MBAM and HijackThis Logs

tekkfall · February 5, 2009

Hello, new poster here. My computer has been getting constant pop ups of corrupt files to run chkdsk and what-not. The files work just fine but I still keep getting these messages, I run the chkdsk utility and it says the drives are locked. I run them during the restart, but the weird thing, is it zips through the test in a matter of seconds, and it says complete. I run CCleaner daily along with Avira Antivirus, Spybot S&D, and Spyware Killer Pro.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 7:25:16 PM, on 2/4/2009

Platform: Windows XP SP3, v.3311 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.5730.0013)

Boot mode: Normal

Running processes:

E:\WINDOWS\System32\smss.exe

E:\WINDOWS\system32\winlogon.exe

E:\WINDOWS\system32\services.exe

E:\WINDOWS\system32\lsass.exe

E:\WINDOWS\system32\svchost.exe

E:\WINDOWS\System32\svchost.exe

E:\WINDOWS\system32\svchost.exe

E:\WINDOWS\system32\spoolsv.exe

E:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

E:\WINDOWS\Explorer.EXE

E:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

E:\WINDOWS\System32\svchost.exe

E:\WINDOWS\system32\svchost.exe

E:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe

E:\WINDOWS\system32\ctfmon.exe

E:\WINDOWS\System32\svchost.exe

E:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

E:\Program Files\Mozilla Firefox\firefox.exe

D:\Turbine Download Manager\TurbineMessageService.exe

D:\Turbine Download Manager\TurbineNetworkService.exe

E:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = localhost:9095

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R3 - Default URLSearchHook is missing

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (file missing)

O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - (no file)

O2 - BHO: (no name) - {60D3AAEB-AA39-4AE0-B2F9-E4AF0613A2A3} - E:\PROGRA~1\Cosmi\SPYWAR~1\pop\ABG_PL~1.DLL

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Office12\GrooveShellExtensions.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - (no file)

O3 - Toolbar: (no name) - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - (no file)

O3 - Toolbar: ZoneAlarm Spy Blocker Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - (no file)

O3 - Toolbar: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file)

O4 - HKLM\..\Run: [avgnt] "E:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKLM\..\Run: [DWQueuedReporting] "E:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t

O4 - HKCU\..\Run: [ctfmon.exe] E:\WINDOWS\system32\ctfmon.exe

O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - (no file)

O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - (no file)

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL

O10 - Unknown file in Winsock LSP: e:\windows\system32\nwprovau.dll

O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - https://ra.qwest.com/sdccommon/download/tgctlcm.cab

O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://pcpitstop.com/pcpitstop/PCPitStop.CAB

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - E:\Program Files\Yahoo!\Common\yinsthelper.dll

O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab

O16 - DPF: {54BE6B6F-3056-470B-97E1-BB92E051B6C4} - http://h20264.www2.hp.com/ediags/dd/instal...nosticsxp2k.cab

O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo...otoUploader.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1190950710218

O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1229655433890

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Office12\GrooveSystemServices.dll

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file)

O20 - AppInit_DLLs: avgrsstx.dll

O20 - Winlogon Notify: !SASWinLogon - E:\Program Files\SUPERAntiSpyware\SASWINLO.dll

O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - E:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - E:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: Turbine Message Service - Live (LiveTurbineMessageService) - Turbine, Inc. - D:\Turbine Download Manager\TurbineMessageService.exe

O23 - Service: Turbine Network Service - Live (LiveTurbineNetworkService) - Turbine, Inc. - D:\Turbine Download Manager\TurbineNetworkService.exe

--

End of file - 5683 bytes

Now onto the Malwarebytes problem. I've been getting these same infections for weeks, even while running in safe mode. Thanks for your time.

Malwarebytes' Anti-Malware 1.33

Database version: 1730

Windows 5.1.2600 Service Pack 3, v.3311

2/4/2009 8:21:52 PM

mbam-log-2009-02-04 (20-21-52).txt

Scan type: Full Scan (C:\|D:\|E:\|)

Objects scanned: 117577

Time elapsed: 1 hour(s), 11 minute(s), 51 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 2

Folders Infected: 0

Files Infected: 2

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: e:\windows\system32\ -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: system32\ -> Quarantined and deleted successfully.

Folders Infected:

(No malicious items detected)

Files Infected:

E:\WINDOWS\system32\ (Trojan.Agent) -> Delete on reboot.

E:\WINDOWS\system32\drivers\ (Trojan.Agent) -> Delete on reboot.

tekkfall · February 5, 2009

anyone out there?

AdvancedSetup · February 5, 2009

Don't know about out there, but I'm in here now

1 hour is not very much time to give someone. This is a free service and software we provide to clean your system, please try to be patient and we'll get you cleaned up. When replying please click on the ADDreply button and not the REPLY button. Thanks.

Please run the following.

Please visit this webpage for instructions for downloading ComboFix to your

DESKTOP

:

how-to-use-combofix

Please ensure you read this guide carefully and install the Recovery Console first.

NOTE!!:

You must save and run

ComboFix.exe

on your DESKTOP and not from any other folder.

Also,

DO NOT

click the mouse or launch any other applications while this is running or it may stall the program

Additional links to download the tool:

ComboFix.exe

Note:

The

Windows Recovery Console

will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

Once installed, you should see a blue screen prompt that says:

The Recovery Console was successfully installed.

Please continue as follows:

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
Click
Yes
to allow ComboFix to continue scanning for malware.
When the tool is finished, it will produce a report for you.
Please post the
C:\ComboFix.txt
along with a
new HijackThis log
so we may continue cleaning the system.

tekkfall · February 6, 2009

Excuse my poor forum etiquette, I apologize. Here is the combofix log.

ComboFix 09-02-05.01 - Dan Tilley 2009-02-05 21:07:34.1 - FAT32x86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.293 [GMT -8:00]

Running from: e:\documents and settings\Dan Tilley\Desktop\ComboFix.exe

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated)

AV: Avira AntiVir PersonalEdition *On-access scanning enabled* (Updated)

AV: ESET NOD32 Antivirus 3.0 *On-access scanning enabled* (Outdated)

FW: ZoneAlarm Firewall *disabled*

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

e:\windows\system32\drivers\TDSSserv.sys

e:\windows\system32\tdssadw.dll

e:\windows\system32\TDSSerrors.log

e:\windows\system32\tdssinit.dll

e:\windows\system32\TDSSl.dll

e:\windows\system32\TDSSlog.dll

e:\windows\system32\tdssmain.dll

e:\windows\system32\TDSSserf.dll

e:\windows\system32\TDSSserf1.dll

e:\windows\system32\TDSSservers.dat

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Service_TDSSserv

-------\Legacy_TDSSserv

((((((((((((((((((((((((( Files Created from 2009-01-06 to 2009-02-06 )))))))))))))))))))))))))))))))

.

2009-02-05 07:43 . 2009-02-05 07:43 <DIR> d-------- e:\program files\Google

2009-02-05 07:30 . 2009-02-05 07:30 <DIR> d-------- e:\documents and settings\A New Beginning\Application Data\Malwarebytes

2009-02-04 19:24 . 2009-02-04 19:24 <DIR> d-------- e:\program files\Trend Micro

2009-02-04 18:53 . 2009-02-04 18:53 <DIR> d-------- e:\program files\Opera

2009-02-03 14:56 . 2009-02-03 14:56 <DIR> d-------- e:\documents and settings\All Users\Application Data\Turbine

2009-01-28 23:14 . 2009-01-28 23:14 <DIR> d-------- e:\program files\Avira

2009-01-28 23:14 . 2009-01-28 23:14 <DIR> d-------- e:\documents and settings\All Users\Application Data\Avira

2009-01-28 22:51 . 2008-03-03 14:25 5,702 --ah----- e:\windows\nod32restoretemdono.reg

2009-01-28 22:51 . 2008-03-03 18:21 568 --ah----- e:\windows\nod32fixtemdono.reg

2009-01-28 22:49 . 2009-01-28 22:49 <DIR> d-------- e:\program files\ESET

2009-01-28 22:49 . 2009-01-28 22:49 <DIR> d-------- e:\documents and settings\All Users\Application Data\ESET

2009-01-28 22:27 . 2009-01-28 22:27 <DIR> d-------- e:\program files\LimeWire

2009-01-28 22:05 . 2009-01-28 22:05 <DIR> d-------- e:\program files\iolo

2009-01-28 22:05 . 2008-04-17 09:45 9,341 --a------ e:\windows\system32\drivers\filedisk.sys

2009-01-28 22:02 . 2009-01-28 22:02 <DIR> d-------- e:\documents and settings\Dan Tilley\Application Data\iolo

2009-01-27 11:27 . 2009-01-27 11:27 <DIR> d-------- e:\program files\common files\Blizzard Entertainment

2009-01-26 17:56 . 2009-01-26 17:56 61,440 --a------ e:\windows\system32\drivers\hcpa.sys

2009-01-25 11:45 . 2009-01-25 11:45 <DIR> d-------- e:\program files\SUPERAntiSpyware

2009-01-25 11:45 . 2009-01-25 11:45 <DIR> d-------- e:\documents and settings\Dan Tilley\Application Data\SUPERAntiSpyware.com

2009-01-25 11:45 . 2009-01-25 11:45 <DIR> d-------- e:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com

2009-01-25 11:44 . 2009-01-25 11:44 <DIR> d-------- e:\program files\common files\Wise Installation Wizard

2009-01-25 01:51 . 2009-01-25 01:51 <DIR> d-------- e:\program files\Malwarebytes' Anti-Malware

2009-01-25 01:51 . 2009-01-25 01:51 <DIR> d-------- e:\documents and settings\Dan Tilley\Application Data\Malwarebytes

2009-01-25 01:51 . 2009-01-25 01:51 <DIR> d-------- e:\documents and settings\All Users\Application Data\Malwarebytes

2009-01-25 01:51 . 2009-01-14 16:11 38,496 --a------ e:\windows\system32\drivers\mbamswissarmy.sys

2009-01-25 01:51 . 2009-01-14 16:11 15,504 --a------ e:\windows\system32\drivers\mbam.sys

2009-01-24 12:57 . 2009-01-24 02:47 15,688 --a------ e:\windows\system32\lsdelete.exe

2009-01-24 03:24 . 2009-01-24 02:46 64,160 --a------ e:\windows\system32\drivers\Lbd.sys

2009-01-24 02:56 . 2009-01-24 02:56 <DIR> d-------- e:\documents and settings\All Users\Application Data\PC Tools

2009-01-24 02:43 . 2009-01-24 02:43 <DIR> d--h----- e:\documents and settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}

2009-01-24 02:41 . 2009-01-24 02:41 <DIR> d-------- e:\program files\Lavasoft

2009-01-23 17:55 . 2008-04-17 13:12 107,368 --a------ e:\windows\system32\GEARAspi.dll

2009-01-23 17:55 . 2008-04-17 13:12 15,464 --a------ e:\windows\system32\drivers\GEARAspiWDM.sys

2009-01-23 17:54 . 2009-01-23 17:54 <DIR> d-------- e:\program files\common files\Apple

2009-01-23 17:54 . 2009-01-23 17:54 <DIR> d-------- e:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}

2009-01-23 17:53 . 2009-01-23 17:53 <DIR> d-------- e:\program files\Bonjour

2009-01-22 14:58 . 2009-01-22 14:58 <DIR> d-------- e:\program files\common files\Adobe

2009-01-22 10:56 . 2009-01-22 10:56 <DIR> d-------- e:\program files\Microsoft Works

2009-01-22 10:56 . 2009-01-22 10:56 <DIR> d-------- e:\program files\common files\L&H

2009-01-21 12:32 . 2009-01-22 10:58 376 --a------ e:\windows\ODBC.INI

2009-01-21 12:19 . 2009-01-21 12:19 <DIR> d-------- e:\program files\CCleaner

2009-01-21 12:19 . 2009-01-21 12:19 <DIR> d-------- e:\documents and settings\Dan Tilley\Application Data\Yahoo!

2009-01-20 18:36 . 2009-01-20 18:36 <DIR> d--hs---- E:\FOUND.000

2009-01-20 11:49 . 2009-01-20 11:49 <DIR> d-------- e:\documents and settings\Dan Tilley\Application Data\PC Tools

2009-01-20 11:49 . 2007-10-18 00:16 79,688 --a------ e:\windows\system32\drivers\iksyssec.sys

2009-01-20 11:49 . 2007-10-18 00:15 62,280 --a------ e:\windows\system32\drivers\iksysflt.sys

2009-01-20 11:49 . 2007-10-18 00:14 41,288 --a------ e:\windows\system32\drivers\ikfilesec.sys

2009-01-20 11:49 . 2007-10-18 00:16 29,000 --a------ e:\windows\system32\drivers\kcom.sys

2009-01-19 19:15 . 2009-01-19 19:15 <DIR> d-------- e:\documents and settings\Dan Tilley\Application Data\Yahoo

2009-01-17 09:12 . 2009-01-17 09:12 <DIR> d-------- e:\program files\RegScrubXP

2009-01-15 04:46 . 2009-01-24 02:25 1,502,720 --a------ e:\windows\goInstaller.exe

2009-01-15 04:45 . 2009-01-15 04:45 <DIR> d-------- e:\program files\Cosmi

2009-01-14 09:33 . 2004-06-01 07:55 1,896,484 --a------ e:\windows\system32\mCodexAPI.dll

2009-01-14 09:33 . 2003-09-24 21:37 96,256 --a------ e:\windows\system32\mCodexDLLStub.exe

2009-01-14 09:33 . 2003-09-24 21:37 69,466 --a------ e:\windows\system32\codex.translations.Active

2009-01-14 09:13 . 1999-04-02 16:37 33,792 -ra------ e:\windows\NPSExec.exe

2009-01-14 09:13 . 2009-01-14 09:13 503 --a------ e:\windows\eReg.dat

2009-01-14 09:09 . 2009-01-14 09:09 <DIR> d-------- e:\documents and settings\Dan Tilley\WINDOWS

2009-01-14 09:09 . 1998-10-29 17:45 306,688 --a------ e:\windows\IsUninst.exe

2009-01-14 03:08 . 2009-01-14 03:08 <DIR> d-------- E:\Documents

2009-01-12 21:00 . 2009-01-12 21:00 <DIR> d-------- e:\documents and settings\Dan Tilley\Tracing

2009-01-12 20:59 . 2009-01-12 20:59 <DIR> d-------- e:\program files\Microsoft

2009-01-06 05:41 . 2009-01-06 05:41 <DIR> d-------- e:\program files\NT Registry Optimizer

2009-01-06 05:08 . 2009-01-06 05:08 <DIR> d-------- e:\program files\Defraggler

2009-01-06 05:05 . 2009-01-06 05:05 <DIR> d-------- e:\program files\Spybot - Search & Destroy

2009-01-06 04:20 . 2009-01-06 04:20 <DIR> d-------- e:\program files\Microsoft Silverlight

2009-01-06 03:42 . 2009-01-06 03:42 <DIR> d-------- e:\windows\system32\URTTEMP

2009-01-06 00:28 . 2006-01-01 01:04 10,027 --a------ e:\windows\system32\mspriv32.dll

2009-01-06 00:12 . 2009-01-06 00:12 10,070 --a------ e:\windows\system32\msrep32.dll

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-01-31 07:26 25,992 ----a-w e:\windows\system32\pgdfgsvc.exe

2009-01-19 19:02 932,696 ----a-w e:\windows\system32\Incinerator.dll

2008-12-22 08:47 --------- d-----w e:\documents and settings\NetworkService\Application Data\iolo

2008-12-22 08:36 --------- d-----w e:\documents and settings\LocalService\Application Data\iolo

2008-12-22 08:35 74,703 ----a-w e:\windows\system32\mfc45.dll

2008-12-22 08:35 --------- d-----w e:\documents and settings\All Users\Application Data\iolo

2008-12-21 05:13 --------- d-----w e:\documents and settings\Dan Tilley\Application Data\TuneUp Software

2008-12-21 05:12 --------- d-sh--w e:\documents and settings\All Users\Application Data\{55A29068-F2CE-456C-9148-C869879E2357}

2008-12-21 05:12 --------- d-----w e:\program files\TuneUp Utilities 2009

2008-12-21 05:12 --------- d-----w e:\documents and settings\All Users\Application Data\TuneUp Software

2008-12-21 03:48 --------- d-----w e:\documents and settings\All Users\Application Data\TEMP

2008-12-13 06:49 21,840 ----a-w e:\windows\system32\SIntfNT.dll

2008-12-13 06:49 17,212 ----a-w e:\windows\system32\SIntf32.dll

2008-12-13 06:49 12,067 ----a-w e:\windows\system32\SIntf16.dll

2008-11-18 19:51 8,192 ----a-w e:\windows\system32\smrgdf.exe

2008-11-06 16:35 200,704 ----a-w e:\windows\system32\ssldivx.dll

2008-11-06 16:35 1,044,480 ----a-w e:\windows\system32\libdivx.dll

2008-02-12 22:59 6,144 --sh--r e:\windows\system32\csrss.exe

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="e:\windows\system32\ctfmon.exe" [2008-02-12 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"avgnt"="e:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]

"DWQueuedReporting"="e:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2003-07-14 34880]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "e:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]

2008-12-22 11:05 356352 e:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"VIDC.JDCT"= jl_jdct.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

@="Service"

[HKLM\~\startupfolder\E:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]

path=e:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk

backup=e:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\E:^Documents and Settings^Dan Tilley^Start Menu^Programs^Startup^LimeWire On Startup.lnk]

path=e:\documents and settings\Dan Tilley\Start Menu\Programs\Startup\LimeWire On Startup.lnk

backup=e:\windows\pss\LimeWire On Startup.lnkStartup

[HKLM\~\startupfolder\E:^Documents and Settings^Dan Tilley^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]

path=e:\documents and settings\Dan Tilley\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk

backup=e:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]

e:\windows\system32\dumprep 0 -k [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ad-Watch]

--a------ 2009-01-24 02:46 507224 e:\program files\Lavasoft\Ad-Aware\AAWTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

--a------ 2008-10-15 01:04 39792 e:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avgnt]

--a------ 2008-06-12 13:28 266497 e:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]

--a------ 2008-04-01 02:39 486856 e:\program files\DAEMON Tools\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DWQueuedReporting]

--a------ 2003-07-14 22:53 34880 e:\progra~1\COMMON~1\MICROS~1\DW\DWTRIG20.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]

--a------ 2007-08-24 07:00 33648 c:\office12\GrooveMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

--a------ 2009-01-06 13:06 290088 e:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

--a------ 2009-01-05 16:18 413696 e:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

--a------ 2007-09-25 01:11 132496 e:\program files\Java\jre1.6.0_03\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]

--a------ 2009-01-15 16:17 1830128 e:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]

--a------ 2009-02-05 07:43 171448 e:\program files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]

--a------ 2007-04-16 15:28 577536 e:\windows\soundman.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"BOCore"=2 (0x2)

"ose"=3 (0x3)

"Messenger"=2 (0x2)

"iPod Service"=3 (0x3)

"Apple Mobile Device"=2 (0x2)

"aawservice"=2 (0x2)

"vsmon"=2 (0x2)

"Ati HotKey Poller"=2 (0x2)

"SupportSoft RemoteAssist"=3 (0x3)

"WLSetupSvc"=3 (0x3)

"odserv"=3 (0x3)

"MDM"=2 (0x2)

"idsvc"=3 (0x3)

"sdAuxService"=2 (0x2)

"sdCoreService"=2 (0x2)

"Avg7UpdSvc"=2 (0x2)

"WMPNetworkSvc"=2 (0x2)

"wscsvc"=2 (0x2)

"wuauserv"=2 (0x2)

"srservice"=2 (0x2)

"VideoAcceleratorService"=2 (0x2)

"usnjsvc"=3 (0x3)

"Bonjour Service"=2 (0x2)

"WinDefend"=2 (0x2)

"ioloSystemService"=2 (0x2)

"ioloFileInfoList"=2 (0x2)

"gusvc"=3 (0x3)

"ASKService"=2 (0x2)

"avg8wd"=2 (0x2)

"avg8emc"=2 (0x2)

"Lavasoft Ad-Aware Service"=2 (0x2)

"LiveTurbineMessageService"=3 (0x3)

"LiveTurbineNetworkService"=3 (0x3)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"QuickTime Task"="e:\program files\QuickTime\QTTask.exe" -atboottime

"iTunesHelper"="e:\program files\iTunes\iTunesHelper.exe"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"e:\\Program Files\\LimeWire\\LimeWire.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Office12\\OUTLOOK.EXE"=

"c:\\Office12\\groove.exe"=

"c:\\Office12\\ONENOTE.EXE"=

"e:\\Program Files\\uTorrent\\uTorrent.exe"=

"e:\\Program Files\\Java\\jre1.6.0_03\\BIN\\javaw.exe"=

"e:\\Program Files\\iTunes\\iTunes.exe"=

"e:\\Program Files\\Cosmi\\SpyWare Killer Pro\\stealth\\stealthsurf.exe"=

"d:\\Turbine Download Manager\\TurbineNetworkService.exe"=

"d:\\Turbine Download Manager\\TurbineMessageService.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"16881:UDP"= 16881:UDP:rty

"62048:TCP"= 62048:TCP:Utor

"62048:UDP"= 62048:UDP:utor

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]

"AllowInboundEchoRequest"= 0 (0x0)

R0 Lbd;Lbd;e:\windows\system32\drivers\Lbd.sys [2009-01-24 64160]

R1 epfwtdir;epfwtdir;e:\windows\system32\drivers\epfwtdir.sys [2008-02-20 33800]

R1 SASDIFSV;SASDIFSV;e:\program files\SUPERAntiSpyware\sasdifsv.sys [2009-01-15 8944]

R1 SASKUTIL;SASKUTIL;e:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2009-01-15 55024]

S1 AvgLdx86;AVG Free AVI Loader Driver x86;e:\windows\system32\Drivers\avgldx86.sys --> e:\windows\system32\Drivers\avgldx86.sys [?]

S3 LiveTurbineMessageService;Turbine Message Service - Live;d:\turbine download manager\TurbineMessageService.exe [2009-02-03 255472]

S3 LiveTurbineNetworkService;Turbine Network Service - Live;d:\turbine download manager\TurbineNetworkService.exe [2009-02-03 218608]

S3 SASENUM;SASENUM;e:\program files\SUPERAntiSpyware\SASENUM.SYS [2009-01-15 7408]

S4 ASKService;ASKService;e:\program files\AskBarDis\bar\bin\AskService.exe --> e:\program files\AskBarDis\bar\bin\AskService.exe [?]

S4 avg8wd;AVG Free8 WatchDog;e:\progra~1\AVG\AVG8\avgwdsvc.exe --> e:\progra~1\AVG\AVG8\avgwdsvc.exe [?]

S4 ekrn;Eset Service;e:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2008-02-20 472320]

S4 ioloFileInfoList;iolo FileInfoList Service;e:\program files\iolo\Common\Lib\ioloServiceManager.exe [2009-01-28 712048]

S4 ioloSystemService;iolo System Service;e:\program files\iolo\Common\Lib\ioloServiceManager.exe [2009-01-28 712048]

S4 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;e:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-01-18 942416]

S4 sdAuxService;PC Tools Auxiliary Service;e:\program files\Spyware Doctor\svcntaux.exe --> e:\program files\Spyware Doctor\svcntaux.exe [?]

S4 WinDefend;Windows Defender;"e:\program files\Windows Defender\MsMpEng.exe" --> e:\program files\Windows Defender\MsMpEng.exe [?]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\I]

\Shell\AutoRun\command - I:\LaunchU3.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c47d84bc-a9e5-11dc-8379-000c76b6d3d4}]

\Shell\AutoRun\command - I:\LaunchU3.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c47d84bd-a9e5-11dc-8379-000c76b6d3d4}]

\Shell\AutoRun\command - J:\setupSNK.exe

.

Contents of the 'Scheduled Tasks' folder

2009-02-02 e:\windows\Tasks\Ad-Aware Update (Weekly).job

- e:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-24 02:46]

.

- - - - ORPHANS REMOVED - - - -

BHO-{201f27d4-3704-41d6-89c1-aa35e39143ed} - (no file)

Toolbar-{3041d03e-fd4b-44e0-b742-2d9b88305f98} - (no file)

WebBrowser-{3041D03E-FD4B-44E0-B742-2D9B88305F98} - (no file)

MSConfigStartUp-AdobeUpdater - e:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe

MSConfigStartUp-Aim6 - e:\program files\AIM6\aim6.exe

MSConfigStartUp-AppleSyncNotifier - e:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe

MSConfigStartUp-AVG7_CC - e:\progra~1\Grisoft\AVG7\avgcc.exe

MSConfigStartUp-AVG8_TRAY - e:\progra~1\AVG\AVG8\avgtray.exe

MSConfigStartUp-BOC-425 - e:\progra~1\Comodo\CBOClean\BOC425.exe

MSConfigStartUp-PC Connection Agent - e:\program files\Microsoft ActiveSync\wcescomm.exe

MSConfigStartUp-HP Software Update - e:\program files\HP\HP Software Update\HPWuSchd2.exe

MSConfigStartUp-Let's Just Play Challenge Tracker - e:\program files\Let's Just Play Challenge Tracker\Let's Just Play Challenge Tracker.exe

MSConfigStartUp-MSMSGS - e:\program files\Messenger\msmsgs.exe

MSConfigStartUp-MySpaceIM - e:\program files\MySpace\IM\MySpaceIM.exe

MSConfigStartUp-realteke - e:\documents and settings\Dan Tilley\Application Data\Google\cijwg16225165.exe

MSConfigStartUp-SDTray - e:\program files\Spyware Doctor\SDTrayApp.exe

MSConfigStartUp-SpeedBitVideoAccelerator - e:\program files\SpeedBit Video Accelerator\VideoAccelerator.exe

MSConfigStartUp-TkBellExe - e:\program files\Common Files\Real\Update_OB\realsched.exe

MSConfigStartUp-TrojanScanner - e:\program files\Trojan Remover\Trjscan.exe

MSConfigStartUp-Veoh - e:\program files\Veoh Networks\Veoh\VeohClient.exe

MSConfigStartUp-ZoneAlarm Client - e:\program files\Zone Labs\ZoneAlarm\zlclient.exe

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.google.com

uInternet Connection Wizard,ShellNext = iexplore

uInternet Settings,ProxyServer = localhost:9095

uInternet Settings,ProxyOverride = *.local

IE: E&xport to Microsoft Excel - e:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000

FF - ProfilePath - e:\documents and settings\Dan Tilley\Application Data\Mozilla\Firefox\Profiles\sxglj6bs.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/firefox?client=firefox-a&rls=org.mozilla:en-US:official

---- FIREFOX POLICIES ----

.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-02-05 21:09:33

Windows 5.1.2600 Service Pack 3, v.3311 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1100)

e:\program files\SUPERAntiSpyware\SASWINLO.dll

e:\windows\system32\Ati2evxx.dll

.

Completion time: 2009-02-05 21:10:56

ComboFix-quarantined-files.txt 2009-02-06 05:10:56

Pre-Run: 7,786,512,384 bytes free

Post-Run: 7,847,297,024 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect

multi(0)disk(0)rdisk(0)partition(3)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

C:\="Microsoft Windows"

Current=7 Default=7 Failed=6 LastKnownGood=8 Sets=1,2,3,4,5,6,7,8

320 --- E O F --- 2008-12-20 07:40:26

Here is the new hijack this.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 9:12:54 PM, on 2/5/2009

Platform: Windows XP SP3, v.3311 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.5730.0013)

Boot mode: Normal

Running processes:

E:\WINDOWS\System32\smss.exe

E:\WINDOWS\system32\winlogon.exe

E:\WINDOWS\system32\services.exe

E:\WINDOWS\system32\lsass.exe

E:\WINDOWS\system32\svchost.exe

E:\WINDOWS\System32\svchost.exe

E:\WINDOWS\system32\svchost.exe

E:\WINDOWS\system32\spoolsv.exe

E:\WINDOWS\System32\svchost.exe

E:\WINDOWS\system32\svchost.exe

E:\WINDOWS\system32\notepad.exe

E:\WINDOWS\system32\imapi.exe

E:\WINDOWS\explorer.exe

E:\WINDOWS\System32\svchost.exe

E:\PROGRA~1\COMMON~1\MICROS~1\DW\DWTRIG20.EXE

E:\WINDOWS\system32\ctfmon.exe

E:\Program Files\Mozilla Firefox\firefox.exe

E:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = localhost:9095

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (file missing)

O2 - BHO: (no name) - {60D3AAEB-AA39-4AE0-B2F9-E4AF0613A2A3} - E:\PROGRA~1\Cosmi\SPYWAR~1\pop\ABG_PL~1.DLL

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Office12\GrooveShellExtensions.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - (no file)

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - e:\program files\google\googletoolbar1.dll

O3 - Toolbar: (no name) - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - (no file)

O3 - Toolbar: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file)

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - e:\program files\google\googletoolbar1.dll