWS\system32\winlogon.exe

    C:\WINDOWS\system32\services.exe

    C:\WINDOWS\system32\lsass.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\System32\svchost.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\system32\spoolsv.exe

    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

    C:\Program Files\Java\jre6\bin\jqs.exe

    C:\WINDOWS\system32\nvsvc32.exe

    C:\Program Files\Photodex\ProShowGold\ScsiAccess.exe

    C:\WINDOWS\System32\svchost.exe

    C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

    C:\PROGRA~1\AVG\AVG8\avgrsx.exe

    C:\WINDOWS\system32\wscntfy.exe

    C:\WINDOWS\Explorer.EXE

    c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe

    C:\WINDOWS\system32\CTHELPER.EXE

    C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe

    C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe

    C:\Program Files\Common Files\Ulead Systems\AutoDetector\Monitor.exe

    C:\PROGRA~1\AVG\AVG8\avgtray.exe

    C:\Program Files\Java\jre6\bin\jusched.exe

    C:\Program Files\Messenger\msmsgs.exe

    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe

    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exe

    C:\WINDOWS\system32\ctfmon.exe

    C:\Program Files\Internet Explorer\IEXPLORE.EXE

    C:\Program Files\Internet Explorer\IEXPLORE.EXE

    C:\Documents and Settings\Thomas Family\desktop\rsit.exe

    C:\Program Files\Trend Micro\HijackThis\Thomas Family.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.hotmail.com/

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

    O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

    O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE

    O4 - HKLM\..\Run: [updReg] C:\WINDOWS\UpdReg.EXE

    O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"

    O4 - HKLM\..\Run: [share-to-Web Namespace Daemon] c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe

    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe

    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

    O4 - HKLM\..\Run: [ulead AutoDetector] C:\Program Files\Common Files\Ulead Systems\AutoDetector\Monitor.exe

    O4 - HKLM\..\Run: [ulead Calendar Checker] C:\Program Files\Ulead Systems\Ulead Photo Express 6\CalCheck.exe

    O4 - HKLM\..\Run: [ulead Quick-Drop] "C:\Program Files\Ulead Systems\Ulead DVD MovieFactory 5 Plus\Ulead DVD MovieFactory 5\Quick-Drop.exe" WINDOWCALL

    O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe

    O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

    O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

    O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe

    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

    O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Program Files\MP3 Player Utilities 4.00\AMVConverter\grab.html

    O8 - Extra context menu item: Add to Media Manager... - C:\Program Files\MP3 Player Utilities 4.00\MediaManager\grab.html

    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1...toUploader5.cab

    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

    O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab

    O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photos.walmart.com/WalmartActivia.cab

    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab

    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1169328104353

    O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.0...oUploader55.cab

    O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx1.hotmail.com/mail/w4/pr01/photo...ol/MSNPUpld.cab

    O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll

    O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

    O23 - Service: iPod Service - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)

    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

    O23 - Service: ScsiAccess - Unknown owner - C:\Program Files\Photodex\ProShowGold\ScsiAccess.exe

    O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

    --

    End of file - 7398 bytes

    ======Registry dump======

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]

    Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]

    Java Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-11-25 41760]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]

    JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-11-25 73728]

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

    "NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2006-10-22 7700480]

    "nwiz"=nwiz.exe /install []

    "NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2006-10-22 86016]

    "NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]

    "WINDVDPatch"=C:\WINDOWS\system32\CTHELPER.EXE [2002-07-02 24576]

    "UpdReg"=C:\WINDOWS\UpdReg.EXE [2000-05-11 90112]

    "Jet Detection"=C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe [2001-11-29 28672]

    "Share-to-Web Namespace Daemon"=c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe [2002-04-17 69632]

    "HP Software Update"=C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe [2006-02-19 49152]

    "QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2007-02-16 282624]

    "Ulead AutoDetector"=C:\Program Files\Common Files\Ulead Systems\AutoDetector\Monitor.exe [2005-07-28 94208]

    "Ulead Calendar Checker"=C:\Program Files\Ulead Systems\Ulead Photo Express 6\CalCheck.exe [2005-08-22 69632]

    "Ulead Quick-Drop"=C:\Program Files\Ulead Systems\Ulead DVD MovieFactory 5 Plus\Ulead DVD MovieFactory 5\Quick-Drop.exe [2006-07-20 118784]

    "AVG8_TRAY"=C:\PROGRA~1\AVG\AVG8\avgtray.exe [2009-11-26 2029336]

    "Malwarebytes Anti-Malware (reboot)"=C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe [2009-09-10 1312080]

    "SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-11-25 149280]

    "Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-10-03 35696]

    "Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2009-09-04 935288]

    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

    "MSMSGS"=C:\Program Files\Messenger\msmsgs.exe [2008-04-13 1695232]

    "ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup

    HP Digital Imaging Monitor.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe

    Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\avgrsstarter]

    C:\WINDOWS\system32\avgrsstx.dll [2009-08-22 11952]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]

    WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]

    "dontdisplaylastusername"=0

    "legalnoticecaption"=

    "legalnoticetext"=

    "shutdownwithoutlogon"=1

    "undockwithoutlogon"=1

    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]

    "NoDriveTypeAutoRun"=323

    "NoDriveAutoRun"=67108863

    "NoDrives"=0

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]

    "HonorAutoRunSetting"=

    "NoDriveAutoRun"=

    "NoDriveTypeAutoRun"=

    "NoDrives"=

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

    "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

    "C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe"="C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe"

    "C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqste08.exe"="C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe"

    "C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpofxm08.exe"="C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe"

    "C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposfx08.exe"="C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe"

    "C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposid01.exe"="C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe"

    "C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqscnvw.exe"="C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqscnvw.exe:*:Enabled:hpqscnvw.exe"

    "C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqkygrp.exe"="C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"

    "C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqCopy.exe"="C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqCopy.exe:*:Enabled:hpqcopy.exe"

    "C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpfccopy.exe"="C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe"

    "C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpzwiz01.exe"="C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe"

    "C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\HpqPhUnl.exe"="C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\HpqPhUnl.exe:*:Enabled:hpqphunl.exe"

    "C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\HpqDIA.exe"="C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\HpqDIA.exe:*:Enabled:hpqdia.exe"

    "C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoews01.exe"="C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe"

    "C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqnrs08.exe"="C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqnrs08.exe:*:Enabled:hpqnrs08.exe"

    "C:\Program Files\AVG\AVG8\avgupd.exe"="C:\Program Files\AVG\AVG8\avgupd.exe:*:Enabled:avgupd.exe"

    "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

    "C:\Program Files\Photodex\ProShowGold\proshow.exe"="C:\Program Files\Photodex\ProShowGold\proshow.exe:*:Disabled:proshow.exe"

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

    "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

    "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

    ======List of files/folders created in the last 1 months======

    2009-11-27 10:54:03 ----A---- C:\ComboFix.txt

    2009-11-25 09:44:52 ----A---- C:\WINDOWS\system32\javaws.exe

    2009-11-25 09:44:52 ----A---- C:\WINDOWS\system32\deploytk.dll

    2009-11-25 09:44:51 ----A---- C:\WINDOWS\system32\javaw.exe

    2009-11-25 09:44:51 ----A---- C:\WINDOWS\system32\java.exe

    2009-11-25 08:57:23 ----D---- C:\WINDOWS\ie8updates

    2009-11-25 08:54:36 ----D---- C:\WINDOWS\WBEM

    2009-11-25 08:52:40 ----HDC---- C:\WINDOWS\ie8

    2009-11-25 03:03:16 ----HDC---- C:\WINDOWS\$NtUninstallKB976098-v2$

    2009-11-25 03:03:02 ----HDC---- C:\WINDOWS\$NtUninstallKB973687$

    2009-11-23 19:30:02 ----D---- C:\WINDOWS\temp

    2009-11-22 18:19:39 ----N---- C:\WINDOWS\system32\eventlog.dll

    2009-11-21 03:07:50 ----HDC---- C:\WINDOWS\$NtUninstallKB976749$

    2009-11-21 03:04:20 ----A---- C:\WINDOWS\system32\MRT.exe

    2009-11-21 03:03:03 ----HDC---- C:\WINDOWS\$NtUninstallKB969947$

    2009-11-20 20:04:25 ----A---- C:\WINDOWS\system32\proquota.exe

    2009-11-20 19:37:35 ----A---- C:\Boot.bak

    2009-11-20 19:37:23 ----RASHD---- C:\cmdcons

    2009-11-20 19:18:45 ----A---- C:\WINDOWS\zip.exe

    2009-11-20 19:18:45 ----A---- C:\WINDOWS\SWXCACLS.exe

    2009-11-20 19:18:45 ----A---- C:\WINDOWS\SWSC.exe

    2009-11-20 19:18:45 ----A---- C:\WINDOWS\SWREG.exe

    2009-11-20 19:18:45 ----A---- C:\WINDOWS\sed.exe

    2009-11-20 19:18:45 ----A---- C:\WINDOWS\PEV.exe

    2009-11-20 19:18:45 ----A---- C:\WINDOWS\NIRCMD.exe

    2009-11-20 19:18:45 ----A---- C:\WINDOWS\MBR.exe

    2009-11-20 19:18:45 ----A---- C:\WINDOWS\grep.exe

    2009-11-20 18:31:44 ----D---- C:\WINDOWS\ERDNT

    2009-11-20 18:31:01 ----D---- C:\Qoobox

    2009-11-17 08:40:35 ----D---- C:\rsit

    2009-10-30 15:08:13 ----D---- C:\Program Files\Trend Micro

    2009-10-30 13:58:14 ----D---- C:\Program Files\Malwarebytes' Anti-Malware

    ======List of files/folders modified in the last 1 months======

    2009-11-29 13:05:18 ----D---- C:\WINDOWS\Prefetch

    2009-11-29 13:03:30 ----D---- C:\WINDOWS\system32\drivers

    2009-11-29 07:59:35 ----D---- C:\My Downloads

    2009-11-29 03:31:32 ----D---- C:\$AVG8.VAULT$

    2009-11-27 19:24:49 ----D---- C:\WINDOWS\system32

    2009-11-27 19:24:49 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI

    2009-11-27 19:24:01 ----A---- C:\WINDOWS\{00000002-00000000-00000007-00001102-00000002-80221102}.BAK

    2009-11-27 10:40:55 ----D---- C:\WINDOWS

    2009-11-27 10:40:55 ----A---- C:\WINDOWS\system.ini

    2009-11-27 10:28:20 ----D---- C:\WINDOWS\AppPatch

    2009-11-27 10:28:15 ----D---- C:\Program Files\Common Files

    2009-11-27 10:13:57 ----RSHDC---- C:\WINDOWS\system32\dllcache

    2009-11-27 10:10:55 ----D---- C:\WINDOWS\system32\CatRoot2

    2009-11-27 10:08:50 ----A---- C:\WINDOWS\SchedLgU.Txt

    2009-11-26 03:04:21 ----HD---- C:\WINDOWS\inf

    2009-11-26 03:04:02 ----HD---- C:\WINDOWS\$hf_mig$

    2009-11-26 03:03:52 ----A---- C:\WINDOWS\imsins.BAK

    2009-11-25 20:20:15 ----D---- C:\Documents and Settings\All Users\Application Data\Adobe

    2009-11-25 10:11:09 ----D---- C:\Config.Msi

    2009-11-25 09:45:02 ----SHD---- C:\WINDOWS\Installer

    2009-11-25 09:44:17 ----D---- C:\Program Files\Java

    2009-11-25 09:39:46 ----D---- C:\Program Files\Common Files\Adobe

    2009-11-25 09:38:53 ----D---- C:\Program Files\Adobe

    2009-11-25 09:27:17 ----D---- C:\WINDOWS\WinSxS

    2009-11-25 08:59:59 ----D---- C:\WINDOWS\Help

    2009-11-25 08:59:59 ----D---- C:\Program Files\Internet Explorer

    2009-11-25 08:54:36 ----D---- C:\WINDOWS\system32\en-US

    2009-11-25 08:54:25 ----D---- C:\WINDOWS\Media

    2009-11-24 03:02:29 ----D---- C:\WINDOWS\system32\CatRoot

    2009-11-23 18:57:56 ----D---- C:\WINDOWS\system32\config

    2009-11-22 18:38:36 ----RD---- C:\Program Files

    2009-11-20 21:11:30 ----A---- C:\WINDOWS\NeroDigital.ini

    2009-11-20 19:37:36 ----RASH---- C:\boot.ini

    2009-11-12 18:33:47 ----SD---- C:\WINDOWS\Downloaded Program Files

    2009-11-04 07:37:04 ----D---- C:\WINDOWS\system32\wbem

    ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

    R1 AvgLdx86;AVG Free AVI Loader Driver x86; C:\WINDOWS\System32\Drivers\avgldx86.sys [2009-08-22 335240]

    R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86; C:\WINDOWS\System32\Drivers\avgmfx86.sys [2009-08-22 27784]

    R1 OMCI;OMCI; C:\WINDOWS\SYSTEM32\DRIVERS\OMCI.SYS [2001-08-22 13632]

    R3 ctac32k;Creative AC3 Software Decoder; C:\WINDOWS\System32\drivers\ctac32k.sys [2002-07-19 127948]

    R3 ctaud2k;Creative Audio Driver (WDM); C:\WINDOWS\system32\drivers\ctaud2k.sys [2002-07-19 837548]

    R3 ctprxy2k;Creative Proxy Driver; C:\WINDOWS\System32\drivers\ctprxy2k.sys [2002-07-19 11068]

    R3 ctsfm2k;Creative SoundFont Management Device Driver; C:\WINDOWS\System32\drivers\ctsfm2k.sys [2002-07-19 213860]

    R3 DM9102;DAVICOM 9102(A) PCI Fast Ethernet Based NT Driver; C:\WINDOWS\System32\DRIVERS\DM9PCI5.SYS [2001-08-17 29696]

    R3 emupia;E-mu Plug-in Architecture Driver; C:\WINDOWS\System32\drivers\emupia2k.sys [2002-07-19 156604]

    R3 ha10kx2k;Creative Hardware Abstract Layer Driver; C:\WINDOWS\system32\drivers\ha10kx2k.sys [2002-07-24 998004]

    R3 HCF_MSFT;HCF_MSFT; C:\WINDOWS\System32\DRIVERS\HCF_MSFT.sys [2001-08-17 907456]

    R3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\System32\DRIVERS\hidusb.sys [2008-04-13 10368]

    R3 mouhid;Mouse HID Driver; C:\WINDOWS\System32\DRIVERS\mouhid.sys [2001-08-17 12160]

    R3 nv;nv; C:\WINDOWS\System32\DRIVERS\nv4_mini.sys [2006-10-22 3994624]

    R3 ossrv;Creative OS Services Driver; C:\WINDOWS\system32\drivers\ctoss2k.sys [2002-07-19 195432]

    R3 pcouffin;VSO Software pcouffin; C:\WINDOWS\System32\Drivers\pcouffin.sys [2009-01-07 47360]

    R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2008-04-13 59520]

    R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\System32\DRIVERS\usbuhci.sys [2008-04-13 20608]

    S3 ADSEXPB;ADS DVD Express B; C:\WINDOWS\System32\Drivers\adsexpb.SYS [2005-04-06 34240]

    S3 catchme;catchme; \??\C:\DOCUME~1\THOMAS~1\LOCALS~1\Temp\catchme.sys []

    S3 ctljystk;Creative SBLive! Gameport; C:\WINDOWS\System32\DRIVERS\ctljystk.sys [2001-08-17 3712]

    S3 emu10k;Creative SB Live! (WDM); C:\WINDOWS\system32\drivers\emu10k1m.sys [2001-08-17 283904]

    S3 emu10k1;Creative Interface Manager Driver (WDM); C:\WINDOWS\system32\drivers\ctlfacem.sys [2001-08-17 6912]

    S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2006-01-31 49664]

    S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2006-01-31 16496]

    S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2006-01-31 21568]

    S3 mbr;mbr; \??\C:\DOCUME~1\THOMAS~1\LOCALS~1\Temp\mbr.sys []

    S3 motmodem;Motorola USB CDC ACM Driver; C:\WINDOWS\system32\DRIVERS\motmodem.sys [2007-06-18 23680]

    S3 sfman;Creative SoundFont Manager Driver (WDM); C:\WINDOWS\system32\drivers\sfmanm.sys [2001-08-17 36480]

    S3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]

    S3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]

    S3 usbscan;USB Scanner Driver; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]

    S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]

    S3 Wdf01000;Wdf01000; C:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2006-11-02 492000]

    S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]

    S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]

    ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

    R2 avg8wd;AVG Free8 WatchDog; C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2009-08-22 297752]

    R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-11-25 153376]

    R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2006-10-22 159810]

    R2 ScsiAccess;ScsiAccess; C:\Program Files\Photodex\ProShowGold\ScsiAccess.exe [2009-09-25 181312]

    R2 UleadBurningHelper;Ulead Burning Helper; C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe [2005-01-31 49152]

    R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-13 14336]

    S2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2005-11-22 69632]

    S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]

    S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]

    S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]

    S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]

    S3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe []

    S3 usprserv;User Privilege Service; C:\WINDOWS\System32\svchost.exe [2008-04-13 14336]

    S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\wmpnetwk.exe [2006-10-18 913408]

    S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

    -----------------EOF-----------------

    info.txt logfile of random's system information tool 1.06 2009-11-29 13:06:30

    ======Uninstall list======

    -->"C:\Program Files\Creative\SBLive\Program\Ctzapxx.EXE" /X /U /S

    -->"C:\Program Files\InstallShield Installation Information\{A644254B-92F6-4970-8635-AB0775371E72}\setup.exe" --u:{A644254B-92F6-4970-8635-AB0775371E72}

    -->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER

    -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{58582977-44D2-44A0-A09B-031CC2AE5938}\setup.exe" -l0x9

    -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{58582977-44D2-44A0-A09B-031CC2AE5938}\setup.exe" -l0x9 /remove

    -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9A4D2983-4662-4387-BE3D-4CFC2FA9C100}\setup.exe" -l0x9

    -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9A4D2983-4662-4387-BE3D-4CFC2FA9C100}\setup.exe" -l0x9 /remove

    -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A731533B-B325-4D9C-91A4-D93C8E294C19}\setup.exe" -l0x9

    -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A731533B-B325-4D9C-91A4-D93C8E294C19}\setup.exe" -l0x9 /remove

    -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FD851F7E-F887-405D-9E1C-488811113EF3}\setup.exe" -l0x9

    -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FD851F7E-F887-405D-9E1C-488811113EF3}\setup.exe" -l0x9 /remove

    -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{87616DD3-61A7-46FB-8AE3-927D5BC4D268}\setup.exe" -l0x9

    -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9BEC3D0E-B569-4998-BFB0-17D00E266854}\setup.exe" -l0x9

    -->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf

    Adobe Digital Editions-->"C:\Program Files\Adobe\Adobe Digital Editions\uninstall.exe"

    Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe

    Adobe Reader 9.2-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A92000000001}

    Adobe Shockwave Player-->C:\WINDOWS\system32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~1\Install.log

    ADS Tech Master Installer V3.6-->C:\PROGRA~1\ADSTech\UNWISE.EXE C:\PROGRA~1\ADSTech\INSTALL.LOG

    AGEIA PhysX v2.4.4-->"C:\Program Files\AGEIA Technologies\uninstall.exe"

    Amazon MP3 Downloader 1.0.5-->C:\Program Files\Amazon\MP3 Downloader\Uninstall.exe

    Audacity 1.2.6-->"C:\Program Files\Audacity\unins000.exe"

    AVG Free 8.5-->C:\Program Files\AVG\AVG8\setup.exe /UNINSTALL

    AviSynth 2.5-->"C:\Program Files\AviSynth 2.5\Uninstall.exe"

    Click'N Design 3D (V5)-->C:\PROGRA~1\CLICK'~1\UNWISE.EXE C:\PROGRA~1\CLICK'~1\INSTALL.LOG

    Compatibility Pack for the 2007 Office system-->MsiExec.exe /X{90120000-0020-0409-0000-0000000FF1CE}

    Coupon Printer for Windows-->"C:\Program Files\Coupons\uninstall.exe" "/U:C:\Program Files\Coupons\Uninstall\uninstall.xml"

    Critical Update for Windows Media Player 11 (KB959772)-->"C:\WINDOWS\$NtUninstallKB959772_WM11$\spuninst\spuninst.exe"

    Dell ResourceCD-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D78653C3-A8FF-415F-92E6-D774E634FF2D}\setup.exe"

    DivX Codec-->C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC

    DivX Content Uploader-->C:\Program Files\DivX\DivXContentUploaderUninstall.exe /CUPLOADER

    DivX Converter-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER

    DivX Player-->C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER

    DivX Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN

    DVD Decrypter (Remove Only)-->"C:\Program Files\DVD Decrypter\uninstall.exe"

    DVD Shrink 3.2-->"C:\Program Files\DVD Shrink\unins000.exe"

    DVDFab (Platinum/Gold/HD Decrypter) (Option: Mobile) 5.2.2.2-->"C:\Program Files\DVDFab 5\unins000.exe"

    EPSON TWAIN 5-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9A3EABC0-CA06-11D4-BF77-00104B130C19}\SETUP.EXE" -l0x9 UNINSTALL

    ffdshow [rev 2527] [2008-12-19]-->"C:\Program Files\ffdshow\unins000.exe"

    FLV Player 1.3.3-->"C:\Program Files\FLVPlayer\uninstall.exe"

    Garmin City Navigator Mexico NT 2010 Update-->MsiExec.exe /X{30AD6AC7-EB40-4C70-9C2B-8D0CA1D92655}

    Garmin Communicator Plugin-->MsiExec.exe /X{A7DEBAA4-B211-4D1A-A6B3-E52BFAAA1D0C}

    Garmin MapSource-->MsiExec.exe /X{EA6EB7D0-C920-4434-B43D-0DDD0AF8F497}

    Garmin USB Drivers-->MsiExec.exe /X{B1102A25-3AA3-446B-AA0F-A699B07A02FD}

    GeoPDF Toolbar-->MsiExec.exe /X{A58686F6-2ADD-4BCC-996D-311F0A39BF65}

    Google Video Player-->"C:\Program Files\Google\Google Video Player\Uninstall.exe"

    HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall

    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT=""

    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""

    Hotfix for Windows Media Format 11 SDK (KB929399)-->"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"

    Hotfix for Windows Media Player 11 (KB939683)-->"C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe"

    Hotfix for Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"

    Hotfix for Windows XP (KB961118)-->"C:\WINDOWS\$NtUninstallKB961118$\spuninst\spuninst.exe"

    Hotfix for Windows XP (KB970653-v3)-->"C:\WINDOWS\$NtUninstallKB970653-v3$\spuninst\spuninst.exe"

    Hotfix for Windows XP (KB976098-v2)-->"C:\WINDOWS\$NtUninstallKB976098-v2$\spuninst\spuninst.exe"

    HP Imaging Device Functions 7.0-->C:\Program Files\Hewlett-Packard\Digital Imaging\DeviceManagement\hpzscr01.exe -datfile hpqbud01.dat

    hp instant support-->C:\PROGRA~1\HEWLET~1\hpis\Uninstall.exe /s CeS

    HP Photo and Imaging 2.1 - Scanjet 2400 Series-->MsiExec.exe /I{6F7ECD56-E224-4263-9B7E-158E5CECC43B}

    HP Photosmart and Deskjet 7.0.A-->C:\Program Files\Hewlett-Packard\Digital Imaging\{A9F5421F-DA70-4C77-BB97-8D77EC33ED5E}\setup\hpzscr01.exe -datfile hposcr09.dat

    HP Photosmart Essential-->MsiExec.exe /X{6994491D-D491-48F1-AE1F-E179C1FFFC2F}

    HP Solution Center 7.0-->C:\Program Files\Hewlett-Packard\Digital Imaging\eSupport\hpzscr01.exe -datfile hpqbud05.dat

    HP Update-->MsiExec.exe /X{8C6027FD-53DC-446D-BB75-CACD7028A134}

    J2SE Runtime Environment 5.0 Update 12-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150120}

    Java 6 Update 17-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216017FF}

    Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"

    Microsoft .NET Framework 1.1 Security Update (KB953297)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M953297\M953297Uninstall.msp"

    Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}

    Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}

    Microsoft .NET Framework 2.0 Service Pack 2-->MsiExec.exe /I{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}

    Microsoft .NET Framework 3.0 Service Pack 2-->MsiExec.exe /I{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}

    Microsoft .NET Framework 3.5 SP1-->C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe

    Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}

    Microsoft Kernel-Mode Driver Framework Feature Pack 1.5-->"C:\WINDOWS\$NtUninstallWdf01005$\spuninst\spuninst.exe"

    Microsoft Office 2000 Professional-->MsiExec.exe /I{00010409-78E1-11D2-B60F-006097C998E7}

    Microsoft Silverlight-->MsiExec.exe /I{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}

    Microsoft User-Mode Driver Framework Feature Pack 1.0-->"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"

    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053-->MsiExec.exe /X{770657D0-A123-3C07-8E44-1C83EC895118}

    Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}

    MP3 Player Utilities 4.00-->MsiExec.exe /I{7784A172-61F1-445E-8368-601607E0DD22}

    MSXML 4.0 SP2 (KB927978)-->MsiExec.exe /I{37477865-A3F1-4772-AD43-AAFC6BCFF99F}

    MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}

    MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}

    MSXML 4.0 SP2 (KB973688)-->MsiExec.exe /I{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}

    MSXML 6 Service Pack 2 (KB954459)-->MsiExec.exe /I{1A528690-6A2D-4BC5-B143-8C4AE8D19D96}

    Nero OEM-->C:\Program Files\Ahead\nero\uninstall\UNNERO.exe /UNINSTALL

    NeroVision Express 2-->C:\WINDOWS\UNNeroVision.exe /UNINSTALL

    OCR Software by I.R.I.S 7.0-->C:\Program Files\Hewlett-Packard\Digital Imaging\OCR\hpzscr01.exe -datfile hpqbud11.dat

    Panda ActiveScan 2.0-->C:\Program Files\Panda Security\ActiveScan 2.0\as2uninst.exe

    Photodex Presenter-->C:\Program Files\Photodex Presenter\uninst.exe

    ProShow Gold-->C:\Program Files\Photodex\ProShowGold\uninst.exe

    QuickTime-->MsiExec.exe /I{5E863175-E85D-44A6-8968-82507D34AE7F}

    Security Update for Windows Internet Explorer 8 (KB971961)-->"C:\WINDOWS\ie8updates\KB971961-IE8\spuninst\spuninst.exe"

    Security Update for Windows Internet Explorer 8 (KB974455)-->"C:\WINDOWS\ie8updates\KB974455-IE8\spuninst\spuninst.exe"

    Security Update for Windows Media Encoder (KB954156)-->"C:\WINDOWS\$NtUninstallKB954156_WM9L$\spuninst\spuninst.exe"

    Security Update for Windows Media Player (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"

    Security Update for Windows Media Player (KB954155)-->"C:\WINDOWS\$NtUninstallKB954155_WM9$\spuninst\spuninst.exe"

    Security Update for Windows Media Player (KB968816)-->"C:\WINDOWS\$NtUninstallKB968816_WM9$\spuninst\spuninst.exe"

    Security Update for Windows Media Player (KB973540)-->"C:\WINDOWS\$NtUninstallKB973540_WM9L$\spuninst\spuninst.exe"

    Security Update for Windows Media Player 11 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe"

    Security Update for Windows Media Player 11 (KB954154)-->"C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe"

    Security Update for Windows Media Player 9 (KB917734)-->"C:\WINDOWS\$NtUninstallKB917734_WMP9$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB923561)-->"C:\WINDOWS\$NtUninstallKB923561$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB923789)-->C:\WINDOWS\system32\MacroMed\Flash\genuinst.exe C:\WINDOWS\system32\MacroMed\Flash\KB923789.inf

    Security Update for Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB938464-v2)-->"C:\WINDOWS\$NtUninstallKB938464-v2$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB950759)-->"C:\WINDOWS\$NtUninstallKB950759$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB950760)-->"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB951376)-->"C:\WINDOWS\$NtUninstallKB951376$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB952004)-->"C:\WINDOWS\$NtUninstallKB952004$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB953838)-->"C:\WINDOWS\$NtUninstallKB953838$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB953839)-->"C:\WINDOWS\$NtUninstallKB953839$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB954211)-->"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB956390)-->"C:\WINDOWS\$NtUninstallKB956390$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB956391)-->"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB956572)-->"C:\WINDOWS\$NtUninstallKB956572$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB956744)-->"C:\WINDOWS\$NtUninstallKB956744$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB956844)-->"C:\WINDOWS\$NtUninstallKB956844$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB957095)-->"C:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB958215)-->"C:\WINDOWS\$NtUninstallKB958215$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB958690)-->"C:\WINDOWS\$NtUninstallKB958690$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB958869)-->"C:\WINDOWS\$NtUninstallKB958869$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB959426)-->"C:\WINDOWS\$NtUninstallKB959426$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB960225)-->"C:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB960714)-->"C:\WINDOWS\$NtUninstallKB960714$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB960715)-->"C:\WINDOWS\$NtUninstallKB960715$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB960803)-->"C:\WINDOWS\$NtUninstallKB960803$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB960859)-->"C:\WINDOWS\$NtUninstallKB960859$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB961371)-->"C:\WINDOWS\$NtUninstallKB961371$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB961373)-->"C:\WINDOWS\$NtUninstallKB961373$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB961501)-->"C:\WINDOWS\$NtUninstallKB961501$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB963027)-->"C:\WINDOWS\$NtUninstallKB963027$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB968537)-->"C:\WINDOWS\$NtUninstallKB968537$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB969059)-->"C:\WINDOWS\$NtUninstallKB969059$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB969897)-->"C:\WINDOWS\$NtUninstallKB969897$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB969898)-->"C:\WINDOWS\$NtUninstallKB969898$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB969947)-->"C:\WINDOWS\$NtUninstallKB969947$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB970238)-->"C:\WINDOWS\$NtUninstallKB970238$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB971486)-->"C:\WINDOWS\$NtUninstallKB971486$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB971557)-->"C:\WINDOWS\$NtUninstallKB971557$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB971633)-->"C:\WINDOWS\$NtUninstallKB971633$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB971657)-->"C:\WINDOWS\$NtUninstallKB971657$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB971961)-->"C:\WINDOWS\$NtUninstallKB971961$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB972260)-->"C:\WINDOWS\$NtUninstallKB972260$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB973346)-->"C:\WINDOWS\$NtUninstallKB973346$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB973354)-->"C:\WINDOWS\$NtUninstallKB973354$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB973507)-->"C:\WINDOWS\$NtUninstallKB973507$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB973525)-->"C:\WINDOWS\$NtUninstallKB973525$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB973869)-->"C:\WINDOWS\$NtUninstallKB973869$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB974112)-->"C:\WINDOWS\$NtUninstallKB974112$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB974455)-->"C:\WINDOWS\$NtUninstallKB974455$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB974571)-->"C:\WINDOWS\$NtUninstallKB974571$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB975025)-->"C:\WINDOWS\$NtUninstallKB975025$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB975467)-->"C:\WINDOWS\$NtUninstallKB975467$\spuninst\spuninst.exe"

    Sound Blaster Live! Web 2K/XP-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{3FCAADB8-EB1B-11D6-AB2D-0090271A23A2}\Setup.exe" -l0x9

    SUPER

    3rd attempt for help

    in Resolved Malware Removal Logs

    Posted

    I am being redirected from search engines randomly to different webites I have not seen any repeats or patterns.

    I will run above shortly.

    Thanks

    SysProt AntiRootkit v1.0.1.0

    by swatkat

    ********************************************************************************

    **********

    ********************************************************************************

    **********

    No Hidden Processes found

    ********************************************************************************

    **********

    ********************************************************************************

    **********

    Kernel Modules:

    Module Name: \SystemRoot\System32\Drivers\dump_atapi.sys

    Service Name: ---

    Module Base: F5944000

    Module End: F595C000

    Hidden: Yes

    Module Name: \SystemRoot\System32\Drivers\dump_WMILIB.SYS

    Service Name: ---

    Module Base: F8AE4000

    Module End: F8AE6000

    Hidden: Yes

    ********************************************************************************

    **********

    ********************************************************************************

    **********

    No SSDT Hooks found

    ********************************************************************************

    **********

    ********************************************************************************

    **********

    No Kernel Hooks found

    ********************************************************************************

    **********

    ********************************************************************************

    **********

    No IRP Hooks found

    ********************************************************************************

    **********

    ********************************************************************************

    **********

    Ports:

    Local Address: THEKUBBAMACHINE.MYHOME.WESTELL.COM:NETBIOS-SSN

    Remote Address: 0.0.0.0:0

    Type: TCP

    Process: System

    State: LISTENING

    Local Address: THEKUBBAMACHINE:5152

    Remote Address: LOCALHOST:3393

    Type: TCP

    Process: C:\Program Files\Java\jre6\bin\jqs.exe

    State: CLOSE_WAIT

    Local Address: THEKUBBAMACHINE:5152

    Remote Address: 0.0.0.0:0

    Type: TCP

    Process: C:\Program Files\Java\jre6\bin\jqs.exe

    State: LISTENING

    Local Address: THEKUBBAMACHINE:1025

    Remote Address: 0.0.0.0:0

    Type: TCP

    Process: C:\WINDOWS\system32\alg.exe

    State: LISTENING

    Local Address: THEKUBBAMACHINE:MICROSOFT-DS

    Remote Address: 0.0.0.0:0

    Type: TCP

    Process: System

    State: LISTENING

    Local Address: THEKUBBAMACHINE:EPMAP

    Remote Address: 0.0.0.0:0

    Type: TCP

    Process: C:\WINDOWS\system32\svchost.exe

    State: LISTENING

    Local Address: THEKUBBAMACHINE.MYHOME.WESTELL.COM:1900

    Remote Address: NA

    Type: UDP

    Process: C:\WINDOWS\system32\svchost.exe

    State: NA

    Local Address: THEKUBBAMACHINE.MYHOME.WESTELL.COM:138

    Remote Address: NA

    Type: UDP

    Process: System

    State: NA

    Local Address: THEKUBBAMACHINE.MYHOME.WESTELL.COM:NETBIOS-NS

    Remote Address: NA

    Type: UDP

    Process: System

    State: NA

    Local Address: THEKUBBAMACHINE.MYHOME.WESTELL.COM:123

    Remote Address: NA

    Type: UDP

    Process: C:\WINDOWS\system32\svchost.exe

    State: NA

    Local Address: THEKUBBAMACHINE:1900

    Remote Address: NA

    Type: UDP

    Process: C:\WINDOWS\system32\svchost.exe

    State: NA

    Local Address: THEKUBBAMACHINE:123

    Remote Address: NA

    Type: UDP

    Process: C:\WINDOWS\system32\svchost.exe

    State: NA

    Local Address: THEKUBBAMACHINE:4500

    Remote Address: NA

    Type: UDP

    Process: C:\WINDOWS\system32\lsass.exe

    State: NA

    Local Address: THEKUBBAMACHINE:500

    Remote Address: NA

    Type: UDP

    Process: C:\WINDOWS\system32\lsass.exe

    State: NA

    Local Address: THEKUBBAMACHINE:MICROSOFT-DS

    Remote Address: NA

    Type: UDP

    Process: System

    State: NA

    ********************************************************************************

    **********

    ********************************************************************************

    **********

    No hidden files/folders found

    3rd attempt for help

    in Resolved Malware Removal Logs

    Posted

    problem is still present

    Malwarebytes' Anti-Malware 1.41

    Database version: 3243

    Windows 5.1.2600 Service Pack 3

    11/27/2009 12:29:02 PM

    mbam-log-2009-11-27 (12-29-02).txt

    Scan type: Quick Scan

    Objects scanned: 101367

    Time elapsed: 7 minute(s), 51 second(s)

    Memory Processes Infected: 0

    Memory Modules Infected: 0

    Registry Keys Infected: 0

    Registry Values Infected: 0

    Registry Data Items Infected: 0

    Folders Infected: 0

    Files Infected: 0

    Memory Processes Infected:

    (No malicious items detected)

    Memory Modules Infected:

    (No malicious items detected)

    Registry Keys Infected:

    (No malicious items detected)

    Registry Values Infected:

    (No malicious items detected)

    Registry Data Items Infected:

    (No malicious items detected)

    Folders Infected:

    (No malicious items detected)

    Files Infected:

    (No malicious items detected)

    3rd attempt for help

    in Resolved Malware Removal Logs

    Posted

    ComboFix 09-11-26.02 - Thomas Family 11/27/2009 10:14.4.1 - x86

    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.222 [GMT -5:00]

    Running from: c:\documents and settings\Thomas Family\Desktop\ComboFix.exe

    Command switches used :: c:\documents and settings\Thomas Family\Desktop\CFScript.txt

    AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

    .

    .

    --------------- FCopy ---------------

    c:\windows\ServicePackFiles\i386\atapi.sys --> c:\windows\system32\drivers\atapi.sys

    .

    ((((((((((((((((((((((((( Files Created from 2009-10-27 to 2009-11-27 )))))))))))))))))))))))))))))))

    .

    2009-11-26 14:06 . 2009-11-06 13:28 2064152 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgcorex.dll

    2009-11-26 14:06 . 2009-11-03 14:15 3513624 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgui.exe

    2009-11-26 14:06 . 2009-11-03 14:15 2028312 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgtray.exe

    2009-11-25 14:44 . 2009-11-25 14:44 411368 ----a-w- c:\windows\system32\deploytk.dll

    2009-11-25 14:05 . 2009-11-25 14:05 -------- d-sh--w- c:\documents and settings\Thomas Family\PrivacIE

    2009-11-25 14:05 . 2009-11-25 14:05 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache

    2009-11-25 14:01 . 2009-11-25 14:01 -------- d-sh--w- c:\documents and settings\Thomas Family\IETldCache

    2009-11-25 13:57 . 2009-11-26 08:04 -------- d-----w- c:\windows\ie8updates

    2009-11-25 13:52 . 2009-11-25 13:54 -------- dc-h--w- c:\windows\ie8

    2009-11-25 13:48 . 2009-10-02 04:44 92160 -c----w- c:\windows\system32\dllcache\iecompat.dll

    2009-11-25 13:47 . 2009-08-29 08:08 594432 -c----w- c:\windows\system32\dllcache\msfeeds.dll

    2009-11-25 13:47 . 2009-08-29 08:08 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll

    2009-11-25 13:47 . 2009-08-29 08:08 55296 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll

    2009-11-25 13:47 . 2009-08-29 08:08 1985536 -c----w- c:\windows\system32\dllcache\iertutil.dll

    2009-11-25 13:47 . 2009-08-29 08:08 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll

    2009-11-25 13:47 . 2009-08-29 08:08 11069440 -c----w- c:\windows\system32\dllcache\ieframe.dll

    2009-11-22 23:19 . 2008-04-14 00:11 56320 -c--a-w- c:\windows\system32\dllcache\eventlog.dll

    2009-11-22 23:19 . 2008-04-14 00:11 56320 ------w- c:\windows\system32\eventlog.dll

    2009-11-21 01:04 . 2008-04-14 00:12 50176 -c--a-w- c:\windows\system32\dllcache\proquota.exe

    2009-11-21 01:04 . 2008-04-14 00:12 50176 ----a-w- c:\windows\system32\proquota.exe

    2009-11-17 13:40 . 2009-11-17 13:41 -------- d-----w- C:\rsit

    2009-10-30 20:08 . 2009-10-30 20:08 -------- d-----w- c:\program files\Trend Micro

    2009-10-30 18:58 . 2009-09-10 18:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

    2009-10-30 18:58 . 2009-10-30 19:33 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

    2009-10-30 18:58 . 2009-09-10 18:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

    2009-10-28 21:31 . 2009-10-28 21:31 -------- d-----w- c:\program files\Enigma Software Group

    .

    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    2009-11-26 21:54 . 2007-01-10 20:30 24 ----a-w- c:\windows\system32\DVCStateBkp-{00000002-00000000-00000007-00001102-00000002-80221102}.dat

    2009-11-26 21:54 . 2007-01-10 20:30 24 ----a-w- c:\windows\system32\DVCState-{00000002-00000000-00000007-00001102-00000002-80221102}.dat

    2009-11-25 14:44 . 2007-07-18 01:31 -------- d-----w- c:\program files\Java

    2009-11-25 14:39 . 2007-01-17 12:28 -------- d-----w- c:\program files\Common Files\Adobe

    2009-10-28 11:01 . 2009-07-29 17:18 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8

    2009-10-16 11:51 . 2009-10-16 11:51 -------- d-----w- c:\documents and settings\Thomas Family\Application Data\Amazon

    2009-10-16 11:50 . 2009-10-16 11:50 -------- d-----w- c:\program files\Amazon

    2009-10-04 15:24 . 2007-01-08 17:58 46896 -c--a-w- c:\documents and settings\Thomas Family\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

    2009-09-25 19:35 . 2009-09-25 19:35 131072 ----a-w- c:\documents and settings\Thomas Family\Application Data\Netscape\Plugins\npPxPlay.dll

    2009-09-25 19:35 . 2009-09-25 19:35 131072 ----a-w- c:\documents and settings\Thomas Family\Application Data\Mozilla\Plugins\npPxPlay.dll

    2009-09-11 14:18 . 2002-09-03 16:46 136192 ----a-w- c:\windows\system32\msv1_0.dll

    2009-09-11 12:11 . 2007-01-08 17:10 77423 ----a-w- c:\windows\PCHealth\HelpCtr\OfflineCache\index.dat

    2009-09-04 21:03 . 2002-09-03 16:44 58880 ----a-w- c:\windows\system32\msasn1.dll

    2006-05-03 09:06 . 2007-08-29 15:51 163328 --sh--r- c:\windows\system32\flvDX.dll

    2007-02-21 10:47 . 2007-08-29 15:51 31232 -csh--r- c:\windows\system32\msfDX.dll

    .

    ((((((((((((((((((((((((((((( SnapShot@2009-11-21_01.30.22 )))))))))))))))))))))))))))))))))))))))))

    .

    + 2009-11-27 01:41 . 2009-11-27 01:41 16384 c:\windows\temp\Perflib_Perfdata_7b0.dat

    - 2007-01-29 08:58 . 2009-07-14 11:03 46080 c:\windows\system32\tzchange.exe

    + 2007-01-29 08:58 . 2009-10-28 15:07 46080 c:\windows\system32\tzchange.exe

    + 2007-01-08 17:43 . 2009-01-07 23:21 26144 c:\windows\system32\spupdsvc.exe

    + 2009-07-04 07:01 . 2009-01-07 23:20 16928 c:\windows\system32\spmsg.dll

    + 2002-09-03 16:52 . 2009-03-08 09:31 46592 c:\windows\system32\pngfilt.dll

    - 2002-09-03 16:51 . 2009-11-21 01:29 71060 c:\windows\system32\perfc009.dat

    + 2002-09-03 16:51 . 2009-11-27 01:45 71060 c:\windows\system32\perfc009.dat

    + 2009-01-07 23:20 . 2009-01-07 23:20 23552 c:\windows\system32\normaliz.dll

    + 2009-01-07 23:20 . 2009-01-07 23:20 24576 c:\windows\system32\nlsdl.dll

    + 2002-09-03 16:44 . 2009-03-08 09:31 48128 c:\windows\system32\mshtmler.dll

    + 2002-09-03 16:44 . 2009-03-08 09:31 66560 c:\windows\system32\mshtmled.dll

    + 2002-09-03 16:44 . 2009-03-08 09:31 45568 c:\windows\system32\mshta.exe

    + 2009-03-08 09:31 . 2009-03-08 09:31 13312 c:\windows\system32\msfeedssync.exe

    + 2009-03-08 09:31 . 2009-08-29 08:08 55296 c:\windows\system32\msfeedsbs.dll

    + 2002-09-03 16:39 . 2009-03-08 09:34 43008 c:\windows\system32\licmgr10.dll

    + 2002-09-03 16:37 . 2009-08-29 08:08 25600 c:\windows\system32\jsproxy.dll

    + 2002-09-03 16:35 . 2009-03-08 09:32 94720 c:\windows\system32\inseng.dll

    + 2002-09-03 16:35 . 2009-03-08 09:31 34816 c:\windows\system32\imgutil.dll

    + 2009-03-08 09:32 . 2009-03-08 09:32 36864 c:\windows\system32\ieudinit.exe

    + 2002-09-03 16:35 . 2009-03-08 09:32 71680 c:\windows\system32\iesetup.dll

    + 2002-09-03 16:35 . 2009-03-08 09:32 55808 c:\windows\system32\iernonce.dll

    + 2009-01-07 23:20 . 2009-01-07 23:20 26112 c:\windows\system32\idndl.dll

    + 2009-03-08 09:31 . 2009-03-08 09:31 59904 c:\windows\system32\icardie.dll

    + 2009-03-08 09:31 . 2009-03-08 09:31 46592 c:\windows\system32\dllcache\pngfilt.dll

    + 2009-03-08 09:31 . 2009-03-08 09:31 48128 c:\windows\system32\dllcache\mshtmler.dll

    + 2009-03-08 09:31 . 2009-03-08 09:31 66560 c:\windows\system32\dllcache\mshtmled.dll

    + 2009-03-08 09:31 . 2009-03-08 09:31 45568 c:\windows\system32\dllcache\mshta.exe

    + 2009-03-08 09:34 . 2009-03-08 09:34 43008 c:\windows\system32\dllcache\licmgr10.dll

    + 2009-03-08 09:33 . 2009-08-29 08:08 25600 c:\windows\system32\dllcache\jsproxy.dll

    + 2009-03-08 09:32 . 2009-03-08 09:32 94720 c:\windows\system32\dllcache\inseng.dll

    + 2009-03-08 09:31 . 2009-03-08 09:31 34816 c:\windows\system32\dllcache\imgutil.dll

    + 2009-03-08 09:32 . 2009-03-08 09:32 71680 c:\windows\system32\dllcache\iesetup.dll

    + 2009-03-08 09:32 . 2009-03-08 09:32 55808 c:\windows\system32\dllcache\iernonce.dll

    + 2009-03-08 09:24 . 2009-03-08 09:24 68608 c:\windows\system32\dllcache\hmmapi.dll

    + 2009-03-08 09:33 . 2009-03-08 09:33 18944 c:\windows\system32\dllcache\corpol.dll

    + 2002-09-03 16:27 . 2008-04-13 18:40 96512 c:\windows\system32\dllcache\atapi.sys

    + 2009-03-08 09:32 . 2009-03-08 09:32 72704 c:\windows\system32\dllcache\admparse.dll

    + 2002-09-03 16:29 . 2009-03-08 09:33 18944 c:\windows\system32\corpol.dll

    - 2007-01-08 17:13 . 2009-11-21 01:14 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat

    + 2007-01-08 17:13 . 2009-11-27 01:40 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat

    + 2007-01-08 17:13 . 2009-11-27 01:40 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat

    - 2007-01-08 17:13 . 2009-11-21 01:14 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat

    + 2007-01-08 17:13 . 2009-11-27 01:40 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat

    - 2007-01-08 17:13 . 2009-11-21 01:14 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat

    + 2002-09-03 16:26 . 2009-03-08 09:32 72704 c:\windows\system32\admparse.dll

    + 2009-11-25 08:01 . 2009-11-25 08:01 32768 c:\windows\Installer\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}\icon.exe

    - 2009-10-20 07:02 . 2009-10-20 07:02 38240 c:\windows\Installer\{90120000-0020-0409-0000-0000000FF1CE}\O12ConvIcon.exe

    + 2009-11-21 08:07 . 2009-11-21 08:07 38240 c:\windows\Installer\{90120000-0020-0409-0000-0000000FF1CE}\O12ConvIcon.exe

    + 2009-11-25 13:57 . 2009-03-08 09:33 12288 c:\windows\ie8updates\KB974455-IE8\xpshims.dll

    + 2009-11-25 13:57 . 2009-03-08 09:31 55296 c:\windows\ie8updates\KB974455-IE8\msfeedsbs.dll

    + 2009-11-25 13:57 . 2009-03-08 09:33 25600 c:\windows\ie8updates\KB974455-IE8\jsproxy.dll

    + 2009-11-25 13:52 . 2008-04-14 00:12 37888 c:\windows\ie8\url.dll

    + 2009-11-25 13:54 . 2009-03-08 19:23 58464 c:\windows\ie8\spuninst\iecustom.dll

    + 2009-11-25 13:52 . 2008-04-14 00:12 39424 c:\windows\ie8\pngfilt.dll

    + 2009-11-25 13:52 . 2008-04-14 00:12 96256 c:\windows\ie8\occache.dll

    + 2009-11-25 13:52 . 2008-04-13 16:26 56832 c:\windows\ie8\mshtmler.dll

    + 2009-11-25 13:52 . 2008-04-14 00:12 29184 c:\windows\ie8\mshta.exe

    + 2009-11-25 13:52 . 2008-04-14 00:11 22016 c:\windows\ie8\licmgr10.dll

    + 2009-11-25 13:52 . 2008-04-14 00:11 15872 c:\windows\ie8\jsproxy.dll

    + 2009-11-25 13:52 . 2008-04-14 00:11 96256 c:\windows\ie8\inseng.dll

    + 2009-11-25 13:52 . 2008-04-14 00:11 35840 c:\windows\ie8\imgutil.dll

    + 2009-11-25 13:52 . 2008-04-14 00:12 93184 c:\windows\ie8\iexplore.exe

    + 2009-11-25 13:52 . 2008-04-14 00:11 62976 c:\windows\ie8\iesetup.dll

    + 2009-11-25 13:52 . 2008-04-14 00:11 48640 c:\windows\ie8\iernonce.dll

    + 2009-11-25 13:52 . 2009-09-25 05:37 81920 c:\windows\ie8\ieencode.dll

    + 2009-11-25 13:52 . 2008-04-14 00:12 34304 c:\windows\ie8\ie4uinit.exe

    + 2009-11-25 13:52 . 2008-04-14 00:11 38912 c:\windows\ie8\hmmapi.dll

    + 2009-11-25 13:52 . 2008-04-14 00:11 35328 c:\windows\ie8\corpol.dll

    + 2009-11-25 13:52 . 2008-04-14 00:11 99840 c:\windows\ie8\advpack.dll

    + 2009-11-25 13:52 . 2008-04-14 00:11 61440 c:\windows\ie8\admparse.dll

    + 2009-11-25 13:58 . 2009-03-08 09:35 2048 c:\windows\ie8updates\KB975364-IE8\iecompat.dll

    - 2008-08-27 20:59 . 2008-04-14 00:12 121856 c:\windows\system32\xmllite.dll

    + 2008-08-27 20:59 . 2009-01-07 23:21 121856 c:\windows\system32\xmllite.dll

    + 2002-09-03 17:12 . 2009-08-29 08:08 916480 c:\windows\system32\wininet.dll

    + 2009-03-08 09:34 . 2009-03-08 09:34 208384 c:\windows\system32\WinFXDocObj.exe

    + 2002-09-03 17:11 . 2009-03-08 09:34 236544 c:\windows\system32\webcheck.dll

    + 2002-09-03 17:09 . 2009-03-08 09:33 420352 c:\windows\system32\vbscript.dll

    + 2002-09-03 17:08 . 2009-03-08 09:34 105984 c:\windows\system32\url.dll

    + 2002-09-03 16:52 . 2009-11-27 01:45 441124 c:\windows\system32\perfh009.dat

    - 2002-09-03 16:52 . 2009-11-21 01:29 441124 c:\windows\system32\perfh009.dat

    + 2002-09-03 16:50 . 2009-08-29 08:08 206848 c:\windows\system32\occache.dll

    + 2002-09-03 16:46 . 2009-03-08 09:32 611840 c:\windows\system32\mstime.dll

    + 2002-09-03 16:46 . 2009-03-08 09:34 193536 c:\windows\system32\msrating.dll

    + 2002-09-03 16:45 . 2009-03-08 09:22 156160 c:\windows\system32\msls31.dll

    + 2009-03-08 09:32 . 2009-08-29 08:08 594432 c:\windows\system32\msfeeds.dll

    + 2009-01-07 23:20 . 2009-01-07 23:20 265720 c:\windows\system32\msdbg2.dll

    + 2002-09-03 16:37 . 2009-06-22 06:44 726528 c:\windows\system32\jscript.dll

    + 2009-11-25 14:44 . 2009-11-25 14:44 149280 c:\windows\system32\javaws.exe

    + 2009-11-25 14:44 . 2009-11-25 14:44 145184 c:\windows\system32\javaw.exe

    + 2009-11-25 14:44 . 2009-11-25 14:44 145184 c:\windows\system32\java.exe

    + 2009-03-08 09:22 . 2009-03-08 09:22 164352 c:\windows\system32\ieui.dll

    + 2002-09-03 16:35 . 2009-08-29 08:08 184320 c:\windows\system32\iepeers.dll

    + 2002-09-03 16:34 . 2009-08-29 08:08 387584 c:\windows\system32\iedkcs32.dll

    + 2009-03-08 09:11 . 2009-03-08 09:11 445952 c:\windows\system32\ieapfltr.dll

    + 2002-09-03 16:34 . 2009-03-08 09:32 163840 c:\windows\system32\ieakui.dll

    + 2002-09-03 16:34 . 2009-03-08 09:33 229376 c:\windows\system32\ieaksie.dll

    + 2002-09-03 16:34 . 2009-03-08 09:33 125952 c:\windows\system32\ieakeng.dll

    + 2002-09-03 16:34 . 2009-08-28 10:35 173056 c:\windows\system32\ie4uinit.exe

    + 2007-01-08 11:59 . 2009-11-21 08:25 186608 c:\windows\system32\FNTCACHE.DAT

    - 2007-01-08 11:59 . 2009-10-07 11:44 186608 c:\windows\system32\FNTCACHE.DAT

    + 2002-09-03 16:32 . 2009-03-08 09:31 216064 c:\windows\system32\dxtrans.dll

    + 2002-09-03 16:32 . 2009-03-08 09:31 348160 c:\windows\system32\dxtmsft.dll

    + 2008-04-21 06:44 . 2009-08-29 08:08 916480 c:\windows\system32\dllcache\wininet.dll

    + 2009-03-08 09:34 . 2009-03-08 09:34 236544 c:\windows\system32\dllcache\webcheck.dll

    + 2009-03-08 09:33 . 2009-03-08 09:33 759296 c:\windows\system32\dllcache\VGX.dll

    + 2008-05-09 10:53 . 2009-03-08 09:33 420352 c:\windows\system32\dllcache\vbscript.dll

    + 2009-03-08 09:34 . 2009-03-08 09:34 105984 c:\windows\system32\dllcache\url.dll

    + 2009-01-07 23:20 . 2009-01-07 23:20 134144 c:\windows\system32\dllcache\sqmapi.dll

    + 2009-01-07 23:20 . 2009-01-07 23:20 474112 c:\windows\system32\dllcache\shlwapi.dll

    + 2009-03-08 09:34 . 2009-08-29 08:08 206848 c:\windows\system32\dllcache\occache.dll

    + 2009-03-08 09:32 . 2009-03-08 09:32 611840 c:\windows\system32\dllcache\mstime.dll

    + 2009-03-08 09:34 . 2009-03-08 09:34 193536 c:\windows\system32\dllcache\msrating.dll

    + 2002-09-03 16:45 . 2009-03-08 09:22 156160 c:\windows\system32\dllcache\msls31.dll

    + 2009-09-11 20:38 . 2009-06-22 06:44 726528 c:\windows\system32\dllcache\jscript.dll

    + 2009-03-08 19:09 . 2009-03-08 19:09 638816 c:\windows\system32\dllcache\iexplore.exe

    + 2009-03-08 09:31 . 2009-08-29 08:08 184320 c:\windows\system32\dllcache\iepeers.dll

    + 2009-03-08 19:09 . 2009-08-29 08:08 387584 c:\windows\system32\dllcache\iedkcs32.dll

    + 2002-09-03 16:34 . 2009-03-08 09:32 163840 c:\windows\system32\dllcache\ieakui.dll

    + 2009-03-08 09:33 . 2009-03-08 09:33 229376 c:\windows\system32\dllcache\ieaksie.dll

    + 2009-03-08 09:33 . 2009-03-08 09:33 125952 c:\windows\system32\dllcache\ieakeng.dll

    + 2009-03-08 09:32 . 2009-08-28 10:35 173056 c:\windows\system32\dllcache\ie4uinit.exe

    + 2009-03-08 09:31 . 2009-03-08 09:31 216064 c:\windows\system32\dllcache\dxtrans.dll

    + 2009-03-08 09:31 . 2009-03-08 09:31 348160 c:\windows\system32\dllcache\dxtmsft.dll

    + 2009-03-08 09:32 . 2009-03-08 09:32 128512 c:\windows\system32\dllcache\advpack.dll

    + 2009-11-25 14:05 . 2009-11-27 01:40 245760 c:\windows\system32\config\systemprofile\IETldCache\index.dat

    + 2002-09-03 16:27 . 2009-03-08 09:32 128512 c:\windows\system32\advpack.dll

    + 2009-11-25 08:01 . 2009-11-25 08:01 429568 c:\windows\Installer\4f6138e.msi

    + 2006-10-27 00:49 . 2006-10-27 00:49 509200 c:\windows\Installer\$PatchCache$\Managed\00002109020090400000000000F01FEC\12.0.6021\WRD12CVR.DLL

    + 2009-11-26 08:04 . 2008-07-08 13:02 382840 c:\windows\ie8updates\KB976749-IE8\spuninst\updspapi.dll

    + 2009-11-26 08:04 . 2008-07-08 13:02 231288 c:\windows\ie8updates\KB976749-IE8\spuninst\spuninst.exe

    + 2009-11-25 13:58 . 2009-05-26 11:40 382840 c:\windows\ie8updates\KB975364-IE8\spuninst\updspapi.dll

    + 2009-11-25 13:58 . 2009-05-26 11:40 231288 c:\windows\ie8updates\KB975364-IE8\spuninst\spuninst.exe

    + 2009-11-25 13:57 . 2009-03-08 09:34 914944 c:\windows\ie8updates\KB974455-IE8\wininet.dll

    + 2009-11-25 13:57 . 2009-05-26 11:40 382840 c:\windows\ie8updates\KB974455-IE8\spuninst\updspapi.dll

    + 2009-11-25 13:57 . 2008-07-08 13:02 231288 c:\windows\ie8updates\KB974455-IE8\spuninst\spuninst.exe

    + 2009-11-25 13:57 . 2009-03-08 09:34 109568 c:\windows\ie8updates\KB974455-IE8\occache.dll

    + 2009-11-25 13:57 . 2009-03-08 09:32 594432 c:\windows\ie8updates\KB974455-IE8\msfeeds.dll

    + 2009-11-25 13:57 . 2009-03-08 09:33 246784 c:\windows\ie8updates\KB974455-IE8\ieproxy.dll

    + 2009-11-25 13:57 . 2009-03-08 09:31 183808 c:\windows\ie8updates\KB974455-IE8\iepeers.dll

    + 2009-11-25 13:57 . 2009-03-08 19:09 391536 c:\windows\ie8updates\KB974455-IE8\iedkcs32.dll

    + 2009-11-25 13:57 . 2009-03-08 09:32 173056 c:\windows\ie8updates\KB974455-IE8\ie4uinit.exe

    + 2009-11-26 08:03 . 2008-07-08 13:02 382840 c:\windows\ie8updates\KB971961-IE8\spuninst\updspapi.dll

    + 2009-11-26 08:03 . 2008-07-08 13:02 231288 c:\windows\ie8updates\KB971961-IE8\spuninst\spuninst.exe

    + 2009-11-26 08:03 . 2009-03-08 09:33 726528 c:\windows\ie8updates\KB971961-IE8\jscript.dll

    + 2009-11-25 13:52 . 2009-09-25 05:37 667136 c:\windows\ie8\wininet.dll

    + 2009-11-25 13:52 . 2008-04-14 00:12 276480 c:\windows\ie8\webcheck.dll

    + 2009-11-25 13:52 . 2008-04-14 00:12 851968 c:\windows\ie8\vgx.dll

    + 2009-11-25 13:52 . 2008-05-09 10:53 430080 c:\windows\ie8\vbscript.dll

    + 2009-11-25 13:52 . 2009-09-25 05:37 627712 c:\windows\ie8\urlmon.dll

    + 2009-11-25 13:54 . 2009-01-07 23:21 382496 c:\windows\ie8\spuninst\updspapi.dll

    + 2009-11-25 13:54 . 2009-01-07 23:20 231456 c:\windows\ie8\spuninst\spuninst.exe

    + 2009-11-25 13:52 . 2008-04-14 00:12 532480 c:\windows\ie8\mstime.dll

    + 2009-11-25 13:52 . 2008-04-14 00:12 146432 c:\windows\ie8\msrating.dll

    + 2009-11-25 13:52 . 2002-09-03 16:45 146432 c:\windows\ie8\msls31.dll

    + 2009-11-25 13:52 . 2008-04-14 00:11 449024 c:\windows\ie8\mshtmled.dll

    + 2009-11-25 13:52 . 2009-08-13 15:16 512000 c:\windows\ie8\jscript.dll

    + 2009-11-25 13:52 . 2008-04-14 00:11 251904 c:\windows\ie8\iepeers.dll

    + 2009-11-25 13:52 . 2008-04-14 00:11 323584 c:\windows\ie8\iedkcs32.dll

    + 2009-11-25 13:52 . 2002-09-03 16:34 221184 c:\windows\ie8\ieakui.dll

    + 2009-11-25 13:52 . 2008-04-14 00:11 216576 c:\windows\ie8\ieaksie.dll

    + 2009-11-25 13:52 . 2008-04-14 00:11 143360 c:\windows\ie8\ieakeng.dll

    + 2009-11-25 13:52 . 2008-04-14 00:11 205312 c:\windows\ie8\dxtrans.dll

    + 2009-11-25 13:52 . 2008-04-14 00:11 357888 c:\windows\ie8\dxtmsft.dll

    + 2009-07-21 05:03 . 2009-07-21 05:03 1348432 c:\windows\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9876.0_x-ww_a621d1d5\msxml4.dll

    + 2002-09-03 17:11 . 2009-08-14 13:21 1850624 c:\windows\system32\win32k.sys

    + 2002-09-03 17:08 . 2009-08-29 08:08 1208832 c:\windows\system32\urlmon.dll

    + 2008-08-30 00:06 . 2009-07-31 15:05 1372672 c:\windows\system32\msxml6.dll

    + 2009-07-21 05:05 . 2009-07-21 05:05 1348432 c:\windows\system32\msxml4.dll

    + 2002-09-03 16:46 . 2009-07-31 04:35 1172480 c:\windows\system32\msxml3.dll

    + 2002-09-03 16:44 . 2009-10-22 09:19 5939712 c:\windows\system32\mshtml.dll

    + 2009-03-08 09:32 . 2009-08-29 08:08 1985536 c:\windows\system32\iertutil.dll

    + 2009-02-07 02:07 . 2009-02-07 02:07 3698584 c:\windows\system32\ieapfltr.dat

    + 2008-10-15 02:23 . 2009-08-14 13:21 1850624 c:\windows\system32\dllcache\win32k.sys

    + 2008-06-26 08:15 . 2009-08-29 08:08 1208832 c:\windows\system32\dllcache\urlmon.dll

    + 2008-08-27 20:58 . 2009-07-31 15:05 1372672 c:\windows\system32\dllcache\msxml6.dll

    + 2006-09-13 05:01 . 2009-07-31 04:35 1172480 c:\windows\system32\dllcache\msxml3.dll

    + 2008-04-21 06:44 . 2009-10-22 09:19 5939712 c:\windows\system32\dllcache\mshtml.dll

    + 2009-01-07 23:20 . 2009-01-07 23:20 1022976 c:\windows\system32\dllcache\browseui.dll

    + 2009-08-18 17:58 . 2009-08-18 17:58 8301056 c:\windows\Installer\1771fb1.msp

    + 2009-11-25 14:44 . 2009-11-25 14:44 1757696 c:\windows\Installer\173b66.msi

    + 2009-11-25 14:40 . 2009-11-25 14:40 3940352 c:\windows\Installer\173b5f.msi

    + 2009-11-26 08:04 . 2009-08-29 08:08 5940224 c:\windows\ie8updates\KB976749-IE8\mshtml.dll

    + 2009-11-25 13:57 . 2009-03-08 09:34 1206784 c:\windows\ie8updates\KB974455-IE8\urlmon.dll

    + 2009-11-25 13:57 . 2009-03-08 09:41 5937152 c:\windows\ie8updates\KB974455-IE8\mshtml.dll

    + 2009-11-25 13:57 . 2009-03-08 09:32 1985024 c:\windows\ie8updates\KB974455-IE8\iertutil.dll

    + 2009-11-25 13:52 . 2009-10-19 23:53 3070976 c:\windows\ie8\mshtml.dll

    + 2009-11-21 08:04 . 2009-11-05 14:36 26768832 c:\windows\system32\MRT.exe

    + 2009-03-08 09:39 . 2009-08-29 08:08 11069440 c:\windows\system32\ieframe.dll

    + 2009-04-04 12:35 . 2009-04-04 12:35 38325760 c:\windows\Installer\1771fa8.msp

    + 2009-11-25 13:57 . 2009-03-08 09:39 11063808 c:\windows\ie8updates\KB974455-IE8\ieframe.dll

    .

    -- Snapshot reset to current date --

    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    .

    *Note* empty entries & legit default entries are not shown

    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "Ulead Quick-Drop"="c:\program files\Ulead Systems\Ulead DVD MovieFactory 5 Plus\Ulead DVD MovieFactory 5\Quick-Drop.exe WINDOWCALL" [X]

    "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480]

    "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-22 86016]

    "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]

    "UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]

    "Jet Detection"="c:\program files\Creative\SBLive\PROGRAM\ADGJDet.exe" [2001-11-29 28672]

    "Share-to-Web Namespace Daemon"="c:\program files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" [2002-04-17 69632]

    "HP Software Update"="c:\program files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2006-02-19 49152]

    "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-02-16 282624]

    "Ulead AutoDetector"="c:\program files\Common Files\Ulead Systems\AutoDetector\Monitor.exe" [2005-07-28 94208]

    "Ulead Calendar Checker"="c:\program files\Ulead Systems\Ulead Photo Express 6\CalCheck.exe" [2005-08-22 69632]

    "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-11-26 2029336]

    "Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]

    "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-11-25 149280]

    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]

    "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]

    "nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2006-10-22 1622016]

    "WINDVDPatch"="CTHELPER.EXE" - c:\windows\system32\CTHELPER.EXE [2002-07-02 24576]

    c:\documents and settings\All Users\Start Menu\Programs\Startup\

    HP Digital Imaging Monitor.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]

    Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]

    2009-08-22 13:37 11952 ----a-w- c:\windows\system32\avgrsstx.dll

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

    "%windir%\\system32\\sessmgr.exe"=

    "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqtra08.exe"=

    "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqste08.exe"=

    "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpofxm08.exe"=

    "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hposfx08.exe"=

    "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hposid01.exe"=

    "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqscnvw.exe"=

    "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqkygrp.exe"=

    "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqCopy.exe"=

    "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpfccopy.exe"=

    "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpzwiz01.exe"=

    "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\Unload\\HpqPhUnl.exe"=

    "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\Unload\\HpqDIA.exe"=

    "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpoews01.exe"=

    "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqnrs08.exe"=

    "c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=

    "c:\\Program Files\\Photodex\\ProShowGold\\proshow.exe"=

    R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [3/11/2009 5:16 PM 28544]

    R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [7/29/2009 12:19 PM 335240]

    R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [7/29/2009 12:18 PM 297752]

    .

    .

    ------- Supplementary Scan -------

    .

    uStart Page = www.hotmail.com/

    uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

    IE: Add to AMV Convert Tool... - c:\program files\MP3 Player Utilities 4.00\AMVConverter\grab.html

    IE: Add to Media Manager... - c:\program files\MP3 Player Utilities 4.00\MediaManager\grab.html

    DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab

    DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab

    .

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

    Rootkit scan 2009-11-27 10:39

    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully

    hidden files: 0

    **************************************************************************

    Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

    device: opened successfully

    user: MBR read successfully

    called modules: ntoskrnl.exe catchme.sys CLASSPNP.SYS disk.sys >>UNKNOWN [0x82BA1E07]<<

    kernel: MBR read successfully

    detected MBR rootkit hooks:

    \Driver\Disk -> CLASSPNP.SYS @ 0xf85baf28

    \Driver\ACPI -> ACPI.sys @ 0xf852dcb8

    \Driver\atapi -> atapi.sys @ 0xf84e5852

    IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805a05a9

    ParseProcedure -> ntoskrnl.exe @ 0x8056ea15

    \Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805a05a9

    ParseProcedure -> ntoskrnl.exe @ 0x8056ea15

    NDIS: CNet PRO200WL PCI Fast Ethernet Adapter -> SendCompleteHandler -> NDIS.sys @ 0xf83dfbd4

    PacketIndicateHandler -> NDIS.sys @ 0xf83eba21

    SendHandler -> NDIS.sys @ 0xf83dfd44

    user & kernel MBR OK

    **************************************************************************

    .

    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'winlogon.exe'(492)

    c:\windows\system32\WININET.dll

    - - - - - - - > 'lsass.exe'(552)

    c:\windows\system32\WININET.dll

    - - - - - - - > 'explorer.exe'(2396)

    c:\windows\system32\WININET.dll

    c:\program files\Hewlett-Packard\HP Share-to-Web\hpgs2wnfps.dll

    c:\windows\system32\ieframe.dll

    c:\windows\system32\webcheck.dll

    c:\windows\system32\WPDShServiceObj.dll

    c:\windows\system32\PortableDeviceTypes.dll

    c:\windows\system32\PortableDeviceApi.dll

    .

    Completion time: 2009-11-27 10:53

    ComboFix-quarantined-files.txt 2009-11-27 15:53

    ComboFix2.txt 2009-11-24 00:29

    ComboFix3.txt 2009-11-23 12:50

    ComboFix4.txt 2009-11-21 01:44

    Pre-Run: 5,619,855,360 bytes free

    Post-Run: 5,676,503,040 bytes free

    - - End Of File - - 705C7C458548644D5C97B50D480F71F6

    3rd attempt for help

    in Resolved Malware Removal Logs

    Posted

    Greetings Melboy, i will await the next command

    all scanners found nothing.

    Scanners

    2009-11-25 Found nothing 2009-11-25 Found nothing

    2009-11-25 Found nothing 2009-11-25 Found nothing

    2009-11-25 Found nothing 2009-11-25 Found nothing

    2009-11-25 Found nothing 2009-11-25 Found nothing

    2009-11-25 Found nothing 2009-11-25 Found nothing

    2009-11-25 Found nothing 2009-11-25 Found nothing

    2009-11-25 Found nothing 2009-11-25 Found nothing

    2009-11-25 Found nothing 2009-11-25 Found nothing

    2009-11-25 Found nothing 2009-11-24 Found nothing

    2009-11-25 Found nothing 2009-11-23 Found nothing

    2009-11-25 Found nothing

    3rd attempt for help

    in Resolved Malware Removal Logs

    Posted

    items removed and updated. I leaving the reinstallation determination up to you.

    GMER 1.0.15.15252 - http://www.gmer.net

    Rootkit scan 2009-11-25 13:28:00

    Windows 5.1.2600 Service Pack 3

    Running: dr1p5n7z.exe; Driver: C:\DOCUME~1\THOMAS~1\LOCALS~1\Temp\axtyykow.sys

    ---- Devices - GMER 1.0.15 ----

    Device \FileSystem\Fastfat \Fat B7A19D20

    AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

    Device \Driver\00001342 -> \Driver\atapi \Device\Harddisk0\DR0 82BA1E07

    ---- Files - GMER 1.0.15 ----

    File C:\WINDOWS\system32\drivers\atapi.sys suspicious modification

    ---- EOF - GMER 1.0.15 ----

    3rd attempt for help

    in Resolved Malware Removal Logs

    Posted

    Still being redirect to 2 sites randomly when using google search. this pc is full of programs we never use would i be better off to reinstall windows? thanks for your help

    ComboFix 09-11-23.01 - Thomas Family 11/23/2009 18:36.3.1 - x86

    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.207 [GMT -5:00]

    Running from: c:\documents and settings\Thomas Family\Desktop\ComboFix.exe

    Command switches used :: c:\documents and settings\Thomas Family\Desktop\CFScript.txt

    AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

    .

    .

    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

    .

    -------\Legacy_GAGP440P

    -------\Service_gAGP440p

    ((((((((((((((((((((((((( Files Created from 2009-10-24 to 2009-11-24 )))))))))))))))))))))))))))))))

    .

    2009-11-22 23:19 . 2008-04-14 00:11 56320 -c--a-w- c:\windows\system32\dllcache\eventlog.dll

    2009-11-22 23:19 . 2008-04-14 00:11 56320 ------w- c:\windows\system32\eventlog.dll

    2009-11-21 01:04 . 2008-04-14 00:12 50176 -c--a-w- c:\windows\system32\dllcache\proquota.exe

    2009-11-21 01:04 . 2008-04-14 00:12 50176 ----a-w- c:\windows\system32\proquota.exe

    2009-11-17 13:40 . 2009-11-17 13:41 -------- d-----w- C:\rsit

    2009-10-30 20:08 . 2009-10-30 20:08 -------- d-----w- c:\program files\Trend Micro

    2009-10-30 18:58 . 2009-09-10 18:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

    2009-10-30 18:58 . 2009-10-30 19:33 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

    2009-10-30 18:58 . 2009-09-10 18:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

    2009-10-28 21:31 . 2009-10-28 21:31 -------- d-----w- c:\program files\Enigma Software Group

    .

    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    2009-11-23 23:58 . 2007-01-10 20:30 24 ----a-w- c:\windows\system32\DVCStateBkp-{00000002-00000000-00000007-00001102-00000002-80221102}.dat

    2009-11-23 23:58 . 2007-01-10 20:30 24 ----a-w- c:\windows\system32\DVCState-{00000002-00000000-00000007-00001102-00000002-80221102}.dat

    2009-10-28 11:01 . 2009-07-29 17:18 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8

    2009-10-16 11:51 . 2009-10-16 11:51 -------- d-----w- c:\documents and settings\Thomas Family\Application Data\Amazon

    2009-10-16 11:50 . 2009-10-16 11:50 -------- d-----w- c:\program files\Amazon

    2009-10-04 15:24 . 2007-01-08 17:58 46896 -c--a-w- c:\documents and settings\Thomas Family\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

    2009-09-28 02:35 . 2009-09-28 02:35 -------- d-----w- c:\program files\MSECache

    2009-09-25 19:42 . 2009-09-25 19:34 -------- d-----w- c:\documents and settings\Thomas Family\Application Data\Photodex

    2009-09-25 19:35 . 2009-09-25 19:35 -------- d-----w- c:\program files\Photodex Presenter

    2009-09-25 19:35 . 2009-09-25 19:35 131072 ----a-w- c:\documents and settings\Thomas Family\Application Data\Netscape\Plugins\npPxPlay.dll

    2009-09-25 19:35 . 2009-09-25 19:35 131072 ----a-w- c:\documents and settings\Thomas Family\Application Data\Mozilla\Plugins\npPxPlay.dll

    2009-09-25 05:37 . 2002-09-03 17:12 667136 ------w- c:\windows\system32\wininet.dll

    2009-09-25 05:37 . 2007-01-08 17:50 81920 ------w- c:\windows\system32\ieencode.dll

    2009-09-11 14:18 . 2002-09-03 16:46 136192 ----a-w- c:\windows\system32\msv1_0.dll

    2009-09-11 12:11 . 2007-01-08 17:10 77423 ----a-w- c:\windows\PCHealth\HelpCtr\OfflineCache\index.dat

    2009-09-04 21:03 . 2002-09-03 16:44 58880 ----a-w- c:\windows\system32\msasn1.dll

    2009-08-26 08:00 . 2002-09-03 17:05 247326 ----a-w- c:\windows\system32\strmdll.dll

    2006-05-03 09:06 . 2007-08-29 15:51 163328 --sh--r- c:\windows\system32\flvDX.dll

    2007-02-21 10:47 . 2007-08-29 15:51 31232 -csh--r- c:\windows\system32\msfDX.dll

    .

    (((((((((((((((((((((((((((((((((((((((((( SR_Search ))))))))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    ------- Sigcheck -------

    [7] 2008-04-13 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\atapi.sys

    [-] 2008-04-13 18:40 . F533E678F6BC226CB9425B556EA39567 . 96512 . . [------] . . c:\windows\system32\drivers\atapi.sys

    [7] 2004-08-04 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\atapi.sys

    c:\windows\System32\drivers\beep.sys ... is missing !!

    .

    ((((((((((((((((((((((((((((( SnapShot@2009-11-21_01.30.22 )))))))))))))))))))))))))))))))))))))))))

    .

    - 2009-07-04 07:01 . 2009-05-26 11:40 17272 c:\windows\system32\spmsg.dll

    + 2009-07-04 07:01 . 2008-07-08 13:02 17272 c:\windows\system32\spmsg.dll

    - 2002-09-03 16:51 . 2009-11-21 01:29 71060 c:\windows\system32\perfc009.dat

    + 2002-09-03 16:51 . 2009-11-24 00:17 71060 c:\windows\system32\perfc009.dat

    - 2007-01-08 17:13 . 2009-11-21 01:14 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat

    + 2007-01-08 17:13 . 2009-11-23 23:59 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat

    - 2007-01-08 17:13 . 2009-11-21 01:14 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat

    + 2007-01-08 17:13 . 2009-11-23 23:59 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat

    - 2007-01-08 17:13 . 2009-11-21 01:14 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat

    + 2007-01-08 17:13 . 2009-11-23 23:59 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat

    + 2009-11-21 08:07 . 2009-11-21 08:07 38240 c:\windows\Installer\{90120000-0020-0409-0000-0000000FF1CE}\O12ConvIcon.exe

    - 2009-10-20 07:02 . 2009-10-20 07:02 38240 c:\windows\Installer\{90120000-0020-0409-0000-0000000FF1CE}\O12ConvIcon.exe

    - 2002-09-03 16:52 . 2009-11-21 01:29 441124 c:\windows\system32\perfh009.dat

    + 2002-09-03 16:52 . 2009-11-24 00:17 441124 c:\windows\system32\perfh009.dat

    + 2002-09-03 16:39 . 2009-03-21 14:18 986112 c:\windows\system32\kernel32.dll

    + 2007-01-08 11:59 . 2009-11-21 08:25 186608 c:\windows\system32\FNTCACHE.DAT

    - 2007-01-08 11:59 . 2009-10-07 11:44 186608 c:\windows\system32\FNTCACHE.DAT

    + 2006-10-27 00:49 . 2006-10-27 00:49 509200 c:\windows\Installer\$PatchCache$\Managed\00002109020090400000000000F01FEC\12.0.6021\WRD12CVR.DLL

    + 2002-09-03 17:11 . 2009-08-14 13:21 1850624 c:\windows\system32\win32k.sys

    + 2002-09-03 16:44 . 2009-10-19 23:53 3070976 c:\windows\system32\mshtml.dll

    - 2002-09-03 16:44 . 2009-09-25 05:37 3070976 c:\windows\system32\mshtml.dll

    + 2008-10-15 02:23 . 2009-08-14 13:21 1850624 c:\windows\system32\dllcache\win32k.sys

    - 2008-04-21 06:44 . 2009-09-25 05:37 3070976 c:\windows\system32\dllcache\mshtml.dll

    + 2008-04-21 06:44 . 2009-10-19 23:53 3070976 c:\windows\system32\dllcache\mshtml.dll

    + 2009-08-18 17:58 . 2009-08-18 17:58 8301056 c:\windows\Installer\1771fb1.msp

    + 2009-11-21 08:04 . 2009-11-05 14:36 26768832 c:\windows\system32\MRT.exe

    + 2009-04-04 12:35 . 2009-04-04 12:35 38325760 c:\windows\Installer\1771fa8.msp

    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    .

    *Note* empty entries & legit default entries are not shown

    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "Ulead Quick-Drop"="c:\program files\Ulead Systems\Ulead DVD MovieFactory 5 Plus\Ulead DVD MovieFactory 5\Quick-Drop.exe WINDOWCALL" [X]

    "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480]

    "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-22 86016]

    "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]

    "UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]

    "Jet Detection"="c:\program files\Creative\SBLive\PROGRAM\ADGJDet.exe" [2001-11-29 28672]

    "Share-to-Web Namespace Daemon"="c:\program files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" [2002-04-17 69632]

    "HP Software Update"="c:\program files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2006-02-19 49152]

    "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-02-16 282624]

    "Ulead AutoDetector"="c:\program files\Common Files\Ulead Systems\AutoDetector\Monitor.exe" [2005-07-28 94208]

    "Ulead Calendar Checker"="c:\program files\Ulead Systems\Ulead Photo Express 6\CalCheck.exe" [2005-08-22 69632]

    "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-11-03 2028312]

    "Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]

    "nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2006-10-22 1622016]

    "WINDVDPatch"="CTHELPER.EXE" - c:\windows\system32\CTHELPER.EXE [2002-07-02 24576]

    c:\documents and settings\All Users\Start Menu\Programs\Startup\

    Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 40048]

    Adobe Reader Synchronizer.lnk - c:\program files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 734872]

    HP Digital Imaging Monitor.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]

    Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]

    2009-08-22 13:37 11952 ----a-w- c:\windows\system32\avgrsstx.dll

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

    "%windir%\\system32\\sessmgr.exe"=

    "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqtra08.exe"=

    "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqste08.exe"=

    "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpofxm08.exe"=

    "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hposfx08.exe"=

    "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hposid01.exe"=

    "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqscnvw.exe"=

    "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqkygrp.exe"=

    "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqCopy.exe"=

    "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpfccopy.exe"=

    "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpzwiz01.exe"=

    "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\Unload\\HpqPhUnl.exe"=

    "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\Unload\\HpqDIA.exe"=

    "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpoews01.exe"=

    "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqnrs08.exe"=

    "c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=

    "c:\\Program Files\\Photodex\\ProShowGold\\proshow.exe"=

    R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [3/11/2009 5:16 PM 28544]

    R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [7/29/2009 12:19 PM 335240]

    .

    .

    ------- Supplementary Scan -------

    .

    uStart Page = www.hotmail.com/

    mStart Page = hxxp://www.google.com

    uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

    IE: Add to AMV Convert Tool... - c:\program files\MP3 Player Utilities 4.00\AMVConverter\grab.html

    IE: Add to Media Manager... - c:\program files\MP3 Player Utilities 4.00\MediaManager\grab.html

    DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab

    DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab

    .

    - - - - ORPHANS REMOVED - - - -

    AddRemove-NVIDIA Drivers - c:\windows\system32\nvudisp.exe UninstallGUI

    AddRemove-Sierra Utilities - c:\program files\Sierra On-Line\sutil32.exe uninstall

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

    Rootkit scan 2009-11-23 19:15

    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully

    hidden files: 0

    **************************************************************************

    Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

    device: opened successfully

    user: MBR read successfully

    called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x82F56E07]<<

    kernel: MBR read successfully

    detected MBR rootkit hooks:

    \Driver\Disk -> CLASSPNP.SYS @ 0xf85f0f28

    \Driver\ACPI -> ACPI.sys @ 0xf8563cb8

    \Driver\atapi -> atapi.sys @ 0xf851b852

    IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805a05a9

    ParseProcedure -> ntoskrnl.exe @ 0x8056ea15

    \Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805a05a9

    ParseProcedure -> ntoskrnl.exe @ 0x8056ea15

    NDIS: CNet PRO200WL PCI Fast Ethernet Adapter -> SendCompleteHandler -> NDIS.sys @ 0xf8415bd4

    PacketIndicateHandler -> NDIS.sys @ 0xf8421a21

    SendHandler -> NDIS.sys @ 0xf8415d44

    user & kernel MBR OK

    **************************************************************************

    .

    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'explorer.exe'(364)

    c:\program files\Hewlett-Packard\HP Share-to-Web\hpgs2wnfps.dll

    c:\windows\system32\WPDShServiceObj.dll

    c:\windows\system32\PortableDeviceTypes.dll

    c:\windows\system32\PortableDeviceApi.dll

    .

    ------------------------ Other Running Processes ------------------------

    .

    c:\progra~1\AVG\AVG8\avgwdsvc.exe

    c:\windows\system32\nvsvc32.exe

    c:\windows\system32\HPZipm12.exe

    c:\program files\Photodex\ProShowGold\ScsiAccess.exe

    c:\progra~1\AVG\AVG8\avgrsx.exe

    c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

    c:\windows\system32\wscntfy.exe

    c:\program files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe

    c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exe

    .

    **************************************************************************

    .

    Completion time: 2009-11-23 19:29 - machine was rebooted

    ComboFix-quarantined-files.txt 2009-11-24 00:29

    ComboFix2.txt 2009-11-23 12:50

    ComboFix3.txt 2009-11-21 01:44

    Pre-Run: 6,367,809,536 bytes free

    Post-Run: 6,373,752,832 bytes free

    - - End Of File - - 251FC1D36D71D3F243360EEF23DC2C4C

    3rd attempt for help

    in Resolved Malware Removal Logs

    Posted

    Logfile of Trend Micro HijackThis v2.0.2

    Scan saved at 7:47:50 PM, on 11/23/2009

    Platform: Windows XP SP3 (WinNT 5.01.2600)

    MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)

    Boot mode: Normal

    Running processes:

    C:\WINDOWS\System32\smss.exe

    C:\WINDOWS\system32\winlogon.exe

    C:\WINDOWS\system32\services.exe

    C:\WINDOWS\system32\lsass.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\System32\svchost.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\system32\spoolsv.exe

    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

    C:\WINDOWS\system32\nvsvc32.exe

    C:\WINDOWS\system32\HPZipm12.exe

    C:\Program Files\Photodex\ProShowGold\ScsiAccess.exe

    C:\WINDOWS\System32\svchost.exe

    C:\PROGRA~1\AVG\AVG8\avgrsx.exe

    C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

    C:\WINDOWS\system32\wscntfy.exe

    c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe

    C:\WINDOWS\system32\wuauclt.exe

    C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe

    C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe

    C:\Program Files\Common Files\Ulead Systems\AutoDetector\Monitor.exe

    C:\Program Files\Ulead Systems\Ulead Photo Express 6\CalCheck.exe

    C:\PROGRA~1\AVG\AVG8\avgtray.exe

    C:\Program Files\Messenger\msmsgs.exe

    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe

    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exe

    C:\WINDOWS\explorer.exe

    C:\WINDOWS\system32\notepad.exe

    C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32Info.exe

    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.hotmail.com/

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

    O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE

    O4 - HKLM\..\Run: [updReg] C:\WINDOWS\UpdReg.EXE

    O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"

    O4 - HKLM\..\Run: [share-to-Web Namespace Daemon] c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe

    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe

    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

    O4 - HKLM\..\Run: [ulead AutoDetector] C:\Program Files\Common Files\Ulead Systems\AutoDetector\Monitor.exe

    O4 - HKLM\..\Run: [ulead Calendar Checker] C:\Program Files\Ulead Systems\Ulead Photo Express 6\CalCheck.exe

    O4 - HKLM\..\Run: [ulead Quick-Drop] "C:\Program Files\Ulead Systems\Ulead DVD MovieFactory 5 Plus\Ulead DVD MovieFactory 5\Quick-Drop.exe" WINDOWCALL

    O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe

    O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe

    O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe

    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe

    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

    O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Program Files\MP3 Player Utilities 4.00\AMVConverter\grab.html

    O8 - Extra context menu item: Add to Media Manager... - C:\Program Files\MP3 Player Utilities 4.00\MediaManager\grab.html

    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1...toUploader5.cab

    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

    O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab

    O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photos.walmart.com/WalmartActivia.cab

    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab

    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1169328104353

    O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.0...oUploader55.cab

    O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx1.hotmail.com/mail/w4/pr01/photo...ol/MSNPUpld.cab

    O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll

    O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

    O23 - Service: iPod Service - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)

    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

    O23 - Service: ScsiAccess - Unknown owner - C:\Program Files\Photodex\ProShowGold\ScsiAccess.exe

    O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

    --

    End of file - 6808 bytes

    3rd attempt for help

    in Resolved Malware Removal Logs

    Posted

    I cannot locate c:\documents and settings\Thomas Family\LOCALService\Temp\gAGP440p.sys via explorer or search.

    ComboFix 09-11-22.02 - Thomas Family 11/22/2009 18:19.2.1 - x86

    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.242 [GMT -5:00]

    Running from: c:\documents and settings\Thomas Family\Desktop\ComboFix.exe

    Command switches used :: c:\documents and settings\Thomas Family\Desktop\CFScript.txt

    AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

    FILE ::

    "c:\documents and settings\Thomas Family\Start Menu\Programs\Startup\PowerReg Scheduler V3.exe"

    "c:\windows\system32\PnkBstrA.exe"

    "c:\windows\system32\PnkBstrB.exe"

    file zipped: c:\windows\system32\mazimiru.exe

    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

    .

    c:\documents and settings\Thomas Family\Application Data\DNA

    c:\documents and settings\Thomas Family\Application Data\DNA\dht.dat

    c:\documents and settings\Thomas Family\Application Data\DNA\dht.dat.old

    c:\documents and settings\Thomas Family\Application Data\DNA\dna.lng

    c:\documents and settings\Thomas Family\Application Data\DNA\resume.dat

    c:\documents and settings\Thomas Family\Application Data\DNA\resume.dat.old

    c:\documents and settings\Thomas Family\Application Data\DNA\rss.dat

    c:\documents and settings\Thomas Family\Application Data\DNA\rss.dat.old

    c:\documents and settings\Thomas Family\Application Data\DNA\settings.dat

    c:\documents and settings\Thomas Family\Application Data\DNA\settings.dat.old

    c:\documents and settings\Thomas Family\Start Menu\Programs\Startup\PowerReg Scheduler V3.exe

    c:\program files\DNA

    c:\program files\DNA\btdna.exe

    c:\program files\DNA\DNAcpl.cpl

    c:\program files\DNA\plugins\npbtdna.dll

    c:\windows\system32\mazimiru.exe

    c:\windows\system32\PnkBstrA.exe

    c:\windows\system32\PnkBstrB.exe

    Infected copy of c:\windows\system32\kernel32.dll was found and disinfected

    Restored copy from - c:\windows\$NtServicePackUninstall$\kernel32.dll

    c:\windows\system32\drivers\beep.sys . . . is missing!!

    .

    --------------- FCopy ---------------

    c:\windows\ServicePackFiles\i386\eventlog.dll --> c:\windows\system32\eventlog.dll

    .

    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

    .

    -------\Legacy_PNKBSTRA

    -------\Legacy_PNKBSTRB

    -------\Service_PnkBstrA

    -------\Service_PnkBstrB

    ((((((((((((((((((((((((( Files Created from 2009-10-23 to 2009-11-23 )))))))))))))))))))))))))))))))

    .

    2009-11-22 23:19 . 2008-04-14 00:11 56320 -c--a-w- c:\windows\system32\dllcache\eventlog.dll

    2009-11-22 23:19 . 2008-04-14 00:11 56320 ----a-w- c:\windows\system32\eventlog.dll

    2009-11-21 01:04 . 2008-04-14 00:12 50176 -c--a-w- c:\windows\system32\dllcache\proquota.exe

    2009-11-21 01:04 . 2008-04-14 00:12 50176 ----a-w- c:\windows\system32\proquota.exe

    2009-11-17 13:40 . 2009-11-17 13:41 -------- d-----w- C:\rsit

    2009-10-30 20:08 . 2009-10-30 20:08 -------- d-----w- c:\program files\Trend Micro

    2009-10-30 18:58 . 2009-09-10 18:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

    2009-10-30 18:58 . 2009-10-30 19:33 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

    2009-10-30 18:58 . 2009-09-10 18:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

    2009-10-28 21:31 . 2009-10-28 21:31 -------- d-----w- c:\program files\Enigma Software Group

    .

    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    2009-11-22 23:42 . 2007-01-10 20:30 24 ----a-w- c:\windows\system32\DVCStateBkp-{00000002-00000000-00000007-00001102-00000002-80221102}.dat

    2009-11-22 23:42 . 2007-01-10 20:30 24 ----a-w- c:\windows\system32\DVCState-{00000002-00000000-00000007-00001102-00000002-80221102}.dat

    2009-10-28 11:01 . 2009-07-29 17:18 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8

    2009-10-16 11:51 . 2009-10-16 11:51 -------- d-----w- c:\documents and settings\Thomas Family\Application Data\Amazon

    2009-10-16 11:50 . 2009-10-16 11:50 -------- d-----w- c:\program files\Amazon

    2009-10-04 15:24 . 2007-01-08 17:58 46896 -c--a-w- c:\documents and settings\Thomas Family\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

    2009-09-28 02:35 . 2009-09-28 02:35 -------- d-----w- c:\program files\MSECache

    2009-09-25 19:42 . 2009-09-25 19:34 -------- d-----w- c:\documents and settings\Thomas Family\Application Data\Photodex

    2009-09-25 19:35 . 2009-09-25 19:35 -------- d-----w- c:\program files\Photodex Presenter

    2009-09-25 19:35 . 2009-09-25 19:35 131072 ----a-w- c:\documents and settings\Thomas Family\Application Data\Netscape\Plugins\npPxPlay.dll

    2009-09-25 19:35 . 2009-09-25 19:35 131072 ----a-w- c:\documents and settings\Thomas Family\Application Data\Mozilla\Plugins\npPxPlay.dll

    2009-09-25 05:37 . 2002-09-03 17:12 667136 ------w- c:\windows\system32\wininet.dll

    2009-09-25 05:37 . 2007-01-08 17:50 81920 ------w- c:\windows\system32\ieencode.dll

    2009-09-11 14:18 . 2002-09-03 16:46 136192 ----a-w- c:\windows\system32\msv1_0.dll

    2009-09-11 12:11 . 2007-01-08 17:10 77423 ----a-w- c:\windows\PCHealth\HelpCtr\OfflineCache\index.dat

    2009-09-04 21:03 . 2002-09-03 16:44 58880 ----a-w- c:\windows\system32\msasn1.dll

    2009-08-26 08:00 . 2002-09-03 17:05 247326 ----a-w- c:\windows\system32\strmdll.dll

    2006-05-03 09:06 . 2007-08-29 15:51 163328 --sh--r- c:\windows\system32\flvDX.dll

    2007-02-21 10:47 . 2007-08-29 15:51 31232 -csh--r- c:\windows\system32\msfDX.dll

    .

    ------- Sigcheck -------

    [7] 2008-04-13 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\atapi.sys

    [-] 2008-04-13 18:40 . F533E678F6BC226CB9425B556EA39567 . 96512 . . [------] . . c:\windows\system32\drivers\atapi.sys

    [7] 2004-08-04 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\atapi.sys

    c:\windows\system32\drivers\beep.sys ... is missing !!

    .

    ((((((((((((((((((((((((((((( SnapShot@2009-11-21_01.30.22 )))))))))))))))))))))))))))))))))))))))))

    .

    - 2009-07-04 07:01 . 2009-05-26 11:40 17272 c:\windows\system32\spmsg.dll

    + 2009-07-04 07:01 . 2008-07-08 13:02 17272 c:\windows\system32\spmsg.dll

    - 2002-09-03 16:51 . 2009-11-21 01:29 71060 c:\windows\system32\perfc009.dat

    + 2002-09-03 16:51 . 2009-11-23 12:33 71060 c:\windows\system32\perfc009.dat

    - 2007-01-08 17:13 . 2009-11-21 01:14 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat

    + 2007-01-08 17:13 . 2009-11-22 23:43 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat

    - 2007-01-08 17:13 . 2009-11-21 01:14 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat

    + 2007-01-08 17:13 . 2009-11-22 23:43 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat

    - 2007-01-08 17:13 . 2009-11-21 01:14 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat

    + 2007-01-08 17:13 . 2009-11-22 23:43 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat

    + 2009-11-21 08:07 . 2009-11-21 08:07 38240 c:\windows\Installer\{90120000-0020-0409-0000-0000000FF1CE}\O12ConvIcon.exe

    - 2009-10-20 07:02 . 2009-10-20 07:02 38240 c:\windows\Installer\{90120000-0020-0409-0000-0000000FF1CE}\O12ConvIcon.exe

    - 2002-09-03 16:52 . 2009-11-21 01:29 441124 c:\windows\system32\perfh009.dat

    + 2002-09-03 16:52 . 2009-11-23 12:33 441124 c:\windows\system32\perfh009.dat

    + 2002-09-03 16:39 . 2009-03-21 14:18 986112 c:\windows\system32\kernel32.dll

    + 2007-01-08 11:59 . 2009-11-21 08:25 186608 c:\windows\system32\FNTCACHE.DAT

    - 2007-01-08 11:59 . 2009-10-07 11:44 186608 c:\windows\system32\FNTCACHE.DAT

    + 2006-10-27 00:49 . 2006-10-27 00:49 509200 c:\windows\Installer\$PatchCache$\Managed\00002109020090400000000000F01FEC\12.0.6021\WRD12CVR.DLL

    + 2002-09-03 17:11 . 2009-08-14 13:21 1850624 c:\windows\system32\win32k.sys

    + 2002-09-03 16:44 . 2009-10-19 23:53 3070976 c:\windows\system32\mshtml.dll

    - 2002-09-03 16:44 . 2009-09-25 05:37 3070976 c:\windows\system32\mshtml.dll

    + 2008-10-15 02:23 . 2009-08-14 13:21 1850624 c:\windows\system32\dllcache\win32k.sys

    - 2008-04-21 06:44 . 2009-09-25 05:37 3070976 c:\windows\system32\dllcache\mshtml.dll

    + 2008-04-21 06:44 . 2009-10-19 23:53 3070976 c:\windows\system32\dllcache\mshtml.dll

    + 2009-08-18 17:58 . 2009-08-18 17:58 8301056 c:\windows\Installer\1771fb1.msp

    + 2009-11-21 08:04 . 2009-11-05 14:36 26768832 c:\windows\system32\MRT.exe

    + 2009-04-04 12:35 . 2009-04-04 12:35 38325760 c:\windows\Installer\1771fa8.msp

    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    .

    *Note* empty entries & legit default entries are not shown

    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480]

    "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-22 86016]

    "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]

    "UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]

    "Jet Detection"="c:\program files\Creative\SBLive\PROGRAM\ADGJDet.exe" [2001-11-29 28672]

    "Share-to-Web Namespace Daemon"="c:\program files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" [2002-04-17 69632]

    "HP Software Update"="c:\program files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2006-02-19 49152]

    "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-02-16 282624]

    "Ulead AutoDetector"="c:\program files\Common Files\Ulead Systems\AutoDetector\Monitor.exe" [2005-07-28 94208]

    "Ulead Calendar Checker"="c:\program files\Ulead Systems\Ulead Photo Express 6\CalCheck.exe" [2005-08-22 69632]

    "Ulead Quick-Drop"="c:\program files\Ulead Systems\Ulead DVD MovieFactory 5 Plus\Ulead DVD MovieFactory 5\Quick-Drop.exe" [2006-07-20 118784]

    "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-11-03 2028312]

    "Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]

    "nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2006-10-22 1622016]

    "WINDVDPatch"="CTHELPER.EXE" - c:\windows\system32\CTHELPER.EXE [2002-07-02 24576]

    c:\documents and settings\All Users\Start Menu\Programs\Startup\

    Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 40048]

    Adobe Reader Synchronizer.lnk - c:\program files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 734872]

    HP Digital Imaging Monitor.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]

    Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]

    2009-08-22 13:37 11952 ----a-w- c:\windows\system32\avgrsstx.dll

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

    Notification Packages REG_MULTI_SZ %I

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

    "%windir%\\system32\\sessmgr.exe"=

    "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqtra08.exe"=

    "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqste08.exe"=

    "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpofxm08.exe"=

    "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hposfx08.exe"=

    "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hposid01.exe"=

    "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqscnvw.exe"=

    "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqkygrp.exe"=

    "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqCopy.exe"=

    "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpfccopy.exe"=

    "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpzwiz01.exe"=

    "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\Unload\\HpqPhUnl.exe"=

    "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\Unload\\HpqDIA.exe"=

    "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpoews01.exe"=

    "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqnrs08.exe"=

    "c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=

    "c:\\Program Files\\Photodex\\ProShowGold\\proshow.exe"=

    R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [3/11/2009 5:16 PM 28544]

    R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [7/29/2009 12:19 PM 335240]

    R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [7/29/2009 12:18 PM 297752]

    S3 gAGP440p;gAGP440p;\??\c:\docume~1\THOMAS~1\LOCALS~1\Temp\gAGP440p.sys --> c:\docume~1\THOMAS~1\LOCALS~1\Temp\gAGP440p.sys [?]

    --- Other Services/Drivers In Memory ---

    *Deregistered* - CLASSPNP_2

    .

    .

    ------- Supplementary Scan -------

    .

    uStart Page = www.hotmail.com/

    mStart Page = hxxp://www.google.com

    uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

    IE: Add to AMV Convert Tool... - c:\program files\MP3 Player Utilities 4.00\AMVConverter\grab.html

    IE: Add to Media Manager... - c:\program files\MP3 Player Utilities 4.00\MediaManager\grab.html

    DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab

    DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab

    .

    - - - - ORPHANS REMOVED - - - -

    AddRemove-BitTorrent DNA - c:\program files\DNA\btdna.exe

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

    Rootkit scan 2009-11-23 07:31

    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully

    hidden files: 0

    **************************************************************************

    Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

    device: opened successfully

    user: MBR read successfully

    called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x82F86E07]<<

    kernel: MBR read successfully

    detected MBR rootkit hooks:

    \Driver\Disk -> CLASSPNP.SYS @ 0xf85f0f28

    \Driver\ACPI -> ACPI.sys @ 0xf8563cb8

    \Driver\atapi -> atapi.sys @ 0xf851b852

    IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805a05a9

    ParseProcedure -> ntoskrnl.exe @ 0x8056ea15

    \Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805a05a9

    ParseProcedure -> ntoskrnl.exe @ 0x8056ea15

    NDIS: CNet PRO200WL PCI Fast Ethernet Adapter -> SendCompleteHandler -> NDIS.sys @ 0xf8415bd4

    PacketIndicateHandler -> NDIS.sys @ 0xf8421a21

    SendHandler -> NDIS.sys @ 0xf8415d44

    user & kernel MBR OK

    **************************************************************************

    .

    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'explorer.exe'(4044)

    c:\program files\Hewlett-Packard\HP Share-to-Web\hpgs2wnfps.dll

    c:\windows\system32\WPDShServiceObj.dll

    c:\windows\system32\PortableDeviceTypes.dll

    c:\windows\system32\PortableDeviceApi.dll

    .

    ------------------------ Other Running Processes ------------------------

    .

    c:\windows\system32\nvsvc32.exe

    c:\windows\system32\HPZipm12.exe

    c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

    c:\progra~1\AVG\AVG8\avgrsx.exe

    c:\windows\system32\wscntfy.exe

    c:\program files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe

    c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exe

    .

    **************************************************************************

    .

    Completion time: 2009-11-23 07:50 - machine was rebooted

    ComboFix-quarantined-files.txt 2009-11-23 12:49

    ComboFix2.txt 2009-11-21 01:44

    Pre-Run: 6,487,367,680 bytes free

    Post-Run: 6,551,126,016 bytes free

    - - End Of File - - 34952BDD09E7F3FBBD0AD1A1A5FDDACF

    3rd attempt for help

    in Resolved Malware Removal Logs

    Posted

    pop-ups and search redirects are still happening. thanks for your help.

    ComboFix 09-11-20.02 - Thomas Family 11/20/2009 19:41.1.1 - x86

    Running from: c:\documents and settings\Thomas Family\Desktop\ComboFix.exe

    * Created a new restore point

    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

    .

    c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat

    c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat

    c:\documents and settings\Thomas Family\Application Data\inst.exe

    c:\documents and settings\Thomas Family\Local Settings\Temporary Internet Files\zapC1.tmp

    c:\documents and settings\Thomas Family\Local Settings\Temporary Internet Files\zapC3.tmp

    c:\documents and settings\Thomas Family\Local Settings\Temporary Internet Files\zapC5.tmp

    c:\documents and settings\Thomas Family\Local Settings\Temporary Internet Files\zapC7.tmp

    c:\documents and settings\Thomas Family\Local Settings\Temporary Internet Files\zapC9.tmp

    c:\documents and settings\Thomas Family\Local Settings\Temporary Internet Files\zapCB.tmp

    c:\documents and settings\Thomas Family\Local Settings\Temporary Internet Files\zapCD.tmp

    c:\program files\Shared

    c:\windows\COUPON~1.OCX

    c:\windows\CouponPrinter.ocx

    ----- BITS: Possible infected sites -----

    hxxp://81.222.236.97

    c:\windows\system32\proquota.exe was missing

    Restored copy from - c:\windows\ServicePackFiles\i386\proquota.exe

    .

    ((((((((((((((((((((((((( Files Created from 2009-10-21 to 2009-11-21 )))))))))))))))))))))))))))))))

    .

    2009-11-21 01:17 . 2009-11-21 01:17 -------- d-----w- c:\windows\LastGood

    2009-11-21 01:04 . 2008-04-14 00:12 50176 -c--a-w- c:\windows\system32\dllcache\proquota.exe

    2009-11-21 01:04 . 2008-04-14 00:12 50176 ----a-w- c:\windows\system32\proquota.exe

    2009-11-17 13:40 . 2009-11-17 13:41 -------- d-----w- C:\rsit

    2009-10-30 20:08 . 2009-10-30 20:08 -------- d-----w- c:\program files\Trend Micro

    2009-10-30 18:58 . 2009-09-10 18:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

    2009-10-30 18:58 . 2009-10-30 19:33 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

    2009-10-30 18:58 . 2009-09-10 18:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

    2009-10-28 21:31 . 2009-10-28 21:31 -------- d-----w- c:\program files\Enigma Software Group

    .

    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    2009-11-21 01:28 . 2008-01-29 20:51 -------- d-----w- c:\program files\DNA

    2009-11-21 01:28 . 2008-01-29 20:51 -------- d-----w- c:\documents and settings\Thomas Family\Application Data\DNA

    2009-11-21 01:13 . 2007-01-10 20:30 24 ----a-w- c:\windows\system32\DVCStateBkp-{00000002-00000000-00000007-00001102-00000002-80221102}.dat

    2009-11-21 01:13 . 2007-01-10 20:30 24 ----a-w- c:\windows\system32\DVCState-{00000002-00000000-00000007-00001102-00000002-80221102}.dat

    2009-10-28 11:01 . 2009-07-29 17:18 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8

    2009-10-16 11:51 . 2009-10-16 11:51 -------- d-----w- c:\documents and settings\Thomas Family\Application Data\Amazon

    2009-10-16 11:50 . 2009-10-16 11:50 -------- d-----w- c:\program files\Amazon

    2009-10-04 15:24 . 2007-01-08 17:58 46896 -c--a-w- c:\documents and settings\Thomas Family\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

    2009-09-28 02:35 . 2009-09-28 02:35 -------- d-----w- c:\program files\MSECache

    2009-09-25 19:42 . 2009-09-25 19:34 -------- d-----w- c:\documents and settings\Thomas Family\Application Data\Photodex

    2009-09-25 19:35 . 2009-09-25 19:35 -------- d-----w- c:\program files\Photodex Presenter

    2009-09-25 19:35 . 2009-09-25 19:35 131072 ----a-w- c:\documents and settings\Thomas Family\Application Data\Netscape\Plugins\npPxPlay.dll

    2009-09-25 19:35 . 2009-09-25 19:35 131072 ----a-w- c:\documents and settings\Thomas Family\Application Data\Mozilla\Plugins\npPxPlay.dll

    2009-09-25 05:37 . 2002-09-03 17:12 667136 ----a-w- c:\windows\system32\wininet.dll

    2009-09-25 05:37 . 2007-01-08 17:50 81920 ------w- c:\windows\system32\ieencode.dll

    2009-09-11 14:18 . 2002-09-03 16:46 136192 ----a-w- c:\windows\system32\msv1_0.dll

    2009-09-11 12:11 . 2007-01-08 17:10 77423 ----a-w- c:\windows\PCHealth\HelpCtr\OfflineCache\index.dat

    2009-09-04 21:03 . 2002-09-03 16:44 58880 ----a-w- c:\windows\system32\msasn1.dll

    2009-08-26 08:00 . 2002-09-03 17:05 247326 ----a-w- c:\windows\system32\strmdll.dll

    2006-05-03 09:06 . 2007-08-29 15:51 163328 --sh--r- c:\windows\system32\flvDX.dll

    2009-07-28 13:37 . 2009-07-28 13:37 114688 --sha-w- c:\windows\system32\mazimiru.exe

    2007-02-21 10:47 . 2007-08-29 15:51 31232 -csh--r- c:\windows\system32\msfDX.dll

    .

    ------- Sigcheck -------

    [7] 2008-04-13 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\atapi.sys

    [-] 2008-04-13 18:40 . F533E678F6BC226CB9425B556EA39567 . 96512 . . [------] . . c:\windows\system32\drivers\atapi.sys

    [7] 2004-08-04 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\atapi.sys

    [7] 2008-04-14 . 6D4FEB43EE538FC5428CC7F0565AA656 . 56320 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\eventlog.dll

    [7] 2004-08-04 . 82B24CB70E5944E6E34662205A2A5B78 . 55808 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\eventlog.dll

    c:\windows\system32\drivers\beep.sys ... is missing !!

    c:\windows\system32\eventlog.dll ... is missing !!

    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    .

    *Note* empty entries & legit default entries are not shown

    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]

    "BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2009-11-13 323392]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480]

    "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-22 86016]

    "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]

    "UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]

    "Jet Detection"="c:\program files\Creative\SBLive\PROGRAM\ADGJDet.exe" [2001-11-29 28672]

    "Share-to-Web Namespace Daemon"="c:\program files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" [2002-04-17 69632]

    "HP Software Update"="c:\program files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2006-02-19 49152]

    "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-02-16 282624]

    "Ulead AutoDetector"="c:\program files\Common Files\Ulead Systems\AutoDetector\Monitor.exe" [2005-07-28 94208]

    "Ulead Calendar Checker"="c:\program files\Ulead Systems\Ulead Photo Express 6\CalCheck.exe" [2005-08-22 69632]

    "Ulead Quick-Drop"="c:\program files\Ulead Systems\Ulead DVD MovieFactory 5 Plus\Ulead DVD MovieFactory 5\Quick-Drop.exe" [2006-07-20 118784]

    "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-11-03 2028312]

    "Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]

    "nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2006-10-22 1622016]

    "WINDVDPatch"="CTHELPER.EXE" - c:\windows\system32\CTHELPER.EXE [2002-07-02 24576]

    c:\documents and settings\Thomas Family\Start Menu\Programs\Startup\

    PowerReg Scheduler V3.exe [2007-3-2 225280]

    c:\documents and settings\All Users\Start Menu\Programs\Startup\

    Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 40048]

    Adobe Reader Synchronizer.lnk - c:\program files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 734872]

    HP Digital Imaging Monitor.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]

    Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]

    2009-08-22 13:37 11952 ----a-w- c:\windows\system32\avgrsstx.dll

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

    "%windir%\\system32\\sessmgr.exe"=

    "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqtra08.exe"=

    "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqste08.exe"=

    "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpofxm08.exe"=

    "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hposfx08.exe"=

    "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hposid01.exe"=

    "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqscnvw.exe"=

    "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqkygrp.exe"=

    "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqCopy.exe"=

    "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpfccopy.exe"=

    "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpzwiz01.exe"=

    "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\Unload\\HpqPhUnl.exe"=

    "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\Unload\\HpqDIA.exe"=

    "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpoews01.exe"=

    "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqnrs08.exe"=

    "c:\\Program Files\\DNA\\btdna.exe"=

    "c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=

    "c:\\Program Files\\Photodex\\ProShowGold\\proshow.exe"=

    R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [3/11/2009 5:16 PM 28544]

    R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [7/29/2009 12:19 PM 335240]

    R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [7/29/2009 12:18 PM 297752]

    S3 gAGP440p;gAGP440p;\??\c:\docume~1\THOMAS~1\LOCALS~1\Temp\gAGP440p.sys --> c:\docume~1\THOMAS~1\LOCALS~1\Temp\gAGP440p.sys [?]

    --- Other Services/Drivers In Memory ---

    *NewlyCreated* - CLASSPNP_2

    *Deregistered* - CLASSPNP_2

    .

    .

    ------- Supplementary Scan -------

    .

    uStart Page = www.hotmail.com/

    mStart Page = hxxp://www.google.com

    uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

    IE: Add to AMV Convert Tool... - c:\program files\MP3 Player Utilities 4.00\AMVConverter\grab.html

    IE: Add to Media Manager... - c:\program files\MP3 Player Utilities 4.00\MediaManager\grab.html

    DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab

    DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab

    .

    - - - - ORPHANS REMOVED - - - -

    HKLM-Run-hcsystray - c:\program files\Kuma Games\hcsystray\hc_tray.exe

    HKLM-Run-AceGain LiveUpdate - c:\program files\AceGain\LiveUpdate\LiveUpdate.exe

    AddRemove-GameSpy Arcade - c:\progra~1\GAMESP~1\UNWISE.EXE

    AddRemove-Move Networks Player_is1 - c:\documents and settings\Thomas Family\Application Data\Move Networks\ie_bin\unins000.exe

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

    Rootkit scan 2009-11-20 20:28

    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    c:\windows\KB976749.log 2166 bytes

    scan completed successfully

    hidden files: 1

    **************************************************************************

    Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

    device: opened successfully

    user: MBR read successfully

    called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x82F3AE07]<<

    kernel: MBR read successfully

    detected MBR rootkit hooks:

    \Driver\Disk -> CLASSPNP.SYS @ 0xf85f0f28

    \Driver\ACPI -> ACPI.sys @ 0xf8563cb8

    \Driver\atapi -> atapi.sys @ 0xf851b852

    IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805a05a9

    ParseProcedure -> ntoskrnl.exe @ 0x8056ea15

    \Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805a05a9

    ParseProcedure -> ntoskrnl.exe @ 0x8056ea15

    NDIS: CNet PRO200WL PCI Fast Ethernet Adapter -> SendCompleteHandler -> NDIS.sys @ 0xf8415bd4

    PacketIndicateHandler -> NDIS.sys @ 0xf8421a21

    SendHandler -> NDIS.sys @ 0xf8415d44

    user & kernel MBR OK

    **************************************************************************

    .

    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'explorer.exe'(2340)

    c:\program files\Hewlett-Packard\HP Share-to-Web\hpgs2wnfps.dll

    c:\windows\system32\WPDShServiceObj.dll

    c:\windows\system32\PortableDeviceTypes.dll

    c:\windows\system32\PortableDeviceApi.dll

    .

    ------------------------ Other Running Processes ------------------------

    .

    c:\windows\system32\nvsvc32.exe

    c:\windows\system32\PnkBstrA.exe

    c:\windows\system32\PnkBstrB.exe

    c:\progra~1\AVG\AVG8\avgrsx.exe

    c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

    c:\program files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe

    c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exe

    .

    **************************************************************************

    .

    Completion time: 2009-11-20 20:44 - machine was rebooted

    ComboFix-quarantined-files.txt 2009-11-21 01:43

    Pre-Run: 6,113,755,136 bytes free

    Post-Run: 6,728,962,048 bytes free

    WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe

    [boot loader]

    timeout=2

    default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS

    [operating systems]

    c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

    multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

    - - End Of File - - 90932E422CCF9660251E12A0218DD248

    3rd attempt for help

    in Resolved Malware Removal Logs

    Posted

    Punkbuster can go as it is no longer used.

    Logfile of random's system information tool 1.06 (written by random/random)

    Run by Thomas Family at 2009-11-17 08:40:35

    Microsoft Windows XP Home Edition Service Pack 3

    System drive C: has 6 GB (15%) free of 38 GB

    Total RAM: 511 MB (46% free)

    Logfile of Trend Micro HijackThis v2.0.2

    Scan saved at 8:41:01 AM, on 11/17/2009

    Platform: Windows XP SP3 (WinNT 5.01.2600)

    MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)

    Boot mode: Normal

    Running processes:

    C:\WINDOWS\System32\smss.exe

    C:\WINDOWS\system32\winlogon.exe

    C:\WINDOWS\system32\services.exe

    C:\WINDOWS\system32\lsass.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\System32\svchost.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\system32\spoolsv.exe

    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

    C:\WINDOWS\system32\nvsvc32.exe

    C:\WINDOWS\system32\PnkBstrA.exe

    C:\WINDOWS\system32\PnkBstrB.exe

    C:\Program Files\Photodex\ProShowGold\ScsiAccess.exe

    C:\WINDOWS\System32\svchost.exe

    C:\PROGRA~1\AVG\AVG8\avgrsx.exe

    C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

    c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe

    C:\WINDOWS\system32\CTHELPER.EXE

    C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe

    C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe

    C:\PROGRA~1\AVG\AVG8\avgtray.exe

    C:\Program Files\DNA\btdna.exe

    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe

    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exe

    C:\WINDOWS\system32\HPZipm12.exe

    C:\WINDOWS\explorer.exe

    C:\Documents and Settings\Thomas Family\Desktop\RSIT.exe

    C:\Program Files\Trend Micro\HijackThis\Thomas Family.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.hotmail.com/

    O1 - Hosts: ::1 localhost

    O1 - Hosts: 91.212.127.226 ossecure2009.microsoft.com

    O1 - Hosts: 91.212.127.226 os-secure2009.com

    O1 - Hosts: 91.212.127.226 www.os-secure2009.com

    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

    O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE

    O4 - HKLM\..\Run: [updReg] C:\WINDOWS\UpdReg.EXE

    O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"

    O4 - HKLM\..\Run: [hcsystray] C:\Program Files\Kuma Games\hcsystray\hc_tray.exe

    O4 - HKLM\..\Run: [share-to-Web Namespace Daemon] c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe

    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe

    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

    O4 - HKLM\..\Run: [ulead AutoDetector] C:\Program Files\Common Files\Ulead Systems\AutoDetector\Monitor.exe

    O4 - HKLM\..\Run: [ulead Calendar Checker] C:\Program Files\Ulead Systems\Ulead Photo Express 6\CalCheck.exe

    O4 - HKLM\..\Run: [ulead Quick-Drop] "C:\Program Files\Ulead Systems\Ulead DVD MovieFactory 5 Plus\Ulead DVD MovieFactory 5\Quick-Drop.exe" WINDOWCALL

    O4 - HKLM\..\Run: [AceGain LiveUpdate] C:\Program Files\AceGain\LiveUpdate\LiveUpdate.exe

    O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe

    O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

    O4 - HKCU\..\Run: [bitTorrent DNA] "C:\Program Files\DNA\btdna.exe"

    O4 - Startup: PowerReg Scheduler V3.exe

    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe

    O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe

    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe

    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

    O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Program Files\MP3 Player Utilities 4.00\AMVConverter\grab.html

    O8 - Extra context menu item: Add to Media Manager... - C:\Program Files\MP3 Player Utilities 4.00\MediaManager\grab.html

    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1...toUploader5.cab

    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

    O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab

    O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photos.walmart.com/WalmartActivia.cab

    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab

    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1169328104353

    O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.0...oUploader55.cab

    O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} - http://a19.g.akamai.net/7/19/7125/1452/ftp...02/cpbrkpie.cab

    O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx1.hotmail.com/mail/w4/pr01/photo...ol/MSNPUpld.cab

    O18 - Filter hijack: text/html - {67157e85-9747-49ea-ba4c-4f11342f9c2c} - C:\WINDOWS\batmeter16.dll

    O20 - AppInit_DLLs: jaguvonu.dll

    O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll

    O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

    O23 - Service: iPod Service - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)

    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

    O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe

    O23 - Service: ScsiAccess - Unknown owner - C:\Program Files\Photodex\ProShowGold\ScsiAccess.exe

    O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

    --

    End of file - 7195 bytes

    ======Registry dump======

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

    "NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2006-10-22 7700480]

    "nwiz"=nwiz.exe /install []

    "NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2006-10-22 86016]

    "NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]

    "WINDVDPatch"=C:\WINDOWS\system32\CTHELPER.EXE [2002-07-02 24576]

    "UpdReg"=C:\WINDOWS\UpdReg.EXE [2000-05-11 90112]

    "Jet Detection"=C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe [2001-11-29 28672]

    "hcsystray"=C:\Program Files\Kuma Games\hcsystray\hc_tray.exe []

    "Share-to-Web Namespace Daemon"=c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe [2002-04-17 69632]

    "HP Software Update"=C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe [2006-02-19 49152]

    "QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2007-02-16 282624]

    "Ulead AutoDetector"=C:\Program Files\Common Files\Ulead Systems\AutoDetector\Monitor.exe [2005-07-28 94208]

    "Ulead Calendar Checker"=C:\Program Files\Ulead Systems\Ulead Photo Express 6\CalCheck.exe [2005-08-22 69632]

    "Ulead Quick-Drop"=C:\Program Files\Ulead Systems\Ulead DVD MovieFactory 5 Plus\Ulead DVD MovieFactory 5\Quick-Drop.exe [2006-07-20 118784]

    "AceGain LiveUpdate"=C:\Program Files\AceGain\LiveUpdate\LiveUpdate.exe []

    "AVG8_TRAY"=C:\PROGRA~1\AVG\AVG8\avgtray.exe [2009-11-03 2028312]

    "Malwarebytes Anti-Malware (reboot)"=C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe [2009-09-10 1312080]

    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

    "MSMSGS"=C:\Program Files\Messenger\msmsgs.exe [2008-04-13 1695232]

    "BitTorrent DNA"=C:\Program Files\DNA\btdna.exe [2009-11-13 323392]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup

    Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe

    Adobe Reader Synchronizer.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe

    HP Digital Imaging Monitor.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe

    Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE

    C:\Documents and Settings\Thomas Family\Start Menu\Programs\Startup

    PowerReg Scheduler V3.exe

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

    "AppInit_DLLS"="jaguvonu.dll"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\avgrsstarter]

    C:\WINDOWS\system32\avgrsstx.dll [2009-08-22 11952]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]

    WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]

    "notification packages"=scecli

    gumizoju.dll

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr]

    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]

    "EnableProfileQuota"=1

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]

    "dontdisplaylastusername"=0

    "legalnoticecaption"=

    "legalnoticetext"=

    "shutdownwithoutlogon"=1

    "undockwithoutlogon"=1

    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]

    "NoDriveTypeAutoRun"=145

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]

    "HonorAutoRunSetting"=

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

    "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

    "C:\Program Files\Activision\Empires Dawn of the Modern World\Empires_DMW.exe"="C:\Program Files\Activision\Empires Dawn of the Modern World\Empires_DMW.exe:*:Disabled:Empires_DMW"

    "C:\My Downloads\wowclient-downloader.exe"="C:\My Downloads\wowclient-downloader.exe:*:Enabled:Blizzard Downloader"

    "C:\Program Files\World of Warcraft\WoW-2.0.3-enUS-downloader.exe"="C:\Program Files\World of Warcraft\WoW-2.0.3-enUS-downloader.exe:*:Enabled:Blizzard Downloader"

    "C:\Program Files\World of Warcraft\WoW-2.0.3.6299-to-2.0.6.6337-enUS-downloader.exe"="C:\Program Files\World of Warcraft\WoW-2.0.3.6299-to-2.0.6.6337-enUS-downloader.exe:*:Enabled:Blizzard Downloader"

    "C:\Program Files\World of Warcraft\WoW-2.0.6.6337-to-2.0.7.6383-enUS-downloader.exe"="C:\Program Files\World of Warcraft\WoW-2.0.6.6337-to-2.0.7.6383-enUS-downloader.exe:*:Enabled:Blizzard Downloader"

    "C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe"="C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe"

    "C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqste08.exe"="C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe"

    "C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpofxm08.exe"="C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe"

    "C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposfx08.exe"="C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe"

    "C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposid01.exe"="C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe"

    "C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqscnvw.exe"="C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqscnvw.exe:*:Enabled:hpqscnvw.exe"

    "C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqkygrp.exe"="C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"

    "C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqCopy.exe"="C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqCopy.exe:*:Enabled:hpqcopy.exe"

    "C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpfccopy.exe"="C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe"

    "C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpzwiz01.exe"="C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe"

    "C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\HpqPhUnl.exe"="C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\HpqPhUnl.exe:*:Enabled:hpqphunl.exe"

    "C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\HpqDIA.exe"="C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\HpqDIA.exe:*:Enabled:hpqdia.exe"

    "C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoews01.exe"="C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe"

    "C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqnrs08.exe"="C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqnrs08.exe:*:Enabled:hpqnrs08.exe"

    "C:\Program Files\World of Warcraft\WoW-2.0.7.6383-to-2.0.8.6403-enUS-downloader.exe"="C:\Program Files\World of Warcraft\WoW-2.0.7.6383-to-2.0.8.6403-enUS-downloader.exe:*:Enabled:Blizzard Downloader"

    "C:\Program Files\Codemasters\Operation Flashpoint\FlashpointResistance.exe"="C:\Program Files\Codemasters\Operation Flashpoint\FlashpointResistance.exe:*:Enabled:Operation Flashpoint"

    "C:\Program Files\America's Army\System\ArmyOps.exe"="C:\Program Files\America's Army\System\ArmyOps.exe:*:Enabled:ArmyOps"

    "C:\Program Files\Atari\Terminator 3 - War of the Machines\T3.exe"="C:\Program Files\Atari\Terminator 3 - War of the Machines\T3.exe:*:Enabled:T3"

    "C:\Program Files\Fox\No One Lives Forever\eReg\NAVBrowser.exe"="C:\Program Files\Fox\No One Lives Forever\eReg\NAVBrowser.exe:*:Enabled:NAVBrowser"

    "C:\Program Files\Fox\No One Lives Forever 2\Lithtech.exe"="C:\Program Files\Fox\No One Lives Forever 2\Lithtech.exe:*:Enabled:Client"

    "C:\Program Files\America's Army\System\Server.exe"="C:\Program Files\America's Army\System\Server.exe:*:Enabled:Server"

    "C:\Program Files\SwiftSwitch\SwiftSwitch.exe"="C:\Program Files\SwiftSwitch\SwiftSwitch.exe:*:Enabled:Utility for RuneScape"

    "C:\SIERRA\Half-Life\hl.exe"="C:\SIERRA\Half-Life\hl.exe:*:Enabled:Half-Life Launcher"

    "C:\Program Files\DNA\btdna.exe"="C:\Program Files\DNA\btdna.exe:*:Enabled:DNA"

    "C:\Program Files\BitTorrent\bittorrent.exe"="C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent"

    "C:\Program Files\EA Games\Battlefield 1942\BF1942.exe"="C:\Program Files\EA Games\Battlefield 1942\BF1942.exe:*:Enabled:BF1942"

    "C:\Program Files\AVG\AVG8\avgupd.exe"="C:\Program Files\AVG\AVG8\avgupd.exe:*:Enabled:avgupd.exe"

    "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

    "C:\Program Files\Photodex\ProShowGold\proshow.exe"="C:\Program Files\Photodex\ProShowGold\proshow.exe:*:Disabled:proshow.exe"

    "C:\WINDOWS\explorer.exe"="C:\WINDOWS\explorer.exe:*:Enabled:Explorer"

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

    "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

    "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

    ======List of files/folders created in the last 1 months======

    2009-11-17 08:40:35 ----D---- C:\rsit

    2009-10-30 15:08:13 ----D---- C:\Program Files\Trend Micro

    2009-10-30 13:58:14 ----D---- C:\Program Files\Malwarebytes' Anti-Malware

    2009-10-28 16:31:09 ----D---- C:\Program Files\Enigma Software Group

    ======List of files/folders modified in the last 1 months======

    2009-11-17 08:36:44 ----RD---- C:\Program Files

    2009-11-17 08:34:39 ----D---- C:\Documents and Settings\Thomas Family\Application Data\DNA

    2009-11-17 07:34:41 ----D---- C:\WINDOWS\Temp

    2009-11-17 03:30:21 ----HD---- C:\$AVG8.VAULT$

    2009-11-15 19:24:08 ----D---- C:\WINDOWS\system32

    2009-11-15 19:24:06 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI

    2009-11-15 19:21:03 ----A---- C:\WINDOWS\{00000002-00000000-00000007-00001102-00000002-80221102}.BAK

    2009-11-15 19:20:55 ----D---- C:\Program Files\DNA

    2009-11-15 19:19:03 ----A---- C:\WINDOWS\SchedLgU.Txt

    2009-11-15 19:05:08 ----SHD---- C:\WINDOWS\Installer

    2009-11-15 19:05:08 ----HD---- C:\Config.Msi

    2009-11-12 18:33:47 ----SD---- C:\WINDOWS\Downloaded Program Files

    2009-11-05 07:45:41 ----D---- C:\WINDOWS\system32\CatRoot2

    2009-11-04 07:37:04 ----D---- C:\WINDOWS\system32\wbem

    2009-11-02 09:12:59 ----D---- C:\WINDOWS

    2009-10-30 15:06:24 ----D---- C:\My Downloads

    2009-10-30 14:33:16 ----D---- C:\WINDOWS\system32\drivers

    2009-10-30 12:39:37 ----A---- C:\WINDOWS\NeroDigital.ini

    2009-10-28 17:30:50 ----D---- C:\WINDOWS\system32\Restore

    2009-10-28 08:39:52 ----D---- C:\WINDOWS\Prefetch

    2009-10-28 06:01:07 ----D---- C:\Documents and Settings\All Users\Application Data\avg8

    2009-10-28 05:58:42 ----D---- C:\Program Files\Shared

    2009-10-22 21:18:05 ----HD---- C:\WINDOWS\inf

    ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

    R1 AvgLdx86;AVG Free AVI Loader Driver x86; C:\WINDOWS\System32\Drivers\avgldx86.sys [2009-08-22 335240]

    R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86; C:\WINDOWS\System32\Drivers\avgmfx86.sys [2009-08-22 27784]

    R1 OMCI;OMCI; C:\WINDOWS\SYSTEM32\DRIVERS\OMCI.SYS [2001-08-22 13632]

    R3 ctac32k;Creative AC3 Software Decoder; C:\WINDOWS\System32\drivers\ctac32k.sys [2002-07-19 127948]

    R3 ctaud2k;Creative Audio Driver (WDM); C:\WINDOWS\system32\drivers\ctaud2k.sys [2002-07-19 837548]

    R3 ctprxy2k;Creative Proxy Driver; C:\WINDOWS\System32\drivers\ctprxy2k.sys [2002-07-19 11068]

    R3 ctsfm2k;Creative SoundFont Management Device Driver; C:\WINDOWS\System32\drivers\ctsfm2k.sys [2002-07-19 213860]

    R3 DM9102;DAVICOM 9102(A) PCI Fast Ethernet Based NT Driver; C:\WINDOWS\System32\DRIVERS\DM9PCI5.SYS [2001-08-17 29696]

    R3 emupia;E-mu Plug-in Architecture Driver; C:\WINDOWS\System32\drivers\emupia2k.sys [2002-07-19 156604]

    R3 ha10kx2k;Creative Hardware Abstract Layer Driver; C:\WINDOWS\system32\drivers\ha10kx2k.sys [2002-07-24 998004]

    R3 HCF_MSFT;HCF_MSFT; C:\WINDOWS\System32\DRIVERS\HCF_MSFT.sys [2001-08-17 907456]

    R3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\System32\DRIVERS\hidusb.sys [2008-04-13 10368]

    R3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2006-01-31 49664]

    R3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2006-01-31 16496]

    R3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2006-01-31 21568]

    R3 mouhid;Mouse HID Driver; C:\WINDOWS\System32\DRIVERS\mouhid.sys [2001-08-17 12160]

    R3 nv;nv; C:\WINDOWS\System32\DRIVERS\nv4_mini.sys [2006-10-22 3994624]

    R3 ossrv;Creative OS Services Driver; C:\WINDOWS\system32\drivers\ctoss2k.sys [2002-07-19 195432]

    R3 pcouffin;VSO Software pcouffin; C:\WINDOWS\System32\Drivers\pcouffin.sys [2009-01-07 47360]

    R3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]

    R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2008-04-13 59520]

    R3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]

    R3 usbscan;USB Scanner Driver; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]

    R3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]

    R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\System32\DRIVERS\usbuhci.sys [2008-04-13 20608]

    S3 ADSEXPB;ADS DVD Express B; C:\WINDOWS\System32\Drivers\adsexpb.SYS [2005-04-06 34240]

    S3 ctljystk;Creative SBLive! Gameport; C:\WINDOWS\System32\DRIVERS\ctljystk.sys [2001-08-17 3712]

    S3 emu10k;Creative SB Live! (WDM); C:\WINDOWS\system32\drivers\emu10k1m.sys [2001-08-17 283904]

    S3 emu10k1;Creative Interface Manager Driver (WDM); C:\WINDOWS\system32\drivers\ctlfacem.sys [2001-08-17 6912]

    S3 gAGP440p;gAGP440p; \??\C:\DOCUME~1\THOMAS~1\LOCALS~1\Temp\gAGP440p.sys []

    S3 motmodem;Motorola USB CDC ACM Driver; C:\WINDOWS\system32\DRIVERS\motmodem.sys [2007-06-18 23680]

    S3 sfman;Creative SoundFont Manager Driver (WDM); C:\WINDOWS\system32\drivers\sfmanm.sys [2001-08-17 36480]

    S3 Wdf01000;Wdf01000; C:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2006-11-02 492000]

    S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]

    S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]

    ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

    R2 avg8wd;AVG Free8 WatchDog; C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2009-08-22 297752]

    R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2006-10-22 159810]

    R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2005-11-22 69632]

    R2 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2007-09-24 66872]

    R2 PnkBstrB;PnkBstrB; C:\WINDOWS\system32\PnkBstrB.exe [2009-01-24 202352]

    R2 ScsiAccess;ScsiAccess; C:\Program Files\Photodex\ProShowGold\ScsiAccess.exe [2009-09-25 181312]

    R2 UleadBurningHelper;Ulead Burning Helper; C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe [2005-01-31 49152]

    R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-13 14336]

    S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]

    S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]

    S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]

    S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]

    S3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe []

    S3 usprserv;User Privilege Service; C:\WINDOWS\System32\svchost.exe [2008-04-13 14336]

    S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\wmpnetwk.exe [2006-10-18 913408]

    S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

    -----------------EOF-----------------

    3rd attempt for help

    in Resolved Malware Removal Logs

    Posted

    info.txt logfile of random's system information tool 1.06 2009-11-17 08:41:07

    ======Uninstall list======

    -->"C:\Program Files\Creative\SBLive\Program\Ctzapxx.EXE" /X /U /S

    -->"C:\Program Files\InstallShield Installation Information\{A644254B-92F6-4970-8635-AB0775371E72}\setup.exe" --u:{A644254B-92F6-4970-8635-AB0775371E72}

    -->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER

    -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{58582977-44D2-44A0-A09B-031CC2AE5938}\setup.exe" -l0x9

    -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{58582977-44D2-44A0-A09B-031CC2AE5938}\setup.exe" -l0x9 /remove

    -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9A4D2983-4662-4387-BE3D-4CFC2FA9C100}\setup.exe" -l0x9

    -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9A4D2983-4662-4387-BE3D-4CFC2FA9C100}\setup.exe" -l0x9 /remove

    -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A731533B-B325-4D9C-91A4-D93C8E294C19}\setup.exe" -l0x9

    -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A731533B-B325-4D9C-91A4-D93C8E294C19}\setup.exe" -l0x9 /remove

    -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FD851F7E-F887-405D-9E1C-488811113EF3}\setup.exe" -l0x9

    -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FD851F7E-F887-405D-9E1C-488811113EF3}\setup.exe" -l0x9 /remove

    -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{87616DD3-61A7-46FB-8AE3-927D5BC4D268}\setup.exe" -l0x9

    -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9BEC3D0E-B569-4998-BFB0-17D00E266854}\setup.exe" -l0x9

    -->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf

    Adobe Digital Editions-->"C:\Program Files\Adobe\Adobe Digital Editions\uninstall.exe"

    Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe

    Adobe Reader 8-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A80000000002}

    Adobe Shockwave Player-->C:\WINDOWS\system32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~1\Install.log

    ADS Tech Master Installer V3.6-->C:\PROGRA~1\ADSTech\UNWISE.EXE C:\PROGRA~1\ADSTech\INSTALL.LOG

    AGEIA PhysX v2.4.4-->"C:\Program Files\AGEIA Technologies\uninstall.exe"

    Amazon MP3 Downloader 1.0.5-->C:\Program Files\Amazon\MP3 Downloader\Uninstall.exe

    Audacity 1.2.6-->"C:\Program Files\Audacity\unins000.exe"

    AVG Free 8.5-->C:\Program Files\AVG\AVG8\setup.exe /UNINSTALL

    AviSynth 2.5-->"C:\Program Files\AviSynth 2.5\Uninstall.exe"

    Click'N Design 3D (V5)-->C:\PROGRA~1\CLICK'~1\UNWISE.EXE C:\PROGRA~1\CLICK'~1\INSTALL.LOG

    Compatibility Pack for the 2007 Office system-->MsiExec.exe /X{90120000-0020-0409-0000-0000000FF1CE}

    Coupon Printer for Windows-->"C:\Program Files\Coupons\uninstall.exe" "/U:C:\Program Files\Coupons\Uninstall\uninstall.xml"

    Critical Update for Windows Media Player 11 (KB959772)-->"C:\WINDOWS\$NtUninstallKB959772_WM11$\spuninst\spuninst.exe"

    Dell ResourceCD-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D78653C3-A8FF-415F-92E6-D774E634FF2D}\setup.exe"

    DivX Codec-->C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC

    DivX Content Uploader-->C:\Program Files\DivX\DivXContentUploaderUninstall.exe /CUPLOADER

    DivX Converter-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER

    DivX Player-->C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER

    DivX Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN

    DVD Decrypter (Remove Only)-->"C:\Program Files\DVD Decrypter\uninstall.exe"

    DVD Shrink 3.2-->"C:\Program Files\DVD Shrink\unins000.exe"

    DVDFab (Platinum/Gold/HD Decrypter) (Option: Mobile) 5.2.2.2-->"C:\Program Files\DVDFab 5\unins000.exe"

    EPSON TWAIN 5-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9A3EABC0-CA06-11D4-BF77-00104B130C19}\SETUP.EXE" -l0x9 UNINSTALL

    ffdshow [rev 2527] [2008-12-19]-->"C:\Program Files\ffdshow\unins000.exe"

    FLV Player 1.3.3-->"C:\Program Files\FLVPlayer\uninstall.exe"

    GameSpy Arcade-->C:\PROGRA~1\GAMESP~1\UNWISE.EXE C:\PROGRA~1\GAMESP~1\INSTALL.LOG

    Garmin City Navigator Mexico NT 2010 Update-->MsiExec.exe /X{30AD6AC7-EB40-4C70-9C2B-8D0CA1D92655}

    Garmin Communicator Plugin-->MsiExec.exe /X{A7DEBAA4-B211-4D1A-A6B3-E52BFAAA1D0C}

    Garmin MapSource-->MsiExec.exe /X{EA6EB7D0-C920-4434-B43D-0DDD0AF8F497}

    Garmin USB Drivers-->MsiExec.exe /X{B1102A25-3AA3-446B-AA0F-A699B07A02FD}

    GeoPDF Toolbar-->MsiExec.exe /X{A58686F6-2ADD-4BCC-996D-311F0A39BF65}

    Google Video Player-->"C:\Program Files\Google\Google Video Player\Uninstall.exe"

    HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall

    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT=""

    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""

    Hotfix for Windows Media Format 11 SDK (KB929399)-->"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"

    Hotfix for Windows Media Player 11 (KB939683)-->"C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe"

    Hotfix for Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"

    Hotfix for Windows XP (KB961118)-->"C:\WINDOWS\$NtUninstallKB961118$\spuninst\spuninst.exe"

    Hotfix for Windows XP (KB970653-v3)-->"C:\WINDOWS\$NtUninstallKB970653-v3$\spuninst\spuninst.exe"

    HP Imaging Device Functions 7.0-->C:\Program Files\Hewlett-Packard\Digital Imaging\DeviceManagement\hpzscr01.exe -datfile hpqbud01.dat

    hp instant support-->C:\PROGRA~1\HEWLET~1\hpis\Uninstall.exe /s CeS

    HP Photo and Imaging 2.1 - Scanjet 2400 Series-->MsiExec.exe /I{6F7ECD56-E224-4263-9B7E-158E5CECC43B}

    HP Photosmart and Deskjet 7.0.A-->C:\Program Files\Hewlett-Packard\Digital Imaging\{A9F5421F-DA70-4C77-BB97-8D77EC33ED5E}\setup\hpzscr01.exe -datfile hposcr09.dat

    HP Photosmart Essential-->MsiExec.exe /X{6994491D-D491-48F1-AE1F-E179C1FFFC2F}

    HP Solution Center 7.0-->C:\Program Files\Hewlett-Packard\Digital Imaging\eSupport\hpzscr01.exe -datfile hpqbud05.dat

    HP Update-->MsiExec.exe /X{8C6027FD-53DC-446D-BB75-CACD7028A134}

    J2SE Runtime Environment 5.0 Update 12-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150120}

    Java 6 Update 2-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160020}

    Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"

    Microsoft .NET Framework 1.1 Security Update (KB953297)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M953297\M953297Uninstall.msp"

    Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}

    Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}

    Microsoft .NET Framework 2.0 Service Pack 2-->MsiExec.exe /I{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}

    Microsoft .NET Framework 3.0 Service Pack 2-->MsiExec.exe /I{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}

    Microsoft .NET Framework 3.5 SP1-->C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe

    Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}

    Microsoft Kernel-Mode Driver Framework Feature Pack 1.5-->"C:\WINDOWS\$NtUninstallWdf01005$\spuninst\spuninst.exe"

    Microsoft Office 2000 Professional-->MsiExec.exe /I{00010409-78E1-11D2-B60F-006097C998E7}

    Microsoft Silverlight-->MsiExec.exe /I{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}

    Microsoft User-Mode Driver Framework Feature Pack 1.0-->"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"

    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053-->MsiExec.exe /X{770657D0-A123-3C07-8E44-1C83EC895118}

    Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}

    Move Networks Player for Internet Explorer-->"C:\Documents and Settings\Thomas Family\Application Data\Move Networks\ie_bin\unins000.exe"

    MP3 Player Utilities 4.00-->MsiExec.exe /I{7784A172-61F1-445E-8368-601607E0DD22}

    MSXML 4.0 SP2 (KB927978)-->MsiExec.exe /I{37477865-A3F1-4772-AD43-AAFC6BCFF99F}

    MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}

    MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}

    MSXML 6 Service Pack 2 (KB954459)-->MsiExec.exe /I{1A528690-6A2D-4BC5-B143-8C4AE8D19D96}

    Nero OEM-->C:\Program Files\Ahead\nero\uninstall\UNNERO.exe /UNINSTALL

    NeroVision Express 2-->C:\WINDOWS\UNNeroVision.exe /UNINSTALL

    NVIDIA Drivers-->C:\WINDOWS\system32\nvudisp.exe UninstallGUI

    OCR Software by I.R.I.S 7.0-->C:\Program Files\Hewlett-Packard\Digital Imaging\OCR\hpzscr01.exe -datfile hpqbud11.dat

    Panda ActiveScan 2.0-->C:\Program Files\Panda Security\ActiveScan 2.0\as2uninst.exe

    Photodex Presenter-->C:\Program Files\Photodex Presenter\uninst.exe

    ProShow Gold-->C:\Program Files\Photodex\ProShowGold\uninst.exe

    QuickTime-->MsiExec.exe /I{5E863175-E85D-44A6-8968-82507D34AE7F}

    Security Update for Windows Media Encoder (KB954156)-->"C:\WINDOWS\$NtUninstallKB954156_WM9L$\spuninst\spuninst.exe"

    Security Update for Windows Media Player (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"

    Security Update for Windows Media Player (KB954155)-->"C:\WINDOWS\$NtUninstallKB954155_WM9$\spuninst\spuninst.exe"

    Security Update for Windows Media Player (KB968816)-->"C:\WINDOWS\$NtUninstallKB968816_WM9$\spuninst\spuninst.exe"

    Security Update for Windows Media Player (KB973540)-->"C:\WINDOWS\$NtUninstallKB973540_WM9L$\spuninst\spuninst.exe"

    Security Update for Windows Media Player 11 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe"

    Security Update for Windows Media Player 11 (KB954154)-->"C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe"

    Security Update for Windows Media Player 9 (KB917734)-->"C:\WINDOWS\$NtUninstallKB917734_WMP9$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB923561)-->"C:\WINDOWS\$NtUninstallKB923561$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB923789)-->C:\WINDOWS\system32\MacroMed\Flash\genuinst.exe C:\WINDOWS\system32\MacroMed\Flash\KB923789.inf

    Security Update for Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB938464-v2)-->"C:\WINDOWS\$NtUninstallKB938464-v2$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB950759)-->"C:\WINDOWS\$NtUninstallKB950759$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB950760)-->"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB951376)-->"C:\WINDOWS\$NtUninstallKB951376$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB952004)-->"C:\WINDOWS\$NtUninstallKB952004$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB953838)-->"C:\WINDOWS\$NtUninstallKB953838$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB953839)-->"C:\WINDOWS\$NtUninstallKB953839$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB954211)-->"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB956390)-->"C:\WINDOWS\$NtUninstallKB956390$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB956391)-->"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB956572)-->"C:\WINDOWS\$NtUninstallKB956572$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB956744)-->"C:\WINDOWS\$NtUninstallKB956744$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB956844)-->"C:\WINDOWS\$NtUninstallKB956844$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB957095)-->"C:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB958215)-->"C:\WINDOWS\$NtUninstallKB958215$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB958690)-->"C:\WINDOWS\$NtUninstallKB958690$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB958869)-->"C:\WINDOWS\$NtUninstallKB958869$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB959426)-->"C:\WINDOWS\$NtUninstallKB959426$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB960225)-->"C:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB960714)-->"C:\WINDOWS\$NtUninstallKB960714$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB960715)-->"C:\WINDOWS\$NtUninstallKB960715$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB960803)-->"C:\WINDOWS\$NtUninstallKB960803$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB960859)-->"C:\WINDOWS\$NtUninstallKB960859$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB961371)-->"C:\WINDOWS\$NtUninstallKB961371$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB961373)-->"C:\WINDOWS\$NtUninstallKB961373$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB961501)-->"C:\WINDOWS\$NtUninstallKB961501$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB963027)-->"C:\WINDOWS\$NtUninstallKB963027$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB968537)-->"C:\WINDOWS\$NtUninstallKB968537$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB969059)-->"C:\WINDOWS\$NtUninstallKB969059$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB969897)-->"C:\WINDOWS\$NtUninstallKB969897$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB969898)-->"C:\WINDOWS\$NtUninstallKB969898$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB970238)-->"C:\WINDOWS\$NtUninstallKB970238$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB971486)-->"C:\WINDOWS\$NtUninstallKB971486$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB971557)-->"C:\WINDOWS\$NtUninstallKB971557$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB971633)-->"C:\WINDOWS\$NtUninstallKB971633$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB971657)-->"C:\WINDOWS\$NtUninstallKB971657$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB971961)-->"C:\WINDOWS\$NtUninstallKB971961$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB972260)-->"C:\WINDOWS\$NtUninstallKB972260$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB973346)-->"C:\WINDOWS\$NtUninstallKB973346$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB973354)-->"C:\WINDOWS\$NtUninstallKB973354$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB973507)-->"C:\WINDOWS\$NtUninstallKB973507$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB973525)-->"C:\WINDOWS\$NtUninstallKB973525$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB973869)-->"C:\WINDOWS\$NtUninstallKB973869$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB974112)-->"C:\WINDOWS\$NtUninstallKB974112$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB974455)-->"C:\WINDOWS\$NtUninstallKB974455$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB974571)-->"C:\WINDOWS\$NtUninstallKB974571$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB975025)-->"C:\WINDOWS\$NtUninstallKB975025$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB975467)-->"C:\WINDOWS\$NtUninstallKB975467$\spuninst\spuninst.exe"

    Sierra Utilities-->C:\Program Files\Sierra On-Line\sutil32.exe uninstall

    Sound Blaster Live! Web 2K/XP-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{3FCAADB8-EB1B-11D6-AB2D-0090271A23A2}\Setup.exe" -l0x9

    SUPER

    3rd attempt for help

    in Resolved Malware Removal Logs

    Posted

    bittorrent uninstalled

    info.txt logfile of random's system information tool 1.06 2009-11-17 08:41:07

    ======Uninstall list======

    -->"C:\Program Files\Creative\SBLive\Program\Ctzapxx.EXE" /X /U /S

    -->"C:\Program Files\InstallShield Installation Information\{A644254B-92F6-4970-8635-AB0775371E72}\setup.exe" --u:{A644254B-92F6-4970-8635-AB0775371E72}

    -->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER

    -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{58582977-44D2-44A0-A09B-031CC2AE5938}\setup.exe" -l0x9

    -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{58582977-44D2-44A0-A09B-031CC2AE5938}\setup.exe" -l0x9 /remove

    -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9A4D2983-4662-4387-BE3D-4CFC2FA9C100}\setup.exe" -l0x9

    -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9A4D2983-4662-4387-BE3D-4CFC2FA9C100}\setup.exe" -l0x9 /remove

    -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A731533B-B325-4D9C-91A4-D93C8E294C19}\setup.exe" -l0x9

    -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A731533B-B325-4D9C-91A4-D93C8E294C19}\setup.exe" -l0x9 /remove

    -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FD851F7E-F887-405D-9E1C-488811113EF3}\setup.exe" -l0x9

    -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FD851F7E-F887-405D-9E1C-488811113EF3}\setup.exe" -l0x9 /remove

    -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{87616DD3-61A7-46FB-8AE3-927D5BC4D268}\setup.exe" -l0x9

    -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9BEC3D0E-B569-4998-BFB0-17D00E266854}\setup.exe" -l0x9

    -->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf

    Adobe Digital Editions-->"C:\Program Files\Adobe\Adobe Digital Editions\uninstall.exe"

    Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe

    Adobe Reader 8-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A80000000002}

    Adobe Shockwave Player-->C:\WINDOWS\system32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~1\Install.log

    ADS Tech Master Installer V3.6-->C:\PROGRA~1\ADSTech\UNWISE.EXE C:\PROGRA~1\ADSTech\INSTALL.LOG

    AGEIA PhysX v2.4.4-->"C:\Program Files\AGEIA Technologies\uninstall.exe"

    Amazon MP3 Downloader 1.0.5-->C:\Program Files\Amazon\MP3 Downloader\Uninstall.exe

    Audacity 1.2.6-->"C:\Program Files\Audacity\unins000.exe"

    AVG Free 8.5-->C:\Program Files\AVG\AVG8\setup.exe /UNINSTALL

    AviSynth 2.5-->"C:\Program Files\AviSynth 2.5\Uninstall.exe"

    Click'N Design 3D (V5)-->C:\PROGRA~1\CLICK'~1\UNWISE.EXE C:\PROGRA~1\CLICK'~1\INSTALL.LOG

    Compatibility Pack for the 2007 Office system-->MsiExec.exe /X{90120000-0020-0409-0000-0000000FF1CE}

    Coupon Printer for Windows-->"C:\Program Files\Coupons\uninstall.exe" "/U:C:\Program Files\Coupons\Uninstall\uninstall.xml"

    Critical Update for Windows Media Player 11 (KB959772)-->"C:\WINDOWS\$NtUninstallKB959772_WM11$\spuninst\spuninst.exe"

    Dell ResourceCD-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D78653C3-A8FF-415F-92E6-D774E634FF2D}\setup.exe"

    DivX Codec-->C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC

    DivX Content Uploader-->C:\Program Files\DivX\DivXContentUploaderUninstall.exe /CUPLOADER

    DivX Converter-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER

    DivX Player-->C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER

    DivX Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN

    DVD Decrypter (Remove Only)-->"C:\Program Files\DVD Decrypter\uninstall.exe"

    DVD Shrink 3.2-->"C:\Program Files\DVD Shrink\unins000.exe"

    DVDFab (Platinum/Gold/HD Decrypter) (Option: Mobile) 5.2.2.2-->"C:\Program Files\DVDFab 5\unins000.exe"

    EPSON TWAIN 5-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9A3EABC0-CA06-11D4-BF77-00104B130C19}\SETUP.EXE" -l0x9 UNINSTALL

    ffdshow [rev 2527] [2008-12-19]-->"C:\Program Files\ffdshow\unins000.exe"

    FLV Player 1.3.3-->"C:\Program Files\FLVPlayer\uninstall.exe"

    GameSpy Arcade-->C:\PROGRA~1\GAMESP~1\UNWISE.EXE C:\PROGRA~1\GAMESP~1\INSTALL.LOG

    Garmin City Navigator Mexico NT 2010 Update-->MsiExec.exe /X{30AD6AC7-EB40-4C70-9C2B-8D0CA1D92655}

    Garmin Communicator Plugin-->MsiExec.exe /X{A7DEBAA4-B211-4D1A-A6B3-E52BFAAA1D0C}

    Garmin MapSource-->MsiExec.exe /X{EA6EB7D0-C920-4434-B43D-0DDD0AF8F497}

    Garmin USB Drivers-->MsiExec.exe /X{B1102A25-3AA3-446B-AA0F-A699B07A02FD}

    GeoPDF Toolbar-->MsiExec.exe /X{A58686F6-2ADD-4BCC-996D-311F0A39BF65}

    Google Video Player-->"C:\Program Files\Google\Google Video Player\Uninstall.exe"

    HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall

    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT=""

    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""

    Hotfix for Windows Media Format 11 SDK (KB929399)-->"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"

    Hotfix for Windows Media Player 11 (KB939683)-->"C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe"

    Hotfix for Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"

    Hotfix for Windows XP (KB961118)-->"C:\WINDOWS\$NtUninstallKB961118$\spuninst\spuninst.exe"

    Hotfix for Windows XP (KB970653-v3)-->"C:\WINDOWS\$NtUninstallKB970653-v3$\spuninst\spuninst.exe"

    HP Imaging Device Functions 7.0-->C:\Program Files\Hewlett-Packard\Digital Imaging\DeviceManagement\hpzscr01.exe -datfile hpqbud01.dat

    hp instant support-->C:\PROGRA~1\HEWLET~1\hpis\Uninstall.exe /s CeS

    HP Photo and Imaging 2.1 - Scanjet 2400 Series-->MsiExec.exe /I{6F7ECD56-E224-4263-9B7E-158E5CECC43B}

    HP Photosmart and Deskjet 7.0.A-->C:\Program Files\Hewlett-Packard\Digital Imaging\{A9F5421F-DA70-4C77-BB97-8D77EC33ED5E}\setup\hpzscr01.exe -datfile hposcr09.dat

    HP Photosmart Essential-->MsiExec.exe /X{6994491D-D491-48F1-AE1F-E179C1FFFC2F}

    HP Solution Center 7.0-->C:\Program Files\Hewlett-Packard\Digital Imaging\eSupport\hpzscr01.exe -datfile hpqbud05.dat

    HP Update-->MsiExec.exe /X{8C6027FD-53DC-446D-BB75-CACD7028A134}

    J2SE Runtime Environment 5.0 Update 12-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150120}

    Java 6 Update 2-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160020}

    Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"

    Microsoft .NET Framework 1.1 Security Update (KB953297)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M953297\M953297Uninstall.msp"

    Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}

    Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}

    Microsoft .NET Framework 2.0 Service Pack 2-->MsiExec.exe /I{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}

    Microsoft .NET Framework 3.0 Service Pack 2-->MsiExec.exe /I{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}

    Microsoft .NET Framework 3.5 SP1-->C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe

    Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}

    Microsoft Kernel-Mode Driver Framework Feature Pack 1.5-->"C:\WINDOWS\$NtUninstallWdf01005$\spuninst\spuninst.exe"

    Microsoft Office 2000 Professional-->MsiExec.exe /I{00010409-78E1-11D2-B60F-006097C998E7}

    Microsoft Silverlight-->MsiExec.exe /I{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}

    Microsoft User-Mode Driver Framework Feature Pack 1.0-->"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"

    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053-->MsiExec.exe /X{770657D0-A123-3C07-8E44-1C83EC895118}

    Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}

    Move Networks Player for Internet Explorer-->"C:\Documents and Settings\Thomas Family\Application Data\Move Networks\ie_bin\unins000.exe"

    MP3 Player Utilities 4.00-->MsiExec.exe /I{7784A172-61F1-445E-8368-601607E0DD22}

    MSXML 4.0 SP2 (KB927978)-->MsiExec.exe /I{37477865-A3F1-4772-AD43-AAFC6BCFF99F}

    MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}

    MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}

    MSXML 6 Service Pack 2 (KB954459)-->MsiExec.exe /I{1A528690-6A2D-4BC5-B143-8C4AE8D19D96}

    Nero OEM-->C:\Program Files\Ahead\nero\uninstall\UNNERO.exe /UNINSTALL

    NeroVision Express 2-->C:\WINDOWS\UNNeroVision.exe /UNINSTALL

    NVIDIA Drivers-->C:\WINDOWS\system32\nvudisp.exe UninstallGUI

    OCR Software by I.R.I.S 7.0-->C:\Program Files\Hewlett-Packard\Digital Imaging\OCR\hpzscr01.exe -datfile hpqbud11.dat

    Panda ActiveScan 2.0-->C:\Program Files\Panda Security\ActiveScan 2.0\as2uninst.exe

    Photodex Presenter-->C:\Program Files\Photodex Presenter\uninst.exe

    ProShow Gold-->C:\Program Files\Photodex\ProShowGold\uninst.exe

    QuickTime-->MsiExec.exe /I{5E863175-E85D-44A6-8968-82507D34AE7F}

    Security Update for Windows Media Encoder (KB954156)-->"C:\WINDOWS\$NtUninstallKB954156_WM9L$\spuninst\spuninst.exe"

    Security Update for Windows Media Player (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"

    Security Update for Windows Media Player (KB954155)-->"C:\WINDOWS\$NtUninstallKB954155_WM9$\spuninst\spuninst.exe"

    Security Update for Windows Media Player (KB968816)-->"C:\WINDOWS\$NtUninstallKB968816_WM9$\spuninst\spuninst.exe"

    Security Update for Windows Media Player (KB973540)-->"C:\WINDOWS\$NtUninstallKB973540_WM9L$\spuninst\spuninst.exe"

    Security Update for Windows Media Player 11 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe"

    Security Update for Windows Media Player 11 (KB954154)-->"C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe"

    Security Update for Windows Media Player 9 (KB917734)-->"C:\WINDOWS\$NtUninstallKB917734_WMP9$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB923561)-->"C:\WINDOWS\$NtUninstallKB923561$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB923789)-->C:\WINDOWS\system32\MacroMed\Flash\genuinst.exe C:\WINDOWS\system32\MacroMed\Flash\KB923789.inf

    Security Update for Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB938464-v2)-->"C:\WINDOWS\$NtUninstallKB938464-v2$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB950759)-->"C:\WINDOWS\$NtUninstallKB950759$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB950760)-->"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB951376)-->"C:\WINDOWS\$NtUninstallKB951376$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB952004)-->"C:\WINDOWS\$NtUninstallKB952004$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB953838)-->"C:\WINDOWS\$NtUninstallKB953838$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB953839)-->"C:\WINDOWS\$NtUninstallKB953839$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB954211)-->"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB956390)-->"C:\WINDOWS\$NtUninstallKB956390$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB956391)-->"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB956572)-->"C:\WINDOWS\$NtUninstallKB956572$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB956744)-->"C:\WINDOWS\$NtUninstallKB956744$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB956844)-->"C:\WINDOWS\$NtUninstallKB956844$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB957095)-->"C:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB958215)-->"C:\WINDOWS\$NtUninstallKB958215$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB958690)-->"C:\WINDOWS\$NtUninstallKB958690$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB958869)-->"C:\WINDOWS\$NtUninstallKB958869$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB959426)-->"C:\WINDOWS\$NtUninstallKB959426$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB960225)-->"C:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB960714)-->"C:\WINDOWS\$NtUninstallKB960714$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB960715)-->"C:\WINDOWS\$NtUninstallKB960715$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB960803)-->"C:\WINDOWS\$NtUninstallKB960803$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB960859)-->"C:\WINDOWS\$NtUninstallKB960859$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB961371)-->"C:\WINDOWS\$NtUninstallKB961371$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB961373)-->"C:\WINDOWS\$NtUninstallKB961373$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB961501)-->"C:\WINDOWS\$NtUninstallKB961501$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB963027)-->"C:\WINDOWS\$NtUninstallKB963027$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB968537)-->"C:\WINDOWS\$NtUninstallKB968537$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB969059)-->"C:\WINDOWS\$NtUninstallKB969059$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB969897)-->"C:\WINDOWS\$NtUninstallKB969897$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB969898)-->"C:\WINDOWS\$NtUninstallKB969898$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB970238)-->"C:\WINDOWS\$NtUninstallKB970238$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB971486)-->"C:\WINDOWS\$NtUninstallKB971486$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB971557)-->"C:\WINDOWS\$NtUninstallKB971557$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB971633)-->"C:\WINDOWS\$NtUninstallKB971633$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB971657)-->"C:\WINDOWS\$NtUninstallKB971657$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB971961)-->"C:\WINDOWS\$NtUninstallKB971961$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB972260)-->"C:\WINDOWS\$NtUninstallKB972260$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB973346)-->"C:\WINDOWS\$NtUninstallKB973346$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB973354)-->"C:\WINDOWS\$NtUninstallKB973354$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB973507)-->"C:\WINDOWS\$NtUninstallKB973507$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB973525)-->"C:\WINDOWS\$NtUninstallKB973525$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB973869)-->"C:\WINDOWS\$NtUninstallKB973869$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB974112)-->"C:\WINDOWS\$NtUninstallKB974112$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB974455)-->"C:\WINDOWS\$NtUninstallKB974455$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB974571)-->"C:\WINDOWS\$NtUninstallKB974571$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB975025)-->"C:\WINDOWS\$NtUninstallKB975025$\spuninst\spuninst.exe"

    Security Update for Windows XP (KB975467)-->"C:\WINDOWS\$NtUninstallKB975467$\spuninst\spuninst.exe"

    Sierra Utilities-->C:\Program Files\Sierra On-Line\sutil32.exe uninstall

    Sound Blaster Live! Web 2K/XP-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{3FCAADB8-EB1B-11D6-AB2D-0090271A23A2}\Setup.exe" -l0x9

    SUPER

    3rd attempt for help

    in Resolved Malware Removal Logs

    Posted

    Logfile of random's system information tool 1.06 (written by random/random)

    Run by Thomas Family at 2009-11-17 08:40:35

    Microsoft Windows XP Home Edition Service Pack 3

    System drive C: has 6 GB (15%) free of 38 GB

    Total RAM: 511 MB (46% free)

    Logfile of Trend Micro HijackThis v2.0.2

    Scan saved at 8:41:01 AM, on 11/17/2009

    Platform: Windows XP SP3 (WinNT 5.01.2600)

    MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)

    Boot mode: Normal

    Running processes:

    C:\WINDOWS\System32\smss.exe

    C:\WINDOWS\system32\winlogon.exe

    C:\WINDOWS\system32\services.exe

    C:\WINDOWS\system32\lsass.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\System32\svchost.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\system32\spoolsv.exe

    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

    C:\WINDOWS\system32\nvsvc32.exe

    C:\WINDOWS\system32\PnkBstrA.exe

    C:\WINDOWS\system32\PnkBstrB.exe

    C:\Program Files\Photodex\ProShowGold\ScsiAccess.exe

    C:\WINDOWS\System32\svchost.exe

    C:\PROGRA~1\AVG\AVG8\avgrsx.exe

    C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

    c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe

    C:\WINDOWS\system32\CTHELPER.EXE

    C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe

    C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe

    C:\PROGRA~1\AVG\AVG8\avgtray.exe

    C:\Program Files\DNA\btdna.exe

    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe

    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exe

    C:\WINDOWS\system32\HPZipm12.exe

    C:\WINDOWS\explorer.exe

    C:\Documents and Settings\Thomas Family\Desktop\RSIT.exe

    C:\Program Files\Trend Micro\HijackThis\Thomas Family.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.hotmail.com/

    O1 - Hosts: ::1 localhost

    O1 - Hosts: 91.212.127.226 ossecure2009.microsoft.com

    O1 - Hosts: 91.212.127.226 os-secure2009.com

    O1 - Hosts: 91.212.127.226 www.os-secure2009.com

    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

    O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE

    O4 - HKLM\..\Run: [updReg] C:\WINDOWS\UpdReg.EXE

    O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"

    O4 - HKLM\..\Run: [hcsystray] C:\Program Files\Kuma Games\hcsystray\hc_tray.exe

    O4 - HKLM\..\Run: [share-to-Web Namespace Daemon] c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe

    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe

    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

    O4 - HKLM\..\Run: [ulead AutoDetector] C:\Program Files\Common Files\Ulead Systems\AutoDetector\Monitor.exe

    O4 - HKLM\..\Run: [ulead Calendar Checker] C:\Program Files\Ulead Systems\Ulead Photo Express 6\CalCheck.exe

    O4 - HKLM\..\Run: [ulead Quick-Drop] "C:\Program Files\Ulead Systems\Ulead DVD MovieFactory 5 Plus\Ulead DVD MovieFactory 5\Quick-Drop.exe" WINDOWCALL

    O4 - HKLM\..\Run: [AceGain LiveUpdate] C:\Program Files\AceGain\LiveUpdate\LiveUpdate.exe

    O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe

    O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

    O4 - HKCU\..\Run: [bitTorrent DNA] "C:\Program Files\DNA\btdna.exe"

    O4 - Startup: PowerReg Scheduler V3.exe

    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe

    O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe

    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe

    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

    O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Program Files\MP3 Player Utilities 4.00\AMVConverter\grab.html

    O8 - Extra context menu item: Add to Media Manager... - C:\Program Files\MP3 Player Utilities 4.00\MediaManager\grab.html

    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1...toUploader5.cab

    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

    O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab

    O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photos.walmart.com/WalmartActivia.cab

    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab

    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1169328104353

    O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.0...oUploader55.cab

    O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} - http://a19.g.akamai.net/7/19/7125/1452/ftp...02/cpbrkpie.cab

    O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx1.hotmail.com/mail/w4/pr01/photo...ol/MSNPUpld.cab

    O18 - Filter hijack: text/html - {67157e85-9747-49ea-ba4c-4f11342f9c2c} - C:\WINDOWS\batmeter16.dll

    O20 - AppInit_DLLs: jaguvonu.dll

    O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll

    O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

    O23 - Service: iPod Service - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)

    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

    O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe

    O23 - Service: ScsiAccess - Unknown owner - C:\Program Files\Photodex\ProShowGold\ScsiAccess.exe

    O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

    --

    End of file - 7195 bytes

    3rd attempt for help

    in Resolved Malware Removal Logs

    Posted

    fyi this started after being hijacked by the "security tool". I was totally hijacked by the "security tool".

    After manually deleting the security tool .exe (hidden as program file/"some numbers") and stopping processes using task manager I was able to run avg from the hard drive and mbam (updated) from a flash drive.

    Mbam will now run from the desktop.

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.