Redirecting my browser

[squigeeman]

I was recently infected with a ton of malware and it crashed my computer. I used Malawarebytes and superantispyware to clean it and it got my computer running again. These days Malawarebytes doesn't find anything when I scan but I notice that my computer has been performing very slowly. After doing google searches in firefox sometimes I click on a link and i am redirected to random sites. Firefox and Iexplore.exe often report errors after I close them. Here is my log:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 9:34:01 PM, on 2/7/2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\ehome\ehtray.exe

C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe

C:\Program Files\Digital Media Reader\readericon45G.exe

C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe

C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe

C:\Program Files\Google\Google Desktop Search\GoogleDesktopDisplay.exe

C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

C:\Program Files\QuickTime\QTTask.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Winamp\winampa.exe

C:\WINDOWS\eHome\ehRecvr.exe

C:\PROGRA~1\AVG\AVG8\avgtray.exe

C:\WINDOWS\eHome\ehSched.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\Veoh Networks\Veoh\VeohClient.exe

C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\BigFix\bigfix.exe

C:\Program Files\Panda Security\Panda Internet Security 2008\PsCtrls.exe

C:\Program Files\Panda Security\Panda Internet Security 2008\AntiSpam\pskmssvc.exe

C:\PROGRA~1\AVG\AVG8\avgrsx.exe

C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS

c:\program files\panda security\panda internet security 2008\firewall\PSHOST.EXE

C:\Program Files\Panda Security\Panda Internet Security 2008\PsImSvc.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Viewpoint\Common\ViewpointService.exe

C:\PROGRA~1\AVG\AVG8\avgemc.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\WINDOWS\system32\dllhost.exe

C:\WINDOWS\eHome\ehmsas.exe

C:\Program Files\Panda Security\Panda Internet Security 2008\PavBckPT.exe

C:\WINDOWS\system32\rundll32.exe

C:\PROGRA~1\AVG\AVG8\aAvgApi.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.com/g/startpage.html?Ch...DTP&M=T5048

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll

O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll

O3 - Toolbar: AIM Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll

O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL

O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe

O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup

O4 - HKLM\..\Run: [readericon] C:\Program Files\Digital Media Reader\readericon45G.exe

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"

O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE

O4 - HKLM\..\Run: [Reminder] %WINDIR%\Creator\Remind_XP.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall

O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Security\Panda Internet Security 2008\APVXDWIN.EXE" /s

O4 - HKLM\..\Run: [sCANINICIO] "C:\Program Files\Panda Security\Panda Internet Security 2008\Inicio.exe"

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKCU\..\Run: [Power2GoExpress] NA

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide

O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe

O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\bigfix.exe

O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aim toolbar 5.0\resources\en-US\local\search.html

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: AIM Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll

O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL,avgrsstx.dll C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL abcnhd.dll

O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

O20 - Winlogon Notify: jkkLBrsT - jkkLBrsT.dll (file missing)

O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe

O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe

O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe

O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: Panda Software Controller - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\PsCtrls.exe

O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\PavFnSvr.exe

O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe

O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\pavsrv51.exe

O23 - Service: Panda Antispam Engine (pmshellsrv) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\AntiSpam\pskmssvc.exe

O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS

O23 - Service: Panda Host Service (PSHost) - Panda Software International - c:\program files\panda security\panda internet security 2008\firewall\PSHOST.EXE

O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\PsImSvc.exe

O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

--

End of file - 9824 bytes

[AdvancedSetup]

Sorry for the delay. If you still need help please let me know.

[AdvancedSetup]

Due to the lack of feedback this Topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

The fixes and advice in this thread are for this machine only. Do not apply the instructions from this thread to your own machine. Please start a new thread describing your issue and someone will be along to assist you.

[AdvancedSetup]

Please post an updated MBAM log.

Hello and Welcome to Malwarebytes.org

If you're having Malware related issues with your computer that you're unable to resolve.

1. Please read and follow the instructions provided here: I'm infected - What do I do now?
2. If needed please post your logs in a NEW topic here: Malware Removal - HijackThis Logs
   
3. When posting logs please do not use any Quote, Code, or other tags. Please copy/paste directly into your post and do not attach files unless requested.
   

• Please do not post any logs in the General forum. We do not work on any logs posted in the General forum.
  
• Please do not install any software or use any removal/scanning tool except for those you're requested to run by the Helper that will assist you.
  
• Using these other tools often makes the cleanup task more difficult and time consuming.
  
• If you have already submitted for assistance at one of the other support sites on the Internet then you should not post a new log here, you should stay working with the Helper from that site until the issue is resolved.
  
• Do not assume you're clean because you don't see something in the logs. Please wait until the person assisting you provides feedback.
  
• There are often many others that require asistance as well, so please be patient. If no one has responded within 48 hours then please go ahead and post a request for review
  

• NOTE: If for some reason you're unable to run some or any of the tools in the first link, then skip that step and move on to the next one. If you can't even run HijackThis, then just proceed and post a NEW topic as shown in the second link describing your issues and someone will assist you as soon as they can.
  

[squigeeman]

For some reason I cannot update malwarebytes or any other of my antivirus programs. It might be a firewall, a virus or my new service provider i don't know. I can connect to the internet with this computer fine most of the time but it won't connect to the malwarebytes server. I am going to post a HijackThis log just in case you need something more

Malwarebytes' Anti-Malware 1.32

Database version: 1616

Windows 5.1.2600 Service Pack 2

2/16/2009 9:04:20 PM

mbam-log-2009-02-16 (21-04-20).txt

Scan type: Quick Scan

Objects scanned: 68147

Time elapsed: 14 minute(s), 0 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 9:09:19 PM, on 2/16/2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\ehome\ehtray.exe

C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe

C:\Program Files\Digital Media Reader\readericon45G.exe

C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe

C:\Program Files\Google\Google Desktop Search\GoogleDesktopDisplay.exe

C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe

C:\WINDOWS\RTHDCPL.EXE

C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\QuickTime\QTTask.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Winamp\winampa.exe

C:\PROGRA~1\AVG\AVG8\avgtray.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\Veoh Networks\Veoh\VeohClient.exe

C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\eHome\ehRecvr.exe

C:\Program Files\BigFix\bigfix.exe

C:\WINDOWS\eHome\ehSched.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Panda Security\Panda Internet Security 2008\PsCtrls.exe

C:\PROGRA~1\AVG\AVG8\avgrsx.exe

C:\Program Files\Panda Security\Panda Internet Security 2008\AntiSpam\pskmssvc.exe

C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS

c:\program files\panda security\panda internet security 2008\firewall\PSHOST.EXE

C:\Program Files\Panda Security\Panda Internet Security 2008\PsImSvc.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Viewpoint\Common\ViewpointService.exe

C:\PROGRA~1\AVG\AVG8\avgemc.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\WINDOWS\system32\dllhost.exe

C:\WINDOWS\eHome\ehmsas.exe

C:\Program Files\Panda Security\Panda Internet Security 2008\PavBckPT.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\PROGRA~1\AVG\AVG8\aAvgApi.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.com/g/startpage.html?Ch...DTP&M=T5048

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll

O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll

O3 - Toolbar: AIM Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll

O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL

O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe

O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup

O4 - HKLM\..\Run: [readericon] C:\Program Files\Digital Media Reader\readericon45G.exe

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"

O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE

O4 - HKLM\..\Run: [Reminder] %WINDIR%\Creator\Remind_XP.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall

O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Security\Panda Internet Security 2008\APVXDWIN.EXE" /s

O4 - HKLM\..\Run: [sCANINICIO] "C:\Program Files\Panda Security\Panda Internet Security 2008\Inicio.exe"

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKCU\..\Run: [Power2GoExpress] NA

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide

O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe

O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\bigfix.exe

O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aim toolbar 5.0\resources\en-US\local\search.html

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: AIM Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll

O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL,avgrsstx.dll C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL abcnhd.dll

O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

O20 - Winlogon Notify: jkkLBrsT - jkkLBrsT.dll (file missing)

O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe

O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe

O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe

O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: Panda Software Controller - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\PsCtrls.exe

O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\PavFnSvr.exe

O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe

O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\pavsrv51.exe

O23 - Service: Panda Antispam Engine (pmshellsrv) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\AntiSpam\pskmssvc.exe

O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS

O23 - Service: Panda Host Service (PSHost) - Panda Software International - c:\program files\panda security\panda internet security 2008\firewall\PSHOST.EXE

O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\PsImSvc.exe

O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

--

End of file - 9920 bytes

[AdvancedSetup]

Well that version of MBAM is VERY OLD now. We're at version 1.34 now.

Please try to download MBAM 1.34 and the latest rules from another computer and burn them to a CD and try to install and update MBAM and scan again please.

You can also try burning this CD from another computer if you have to and scan with it to see if it can fix it enough to get back online with security sites.

Avira AntiVir Rescue System

Requires access to a working computer with a CD/DVD burner to create a bootable CD.

• Download the
  Avira AntiVir Rescue System
  from
  here
• Place a blank CD in your burner and double-click on the downloaded file.
  
  
• The program will automatically burn the CD for you.
  
  
• Place the burned CD into the affected computer and start the computer from this CD.
  
  
• On the bottom left side of the screen there are 2 flags. Using your mouse click on the British flag to use English.
  
  
• Click on the
  Configuration
  button.
  
  
  • Select
    Scan all files
  • Select
    Try to repair infected files
    and
    Rename files, if they cannot be removed
    
    
  • Select
    Scan for dialers
    
    
  • Select
    Scan for joke programs (Jokes)
    
    
  • Select
    Scan for games
    
    
  • Select
    Scan for spyware (SPR)
    
    
  [*]
  Click on
  Virus scanner
  [*]
  Click on
  Start scanner
  at the bottom of the screen
  [*]
  Currently the program does not support saving a log. Write down the amount of items for Records, Suspect files, and Warnings

The Avira AntiVir Rescue System is a Linux-based application that allows accessing computers that cannot be booted anymore and is updated several times a day so that the most recent security updates are always available.

Screen resolution problems

Please see the post

here

if you're unable to view the entire screen of Avira.

[squigeeman]

Ok I downloaded the recent version and it did find 1 item and removed it. Here is the log:

Malwarebytes' Anti-Malware 1.34

Database version: 1749

Windows 5.1.2600 Service Pack 2

2/18/2009 2:20:32 AM

mbam-log-2009-02-18 (02-20-32).txt

Scan type: Quick Scan

Objects scanned: 78596

Time elapsed: 15 minute(s), 8 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\WINDOWS\system32\ffkuz.dll (Trojan.Downloader) -> Quarantined and deleted successfully.

[AdvancedSetup]

Good, how is the system running now?

Please run this Anti-Virus scanner to ensure the system is clean.

Please download to your Desktop: Dr.Web CureIt

• After the file has downloaded, disable your current Anti-Virus and disconnect from the Internet
  
• Doubleclick the drweb-cureit.exe file, then click the Start button, then the OK button to perform an Express Scan.
  
• This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it.
  
• Once the short scan has finished, Click on the Complete scan radio button.
  
• Then click on the Settings menu on top, the select Change Settings or press the F9 key. You can also change the Language
  
• Choose the Scanning tab and I recomend leaving the Heuristic analysis enabled (this can lead to False Positives though)
  
• On the File types tab ensure you select All files
  
• Click on the Actions tab and set the following:
  
  • Objects Infected objects = Cure, Incurable objects = Move, Suspicious objects = Report
    
  • Infected packages Archive = Move, E-mails = Report, Containers = Move
    
  • Malware Adware = Move, Dialers = Move, Jokes = Move, Riskware = Move, Hacktools = Move
    
  • Do not change the Rename extension - default is: #??
    
  • Leave the default save path for Moved files here: %USERPROFILE%\DoctorWeb\Quarantine\
    
  • Leave prompt on Action checked
    

  [*]On the Log file tab leave the Log to file checked.

  [*]Leave the log file path alone: %USERPROFILE%\DoctorWeb\CureIt.log

  [*]Log mode = Append

  [*]Encoding = ANSI

  [*]Details Leave Names of file packers and Statistics checked.

  [*]Limit log file size = 2048 KB and leave the check mark on the Maximum log file size.

  [*]On the General tab leave the Scan Priority on High

  [*]Click the Apply button at the bottom, and then the OK button.

  [*]On the right side under the Dr Web Anti-Virus Logo you will see 3 little buttons. Click the left VCR style Start button.

  [*]In this mode it will scan Boot sectors of all disks, All removable media, and all local drives

  [*]The more files and folders you have the longer the scan will take. On large drives it can take hours to complete.

  [*]When the Cure option is selected, an additional context menu will open. Select the necessary action of the program, if the curing fails.

  [*]Click 'Yes to all' if it asks if you want to cure/move the files.

  [*]This will move it to the %USERPROFILE%\DoctorWeb\Quarantine\ folder if it can't be cured. (in this case we need samples)

  [*]After selecting, in the Dr.Web CureIt menu on top, click file and choose save report list

  [*]Save the report to your Desktop. The report will be called DrWeb.csv

  [*]Close Dr.Web Cureit.

  [*]Reboot your computer!! Because it could be possible that files in use will be moved/deleted during reboot.

  [*]After reboot, post the contents of the log from Dr.Web you saved previously to your Desktop in your next reply with a new hijackthis log.

  

[squigeeman]

I didn't really see much of a change after updating malwarebytes. I still got an iexplore error message after I closed internet explorer. Dr Web wasn't able to move everything but I did reboot here are the logs:

aoltsmon.dll;c:\program files\common files\aol\topspeed\2.0;Probably DLOADER.Trojan;Incurable.Moved.;

GTDownAO_106.ocx;C:\Program Files\Common Files\AolCoach\en_en;Adware.Gdown;Moved.;

A0032026.dll;C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP260;Probably DLOADER.Trojan;;

A0032027.ocx;C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP260;Adware.Gdown;Moved.;

aolcinst.exe\core.cab\GTDOWNAO_106.ocx;D:\i386\Apps\App17981\comps\coach\aolcinst.exe;Adware.Gdown;;

aolcinst.exe;D:\i386\Apps\App17981\comps\coach;Archive contains infected objects;Moved.;

tssetup.exe\data002;D:\i386\Apps\App17981\comps\tpspd\tssetup.exe;Probably DLOADER.Trojan;;

tssetup.exe;D:\i386\Apps\App17981\comps\tpspd;Archive contains infected objects;Moved.;

A0032028.exe\core.cab\GTDOWNAO_106.ocx;D:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP260\A0032028.exe;Adware.Gdown;;

A0032028.exe;D:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP260;Archive contains infected objects;Moved.;

A0032029.exe\data002;D:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP260\A0032029.exe;Probably DLOADER.Trojan;;

A0032029.exe;D:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP260;Archive contains infected objects;Moved.;

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 9:04:27 PM, on 2/19/2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\WINDOWS\ehome\ehtray.exe

C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

C:\Program Files\Digital Media Reader\readericon45G.exe

C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe

C:\WINDOWS\RTHDCPL.EXE

C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

C:\Program Files\Google\Google Desktop Search\GoogleDesktopDisplay.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\eHome\ehRecvr.exe

C:\WINDOWS\eHome\ehSched.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Panda Security\Panda Internet Security 2008\PsCtrls.exe

C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe

C:\Program Files\Panda Security\Panda Internet Security 2008\AntiSpam\pskmssvc.exe

C:\Program Files\QuickTime\QTTask.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Winamp\winampa.exe

C:\PROGRA~1\AVG\AVG8\avgrsx.exe

C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS

c:\program files\panda security\panda internet security 2008\firewall\PSHOST.EXE

C:\PROGRA~1\AVG\AVG8\avgtray.exe

C:\Program Files\Panda Security\Panda Internet Security 2008\PsImSvc.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\Veoh Networks\Veoh\VeohClient.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\Program Files\Viewpoint\Common\ViewpointService.exe

C:\PROGRA~1\AVG\AVG8\avgemc.exe

C:\Program Files\BigFix\bigfix.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\WINDOWS\system32\dllhost.exe

C:\WINDOWS\eHome\ehmsas.exe

C:\Program Files\Panda Security\Panda Internet Security 2008\PavBckPT.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\PROGRA~1\AVG\AVG8\aAvgApi.exe

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.com/g/startpage.html?Ch...DTP&M=T5048

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll

O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll

O3 - Toolbar: AIM Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll

O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL

O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe

O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup

O4 - HKLM\..\Run: [readericon] C:\Program Files\Digital Media Reader\readericon45G.exe

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"

O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE

O4 - HKLM\..\Run: [Reminder] %WINDIR%\Creator\Remind_XP.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall

O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Security\Panda Internet Security 2008\APVXDWIN.EXE" /s

O4 - HKLM\..\Run: [sCANINICIO] "C:\Program Files\Panda Security\Panda Internet Security 2008\Inicio.exe"

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKCU\..\Run: [Power2GoExpress] NA

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide

O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe

O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\bigfix.exe

O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aim toolbar 5.0\resources\en-US\local\search.html

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: AIM Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll

O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL,avgrsstx.dll C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL abcnhd.dll

O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

O20 - Winlogon Notify: jkkLBrsT - jkkLBrsT.dll (file missing)

O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe

O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe

O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe

O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: Panda Software Controller - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\PsCtrls.exe

O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\PavFnSvr.exe

O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe

O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\pavsrv51.exe

O23 - Service: Panda Antispam Engine (pmshellsrv) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\AntiSpam\pskmssvc.exe

O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS

O23 - Service: Panda Host Service (PSHost) - Panda Software International - c:\program files\panda security\panda internet security 2008\firewall\PSHOST.EXE

O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\PsImSvc.exe

O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

--

End of file - 9764 bytes

[AdvancedSetup]

What kind of an error?

Please remove ALL Java.

Please go into the Control Panel, Add/Remove and for now remove ALL versions of JAVA

When we're done you can go back and install the latest version but for now please do not install any.

Then run this tool to help cleanup any left over Java

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.

Please download JavaRa and unzip it to your desktop.

***Please close any instances of Internet Explorer (or other web browser) before continuing!***

• Double-click on JavaRa.exe to start the program.
  
• From the drop-down menu, choose English and click on Select.
  
• JavaRa will open; click on Remove Older Versions to remove the older versions of Java installed on your computer.
  
• Click Yes when prompted. When JavaRa is done, a notice will appear that a logfile has been produced. Click OK.
  
• A logfile will pop up. Please save it to a convenient location and post it back when you reply
  Then look for the following Java folders and if found delete them.
  C:\Program Files\Java
  C:\Program Files\Common Files\Java
  C:\Documents and Settings\All Users\Application Data\Java
  C:\Documents and Settings\All Users\Application Data\Sun\Java
  C:\Documents and Settings\username\Application Data\Java
  C:\Documents and Settings\username\Application Data\Sun\Java
  

Download and install CCleaner
• CCleaner
  
• Double-click on the downloaded file "ccsetup216.exe" and install the application.
  
• Keep the default installation folder "C:\Program Files\CCleaner"
  
• Uncheck "Add CCleaner Yahoo! Toolbar and use CCleaner from your browser"
  
• Click finish when done and close ALL PROGRAMS
  
• Start the CCleaner program.
  
• Click on Registry and Uncheck Registry Integrity so that it does not run (basically the very top, uncheck it)
  
• Click on Options - Advanced and Uncheck "Only delete files in Windows Temp folders older than 48 hours"
  
• Click back to Cleaner and under SYSTEM uncheck the Memory Dumps and Windows Log Files
  
• Click on Run Cleaner button on the bottom right side of the program.
  
• Click OK to any prompts
  

Then try to run Combofix. DISABLE your Anti-Virus so that it does not stop or block Combofix from doing it's job.

Please visit this webpage for instructions for downloading ComboFix to your

DESKTOP

:

how-to-use-combofix

Please ensure you read this guide carefully and install the Recovery Console first.

NOTE!!:

You must save and run

ComboFix.exe

on your DESKTOP and not from any other folder.

Also,

DO NOT

click the mouse or launch any other applications while this is running or it may stall the program

Additional links to download the tool:

ComboFix.exe

ComboFix.exe

ComboFix.exe

Note:

The

Windows Recovery Console

will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

Once installed, you should see a blue screen prompt that says:

The Recovery Console was successfully installed.

Please continue as follows:

• Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
• Click
  Yes
  to allow ComboFix to continue scanning for malware.
  
  
• When the tool is finished, it will produce a report for you.
  
  
• Please post the
  C:\ComboFix.txt
  along with a
  new HijackThis log
  so we may continue cleaning the system.
  
  

[squigeeman]

I'm sorry it took so long for me to get back to you.

Right after I close Internet Explorer I often get an error telling me that Iexplore.exe has encountered a problem and needs to close. It's the same with Firefox.

I did all you asked but Combofix could not connect to the internet to get the recovery console and it started to autoscan without it. Here is the Javara log:

The JavaRa removal process was started on Sat Feb 21 14:34:37 2009

Found and removed: SOFTWARE\Classes\JavaPlugin.150_02

Found and removed: SOFTWARE\Classes\JavaWebStart.isInstalled.1.5.0.0

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Java\jre1.5.0_02\

------------------------------------

Here is the Combofix log:

omboFix 09-02-19.01 - Owner 2009-02-23 19:17:25.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.382.113 [GMT -5:00]

Running from: c:\documents and settings\Owner.Dennis\Desktop\ComboFix.exe

AV: AVG Anti-Virus Free *On-access scanning disabled* (Outdated)

AV: Panda Internet Security 2008 *On-access scanning disabled* (Outdated)

FW: Panda Internet Security 2008 *disabled*

* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat

c:\windows\IE4 Error Log.txt

c:\windows\system32\PsvvyGgh.ini

c:\windows\system32\PsvvyGgh.ini2

c:\windows\system32\svybnsgt.ini

c:\windows\wiaservv.log

D:\Autorun.inf

----- BITS: Possible infected sites -----

hxxp://childhe.com

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Service_seneka

((((((((((((((((((((((((( Files Created from 2009-01-24 to 2009-02-24 )))))))))))))))))))))))))))))))

.

2009-02-21 14:42 . 2009-02-21 14:42 <DIR> d-------- c:\program files\CCleaner

2009-02-19 18:05 . 2009-02-19 18:15 <DIR> d-------- c:\documents and settings\Owner.Dennis\DoctorWeb

2009-02-07 21:33 . 2009-02-07 21:33 <DIR> d-------- c:\program files\Trend Micro

2009-01-31 19:10 . 2009-01-31 19:10 410,984 --a------ c:\windows\system32\deploytk.dll

2009-01-29 00:33 . 2009-01-29 00:32 102,664 --a------ c:\windows\system32\drivers\tmcomm.sys

2009-01-29 00:31 . 2009-01-30 18:09 <DIR> d-------- c:\documents and settings\Owner.Dennis\.housecall6.6

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-02-23 14:29 13,880 ----a-w c:\windows\system32\drivers\COMFiltr.sys

2009-02-21 09:15 --------- d-----w c:\documents and settings\Owner.Dennis\Application Data\LimeWire

2009-02-18 06:33 --------- d-----w c:\program files\Malwarebytes' Anti-Malware

2009-02-11 15:19 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys

2009-02-11 15:19 15,504 ----a-w c:\windows\system32\drivers\mbam.sys

2009-02-09 21:11 --------- d-----w c:\program files\Google

2009-02-07 20:35 --------- d-----w c:\documents and settings\All Users\Application Data\McAfee

2009-01-18 02:20 --------- d-----w c:\documents and settings\Owner.Dennis\Application Data\autodessys

2009-01-18 02:19 66,115 ----a-w c:\program files\uninstal.log

2009-01-18 02:19 61,328 ----a-w c:\program files\setuplog.txt

2009-01-18 02:17 --------- d-----w c:\program files\formZ

2009-01-08 22:15 --------- d-----w c:\documents and settings\Owner.Dennis\Application Data\U3

2009-01-08 22:15 --------- d-----w c:\documents and settings\Owner.Dennis\Application Data\Malwarebytes

2009-01-08 22:15 --------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes

2009-01-08 19:48 --------- d-----w c:\program files\SUPERAntiSpyware

2009-01-08 19:48 --------- d-----w c:\documents and settings\Owner.Dennis\Application Data\SUPERAntiSpyware.com

2009-01-08 19:48 --------- d-----w c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com

2009-01-08 19:47 --------- d-----w c:\program files\Common Files\Wise Installation Wizard

2009-01-08 19:00 --------- d-----w c:\windows\system32\config\systemprofile\Application Data\AVGTOOLBAR

2009-01-08 18:43 --------- d-----w c:\documents and settings\Owner.Dennis\Application Data\AVGTOOLBAR

2009-01-07 04:41 --------- d-----w c:\documents and settings\All Users\Application Data\avg8

2009-01-07 04:37 97,928 ----a-w c:\windows\system32\drivers\avgldx86.sys

2009-01-07 04:37 76,040 ----a-w c:\windows\system32\drivers\avgtdix.sys

2009-01-07 04:37 --------- d-----w c:\program files\AVG

2009-01-05 01:10 --------- d-----w c:\program files\Panda Security

2009-01-04 21:18 384,188 ----a-w c:\windows\system32\drivers\APPFCONT.DAT.bck

2009-01-04 21:18 384,188 ----a-w c:\windows\system32\drivers\APPFCONT.DAT

2009-01-04 18:01 1,224 ----a-w c:\windows\system32\drivers\APPFLTR.CFG.bck

2009-01-04 18:01 1,224 ----a-w c:\windows\system32\drivers\APPFLTR.CFG

2008-05-23 00:45 5,754,977 ----a-w c:\program files\ALZip.exe

2008-12-19 03:39 67,688 ----a-w c:\program files\mozilla firefox\components\jar50.dll

2008-12-19 03:39 54,368 ----a-w c:\program files\mozilla firefox\components\jsd3250.dll

2008-12-19 03:39 34,944 ----a-w c:\program files\mozilla firefox\components\myspell.dll

2008-12-19 03:39 46,712 ----a-w c:\program files\mozilla firefox\components\spellchk.dll

2008-12-19 03:39 172,136 ----a-w c:\program files\mozilla firefox\components\xpinstal.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Power2GoExpress"="NA" [X]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-04-12 68856]

"Veoh"="c:\program files\Veoh Networks\Veoh\VeohClient.exe" [2008-08-28 3660848]

"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-12-22 1830128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]

"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-02-22 169984]

"readericon"="c:\program files\Digital Media Reader\readericon45G.exe" [2005-12-09 139264]

"AOL Spyware Protection"="c:\progra~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe" [2004-10-18 79448]

"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-14 212992]

"Reminder"="c:\windows\Creator\Remind_XP.exe" [2005-02-25 966656]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-01-31 385024]

"MSKDetectorExe"="c:\program files\McAfee\SpamKiller\MSKDetct.exe" [2005-08-12 1121792]

"APVXDWIN"="c:\program files\Panda Security\Panda Internet Security 2008\APVXDWIN.EXE" [2007-07-23 406832]

"SCANINICIO"="c:\program files\Panda Security\Panda Internet Security 2008\Inicio.exe" [2007-07-11 27952]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-02-19 267048]

"WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-09-12 36352]

"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-01-06 1261336]

"RTHDCPL"="RTHDCPL.EXE" [2006-04-04 c:\windows\RTHDCPL.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

AutoCAD Startup Accelerator.lnk - c:\program files\Common Files\Autodesk Shared\acstart16.exe [2005-03-05 10872]

BigFix.lnk - c:\program files\BigFix\bigfix.exe [2008-02-22 2168360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]

2008-12-22 11:05 356352 c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avldr]

2007-02-15 20:02 50736 c:\windows\system32\avldr.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"msacm.clmp3enc"= c:\progra~1\CYBERL~1\Power2Go\CLMP3Enc.ACM

"vidc.mjpg"= pvmjpg30.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=

"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=

"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=

"c:\\Program Files\\America Online 9.0\\waol.exe"=

"c:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltsmon.exe"=

"c:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltpspd.exe"=

"c:\\Program Files\\Common Files\\AOL\\1203660334\\EE\\AOLServiceHost.exe"=

"c:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe"=

"c:\\Program Files\\Common Files\\AOL\\AOL Spyware Protection\\AOLSP Scheduler.exe"=

"c:\\Program Files\\Common Files\\AOL\\AOL Spyware Protection\\asp.exe"=

"c:\\Program Files\\Common Files\\AolCoach\\en_en\\player\\AOLNySEV.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\Program Files\\uTorrent\\uTorrent.exe"=

"c:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\RM.exe"=

"c:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\PMSRegisterFile.exe"=

"c:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\umi.exe"=

"c:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\VideoSpin.exe"=

"c:\\Program Files\\LimeWire\\LimeWire.exe"=

"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=

"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2009-01-04 28544]

R1 APPFLT;App Filter Plugin;c:\windows\system32\drivers\APPFLT.SYS [2008-02-26 71736]

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-01-06 97928]

R1 DSAFLT;DSA Filter Plugin;c:\windows\system32\drivers\dsaflt.sys [2008-02-26 51256]

R1 FNETMON;NetMon Filter Plugin;c:\windows\system32\drivers\fnetmon.sys [2008-02-26 22072]

R1 IDSFLT;Ids Filter Plugin;c:\windows\system32\drivers\idsflt.sys [2008-02-26 191672]

R1 NETFLTDI;Panda Net Driver [TDI Layer];c:\windows\system32\drivers\NETFLTDI.SYS [2008-02-26 00:45:22 132920]

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2008-12-22 8944]

R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2008-12-22 55024]

R1 ShldDrv;Panda File Shield Driver;c:\windows\system32\drivers\ShlDrv51.sys [2008-02-26 38968]

R1 SMSFLT;SMS Filter Plugin;c:\windows\system32\drivers\smsflt.sys [2008-02-26 37304]

R1 WNMFLT;Wifi Monitor Filter Plugin;c:\windows\system32\drivers\wnmflt.sys [2008-02-26 30648]

R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2009-01-06 875288]

R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-01-06 231704]

R2 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-01-06 76040]

R2 cpoint;Panda CPoint Driver;c:\windows\system32\drivers\cpoint.sys [2008-02-26 24760]

R2 PavProc;Panda Process Protection Driver;c:\windows\system32\drivers\PavProc.sys [2008-02-26 178872]

R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2008-03-09 24652]

R3 ComFiltr;Panda Anti-Dialer;c:\windows\system32\drivers\COMFiltr.sys [2008-02-26 13880]

R3 NETIMFLT;PANDA NDIS IM Filter Miniport;c:\windows\system32\drivers\netimflt.sys [2008-02-26 142128]

R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2008-12-22 7408]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - COMFILTR

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]

\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe folder.htt 480 480

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]

\Shell\AutoRun\command - E:\Autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J]

\Shell\AutoRun\command - J:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{051ed0a7-ba2a-11dd-8c87-001676ba6276}]

\Shell\AutoRun\command - J:\LaunchU3.exe -a

.

Contents of the 'Scheduled Tasks' folder

2009-02-23 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 14:57]

2009-02-23 c:\windows\Tasks\At1.job

- c:\windows\system32\65B2K4vy.exe []

2009-02-01 c:\windows\Tasks\At10.job

- c:\windows\system32\65B2K4vy.exe []

2009-02-23 c:\windows\Tasks\At11.job

- c:\windows\system32\65B2K4vy.exe []

2009-02-23 c:\windows\Tasks\At12.job

- c:\windows\system32\65B2K4vy.exe []

2009-02-23 c:\windows\Tasks\At13.job

- c:\windows\system32\65B2K4vy.exe []

2009-02-23 c:\windows\Tasks\At14.job

- c:\windows\system32\65B2K4vy.exe []

2009-02-23 c:\windows\Tasks\At15.job

- c:\windows\system32\65B2K4vy.exe []

2009-02-23 c:\windows\Tasks\At16.job

- c:\windows\system32\65B2K4vy.exe []

2009-02-23 c:\windows\Tasks\At17.job

- c:\windows\system32\65B2K4vy.exe []

2009-02-23 c:\windows\Tasks\At18.job

- c:\windows\system32\65B2K4vy.exe []

2009-02-23 c:\windows\Tasks\At19.job

- c:\windows\system32\65B2K4vy.exe []

2009-02-23 c:\windows\Tasks\At2.job

- c:\windows\system32\65B2K4vy.exe []

2009-02-24 c:\windows\Tasks\At20.job

- c:\windows\system32\65B2K4vy.exe []

2009-02-23 c:\windows\Tasks\At21.job

- c:\windows\system32\65B2K4vy.exe []

2009-02-23 c:\windows\Tasks\At22.job

- c:\windows\system32\65B2K4vy.exe []

2009-02-23 c:\windows\Tasks\At23.job

- c:\windows\system32\65B2K4vy.exe []

2009-02-23 c:\windows\Tasks\At24.job

- c:\windows\system32\65B2K4vy.exe []

2009-02-23 c:\windows\Tasks\At25.job

- c:\windows\system32\Hp3804ao.exe []

2009-02-23 c:\windows\Tasks\At26.job

- c:\windows\system32\Hp3804ao.exe []

2009-02-22 c:\windows\Tasks\At27.job

- c:\windows\system32\Hp3804ao.exe []

2009-02-22 c:\windows\Tasks\At28.job

- c:\windows\system32\Hp3804ao.exe []

2009-02-22 c:\windows\Tasks\At29.job

- c:\windows\system32\Hp3804ao.exe []

2009-02-22 c:\windows\Tasks\At3.job

- c:\windows\system32\65B2K4vy.exe []

2009-02-22 c:\windows\Tasks\At30.job

- c:\windows\system32\Hp3804ao.exe []

2009-02-15 c:\windows\Tasks\At31.job

- c:\windows\system32\Hp3804ao.exe []

2009-02-01 c:\windows\Tasks\At32.job

- c:\windows\system32\Hp3804ao.exe []

2009-02-11 c:\windows\Tasks\At33.job

- c:\windows\system32\Hp3804ao.exe []

2009-02-01 c:\windows\Tasks\At34.job

- c:\windows\system32\Hp3804ao.exe []

2009-02-23 c:\windows\Tasks\At35.job

- c:\windows\system32\Hp3804ao.exe []

2009-02-23 c:\windows\Tasks\At36.job

- c:\windows\system32\Hp3804ao.exe []

2009-02-23 c:\windows\Tasks\At37.job

- c:\windows\system32\Hp3804ao.exe []

2009-02-23 c:\windows\Tasks\At38.job

- c:\windows\system32\Hp3804ao.exe []

2009-02-23 c:\windows\Tasks\At39.job

- c:\windows\system32\Hp3804ao.exe []

2009-02-22 c:\windows\Tasks\At4.job

- c:\windows\system32\65B2K4vy.exe []

2009-02-23 c:\windows\Tasks\At40.job

- c:\windows\system32\Hp3804ao.exe []

2009-02-23 c:\windows\Tasks\At41.job

- c:\windows\system32\Hp3804ao.exe []

2009-02-23 c:\windows\Tasks\At42.job

- c:\windows\system32\Hp3804ao.exe []

2009-02-23 c:\windows\Tasks\At43.job

- c:\windows\system32\Hp3804ao.exe []

2009-02-24 c:\windows\Tasks\At44.job

- c:\windows\system32\Hp3804ao.exe []

2009-02-23 c:\windows\Tasks\At45.job

- c:\windows\system32\Hp3804ao.exe []

2009-02-23 c:\windows\Tasks\At46.job

- c:\windows\system32\Hp3804ao.exe []

2009-02-23 c:\windows\Tasks\At47.job

- c:\windows\system32\Hp3804ao.exe []

2009-02-23 c:\windows\Tasks\At48.job

- c:\windows\system32\Hp3804ao.exe []

2009-02-22 c:\windows\Tasks\At5.job

- c:\windows\system32\65B2K4vy.exe []

2009-02-22 c:\windows\Tasks\At6.job

- c:\windows\system32\65B2K4vy.exe []

2009-02-15 c:\windows\Tasks\At7.job

- c:\windows\system32\65B2K4vy.exe []

2009-02-01 c:\windows\Tasks\At8.job

- c:\windows\system32\65B2K4vy.exe []

2009-02-11 c:\windows\Tasks\At9.job

- c:\windows\system32\65B2K4vy.exe []

2009-02-24 c:\windows\Tasks\pwrxluhd.job

- c:\windows\system32\vtUonklI.dll []

.

- - - - ORPHANS REMOVED - - - -

HKCU-Run-Aim6 - (no file)

Notify-jkkLBrsT - jkkLBrsT.dll

.

------- Supplementary Scan -------

.

uSearch Page = hxxp://www.google.com

uSearch Bar = hxxp://www.google.com/ie

mStart Page = hxxp://www.gateway.com/g/startpage.html?Ch=Retail&Br=EM&Loc=ENG_US&Sys=DTP&M=T5048

uInternet Settings,ProxyOverride = *.local

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: &AOL Toolbar Search - c:\program files\aol\aim toolbar 5.0\resources\en-US\local\search.html

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

LSP: c:\program files\Panda Security\Panda Internet Security 2008\pavlsp.dll

FF - ProfilePath - c:\documents and settings\Owner.Dennis\Application Data\Mozilla\Firefox\Profiles\fu2e97pd.default\

FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://en-us.start.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:en-US:official

FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll

FF - component: c:\program files\AVG\AVG8\ToolbarFF\components\vmAVGConnector.dll

FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll

FF - component: c:\program files\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbar.dll

FF - component: c:\program files\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\metrics.dll

.

.

------- File Associations -------

.

JSEFile=c:\progra~1\PANDAS~1\PANDAI~1\PAVSCRIP.EXE "%1" %*

VBEFile=c:\progra~1\PANDAS~1\PANDAI~1\PAVSCRIP.EXE "%1" %*

VBSFile=c:\progra~1\PANDAS~1\PANDAI~1\PAVSCRIP.EXE "%1" %*

.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-02-23 19:22:22

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"cd042efbbd7f7af1647644e76e06692b"=hex:c8,28,51,af,b0,29,a3,98,2e,d0,bf,71,33,

06,ac,b0,c8,28,51,af,b0,29,a3,98,c3,1c,14,53,cb,9e,5c,2d,e2,63,26,f1,3f,c8,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"bca643cdc5c2726b20d2ecedcc62c59b"=hex:6a,9c,d6,61,af,45,84,18,db,53,37,fd,97,

e3,2f,f4,71,3b,04,66,8b,46,0d,96,e2,70,47,72,c2,bc,0e,de,6a,9c,d6,61,af,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"2c81e34222e8052573023a60d06dd016"=hex:25,da,ec,7e,55,20,c9,26,5c,1f,17,2b,04,

f3,98,88,25,da,ec,7e,55,20,c9,26,f3,73,b3,e9,fc,63,a1,99,ff,7c,85,e0,43,d4,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"2582ae41fb52324423be06337561aa48"=hex:3e,1e,9e,e0,57,5a,93,61,25,b0,e7,71,b1,

58,1c,8f,3e,1e,9e,e0,57,5a,93,61,b0,b1,1b,e7,c7,bd,28,4a,86,8c,21,01,be,91,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"caaeda5fd7a9ed7697d9686d4b818472"=hex:f5,1d,4d,73,a8,13,5c,05,d2,3d,ba,8b,55,

10,3a,d4,cd,44,cd,b9,a6,33,6c,cd,73,ed,47,12,1c,5f,e1,5c,f5,1d,4d,73,a8,13,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:b0,18,ed,a7,3f,8d,37,a4,31,02,e1,7f,0d,

f7,a2,c6,b0,18,ed,a7,3f,8d,37,a4,6a,99,0b,ab,01,d1,8f,c2,df,20,58,62,78,6b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"4d370831d2c43cd13623e232fed27b7b"=hex:97,20,4e,9a,c7,f1,35,ee,96,1f,84,e8,3b,

9e,a1,43,31,77,e1,ba,b1,f8,68,02,5a,e0,d6,d5,11,a7,a3,50,fb,a7,78,e6,12,2f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"1d68fe701cdea33e477eb204b76f993d"=hex:83,6c,56,8b,a0,85,96,ab,25,98,41,8f,1a,

4d,98,b3,83,6c,56,8b,a0,85,96,ab,31,e6,5e,dd,05,a5,15,0d,01,3a,48,fc,e8,04,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"1fac81b91d8e3c5aa4b0a51804d844a3"=hex:51,fa,6e,91,28,9e,14,cc,2e,01,7d,b0,db,

8c,06,9b,51,fa,6e,91,28,9e,14,cc,8a,8a,f9,b1,7a,c8,00,ff,f6,0f,4e,58,98,5b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"f5f62a6129303efb32fbe080bb27835b"=hex:b1,cd,45,5a,a8,c4,f8,b9,f6,61,3d,10,09,

02,d0,b9,b1,cd,45,5a,a8,c4,f8,b9,b3,ab,72,67,f6,ce,84,40,3d,ce,ea,26,2d,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:2a,b7,cc,b5,b9,7f,41,e7,2f,45,1d,7b,1b,

58,65,6c,e3,0e,66,d5,eb,bc,2f,6b,ca,98,23,db,41,b3,1a,de,2a,b7,cc,b5,b9,7f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"8a8aec57dd6508a385616fbc86791ec2"=hex:6c,43,2d,1e,aa,22,2f,9c,f5,af,96,e1,36,

a9,77,72,fa,ea,66,7f,d4,3b,6b,70,90,22,a8,f8,77,4e,6f,22,6c,43,2d,1e,aa,22,\

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]

@DACL=(02 0000)

"Installed"="1"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]

@DACL=(02 0000)

"Installed"="1"

"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]

@DACL=(02 0000)

"Installed"="1"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(876)

c:\program files\SUPERAntiSpyware\SASWINLO.dll

c:\windows\system32\Ati2evxx.dll

c:\windows\system32\avldr.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\ati2evxx.exe

c:\windows\system32\ati2evxx.exe

c:\program files\Common Files\AOL\ACS\AOLacsd.exe

c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

c:\progra~1\BigFix\bigfix.exe

c:\program files\Google\Google Desktop Search\GoogleDesktopIndex.exe

c:\program files\Google\Google Desktop Search\GoogleDesktopDisplay.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\windows\ehome\ehrecvr.exe

c:\windows\ehome\ehSched.exe

c:\program files\Panda Security\Panda Internet Security 2008\PsCtrlS.exe

c:\progra~1\AVG\AVG8\avgrsx.exe

c:\program files\Panda Security\Panda Internet Security 2008\AntiSpam\pskmssvc.exe

c:\program files\Common Files\New Boundary\PrismXL\PRISMXL.SYS

c:\program files\Panda Security\Panda Internet Security 2008\FIREWALL\PSHost.exe

c:\program files\Panda Security\Panda Internet Security 2008\PsImSvc.exe

c:\program files\iPod\bin\iPodService.exe

c:\windows\ehome\ehmsas.exe

c:\windows\system32\dllhost.exe

c:\program files\Panda Security\Panda Internet Security 2008\SrvLoad.exe

c:\program files\Panda Security\Panda Internet Security 2008\WebProxy.exe

c:\program files\Panda Security\Panda Internet Security 2008\PavBckPT.exe

.

**************************************************************************

.

Completion time: 2009-02-23 19:33:18 - machine was rebooted

ComboFix-quarantined-files.txt 2009-02-24 00:33:04

Pre-Run: 132,475,441,152 bytes free

Post-Run: 132,413,448,192 bytes free

419 --- E O F --- 2008-12-19 07:42:43

HijackThis log:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 7:56:04 PM, on 2/23/2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe

C:\WINDOWS\ehome\ehtray.exe

C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

C:\Program Files\Digital Media Reader\readericon45G.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe

C:\Program Files\QuickTime\QTTask.exe

C:\Program Files\Panda Security\Panda Internet Security 2008\APVXDWIN.EXE

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Winamp\winampa.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\Veoh Networks\Veoh\VeohClient.exe

C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\Program Files\BigFix\bigfix.exe

C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe

C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

C:\Program Files\Google\Google Desktop Search\GoogleDesktopDisplay.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\eHome\ehRecvr.exe

C:\WINDOWS\eHome\ehSched.exe

C:\Program Files\Panda Security\Panda Internet Security 2008\PsCtrls.exe

C:\PROGRA~1\AVG\AVG8\avgrsx.exe

C:\Program Files\Panda Security\Panda Internet Security 2008\AntiSpam\pskmssvc.exe

C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS

c:\program files\panda security\panda internet security 2008\firewall\PSHOST.EXE

C:\Program Files\Panda Security\Panda Internet Security 2008\PsImSvc.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Viewpoint\Common\ViewpointService.exe

C:\PROGRA~1\AVG\AVG8\avgemc.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\WINDOWS\eHome\ehmsas.exe

C:\WINDOWS\system32\dllhost.exe

C:\Program Files\Panda Security\Panda Internet Security 2008\SRVLOAD.EXE

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Panda Security\Panda Internet Security 2008\WebProxy.exe

C:\Program Files\Panda Security\Panda Internet Security 2008\PavBckPT.exe

C:\WINDOWS\explorer.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\PROGRA~1\AVG\AVG8\aAvgApi.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.com/g/startpage.html?Ch...DTP&M=T5048

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (file missing)

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll

O3 - Toolbar: AIM Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll

O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL

O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe

O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup

O4 - HKLM\..\Run: [readericon] C:\Program Files\Digital Media Reader\readericon45G.exe

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"

O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE

O4 - HKLM\..\Run: [Reminder] %WINDIR%\Creator\Remind_XP.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall

O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Security\Panda Internet Security 2008\APVXDWIN.EXE" /s

O4 - HKLM\..\Run: [sCANINICIO] "C:\Program Files\Panda Security\Panda Internet Security 2008\Inicio.exe"

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"

O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe

O4 - HKCU\..\Run: [Power2GoExpress] NA

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide

O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe

O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\bigfix.exe

O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aim toolbar 5.0\resources\en-US\local\search.html

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: AIM Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll

O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe

O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe

O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe

O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Panda Software Controller - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\PsCtrls.exe

O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\PavFnSvr.exe

O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe

O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\pavsrv51.exe

O23 - Service: Panda Antispam Engine (pmshellsrv) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\AntiSpam\pskmssvc.exe

O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS

O23 - Service: Panda Host Service (PSHost) - Panda Software International - c:\program files\panda security\panda internet security 2008\firewall\PSHOST.EXE

O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\PsImSvc.exe

O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

--

End of file - 9331 bytes

[AdvancedSetup]

Well we certainly need to do some cleanup, but first let me ask you this. WHAT Anti-Virus are you running or want to run? I see like 3 or 4 pieces of different AV software on the box. Please UNINSTALL ALL versions of Anti-Virus you're not using and then let me know which one you want to keep and I'll give you a script to blow out the rest of the junk.

[squigeeman]

I definately don't want Panda anymore. I have been meaning to uninstall it. It's out of date anyways. I don't think I want AVG anymore. It wasn't helpful when my system crashed. I think I'll uninstall those and stick with malwarebytes and superantispyware.

[AdvancedSetup]

Malwarebytes and SUPERAntiSpyware are NOT Anti-Virus products they are Anti-Malware products. You NEED to have a live daily updated Anti-Virus solution. Many users seem to like Avira so you may want to give it a try and see.

In any case please UNINSTALL all versions of Anti-Virus you're not keeping and then post a NEW Combofix log and we'll finish some clean up.

[squigeeman]

ok here is the new log

omboFix 09-02-28.01 - Owner 2009-02-28 23:35:30.2 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.382.149 [GMT -5:00]

Running from: c:\documents and settings\Owner.Dennis\Desktop\ComboFix.exe

AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Updated)

* Created a new restore point

.

((((((((((((((((((((((((( Files Created from 2009-02-01 to 2009-03-01 )))))))))))))))))))))))))))))))

.

2009-02-28 23:20 . 2004-08-10 14:00 13,463,552 --a--c--- c:\windows\system32\dllcache\hwxjpn.dll

2009-02-28 23:19 . 2009-02-28 23:19 <DIR> d-------- c:\program files\Avira

2009-02-28 23:19 . 2009-02-28 23:19 <DIR> d-------- c:\documents and settings\All Users\Application Data\Avira

2009-02-24 01:48 . 2009-02-24 01:48 <DIR> d-------- c:\program files\Java

2009-02-24 01:48 . 2009-02-24 01:48 73,728 --a------ c:\windows\system32\javacpl.cpl

2009-02-21 14:42 . 2009-02-21 14:42 <DIR> d-------- c:\program files\CCleaner

2009-02-19 18:05 . 2009-02-19 18:15 <DIR> d-------- c:\documents and settings\Owner.Dennis\DoctorWeb

2009-02-07 21:33 . 2009-02-07 21:33 <DIR> d-------- c:\program files\Trend Micro

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-02-27 22:06 --------- d-----w c:\program files\Microsoft Silverlight

2009-02-27 04:24 --------- d-----w c:\documents and settings\Owner.Dennis\Application Data\LimeWire

2009-02-25 22:04 --------- d-----w c:\program files\Google

2009-02-24 23:46 --------- d-----w c:\program files\SUPERAntiSpyware

2009-02-24 23:44 --------- d--h--w c:\program files\InstallShield Installation Information

2009-02-24 23:44 --------- d-----w c:\program files\Common Files\Panda Software

2009-02-18 06:33 --------- d-----w c:\program files\Malwarebytes' Anti-Malware

2009-02-11 15:19 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys

2009-02-11 15:19 15,504 ----a-w c:\windows\system32\drivers\mbam.sys

2009-02-07 20:35 --------- d-----w c:\documents and settings\All Users\Application Data\McAfee

2009-01-29 05:32 102,664 ----a-w c:\windows\system32\drivers\tmcomm.sys

2009-01-18 02:20 --------- d-----w c:\documents and settings\Owner.Dennis\Application Data\autodessys

2009-01-18 02:19 66,115 ----a-w c:\program files\uninstal.log

2009-01-18 02:19 61,328 ----a-w c:\program files\setuplog.txt

2009-01-18 02:17 --------- d-----w c:\program files\formZ

2009-01-08 22:15 --------- d-----w c:\documents and settings\Owner.Dennis\Application Data\U3

2009-01-08 22:15 --------- d-----w c:\documents and settings\Owner.Dennis\Application Data\Malwarebytes

2009-01-08 22:15 --------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes

2009-01-08 19:48 --------- d-----w c:\documents and settings\Owner.Dennis\Application Data\SUPERAntiSpyware.com

2009-01-08 19:48 --------- d-----w c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com

2009-01-08 19:47 --------- d-----w c:\program files\Common Files\Wise Installation Wizard

2009-01-08 19:00 --------- d-----w c:\windows\system32\config\systemprofile\Application Data\AVGTOOLBAR

2009-01-07 04:37 --------- d-----w c:\program files\AVG

2009-01-05 01:10 --------- d-----w c:\program files\Panda Security

2008-05-23 00:45 5,754,977 ----a-w c:\program files\ALZip.exe

2008-12-19 03:39 67,688 ----a-w c:\program files\mozilla firefox\components\jar50.dll

2008-12-19 03:39 54,368 ----a-w c:\program files\mozilla firefox\components\jsd3250.dll

2008-12-19 03:39 34,944 ----a-w c:\program files\mozilla firefox\components\myspell.dll

2008-12-19 03:39 46,712 ----a-w c:\program files\mozilla firefox\components\spellchk.dll

2008-12-19 03:39 172,136 ----a-w c:\program files\mozilla firefox\components\xpinstal.dll

.

((((((((((((((((((((((((((((( SnapShot@2009-02-23_19.30.16.29 )))))))))))))))))))))))))))))))))))))))))

.

+ 2008-07-03 13:03:29 8,460,800 ----a-w c:\windows\$hf_mig$\KB967715\SP2QFE\shell32.dll

+ 2008-02-15 09:06:21 351,744 ----a-w c:\windows\$hf_mig$\KB967715\SP2QFE\xpsp3res.dll

+ 2008-06-17 19:02:19 8,461,312 ----a-w c:\windows\$hf_mig$\KB967715\SP3GDR\shell32.dll

+ 2008-06-17 19:04:34 8,461,824 ----a-w c:\windows\$hf_mig$\KB967715\SP3QFE\shell32.dll

+ 2008-07-09 07:38:24 17,272 ----a-w c:\windows\$hf_mig$\KB967715\spmsg.dll

+ 2008-07-09 07:38:25 231,288 ----a-w c:\windows\$hf_mig$\KB967715\spuninst.exe

+ 2008-07-09 07:38:24 26,488 ----a-w c:\windows\$hf_mig$\KB967715\update\spcustom.dll

+ 2008-07-09 07:38:29 755,576 ----a-w c:\windows\$hf_mig$\KB967715\update\update.exe

+ 2008-07-09 07:38:37 382,840 ----a-w c:\windows\$hf_mig$\KB967715\update\updspapi.dll

+ 2004-08-10 19:00:00 175,104 ----a-w c:\windows\ime\chsime\applets\PINTLCSA.DLL

+ 2004-08-10 19:00:00 53,760 ----a-w c:\windows\ime\chsime\applets\PINTLCSD.DLL

+ 2004-08-10 19:00:00 97,792 ----a-w c:\windows\ime\CHTIME\Applets\CHTMBX.DLL

+ 2004-08-10 19:00:00 56,320 ----a-w c:\windows\ime\CHTIME\Applets\CHTSKDIC.DLL

+ 2004-08-10 19:00:00 173,568 ----a-w c:\windows\ime\CHTIME\Applets\CHTSKF.DLL

+ 2004-08-10 19:00:00 10,096,640 ----a-w c:\windows\ime\CHTIME\Applets\HWXCHT.DLL

+ 2004-08-10 19:00:00 13,463,552 ----a-w c:\windows\ime\imjp8_1\applets\hwxjpn.dll

+ 2004-08-10 19:00:00 471,102 ----a-w c:\windows\ime\imjp8_1\applets\imskdic.dll

+ 2004-08-10 19:00:00 315,452 ----a-w c:\windows\ime\imjp8_1\applets\imskf.dll

+ 2004-08-10 19:00:00 229,439 ----a-w c:\windows\ime\imjp8_1\applets\multibox.dll

+ 2004-08-10 19:00:00 143,422 ----a-w c:\windows\ime\imjp8_1\applets\softkey.dll

+ 2004-08-10 19:00:00 426,041 ----a-w c:\windows\ime\imjp8_1\applets\voicepad.dll

+ 2004-08-10 19:00:00 86,073 ----a-w c:\windows\ime\imjp8_1\applets\voicesub.dll

+ 2004-08-10 19:00:00 57,399 ----a-w c:\windows\ime\imjp8_1\cplexe.exe

+ 2004-08-10 19:00:00 368,696 ----a-w c:\windows\ime\imjp8_1\imjpcic.dll

+ 2004-08-10 19:00:00 716,856 ----a-w c:\windows\ime\imjp8_1\imjpcus.dll

+ 2004-08-10 19:00:00 57,398 ----a-w c:\windows\ime\imjp8_1\imjpdadm.exe

+ 2004-08-10 19:00:00 81,976 ----a-w c:\windows\ime\imjp8_1\imjpdct.dll

+ 2004-08-10 19:00:00 307,257 ----a-w c:\windows\ime\imjp8_1\imjpdct.exe

+ 2004-08-10 19:00:00 155,705 ----a-w c:\windows\ime\imjp8_1\imjpdsvr.exe

+ 2004-08-10 19:00:00 196,665 ----a-w c:\windows\ime\imjp8_1\imjpinst.exe

+ 2004-08-10 19:00:00 208,952 ----a-w c:\windows\ime\imjp8_1\imjpmig.exe

+ 2004-08-10 19:00:00 233,527 ----a-w c:\windows\ime\imjp8_1\imjprw.exe

+ 2004-08-10 19:00:00 45,109 ----a-w c:\windows\ime\imjp8_1\imjpuex.exe

+ 2004-08-10 19:00:00 262,200 ----a-w c:\windows\ime\imjp8_1\imjputy.exe

+ 2004-08-10 19:00:00 274,489 ----a-w c:\windows\ime\imjp8_1\imjputyc.dll

+ 2004-08-10 19:00:00 10,129,408 ----a-w c:\windows\ime\imkr6_1\applets\hwxkor.dll

+ 2004-08-10 19:00:00 86,016 ----a-w c:\windows\ime\imkr6_1\applets\imekrmbx.dll

+ 2004-08-10 19:00:00 36,864 ----a-w c:\windows\ime\imkr6_1\dicts\hanjadic.dll

+ 2004-08-10 19:00:00 106,496 ----a-w c:\windows\ime\imkr6_1\imekrcic.dll

+ 2004-08-10 19:00:00 44,032 ----a-w c:\windows\ime\imkr6_1\imekrmig.exe

+ 2004-08-10 19:00:00 59,904 ----a-w c:\windows\ime\imkr6_1\imkrinst.exe

+ 2004-08-10 19:00:00 102,463 ----a-w c:\windows\ime\shared\imepadsm.dll

+ 2004-08-10 19:00:00 311,359 ----a-w c:\windows\ime\shared\imepadsv.exe

+ 2004-08-10 19:00:00 102,456 ----a-w c:\windows\ime\shared\imlang.dll

+ 2004-08-10 19:00:00 15,872 ----a-w c:\windows\ime\shared\res\PADRS404.DLL

+ 2004-08-10 19:00:00 36,927 ----a-w c:\windows\ime\shared\res\padrs411.dll

+ 2004-08-10 19:00:00 14,336 ----a-w c:\windows\ime\shared\res\padrs412.dll

+ 2004-08-10 19:00:00 15,360 ----a-w c:\windows\ime\shared\res\padrs804.dll

- 2008-12-13 08:32:39 593,920 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\accicons.exe

+ 2009-02-24 08:05:02 593,920 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\accicons.exe

- 2008-12-13 08:32:39 12,288 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\cagicon.exe

+ 2009-02-24 08:05:02 12,288 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\cagicon.exe

- 2008-12-13 08:32:39 86,016 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\inficon.exe

+ 2009-02-24 08:05:02 86,016 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\inficon.exe

- 2008-12-13 08:32:39 135,168 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\misc.exe

+ 2009-02-24 08:05:02 135,168 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\misc.exe

- 2008-12-13 08:32:39 11,264 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\mspicons.exe

+ 2009-02-24 08:05:02 11,264 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\mspicons.exe

- 2008-12-13 08:32:39 27,136 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\oisicon.exe

+ 2009-02-24 08:05:02 27,136 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\oisicon.exe

- 2008-12-13 08:32:40 4,096 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\opwicon.exe

+ 2009-02-24 08:05:02 4,096 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\opwicon.exe

- 2008-12-13 08:32:40 794,624 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\outicon.exe

+ 2009-02-24 08:05:02 794,624 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\outicon.exe

- 2008-12-13 08:32:39 249,856 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pptico.exe

+ 2009-02-24 08:05:02 249,856 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pptico.exe

- 2008-12-13 08:32:39 61,440 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pubs.exe

+ 2009-02-24 08:05:02 61,440 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pubs.exe

- 2008-12-13 08:32:40 23,040 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\unbndico.exe

+ 2009-02-24 08:05:02 23,040 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\unbndico.exe

- 2008-12-13 08:32:38 286,720 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\wordicon.exe

+ 2009-02-24 08:05:02 286,720 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\wordicon.exe

- 2008-12-13 08:32:38 409,600 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\xlicons.exe

+ 2009-02-24 08:05:02 409,600 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\xlicons.exe

- 2008-12-13 08:36:07 12,288 ----a-r c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\cagicon.exe

+ 2009-02-24 08:05:58 12,288 ----a-r c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\cagicon.exe

- 2008-12-13 08:36:06 135,168 ----a-r c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\misc.exe

+ 2009-02-24 08:05:58 135,168 ----a-r c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\misc.exe

- 2008-12-13 08:36:07 11,264 ----a-r c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\mspicons.exe

+ 2009-02-24 08:05:58 11,264 ----a-r c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\mspicons.exe

- 2008-12-13 08:36:07 27,136 ----a-r c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\oisicon.exe

+ 2009-02-24 08:05:58 27,136 ----a-r c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\oisicon.exe

- 2008-12-13 08:36:08 4,096 ----a-r c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\opwicon.exe

+ 2009-02-24 08:05:59 4,096 ----a-r c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\opwicon.exe

- 2008-12-13 08:36:08 794,624 ----a-r c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\outicon.exe

+ 2009-02-24 08:05:59 794,624 ----a-r c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\outicon.exe

- 2008-12-13 08:36:06 249,856 ----a-r c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\pptico.exe

+ 2009-02-24 08:05:58 249,856 ----a-r c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\pptico.exe

- 2008-12-13 08:36:08 23,040 ----a-r c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\unbndico.exe

+ 2009-02-24 08:05:59 23,040 ----a-r c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\unbndico.exe

- 2008-12-13 08:36:06 286,720 ----a-r c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\wordicon.exe

+ 2009-02-24 08:05:58 286,720 ----a-r c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\wordicon.exe

- 2008-12-13 08:36:05 409,600 ----a-r c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\xlicons.exe

+ 2009-02-24 08:05:58 409,600 ----a-r c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\xlicons.exe

+ 2004-08-10 19:00:00 19,456 ----a-w c:\windows\msagent\intl\agt0404.dll

+ 2004-08-10 19:00:00 19,456 ----a-w c:\windows\msagent\intl\agt0411.dll

+ 2004-08-10 19:00:00 19,456 ----a-w c:\windows\msagent\intl\agt0412.dll

+ 2004-08-10 19:00:00 19,456 ----a-w c:\windows\msagent\intl\agt0804.dll

+ 2004-08-10 19:00:00 218,112 ----a-w c:\windows\system32\c_g18030.dll

+ 2004-08-10 19:00:00 6,656 ----a-w c:\windows\system32\c_is2022.dll

+ 2004-08-10 19:00:00 1,677,824 ----a-w c:\windows\system32\chsbrkr.dll

+ 2004-08-10 19:00:00 838,144 ----a-w c:\windows\system32\chtbrkr.dll

- 2009-02-01 00:10:09 410,984 ----a-w c:\windows\system32\deploytk.dll

+ 2009-02-24 06:48:04 410,984 ----a-w c:\windows\system32\deploytk.dll

+ 2004-08-10 19:00:00 19,456 -c--a-w c:\windows\system32\dllcache\agt0404.dll

+ 2004-08-10 19:00:00 19,456 -c--a-w c:\windows\system32\dllcache\agt0411.dll

+ 2004-08-10 19:00:00 19,456 -c--a-w c:\windows\system32\dllcache\agt0412.dll

+ 2004-08-10 19:00:00 19,456 -c--a-w c:\windows\system32\dllcache\agt0804.dll

+ 2004-08-10 19:00:00 218,112 -c--a-w c:\windows\system32\dllcache\c_g18030.dll

+ 2004-08-10 19:00:00 6,656 -c--a-w c:\windows\system32\dllcache\c_is2022.dll

+ 2004-08-10 19:00:00 1,677,824 -c--a-w c:\windows\system32\dllcache\chsbrkr.dll

+ 2004-08-10 19:00:00 838,144 -c--a-w c:\windows\system32\dllcache\chtbrkr.dll

+ 2004-08-10 19:00:00 97,792 -c--a-w c:\windows\system32\dllcache\chtmbx.dll

+ 2004-08-10 19:00:00 56,320 -c--a-w c:\windows\system32\dllcache\chtskdic.dll

+ 2004-08-10 19:00:00 173,568 -c--a-w c:\windows\system32\dllcache\chtskf.dll

+ 2004-08-10 19:00:00 198,656 -c--a-w c:\windows\system32\dllcache\cintime.dll

+ 2004-08-10 19:00:00 480,256 -c--a-w c:\windows\system32\dllcache\cintsetp.exe

+ 2004-08-10 19:00:00 57,399 -c--a-w c:\windows\system32\dllcache\cplexe.exe

+ 2004-08-10 19:00:00 7,168 -c--a-w c:\windows\system32\dllcache\f3ahvoas.dll

+ 2004-08-10 19:00:00 36,864 -c--a-w c:\windows\system32\dllcache\hanjadic.dll

+ 2004-08-10 19:00:00 10,096,640 -c--a-w c:\windows\system32\dllcache\hwxcht.dll

+ 2004-08-10 19:00:00 10,129,408 -c--a-w c:\windows\system32\dllcache\hwxkor.dll

+ 2004-08-10 19:00:00 106,496 -c--a-w c:\windows\system32\dllcache\imekrcic.dll

+ 2004-08-10 19:00:00 86,016 -c--a-w c:\windows\system32\dllcache\imekrmbx.dll

+ 2004-08-10 19:00:00 44,032 -c--a-w c:\windows\system32\dllcache\imekrmig.exe

+ 2004-08-10 19:00:00 102,463 -c--a-w c:\windows\system32\dllcache\imepadsm.dll

+ 2004-08-10 19:00:00 311,359 -c--a-w c:\windows\system32\dllcache\imepadsv.exe

+ 2004-08-10 19:00:00 811,064 -c--a-w c:\windows\system32\dllcache\imjp81k.dll

+ 2004-08-10 19:00:00 368,696 -c--a-w c:\windows\system32\dllcache\imjpcic.dll

+ 2004-08-10 19:00:00 716,856 -c--a-w c:\windows\system32\dllcache\imjpcus.dll

+ 2004-08-10 19:00:00 57,398 -c--a-w c:\windows\system32\dllcache\imjpdadm.exe

+ 2004-08-10 19:00:00 81,976 -c--a-w c:\windows\system32\dllcache\imjpdct.dll

+ 2004-08-10 19:00:00 307,257 -c--a-w c:\windows\system32\dllcache\imjpdct.exe

+ 2004-08-10 19:00:00 155,705 -c--a-w c:\windows\system32\dllcache\imjpdsvr.exe

+ 2004-08-10 19:00:00 196,665 -c--a-w c:\windows\system32\dllcache\imjpinst.exe

+ 2004-08-10 19:00:00 208,952 -c--a-w c:\windows\system32\dllcache\imjpmig.exe

+ 2004-08-10 19:00:00 233,527 -c--a-w c:\windows\system32\dllcache\imjprw.exe

+ 2004-08-10 19:00:00 45,109 -c--a-w c:\windows\system32\dllcache\imjpuex.exe

+ 2004-08-10 19:00:00 262,200 -c--a-w c:\windows\system32\dllcache\imjputy.exe

+ 2004-08-10 19:00:00 274,489 -c--a-w c:\windows\system32\dllcache\imjputyc.dll

+ 2004-08-10 19:00:00 59,904 -c--a-w c:\windows\system32\dllcache\imkrinst.exe

+ 2004-08-10 19:00:00 102,456 -c--a-w c:\windows\system32\dllcache\imlang.dll

+ 2004-08-10 19:00:00 59,392 -c--a-w c:\windows\system32\dllcache\imscinst.exe

+ 2004-08-10 19:00:00 471,102 -c--a-w c:\windows\system32\dllcache\imskdic.dll

+ 2004-08-10 19:00:00 315,452 -c--a-w c:\windows\system32\dllcache\imskf.dll

+ 2004-08-10 19:00:00 6,144 -c--a-w c:\windows\system32\dllcache\kbd101.dll

+ 2004-08-10 19:00:00 6,144 -c--a-w c:\windows\system32\dllcache\kbd101a.dll

- 2001-08-17 18:55:56 6,144 -c--a-w c:\windows\system32\dllcache\kbd101b.dll

+ 2001-08-17 19:55:56 6,144 -c--a-w c:\windows\system32\dllcache\kbd101b.dll

- 2001-08-17 18:55:56 6,144 -c--a-w c:\windows\system32\dllcache\kbd101c.dll

+ 2001-08-17 19:55:56 6,144 -c--a-w c:\windows\system32\dllcache\kbd101c.dll

- 2001-08-17 18:55:56 5,632 -c--a-w c:\windows\system32\dllcache\kbd103.dll

+ 2001-08-17 19:55:56 5,632 -c--a-w c:\windows\system32\dllcache\kbd103.dll

- 2001-08-17 18:55:56 6,144 -c--a-w c:\windows\system32\dllcache\kbd106.dll

+ 2001-08-17 19:55:56 6,144 -c--a-w c:\windows\system32\dllcache\kbd106.dll

+ 2004-08-10 19:00:00 6,144 -c--a-w c:\windows\system32\dllcache\kbd106n.dll

+ 2004-08-10 19:00:00 6,144 -c--a-w c:\windows\system32\dllcache\kbdax2.dll

+ 2004-08-10 19:00:00 7,168 -c--a-w c:\windows\system32\dllcache\kbdibm02.dll

+ 2001-08-18 03:36:18 8,704 -c--a-w c:\windows\system32\dllcache\kbdjpn.dll

+ 2001-08-18 03:36:18 8,192 -c--a-w c:\windows\system32\dllcache\kbdkor.dll

+ 2004-08-10 19:00:00 6,656 -c--a-w c:\windows\system32\dllcache\kbdlk41a.dll

+ 2004-08-10 19:00:00 6,144 -c--a-w c:\windows\system32\dllcache\kbdlk41j.dll

+ 2004-08-10 19:00:00 7,168 -c--a-w c:\windows\system32\dllcache\kbdnec.dll

+ 2004-08-10 19:00:00 7,168 -c--a-w c:\windows\system32\dllcache\kbdnec95.dll

+ 2004-08-10 19:00:00 9,216 -c--a-w c:\windows\system32\dllcache\kbdnecat.dll

+ 2004-08-10 19:00:00 7,680 -c--a-w c:\windows\system32\dllcache\kbdnecnt.dll

+ 2004-08-10 19:00:00 70,656 -c--a-w c:\windows\system32\dllcache\korwbrkr.dll

+ 2004-08-10 19:00:00 98,304 -c--a-w c:\windows\system32\dllcache\msir3jp.dll

+ 2004-08-10 19:00:00 229,439 -c--a-w c:\windows\system32\dllcache\multibox.dll

+ 2004-08-10 19:00:00 15,872 -c--a-w c:\windows\system32\dllcache\padrs404.dll

+ 2004-08-10 19:00:00 36,927 -c--a-w c:\windows\system32\dllcache\padrs411.dll

+ 2004-08-10 19:00:00 14,336 -c--a-w c:\windows\system32\dllcache\padrs412.dll

+ 2004-08-10 19:00:00 15,360 -c--a-w c:\windows\system32\dllcache\padrs804.dll

+ 2004-08-10 19:00:00 175,104 -c--a-w c:\windows\system32\dllcache\pintlcsa.dll

+ 2004-08-10 19:00:00 53,760 -c--a-w c:\windows\system32\dllcache\pintlcsd.dll

+ 2004-08-10 19:00:00 70,144 -c--a-w c:\windows\system32\dllcache\pintlphr.exe

+ 2004-08-10 19:00:00 67,584 -c--a-w c:\windows\system32\dllcache\pmigrate.dll

- 2007-10-26 03:36:51 8,454,656 -c--a-w c:\windows\system32\dllcache\shell32.dll

+ 2008-07-03 13:16:57 8,454,656 -c--a-w c:\windows\system32\dllcache\shell32.dll

+ 2004-08-10 19:00:00 143,422 -c--a-w c:\windows\system32\dllcache\softkey.dll

- 2008-08-28 10:04:17 333,056 -c--a-w c:\windows\system32\dllcache\srv.sys

+ 2008-12-11 11:57:21 333,184 -c--a-w c:\windows\system32\dllcache\srv.sys

+ 2004-08-10 19:00:00 44,032 -c--a-w c:\windows\system32\dllcache\tintlphr.exe

+ 2004-08-10 19:00:00 455,168 -c--a-w c:\windows\system32\dllcache\tintsetp.exe

+ 2004-08-10 19:00:00 10,240 -c--a-w c:\windows\system32\dllcache\tmigrate.dll

+ 2004-08-10 19:00:00 76,288 -c--a-w c:\windows\system32\dllcache\uniime.dll

+ 2004-08-10 19:00:00 426,041 -c--a-w c:\windows\system32\dllcache\voicepad.dll

+ 2004-08-10 19:00:00 86,073 -c--a-w c:\windows\system32\dllcache\voicesub.dll

+ 2008-05-09 17:15:51 45,376 ----a-w c:\windows\system32\drivers\avgntdd.sys

+ 2008-01-21 22:11:28 22,336 ----a-w c:\windows\system32\drivers\avgntmgr.sys

+ 2008-10-30 15:21:03 75,072 ----a-w c:\windows\system32\drivers\avipbb.sys

- 2008-08-28 10:04:17 333,056 ----a-w c:\windows\system32\drivers\srv.sys

+ 2008-12-11 11:57:21 333,184 ----a-w c:\windows\system32\drivers\srv.sys

+ 2007-03-01 14:34:22 28,352 ----a-w c:\windows\system32\drivers\ssmdrv.sys

+ 2004-08-10 19:00:00 7,168 ----a-w c:\windows\system32\f3ahvoas.dll

- 2008-11-18 22:16:08 318,744 ----a-w c:\windows\system32\FNTCACHE.DAT

+ 2009-03-01 04:38:52 324,320 ----a-w c:\windows\system32\FNTCACHE.DAT

+ 2004-08-10 19:00:00 198,656 ----a-w c:\windows\system32\IME\CINTLGNT\CINTIME.DLL

+ 2004-08-10 19:00:00 480,256 ----a-w c:\windows\system32\IME\CINTLGNT\CINTSETP.EXE

+ 2004-08-10 19:00:00 59,392 ----a-w c:\windows\system32\IME\PINTLGNT\IMSCINST.EXE

+ 2004-08-10 19:00:00 70,144 ----a-w c:\windows\system32\IME\PINTLGNT\PINTLPHR.EXE

+ 2004-08-10 19:00:00 67,584 ----a-w c:\windows\system32\IME\PINTLGNT\PMIGRATE.DLL

+ 2004-08-10 19:00:00 44,032 ----a-w c:\windows\system32\IME\TINTLGNT\TINTLPHR.EXE

+ 2004-08-10 19:00:00 455,168 ----a-w c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE

+ 2004-08-10 19:00:00 10,240 ----a-w c:\windows\system32\IME\TINTLGNT\TMIGRATE.DLL

+ 2004-08-10 19:00:00 811,064 ----a-w c:\windows\system32\imjp81k.dll

+ 2009-02-24 06:48:04 144,792 ----a-w c:\windows\system32\java.exe

+ 2009-02-24 06:48:04 144,792 ----a-w c:\windows\system32\javaw.exe

+ 2009-02-24 06:48:04 148,888 ----a-w c:\windows\system32\javaws.exe

+ 2004-08-10 19:00:00 6,144 ----a-w c:\windows\system32\kbd101.dll

+ 2004-08-10 19:00:00 6,144 ----a-w c:\windows\system32\kbd101a.dll

- 2001-08-17 18:55:56 6,144 ----a-w c:\windows\system32\kbd101b.dll

+ 2001-08-17 19:55:56 6,144 ----a-w c:\windows\system32\kbd101b.dll

- 2001-08-17 18:55:56 6,144 ----a-w c:\windows\system32\kbd101c.dll

+ 2001-08-17 19:55:56 6,144 ----a-w c:\windows\system32\kbd101c.dll

- 2001-08-17 18:55:56 5,632 ----a-w c:\windows\system32\kbd103.dll

+ 2001-08-17 19:55:56 5,632 ----a-w c:\windows\system32\kbd103.dll

- 2001-08-17 18:55:56 6,144 ----a-w c:\windows\system32\kbd106.dll

+ 2001-08-17 19:55:56 6,144 ----a-w c:\windows\system32\kbd106.dll

+ 2004-08-10 19:00:00 6,144 ----a-w c:\windows\system32\kbd106n.dll

+ 2004-08-10 19:00:00 6,144 ----a-w c:\windows\system32\kbdax2.dll

+ 2004-08-10 19:00:00 7,168 ----a-w c:\windows\system32\kbdibm02.dll

+ 2001-08-18 03:36:18 8,704 ----a-w c:\windows\system32\kbdjpn.dll

+ 2001-08-18 03:36:18 8,192 ----a-w c:\windows\system32\kbdkor.dll

+ 2004-08-10 19:00:00 6,656 ----a-w c:\windows\system32\kbdlk41a.dll

+ 2004-08-10 19:00:00 6,144 ----a-w c:\windows\system32\kbdlk41j.dll

+ 2004-08-10 19:00:00 7,168 ----a-w c:\windows\system32\kbdnec95.dll

+ 2004-08-10 19:00:00 9,216 ----a-w c:\windows\system32\kbdnecAT.dll

+ 2004-08-10 19:00:00 7,680 ----a-w c:\windows\system32\kbdnecNT.dll

+ 2004-08-10 19:00:00 70,656 ----a-w c:\windows\system32\korwbrkr.dll

+ 2004-08-10 19:00:00 98,304 ----a-w c:\windows\system32\msir3jp.dll

- 2007-10-26 03:36:51 8,454,656 ----a-w c:\windows\system32\shell32.dll

+ 2008-07-03 13:16:57 8,454,656 ----a-w c:\windows\system32\shell32.dll

- 2007-11-30 12:39:22 17,272 ----a-w c:\windows\system32\spmsg.dll

+ 2008-07-09 07:38:24 17,272 ------w c:\windows\system32\spmsg.dll

+ 2004-08-10 19:00:00 76,288 ----a-w c:\windows\system32\uniime.dll

+ 2009-03-01 04:39:19 16,384 ----atw c:\windows\temp\Perflib_Perfdata_440.dat

.

-- Snapshot reset to current date --

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Power2GoExpress"="NA" [X]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-04-12 68856]

"Veoh"="c:\program files\Veoh Networks\Veoh\VeohClient.exe" [2008-08-28 3660848]

"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-02-24 1830128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]

"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-02-22 169984]

"readericon"="c:\program files\Digital Media Reader\readericon45G.exe" [2005-12-09 139264]

"AOL Spyware Protection"="c:\progra~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe" [2004-10-18 79448]

"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-14 212992]

"Reminder"="c:\windows\Creator\Remind_XP.exe" [2005-02-25 966656]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-01-31 385024]

"MSKDetectorExe"="c:\program files\McAfee\SpamKiller\MSKDetct.exe" [2005-08-12 1121792]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-02-19 267048]

"WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-09-12 36352]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-24 148888]

"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]

"RTHDCPL"="RTHDCPL.EXE" [2006-04-04 c:\windows\RTHDCPL.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

AutoCAD Startup Accelerator.lnk - c:\program files\Common Files\Autodesk Shared\acstart16.exe [2005-03-05 10872]

BigFix.lnk - c:\program files\BigFix\bigfix.exe [2008-02-22 2168360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]

2008-12-22 11:05 356352 c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"msacm.clmp3enc"= c:\progra~1\CYBERL~1\Power2Go\CLMP3Enc.ACM

"vidc.mjpg"= pvmjpg30.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=

"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=

"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=

"c:\\Program Files\\America Online 9.0\\waol.exe"=

"c:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltsmon.exe"=

"c:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltpspd.exe"=

"c:\\Program Files\\Common Files\\AOL\\1203660334\\EE\\AOLServiceHost.exe"=

"c:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe"=

"c:\\Program Files\\Common Files\\AOL\\AOL Spyware Protection\\AOLSP Scheduler.exe"=

"c:\\Program Files\\Common Files\\AOL\\AOL Spyware Protection\\asp.exe"=

"c:\\Program Files\\Common Files\\AolCoach\\en_en\\player\\AOLNySEV.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\Program Files\\uTorrent\\uTorrent.exe"=

"c:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\RM.exe"=

"c:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\PMSRegisterFile.exe"=

"c:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\umi.exe"=

"c:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\VideoSpin.exe"=

"c:\\Program Files\\LimeWire\\LimeWire.exe"=

"c:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"=

R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2009-01-04 28544]

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2008-12-22 8944]

R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2008-12-22 55024]

R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2008-03-09 24652]

R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2008-12-22 7408]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - SSMDRV

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]

\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe folder.htt 480 480

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]

\Shell\AutoRun\command - E:\Autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J]

\Shell\AutoRun\command - J:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{051ed0a7-ba2a-11dd-8c87-001676ba6276}]

\Shell\AutoRun\command - J:\LaunchU3.exe -a

.

Contents of the 'Scheduled Tasks' folder

2009-02-23 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 14:57]

2009-02-28 c:\windows\Tasks\At1.job

- c:\windows\system32\65B2K4vy.exe []

2009-02-25 c:\windows\Tasks\At10.job

- c:\windows\system32\65B2K4vy.exe []

2009-02-25 c:\windows\Tasks\At11.job

- c:\windows\system32\65B2K4vy.exe []

2009-02-25 c:\windows\Tasks\At12.job

- c:\windows\system32\65B2K4vy.exe []

2009-02-28 c:\windows\Tasks\At13.job

- c:\windows\system32\65B2K4vy.exe []

2009-02-28 c:\windows\Tasks\At14.job

- c:\windows\system32\65B2K4vy.exe []

2009-02-28 c:\windows\Tasks\At15.job

- c:\windows\system32\65B2K4vy.exe []

2009-02-28 c:\windows\Tasks\At16.job

- c:\windows\system32\65B2K4vy.exe []

2009-02-28 c:\windows\Tasks\At17.job

- c:\windows\system32\65B2K4vy.exe []

2009-02-28 c:\windows\Tasks\At18.job

- c:\windows\system32\65B2K4vy.exe []

2009-02-28 c:\windows\Tasks\At19.job

- c:\windows\system32\65B2K4vy.exe []

2009-02-28 c:\windows\Tasks\At2.job

- c:\windows\system32\65B2K4vy.exe []

2009-03-01 c:\windows\Tasks\At20.job

- c:\windows\system32\65B2K4vy.exe []

2009-03-01 c:\windows\Tasks\At21.job

- c:\windows\system32\65B2K4vy.exe []

2009-03-01 c:\windows\Tasks\At22.job

- c:\windows\system32\65B2K4vy.exe []

2009-03-01 c:\windows\Tasks\At23.job

- c:\windows\system32\65B2K4vy.exe []

2009-03-01 c:\windows\Tasks\At24.job

- c:\windows\system32\65B2K4vy.exe []

2009-02-28 c:\windows\Tasks\At25.job

- c:\windows\system32\Hp3804ao.exe []

2009-02-28 c:\windows\Tasks\At26.job

- c:\windows\system32\Hp3804ao.exe []

2009-02-28 c:\windows\Tasks\At27.job

- c:\windows\system32\Hp3804ao.exe []

2009-02-28 c:\windows\Tasks\At28.job

- c:\windows\system32\Hp3804ao.exe []

2009-02-28 c:\windows\Tasks\At29.job

- c:\windows\system32\Hp3804ao.exe []

2009-02-28 c:\windows\Tasks\At3.job

- c:\windows\system32\65B2K4vy.exe []

2009-02-22 c:\windows\Tasks\At30.job

- c:\windows\system32\Hp3804ao.exe []

2009-02-15 c:\windows\Tasks\At31.job

- c:\windows\system32\Hp3804ao.exe []

2009-02-01 c:\windows\Tasks\At32.job

- c:\windows\system32\Hp3804ao.exe []

2009-02-11 c:\windows\Tasks\At33.job

- c:\windows\system32\Hp3804ao.exe []

2009-02-25 c:\windows\Tasks\At34.job

- c:\windows\system32\Hp3804ao.exe []

2009-02-25 c:\windows\Tasks\At35.job

- c:\windows\system32\Hp3804ao.exe []

2009-02-25 c:\windows\Tasks\At36.job

- c:\windows\system32\Hp3804ao.exe []

2009-02-28 c:\windows\Tasks\At37.job

- c:\windows\system32\Hp3804ao.exe []

2009-02-28 c:\windows\Tasks\At38.job

- c:\windows\system32\Hp3804ao.exe []

2009-02-28 c:\windows\Tasks\At39.job

- c:\windows\system32\Hp3804ao.exe []

2009-02-28 c:\windows\Tasks\At4.job

- c:\windows\system32\65B2K4vy.exe []

2009-02-28 c:\windows\Tasks\At40.job

- c:\windows\system32\Hp3804ao.exe []

2009-02-28 c:\windows\Tasks\At41.job

- c:\windows\system32\Hp3804ao.exe []

2009-02-28 c:\windows\Tasks\At42.job

- c:\windows\system32\Hp3804ao.exe []

2009-02-28 c:\windows\Tasks\At43.job

- c:\windows\system32\Hp3804ao.exe []

2009-03-01 c:\windows\Tasks\At44.job

- c:\windows\system32\Hp3804ao.exe []

2009-03-01 c:\windows\Tasks\At45.job

- c:\windows\system32\Hp3804ao.exe []

2009-03-01 c:\windows\Tasks\At46.job

- c:\windows\system32\Hp3804ao.exe []

2009-03-01 c:\windows\Tasks\At47.job

- c:\windows\system32\Hp3804ao.exe []

2009-03-01 c:\windows\Tasks\At48.job

- c:\windows\system32\Hp3804ao.exe []

2009-02-28 c:\windows\Tasks\At5.job

- c:\windows\system32\65B2K4vy.exe []

2009-02-22 c:\windows\Tasks\At6.job

- c:\windows\system32\65B2K4vy.exe []

2009-02-15 c:\windows\Tasks\At7.job

- c:\windows\system32\65B2K4vy.exe []

2009-02-01 c:\windows\Tasks\At8.job

- c:\windows\system32\65B2K4vy.exe []

2009-02-11 c:\windows\Tasks\At9.job

- c:\windows\system32\65B2K4vy.exe []

2009-03-01 c:\windows\Tasks\pwrxluhd.job

- c:\windows\system32\vtUonklI.dll []

.

.

------- Supplementary Scan -------

.

uSearch Page = hxxp://www.google.com

uSearch Bar = hxxp://www.google.com/ie

mDefault_Search_URL = hxxp://www.google.com/ie

mStart Page = hxxp://www.gateway.com/g/startpage.html?Ch=Retail&Br=EM&Loc=ENG_US&Sys=DTP&M=T5048

uInternet Settings,ProxyOverride = *.local

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

mSearchAssistant = hxxp://www.google.com/ie

IE: &AOL Toolbar Search - c:\program files\aol\aim toolbar 5.0\resources\en-US\local\search.html

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

FF - ProfilePath - c:\documents and settings\Owner.Dennis\Application Data\Mozilla\Firefox\Profiles\fu2e97pd.default\

FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://en-us.start.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:en-US:official

FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll

FF - component: c:\program files\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbar.dll

FF - component: c:\program files\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\metrics.dll

.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-02-28 23:40:19

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"cd042efbbd7f7af1647644e76e06692b"=hex:c8,28,51,af,b0,29,a3,98,2e,d0,bf,71,33,

06,ac,b0,c8,28,51,af,b0,29,a3,98,c3,1c,14,53,cb,9e,5c,2d,e2,63,26,f1,3f,c8,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"bca643cdc5c2726b20d2ecedcc62c59b"=hex:6a,9c,d6,61,af,45,84,18,db,53,37,fd,97,

e3,2f,f4,71,3b,04,66,8b,46,0d,96,e2,70,47,72,c2,bc,0e,de,6a,9c,d6,61,af,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"2c81e34222e8052573023a60d06dd016"=hex:25,da,ec,7e,55,20,c9,26,5c,1f,17,2b,04,

f3,98,88,25,da,ec,7e,55,20,c9,26,f3,73,b3,e9,fc,63,a1,99,ff,7c,85,e0,43,d4,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"2582ae41fb52324423be06337561aa48"=hex:3e,1e,9e,e0,57,5a,93,61,25,b0,e7,71,b1,

58,1c,8f,3e,1e,9e,e0,57,5a,93,61,b0,b1,1b,e7,c7,bd,28,4a,86,8c,21,01,be,91,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"caaeda5fd7a9ed7697d9686d4b818472"=hex:f5,1d,4d,73,a8,13,5c,05,d2,3d,ba,8b,55,

10,3a,d4,cd,44,cd,b9,a6,33,6c,cd,73,ed,47,12,1c,5f,e1,5c,f5,1d,4d,73,a8,13,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:b0,18,ed,a7,3f,8d,37,a4,31,02,e1,7f,0d,

f7,a2,c6,b0,18,ed,a7,3f,8d,37,a4,6a,99,0b,ab,01,d1,8f,c2,df,20,58,62,78,6b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"4d370831d2c43cd13623e232fed27b7b"=hex:97,20,4e,9a,c7,f1,35,ee,96,1f,84,e8,3b,

9e,a1,43,31,77,e1,ba,b1,f8,68,02,5a,e0,d6,d5,11,a7,a3,50,fb,a7,78,e6,12,2f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"1d68fe701cdea33e477eb204b76f993d"=hex:83,6c,56,8b,a0,85,96,ab,25,98,41,8f,1a,

4d,98,b3,83,6c,56,8b,a0,85,96,ab,31,e6,5e,dd,05,a5,15,0d,01,3a,48,fc,e8,04,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"1fac81b91d8e3c5aa4b0a51804d844a3"=hex:51,fa,6e,91,28,9e,14,cc,2e,01,7d,b0,db,

8c,06,9b,51,fa,6e,91,28,9e,14,cc,8a,8a,f9,b1,7a,c8,00,ff,f6,0f,4e,58,98,5b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"f5f62a6129303efb32fbe080bb27835b"=hex:b1,cd,45,5a,a8,c4,f8,b9,f6,61,3d,10,09,

02,d0,b9,b1,cd,45,5a,a8,c4,f8,b9,b3,ab,72,67,f6,ce,84,40,3d,ce,ea,26,2d,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:2a,b7,cc,b5,b9,7f,41,e7,2f,45,1d,7b,1b,

58,65,6c,e3,0e,66,d5,eb,bc,2f,6b,ca,98,23,db,41,b3,1a,de,2a,b7,cc,b5,b9,7f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"8a8aec57dd6508a385616fbc86791ec2"=hex:6c,43,2d,1e,aa,22,2f,9c,f5,af,96,e1,36,

a9,77,72,fa,ea,66,7f,d4,3b,6b,70,90,22,a8,f8,77,4e,6f,22,6c,43,2d,1e,aa,22,\

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]

@DACL=(02 0000)

"Installed"="1"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]

@DACL=(02 0000)

"Installed"="1"

"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]

@DACL=(02 0000)

"Installed"="1"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(560)

c:\program files\SUPERAntiSpyware\SASWINLO.dll

c:\windows\system32\Ati2evxx.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\ati2evxx.exe

c:\program files\Avira\AntiVir PersonalEdition Classic\sched.exe

c:\windows\system32\ati2evxx.exe

c:\program files\Avira\AntiVir PersonalEdition Classic\avguard.exe

c:\program files\Common Files\AOL\ACS\AOLacsd.exe

c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\windows\ehome\ehrecvr.exe

c:\windows\ehome\ehSched.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\program files\Google\Google Desktop Search\GoogleDesktopIndex.exe

c:\program files\Google\Google Desktop Search\GoogleDesktopDisplay.exe

c:\program files\Common Files\New Boundary\PrismXL\PRISMXL.SYS

c:\windows\ehome\mcrdsvc.exe

c:\windows\ehome\ehmsas.exe

c:\program files\iPod\bin\iPodService.exe

c:\windows\system32\dllhost.exe

.

**************************************************************************

.

Completion time: 2009-02-28 23:45:11 - machine was rebooted

ComboFix-quarantined-files.txt 2009-03-01 04:45:06

ComboFix2.txt 2009-02-24 00:33:22

Pre-Run: 131,583,418,368 bytes free

Post-Run: 131,689,861,120 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

[boot loader]

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect

608 --- E O F --- 2009-02-27 07:34:47

[AdvancedSetup]

STEP 01

Download but do not yet run ComboFix

If you have a previous version of Combofix.exe, delete it and download a fresh copy.

Download it to your DESKTOP - it MUST run from the Desktop

download.bleepingcomputer.com/sUBs/ComboFix.exe

subs.geekstogo.com/ComboFix.exe

Using your mouse, Highlight and then Right-click | Copy the entire contents of the Code box below, including blank lines

KILLALL::

RegLock::
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]

RegNull::
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]


Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{051ed0a7-ba2a-11dd-8c87-001676ba6276}]



File::
c:\windows\system32\65B2K4vy.exe
c:\windows\system32\Hp3804ao.exe
c:\windows\Tasks\pwrxluhd.job
c:\windows\system32\vtUonklI.dll

Open a new Notepad session (Do not use a Word Processor or WordPad). Click "Format" and be certain that Word Wrap is not enabled. Right-click | Paste the Code box contents from above into Notepad. Click File, Save as..., and set the location to your Desktop, and enter (including quotation marks) as the filename: "CFscript.txt" .

Using your mouse, drag the new file CFscript.txt and drop it on the Combo-Fix.exe icon as shown:

• Important: Have no other programs running. Your Task Bar should be clear of any program entries including your Browser.
  
• Disconnect from the Internet.
  
• Disable your Antivirus software. If it has Script Blocking features, please disable these as well.
  
• A window may open with a series of Disclaimers. Accept the Disclaimers to start the fix.
  
• It may identify that Recovery Console is not installed. Please accept when asked if you wish it to be installed.
  When the scan completes Notepad will open with with your results log open. Do a File, Exit.
  

A caution - Do not run Combofix more than once. Do not touch your mouse/keyboard until the scan has completed, as this may cause the process to stall or your computer to lock. The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled. If this occurs, please reboot to restore the desktop. Even when ComboFix appears to be doing nothing, look at your Drive light. If it is flashing, Combofix is still at work.

Post back the Combofix log on your next reply.

STEP 02

Click on START - RUN and type in or copy/paste DEL c:\windows\Tasks\At*.JOB and click OK

STEP 03

Update and Scan with Malwarebytes' Anti-Malware

• Start MalwareBytes AntiMalware (Vista users must Right click and choose RunAs Admin)
  
• Please DO NOT run MBAM in Safe Mode unless requested to, you MUST run it in normal Windows mode.
  
  • Update Malwarebytes' Anti-Malware
  • Select the Update tab
    
  • Click Update
    

  [*]When the update is complete, select the Scanner tab

  [*]Select Perform quick scan, then click Scan.

  [*]When the scan is complete, click OK, then Show Results to view the results.

  [*]Be sure that everything is checked, and click Remove Selected.

  [*]When completed, a log will open in Notepad. please copy and paste the log into your next reply

  • If you accidently close it, the log file is saved here and will be named like this:
    
  • C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt
    

Then post back the MBAM log and a new Hijackthis log.

[squigeeman]

I couldn't do Step 2. When I tried it said that windows could not find 'DEL' I did the other steps though. Here is the combofix log:

ComboFix 09-03-01.01 - Owner 2009-03-01 18:56:18.3 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.382.138 [GMT -5:00]

Running from: c:\documents and settings\Owner.Dennis\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\Owner.Dennis\Desktop\CFscript.txt

AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Updated)

* Created a new restore point

FILE ::

c:\windows\system32\65B2K4vy.exe

c:\windows\system32\Hp3804ao.exe

c:\windows\system32\vtUonklI.dll

c:\windows\Tasks\pwrxluhd.job

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\Tasks\pwrxluhd.job

.

((((((((((((((((((((((((( Files Created from 2009-02-02 to 2009-03-02 )))))))))))))))))))))))))))))))

.

2009-02-28 23:20 . 2004-08-10 14:00 13,463,552 --a--c--- c:\windows\system32\dllcache\hwxjpn.dll

2009-02-28 23:19 . 2009-02-28 23:19 <DIR> d-------- c:\program files\Avira

2009-02-28 23:19 . 2009-02-28 23:19 <DIR> d-------- c:\documents and settings\All Users\Application Data\Avira

2009-02-24 01:48 . 2009-02-24 01:48 <DIR> d-------- c:\program files\Java

2009-02-24 01:48 . 2009-02-24 01:48 73,728 --a------ c:\windows\system32\javacpl.cpl

2009-02-21 14:42 . 2009-02-21 14:42 <DIR> d-------- c:\program files\CCleaner

2009-02-19 18:05 . 2009-02-19 18:15 <DIR> d-------- c:\documents and settings\Owner.Dennis\DoctorWeb

2009-02-07 21:33 . 2009-02-07 21:33 <DIR> d-------- c:\program files\Trend Micro

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-02-27 22:06 --------- d-----w c:\program files\Microsoft Silverlight

2009-02-27 04:24 --------- d-----w c:\documents and settings\Owner.Dennis\Application Data\LimeWire

2009-02-25 22:04 --------- d-----w c:\program files\Google

2009-02-24 23:46 --------- d-----w c:\program files\SUPERAntiSpyware

2009-02-24 23:44 --------- d--h--w c:\program files\InstallShield Installation Information

2009-02-24 23:44 --------- d-----w c:\program files\Common Files\Panda Software

2009-02-18 06:33 --------- d-----w c:\program files\Malwarebytes' Anti-Malware

2009-02-11 15:19 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys

2009-02-11 15:19 15,504 ----a-w c:\windows\system32\drivers\mbam.sys

2009-02-07 20:35 --------- d-----w c:\documents and settings\All Users\Application Data\McAfee

2009-01-29 05:32 102,664 ----a-w c:\windows\system32\drivers\tmcomm.sys

2009-01-18 02:20 --------- d-----w c:\documents and settings\Owner.Dennis\Application Data\autodessys

2009-01-18 02:19 66,115 ----a-w c:\program files\uninstal.log

2009-01-18 02:19 61,328 ----a-w c:\program files\setuplog.txt

2009-01-18 02:17 --------- d-----w c:\program files\formZ

2009-01-08 22:15 --------- d-----w c:\documents and settings\Owner.Dennis\Application Data\U3

2009-01-08 22:15 --------- d-----w c:\documents and settings\Owner.Dennis\Application Data\Malwarebytes

2009-01-08 22:15 --------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes

2009-01-08 19:48 --------- d-----w c:\documents and settings\Owner.Dennis\Application Data\SUPERAntiSpyware.com

2009-01-08 19:48 --------- d-----w c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com

2009-01-08 19:47 --------- d-----w c:\program files\Common Files\Wise Installation Wizard

2009-01-08 19:00 --------- d-----w c:\windows\system32\config\systemprofile\Application Data\AVGTOOLBAR

2009-01-07 04:37 --------- d-----w c:\program files\AVG

2009-01-05 01:10 --------- d-----w c:\program files\Panda Security

2008-05-23 00:45 5,754,977 ----a-w c:\program files\ALZip.exe

2008-12-19 03:39 67,688 ----a-w c:\program files\mozilla firefox\components\jar50.dll

2008-12-19 03:39 54,368 ----a-w c:\program files\mozilla firefox\components\jsd3250.dll

2008-12-19 03:39 34,944 ----a-w c:\program files\mozilla firefox\components\myspell.dll

2008-12-19 03:39 46,712 ----a-w c:\program files\mozilla firefox\components\spellchk.dll

2008-12-19 03:39 172,136 ----a-w c:\program files\mozilla firefox\components\xpinstal.dll

.

((((((((((((((((((((((((((((( SnapShot_2009-02-28_23.44.09.85 )))))))))))))))))))))))))))))))))))))))))

.

+ 2009-03-01 23:59:42 16,384 ----atw c:\windows\temp\Perflib_Perfdata_704.dat

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Power2GoExpress"="NA" [X]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-04-12 68856]

"Veoh"="c:\program files\Veoh Networks\Veoh\VeohClient.exe" [2008-08-28 3660848]

"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-02-24 1830128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]

"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-02-22 169984]

"readericon"="c:\program files\Digital Media Reader\readericon45G.exe" [2005-12-09 139264]

"AOL Spyware Protection"="c:\progra~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe" [2004-10-18 79448]

"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-14 212992]

"Reminder"="c:\windows\Creator\Remind_XP.exe" [2005-02-25 966656]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-01-31 385024]

"MSKDetectorExe"="c:\program files\McAfee\SpamKiller\MSKDetct.exe" [2005-08-12 1121792]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-02-19 267048]

"WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-09-12 36352]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-24 148888]

"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]

"RTHDCPL"="RTHDCPL.EXE" [2006-04-04 c:\windows\RTHDCPL.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

AutoCAD Startup Accelerator.lnk - c:\program files\Common Files\Autodesk Shared\acstart16.exe [2005-03-05 10872]

BigFix.lnk - c:\program files\BigFix\bigfix.exe [2008-02-22 2168360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]

2008-12-22 11:05 356352 c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"msacm.clmp3enc"= c:\progra~1\CYBERL~1\Power2Go\CLMP3Enc.ACM

"vidc.mjpg"= pvmjpg30.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=

"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=

"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=

"c:\\Program Files\\America Online 9.0\\waol.exe"=

"c:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltsmon.exe"=

"c:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltpspd.exe"=

"c:\\Program Files\\Common Files\\AOL\\1203660334\\EE\\AOLServiceHost.exe"=

"c:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe"=

"c:\\Program Files\\Common Files\\AOL\\AOL Spyware Protection\\AOLSP Scheduler.exe"=

"c:\\Program Files\\Common Files\\AOL\\AOL Spyware Protection\\asp.exe"=

"c:\\Program Files\\Common Files\\AolCoach\\en_en\\player\\AOLNySEV.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\Program Files\\uTorrent\\uTorrent.exe"=

"c:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\RM.exe"=

"c:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\PMSRegisterFile.exe"=

"c:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\umi.exe"=

"c:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\VideoSpin.exe"=

"c:\\Program Files\\LimeWire\\LimeWire.exe"=

"c:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"=

R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2009-01-04 28544]

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2008-12-22 8944]

R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2008-12-22 55024]

R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2008-03-09 24652]

R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2008-12-22 7408]

.

Contents of the 'Scheduled Tasks' folder

2009-02-23 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 14:57]

2009-03-01 c:\windows\Tasks\At1.job

- c:\windows\system32\65B2K4vy.exe []

2009-02-25 c:\windows\Tasks\At10.job

- c:\windows\system32\65B2K4vy.exe []

2009-02-25 c:\windows\Tasks\At11.job

- c:\windows\system32\65B2K4vy.exe []

2009-02-25 c:\windows\Tasks\At12.job

- c:\windows\system32\65B2K4vy.exe []

2009-02-28 c:\windows\Tasks\At13.job

- c:\windows\system32\65B2K4vy.exe []

2009-02-28 c:\windows\Tasks\At14.job

- c:\windows\system32\65B2K4vy.exe []

2009-02-28 c:\windows\Tasks\At15.job

- c:\windows\system32\65B2K4vy.exe []

2009-02-28 c:\windows\Tasks\At16.job

- c:\windows\system32\65B2K4vy.exe []

2009-03-01 c:\windows\Tasks\At17.job

- c:\windows\system32\65B2K4vy.exe []

2009-03-01 c:\windows\Tasks\At18.job

- c:\windows\system32\65B2K4vy.exe []

2009-03-01 c:\windows\Tasks\At19.job

- c:\windows\system32\65B2K4vy.exe []

2009-03-01 c:\windows\Tasks\At2.job

- c:\windows\system32\65B2K4vy.exe []

2009-03-02 c:\windows\Tasks\At20.job

- c:\windows\system32\65B2K4vy.exe []

2009-03-01 c:\windows\Tasks\At21.job

- c:\windows\system32\65B2K4vy.exe []

2009-03-01 c:\windows\Tasks\At22.job

- c:\windows\system32\65B2K4vy.exe []

2009-03-01 c:\windows\Tasks\At23.job

- c:\windows\system32\65B2K4vy.exe []

2009-03-01 c:\windows\Tasks\At24.job

- c:\windows\system32\65B2K4vy.exe []

2009-03-01 c:\windows\Tasks\At25.job

- c:\windows\system32\Hp3804ao.exe []

2009-03-01 c:\windows\Tasks\At26.job

- c:\windows\system32\Hp3804ao.exe []

2009-03-01 c:\windows\Tasks\At27.job

- c:\windows\system32\Hp3804ao.exe []

2009-03-01 c:\windows\Tasks\At28.job

- c:\windows\system32\Hp3804ao.exe []

2009-03-01 c:\windows\Tasks\At29.job

- c:\windows\system32\Hp3804ao.exe []

2009-03-01 c:\windows\Tasks\At3.job

- c:\windows\system32\65B2K4vy.exe []

2009-02-22 c:\windows\Tasks\At30.job

- c:\windows\system32\Hp3804ao.exe []

2009-02-15 c:\windows\Tasks\At31.job

- c:\windows\system32\Hp3804ao.exe []

2009-02-01 c:\windows\Tasks\At32.job

- c:\windows\system32\Hp3804ao.exe []

2009-02-11 c:\windows\Tasks\At33.job

- c:\windows\system32\Hp3804ao.exe []

2009-02-25 c:\windows\Tasks\At34.job

- c:\windows\system32\Hp3804ao.exe []

2009-02-25 c:\windows\Tasks\At35.job

- c:\windows\system32\Hp3804ao.exe []

2009-02-25 c:\windows\Tasks\At36.job

- c:\windows\system32\Hp3804ao.exe []

2009-02-28 c:\windows\Tasks\At37.job

- c:\windows\system32\Hp3804ao.exe []

2009-02-28 c:\windows\Tasks\At38.job

- c:\windows\system32\Hp3804ao.exe []

2009-02-28 c:\windows\Tasks\At39.job

- c:\windows\system32\Hp3804ao.exe []

2009-03-01 c:\windows\Tasks\At4.job

- c:\windows\system32\65B2K4vy.exe []

2009-02-28 c:\windows\Tasks\At40.job

- c:\windows\system32\Hp3804ao.exe []

2009-03-01 c:\windows\Tasks\At41.job

- c:\windows\system32\Hp3804ao.exe []

2009-03-01 c:\windows\Tasks\At42.job

- c:\windows\system32\Hp3804ao.exe []

2009-03-01 c:\windows\Tasks\At43.job

- c:\windows\system32\Hp3804ao.exe []

2009-03-02 c:\windows\Tasks\At44.job

- c:\windows\system32\Hp3804ao.exe []

2009-03-01 c:\windows\Tasks\At45.job

- c:\windows\system32\Hp3804ao.exe []

2009-03-01 c:\windows\Tasks\At46.job

- c:\windows\system32\Hp3804ao.exe []

2009-03-01 c:\windows\Tasks\At47.job

- c:\windows\system32\Hp3804ao.exe []

2009-03-01 c:\windows\Tasks\At48.job

- c:\windows\system32\Hp3804ao.exe []

2009-03-01 c:\windows\Tasks\At5.job

- c:\windows\system32\65B2K4vy.exe []

2009-02-22 c:\windows\Tasks\At6.job

- c:\windows\system32\65B2K4vy.exe []

2009-02-15 c:\windows\Tasks\At7.job

- c:\windows\system32\65B2K4vy.exe []

2009-02-01 c:\windows\Tasks\At8.job

- c:\windows\system32\65B2K4vy.exe []

2009-02-11 c:\windows\Tasks\At9.job

- c:\windows\system32\65B2K4vy.exe []

.

.

------- Supplementary Scan -------

.

uSearch Page = hxxp://www.google.com

uSearch Bar = hxxp://www.google.com/ie

mStart Page = hxxp://www.gateway.com/g/startpage.html?Ch=Retail&Br=EM&Loc=ENG_US&Sys=DTP&M=T5048

uInternet Settings,ProxyOverride = *.local

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: &AOL Toolbar Search - c:\program files\aol\aim toolbar 5.0\resources\en-US\local\search.html

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

FF - ProfilePath - c:\documents and settings\Owner.Dennis\Application Data\Mozilla\Firefox\Profiles\fu2e97pd.default\

FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://en-us.start.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:en-US:official

FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll

FF - component: c:\program files\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbar.dll

FF - component: c:\program files\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\metrics.dll

.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-03-01 19:00:24

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"cd042efbbd7f7af1647644e76e06692b"=hex:c8,28,51,af,b0,29,a3,98,2e,d0,bf,71,33,

06,ac,b0,c8,28,51,af,b0,29,a3,98,c3,1c,14,53,cb,9e,5c,2d,e2,63,26,f1,3f,c8,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"bca643cdc5c2726b20d2ecedcc62c59b"=hex:6a,9c,d6,61,af,45,84,18,db,53,37,fd,97,

e3,2f,f4,71,3b,04,66,8b,46,0d,96,e2,70,47,72,c2,bc,0e,de,6a,9c,d6,61,af,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"2c81e34222e8052573023a60d06dd016"=hex:25,da,ec,7e,55,20,c9,26,5c,1f,17,2b,04,

f3,98,88,25,da,ec,7e,55,20,c9,26,f3,73,b3,e9,fc,63,a1,99,ff,7c,85,e0,43,d4,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"2582ae41fb52324423be06337561aa48"=hex:3e,1e,9e,e0,57,5a,93,61,25,b0,e7,71,b1,

58,1c,8f,3e,1e,9e,e0,57,5a,93,61,b0,b1,1b,e7,c7,bd,28,4a,86,8c,21,01,be,91,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"caaeda5fd7a9ed7697d9686d4b818472"=hex:f5,1d,4d,73,a8,13,5c,05,d2,3d,ba,8b,55,

10,3a,d4,cd,44,cd,b9,a6,33,6c,cd,73,ed,47,12,1c,5f,e1,5c,f5,1d,4d,73,a8,13,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:b0,18,ed,a7,3f,8d,37,a4,31,02,e1,7f,0d,

f7,a2,c6,b0,18,ed,a7,3f,8d,37,a4,6a,99,0b,ab,01,d1,8f,c2,df,20,58,62,78,6b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"4d370831d2c43cd13623e232fed27b7b"=hex:97,20,4e,9a,c7,f1,35,ee,96,1f,84,e8,3b,

9e,a1,43,31,77,e1,ba,b1,f8,68,02,5a,e0,d6,d5,11,a7,a3,50,fb,a7,78,e6,12,2f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"1d68fe701cdea33e477eb204b76f993d"=hex:83,6c,56,8b,a0,85,96,ab,25,98,41,8f,1a,

4d,98,b3,83,6c,56,8b,a0,85,96,ab,31,e6,5e,dd,05,a5,15,0d,01,3a,48,fc,e8,04,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"1fac81b91d8e3c5aa4b0a51804d844a3"=hex:51,fa,6e,91,28,9e,14,cc,2e,01,7d,b0,db,

8c,06,9b,51,fa,6e,91,28,9e,14,cc,8a,8a,f9,b1,7a,c8,00,ff,f6,0f,4e,58,98,5b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"f5f62a6129303efb32fbe080bb27835b"=hex:b1,cd,45,5a,a8,c4,f8,b9,f6,61,3d,10,09,

02,d0,b9,b1,cd,45,5a,a8,c4,f8,b9,b3,ab,72,67,f6,ce,84,40,3d,ce,ea,26,2d,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:2a,b7,cc,b5,b9,7f,41,e7,2f,45,1d,7b,1b,

58,65,6c,e3,0e,66,d5,eb,bc,2f,6b,ca,98,23,db,41,b3,1a,de,2a,b7,cc,b5,b9,7f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"8a8aec57dd6508a385616fbc86791ec2"=hex:6c,43,2d,1e,aa,22,2f,9c,f5,af,96,e1,36,

a9,77,72,fa,ea,66,7f,d4,3b,6b,70,90,22,a8,f8,77,4e,6f,22,6c,43,2d,1e,aa,22,\

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(560)

c:\program files\SUPERAntiSpyware\SASWINLO.dll

c:\windows\system32\Ati2evxx.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\ati2evxx.exe

c:\program files\Avira\AntiVir PersonalEdition Classic\sched.exe

c:\windows\system32\ati2evxx.exe

c:\program files\Google\Google Desktop Search\GoogleDesktopIndex.exe

c:\program files\Google\Google Desktop Search\GoogleDesktopDisplay.exe

c:\progra~1\BigFix\bigfix.exe

c:\program files\Avira\AntiVir PersonalEdition Classic\avguard.exe

c:\program files\Common Files\AOL\ACS\AOLacsd.exe

c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\windows\ehome\ehrecvr.exe

c:\windows\ehome\ehSched.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\program files\Common Files\New Boundary\PrismXL\PRISMXL.SYS

c:\windows\ehome\mcrdsvc.exe

c:\windows\ehome\ehmsas.exe

c:\program files\iPod\bin\iPodService.exe

c:\windows\system32\dllhost.exe

.

**************************************************************************

.

Completion time: 2009-03-01 19:04:51 - machine was rebooted

ComboFix-quarantined-files.txt 2009-03-02 00:04:46

ComboFix2.txt 2009-03-01 04:45:13

ComboFix3.txt 2009-02-24 00:33:22

Pre-Run: 131,686,330,368 bytes free

Post-Run: 131,674,296,320 bytes free

351 --- E O F --- 2009-02-27 07:34:47

the malwarebytes log:

Malwarebytes' Anti-Malware 1.34

Database version: 1814

Windows 5.1.2600 Service Pack 2

3/1/2009 7:15:42 PM

mbam-log-2009-03-01 (19-15-42).txt

Scan type: Quick Scan

Objects scanned: 69007

Time elapsed: 4 minute(s), 8 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

hijackThis:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 7:16:00 PM, on 3/1/2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\ehome\ehtray.exe

C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

C:\Program Files\Digital Media Reader\readericon45G.exe

C:\WINDOWS\RTHDCPL.EXE

C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe

C:\Program Files\QuickTime\QTTask.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Winamp\winampa.exe

C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\Veoh Networks\Veoh\VeohClient.exe

C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\Program Files\Google\Google Desktop Search\GoogleDesktopDisplay.exe

C:\Program Files\BigFix\bigfix.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\eHome\ehRecvr.exe

C:\WINDOWS\eHome\ehSched.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Viewpoint\Common\ViewpointService.exe

C:\WINDOWS\eHome\ehmsas.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\WINDOWS\system32\dllhost.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\notepad.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.com/g/startpage.html?Ch...DTP&M=T5048

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll

O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: AIM Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll

O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll

O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe

O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup

O4 - HKLM\..\Run: [readericon] C:\Program Files\Digital Media Reader\readericon45G.exe

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"

O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE

O4 - HKLM\..\Run: [Reminder] %WINDIR%\Creator\Remind_XP.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKCU\..\Run: [Power2GoExpress] NA

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide

O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe

O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\bigfix.exe

O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aim toolbar 5.0\resources\en-US\local\search.html

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: AIM Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe

O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS

O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

--

End of file - 7976 bytes

[AdvancedSetup]

Sorry about #2 - please run it this way.

Click on START - RUN and copy/paste the following. When done you can close or exit that box.

CMD /K DEL c:\windows\Tasks\At*.JOB

Then please run this Combofix script again.

Download but do not yet run ComboFix

If you have a previous version of Combofix.exe, delete it and download a fresh copy.

Download it to your DESKTOP - it MUST run from the Desktop

download.bleepingcomputer.com/sUBs/ComboFix.exe

subs.geekstogo.com/ComboFix.exe

Using your mouse, Highlight and then Right-click | Copy the entire contents of the Code box below, including blank lines

KILLALL::

RegLock::
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]

RegNull::
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]


Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{051ed0a7-ba2a-11dd-8c87-001676ba6276}]

Open a new Notepad session (Do not use a Word Processor or WordPad). Click "Format" and be certain that Word Wrap is not enabled. Right-click | Paste the Code box contents from above into Notepad. Click File, Save as..., and set the location to your Desktop, and enter (including quotation marks) as the filename: "CFscript.txt" .

Using your mouse, drag the new file CFscript.txt and drop it on the Combo-Fix.exe icon as shown:

• Important: Have no other programs running. Your Task Bar should be clear of any program entries including your Browser.
  
• Disconnect from the Internet.
  
• Disable your Antivirus software. If it has Script Blocking features, please disable these as well.
  
• A window may open with a series of Disclaimers. Accept the Disclaimers to start the fix.
  
• It may identify that Recovery Console is not installed. Please accept when asked if you wish it to be installed.
  When the scan completes Notepad will open with with your results log open. Do a File, Exit.
  

A caution - Do not run Combofix more than once. Do not touch your mouse/keyboard until the scan has completed, as this may cause the process to stall or your computer to lock. The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled. If this occurs, please reboot to restore the desktop. Even when ComboFix appears to be doing nothing, look at your Drive light. If it is flashing, Combofix is still at work.

Post back the Combofix log on your next reply.

[squigeeman]

I think Step two worked this time around thanks. Avira detected something yesterday out of the blue I noticed that after this was directed my google searches in Firefox were redirected again to random sites. I haven't been using that much since then though so i don't know if it is better. I got this from the events section of Avira:

Virus or unwanted program 'TR/Dropper.Gen [trojan]'

detected in file 'C:\Documents and Settings\Owner.Dennis\Local Settings\Temporary Internet Files\Content.IE5\89JBCMNF\install[1].exe.

Action performed: Delete file

Anyways here is the combofix log you requested

ComboFix 09-03-01.01 - Owner 2009-03-03 1:37:52.4 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.382.161 [GMT -5:00]

Running from: c:\documents and settings\Owner.Dennis\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\Owner.Dennis\Desktop\CFscript.txt

AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Updated)

* Created a new restore point

.

((((((((((((((((((((((((( Files Created from 2009-02-03 to 2009-03-03 )))))))))))))))))))))))))))))))

.

2009-02-28 23:20 . 2004-08-10 14:00 13,463,552 --a--c--- c:\windows\system32\dllcache\hwxjpn.dll

2009-02-28 23:19 . 2009-02-28 23:19 <DIR> d-------- c:\program files\Avira

2009-02-28 23:19 . 2009-02-28 23:19 <DIR> d-------- c:\documents and settings\All Users\Application Data\Avira

2009-02-24 01:48 . 2009-02-24 01:48 <DIR> d-------- c:\program files\Java

2009-02-24 01:48 . 2009-02-24 01:48 73,728 --a------ c:\windows\system32\javacpl.cpl

2009-02-21 14:42 . 2009-02-21 14:42 <DIR> d-------- c:\program files\CCleaner

2009-02-19 18:05 . 2009-02-19 18:15 <DIR> d-------- c:\documents and settings\Owner.Dennis\DoctorWeb

2009-02-07 21:33 . 2009-02-07 21:33 <DIR> d-------- c:\program files\Trend Micro

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-03-03 06:23 --------- d-----w c:\documents and settings\Owner.Dennis\Application Data\LimeWire

2009-02-27 22:06 --------- d-----w c:\program files\Microsoft Silverlight

2009-02-25 22:04 --------- d-----w c:\program files\Google

2009-02-24 23:46 --------- d-----w c:\program files\SUPERAntiSpyware

2009-02-24 23:44 --------- d--h--w c:\program files\InstallShield Installation Information

2009-02-24 23:44 --------- d-----w c:\program files\Common Files\Panda Software

2009-02-18 06:33 --------- d-----w c:\program files\Malwarebytes' Anti-Malware

2009-02-11 15:19 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys

2009-02-11 15:19 15,504 ----a-w c:\windows\system32\drivers\mbam.sys

2009-02-07 20:35 --------- d-----w c:\documents and settings\All Users\Application Data\McAfee

2009-01-29 05:32 102,664 ----a-w c:\windows\system32\drivers\tmcomm.sys

2009-01-18 02:20 --------- d-----w c:\documents and settings\Owner.Dennis\Application Data\autodessys

2009-01-18 02:19 66,115 ----a-w c:\program files\uninstal.log

2009-01-18 02:19 61,328 ----a-w c:\program files\setuplog.txt

2009-01-18 02:17 --------- d-----w c:\program files\formZ

2009-01-08 22:15 --------- d-----w c:\documents and settings\Owner.Dennis\Application Data\U3

2009-01-08 22:15 --------- d-----w c:\documents and settings\Owner.Dennis\Application Data\Malwarebytes

2009-01-08 22:15 --------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes

2009-01-08 19:48 --------- d-----w c:\documents and settings\Owner.Dennis\Application Data\SUPERAntiSpyware.com

2009-01-08 19:48 --------- d-----w c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com

2009-01-08 19:47 --------- d-----w c:\program files\Common Files\Wise Installation Wizard

2009-01-08 19:00 --------- d-----w c:\windows\system32\config\systemprofile\Application Data\AVGTOOLBAR

2009-01-07 04:37 --------- d-----w c:\program files\AVG

2009-01-05 01:10 --------- d-----w c:\program files\Panda Security

2008-05-23 00:45 5,754,977 ----a-w c:\program files\ALZip.exe

2008-12-19 03:39 67,688 ----a-w c:\program files\mozilla firefox\components\jar50.dll

2008-12-19 03:39 54,368 ----a-w c:\program files\mozilla firefox\components\jsd3250.dll

2008-12-19 03:39 34,944 ----a-w c:\program files\mozilla firefox\components\myspell.dll

2008-12-19 03:39 46,712 ----a-w c:\program files\mozilla firefox\components\spellchk.dll

2008-12-19 03:39 172,136 ----a-w c:\program files\mozilla firefox\components\xpinstal.dll

.

((((((((((((((((((((((((((((( SnapShot_2009-02-28_23.44.09.85 )))))))))))))))))))))))))))))))))))))))))

.

+ 2005-10-12 23:12:25 14,048 ----a-w c:\windows\$hf_mig$\KB901190\spmsg.dll

+ 2005-10-12 23:12:26 213,216 ----a-w c:\windows\$hf_mig$\KB901190\spuninst.exe

+ 2005-10-12 23:12:25 22,752 ----a-w c:\windows\$hf_mig$\KB901190\update\spcustom.dll

+ 2005-10-12 23:12:29 716,000 ----a-w c:\windows\$hf_mig$\KB901190\update\update.exe

+ 2005-10-12 23:12:34 371,424 ----a-w c:\windows\$hf_mig$\KB901190\update\updspapi.dll

+ 2009-03-03 06:42:23 16,384 ----atw c:\windows\temp\Perflib_Perfdata_7b0.dat

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Power2GoExpress"="NA" [X]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-04-12 68856]

"Veoh"="c:\program files\Veoh Networks\Veoh\VeohClient.exe" [2008-08-28 3660848]

"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-02-24 1830128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]

"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-02-22 169984]

"readericon"="c:\program files\Digital Media Reader\readericon45G.exe" [2005-12-09 139264]

"AOL Spyware Protection"="c:\progra~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe" [2004-10-18 79448]

"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-14 212992]

"Reminder"="c:\windows\Creator\Remind_XP.exe" [2005-02-25 966656]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-01-31 385024]

"MSKDetectorExe"="c:\program files\McAfee\SpamKiller\MSKDetct.exe" [2005-08-12 1121792]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-02-19 267048]

"WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-09-12 36352]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-24 148888]

"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]

"RTHDCPL"="RTHDCPL.EXE" [2006-04-04 c:\windows\RTHDCPL.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

AutoCAD Startup Accelerator.lnk - c:\program files\Common Files\Autodesk Shared\acstart16.exe [2005-03-05 10872]

BigFix.lnk - c:\program files\BigFix\bigfix.exe [2008-02-22 2168360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]

2008-12-22 11:05 356352 c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"msacm.clmp3enc"= c:\progra~1\CYBERL~1\Power2Go\CLMP3Enc.ACM

"vidc.mjpg"= pvmjpg30.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=

"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=

"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=

"c:\\Program Files\\America Online 9.0\\waol.exe"=

"c:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltsmon.exe"=

"c:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltpspd.exe"=

"c:\\Program Files\\Common Files\\AOL\\1203660334\\EE\\AOLServiceHost.exe"=

"c:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe"=

"c:\\Program Files\\Common Files\\AOL\\AOL Spyware Protection\\AOLSP Scheduler.exe"=

"c:\\Program Files\\Common Files\\AOL\\AOL Spyware Protection\\asp.exe"=

"c:\\Program Files\\Common Files\\AolCoach\\en_en\\player\\AOLNySEV.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\Program Files\\uTorrent\\uTorrent.exe"=

"c:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\RM.exe"=

"c:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\PMSRegisterFile.exe"=

"c:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\umi.exe"=

"c:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\VideoSpin.exe"=

"c:\\Program Files\\LimeWire\\LimeWire.exe"=

"c:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"=

R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2009-01-04 28544]

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2008-12-22 8944]

R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2008-12-22 55024]

R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2008-03-09 24652]

R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2008-12-22 7408]

.

Contents of the 'Scheduled Tasks' folder

2009-03-02 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 14:57]

.

.

------- Supplementary Scan -------

.

uSearch Page = hxxp://www.google.com

uSearch Bar = hxxp://www.google.com/ie

mStart Page = hxxp://www.gateway.com/g/startpage.html?Ch=Retail&Br=EM&Loc=ENG_US&Sys=DTP&M=T5048

uInternet Settings,ProxyOverride = *.local

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: &AOL Toolbar Search - c:\program files\aol\aim toolbar 5.0\resources\en-US\local\search.html

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

FF - ProfilePath - c:\documents and settings\Owner.Dennis\Application Data\Mozilla\Firefox\Profiles\fu2e97pd.default\

FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://en-us.start.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:en-US:official

FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll

FF - component: c:\program files\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbar.dll

FF - component: c:\program files\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\metrics.dll

.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-03-03 01:43:02

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(560)

c:\program files\SUPERAntiSpyware\SASWINLO.dll

c:\windows\system32\Ati2evxx.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\ati2evxx.exe

c:\program files\Avira\AntiVir PersonalEdition Classic\sched.exe

c:\windows\system32\ati2evxx.exe

c:\program files\Google\Google Desktop Search\GoogleDesktopIndex.exe

c:\program files\Google\Google Desktop Search\GoogleDesktopDisplay.exe

c:\progra~1\BigFix\bigfix.exe

c:\program files\Avira\AntiVir PersonalEdition Classic\avguard.exe

c:\program files\Common Files\AOL\ACS\AOLacsd.exe

c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\windows\ehome\ehrecvr.exe

c:\windows\ehome\ehSched.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\program files\Common Files\New Boundary\PrismXL\PRISMXL.SYS

c:\windows\ehome\mcrdsvc.exe

c:\windows\ehome\ehmsas.exe

c:\program files\iPod\bin\iPodService.exe

c:\windows\system32\dllhost.exe

.

**************************************************************************

.

Completion time: 2009-03-03 1:48:04 - machine was rebooted [Owner]

ComboFix-quarantined-files.txt 2009-03-03 06:47:58

ComboFix2.txt 2009-03-02 00:04:53

ComboFix3.txt 2009-03-01 04:45:13

ComboFix4.txt 2009-02-24 00:33:22

Pre-Run: 131,000,086,528 bytes free

Post-Run: 131,564,314,624 bytes free

190 --- E O F --- 2009-03-02 08:01:28

[AdvancedSetup]

That all looks pretty good now.

How is the computer running now?

Are there still any signs of an infection?

Update your Anti-Virus and then start cruising the Web some and see if searches are redirected or any unexpected issues and let me know, but so far it looks okay unless it's hidden deeper.

[squigeeman]

One of my google searches was redirected on Firefox after I did the latest combofix thing. I think my computer is still slower than it used to be. The fan in my PC goes haywire anytime I run streaming video these days. It was like that after my big infection and not before.

[AdvancedSetup]

Well one search could just be dumb results from the search engine. If you were still infected then MOST if not all your searches should be redirected.

As for being slow that may not be Malware.

Computer and browser slowness are not always malware related

Poor performance and other problems can be the result of disk fragmentation, disk errors, corrupt system files, too many startup programs, unnecessary services running, not enough RAM, dirty hardware, etc. As your system gets older it becomes filled with more files/programs and has a natural tendency to slow down so cleaning and regular maintenance is essential.

Listed below are a few things you can do to improve speed and system performance. Many of the these suggestions will apply if you're using Windows Vista but may be done a bit differently. Near the bottom of this thread there is a section specifically devoted to Vista Users.

For browser problems, see:

• Its not always malware: How to fix the top 10 Internet Explorer issues
  
• How and Why to Clear Your Cache
  

If your having connectivity issues or errors such as Page cannot be displayed see

• Repair/Reset Winsock settings
  
• Troubleshooting Internet Connection Problems
  

If you're using Vista or Internet Explorer 7, see

• Why is my Internet connection so slow?
  
• Windows Vista - My Internet connection is slow
  
• The Phishing Filter may slow down the PC
  
• Tuning IE7 for Better Performance
  
• How to optimize or reset Internet Explorer 7
  

If you have a lot of toolbars and add-ons attached to Internet Explorer, you could try improving performance by disabling those which are unecessary. See:

• Control Internet Explorer Add-ons with Add-on Manager
  
• Troubleshooting and Internet Explorer

[squigeeman]

Ok I will try to do some this to figure out the problem. Thank you for all of your help! I couldn't have cleaned it without you

[AdvancedSetup]

Great, all looks good now.

I'll close your post soon so that other don't post into it and leave you with this information and suggestions.

So how did I get infected in the first place?

At this time your system appears to be clean. Nothing else in the logs indicates that you are still infected.

Now that you appear to be clean, please follow these simple steps in order to keep your computer clean and secure:

Disable and Enable System Restore-WINDOWS XP

This is a good time to clear your existing system restore points and establish a new clean restore point:

Turn off System Restore

• On the Desktop, right-click My Computer.
• Click Properties.
  
  
• Click the System Restore tab.
  
  
• Check Turn off System Restore.
  
  
• Click Apply, and then click OK.
  
  
• Reboot.
  
  

Turn ON System Restore

• On the Desktop, right-click My Computer.
• Click Properties.
  
  
• Click the System Restore tab.
  
  
• UN-Check *Turn off System Restore*.
  
  
• Click Apply, and then click OK.
  
  

This will remove all restore points except the new one you just created.

Here are some free programs I recommend that could help you improve your computer's security.

Install SpyWare Blaster

Download it from

here

Find here the tutorial on how to use Spyware Blaster

here

Install WinPatrol

Download it from

here

Here you can find information about how WinPatrol works

here

Install FireTrust SiteHound

You can find information and download it from

here

Install hpHosts

Download it from

here

hpHosts is a community managed and maintained hosts file that allows an additional layer of protection against access to ad,

tracking and malicious websites. This prevents your computer from connecting to these untrusted sites

by redirecting them to 127.0.0.1 which is your own local computer.

hpHosts Support Forum

Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.

You can use one of these sites to check if any updates are needed for your pc.

Secunia Software Inspector

F-secure Health Check

Visit Microsoft often to get the latest updates for your computer.

http://www.update.microsoft.com

Note 1:

If you are running Windows XP

SP2

, you should upgrade to

SP3

.

Note 2:

Users of Norton Internet Security 2008 should uninstall the software before they install Service Pack 3.

The security suite can then be reinstalled afterwards.

The windows firewall is not sufficient to protect your system. It doesn't monitor outgoing traffic and this is a must.

I recommend

Online Armor Free

A little outdated but good reading on

how to prevent Malware

Keep safe online and happy surfing.

Since this issue is resolved I will close the thread to prevent others from posting into it. If you need assistance please start your own topic and someone will be happy to assist you.

The fixes and advice in this thread are for this machine only. Do not apply to your machine unless you

Fully Understand

how these programs work and what you're doing. Please start a thread of your own and someone will be happy to help you, just follow the Pre-Hijackthis instructions found here before posting

Pre- HJT Post Instructions

Also don't forget that we offer

FREE

assistance with General PC questions and repair here

PC Help

If you're pleased with the product

Malwarebytes

and the service provided you, please let your friends, family, and co-workers know.

http://www.malwarebytes.org