Malwarebytes wont run/re-install

NightSky · February 27, 2009

Working on my computer last night when Spy Protecter 2009 auto-ran on my desktop. Spybot and McAfee cought the file trying to change and create new regis. keys, but i was able to stop them. After deleting the host file(according to Spybot and McAfee) i figured it would be a great time to run a few virus and malware scans to make sure i had everything cleaned out. Neither Malwarebytes Anti-Malware or Spybot would run, or even start the .exe file while McAfee seemed to be un-effected. Trying to solve the problem on my own, i decided to try re-installing it by using my laptop to download the host file's of both Malwarebytes and Spybot to a USB card. Now the install .exe wont run on either, and it seems that even though the malware file was removed, it isn't completely gone. My desktop is pretty much useless as no form of internet browser will connect to the internet, and now i cant log into my account without the system freezing unless it's in safe mode. Please help!

Here is my HJT Log:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 9:58:48 AM, on 2/27/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16791)

Boot mode: Safe mode

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.alagaesia.com/index.php

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: (no name) - {56038DE5-E66A-4145-B69A-9DAD6110621B} - (no file)

O2 - BHO: (no name) - {5ACFE904-8346-4943-ADA4-9AFA6B2F1224} - (no file)

O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll

O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\scriptcl.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: (no name) - {90464fbb-9284-45dc-ad60-f7371966cf92} - (no file)

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe

O4 - HKLM\..\Run: [Creative WebCam Tray] C:\Program Files\Creative\Shared Files\CAMTRAY.EXE

O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg

O4 - HKLM\..\Run: [Pinnacle WebUpdater] "C:\Program Files\Pinnacle\Shared Files\Programs\WebUpdater\WebUpdater.exe" -s -f=UpdateVersion.xml -url=http://cdn.pinnaclesys.com/SupportFiles

O4 - HKLM\..\Run: [PMCRemote] C:\Program Files\Pinnacle\Shared Files\Programs\Remote\Remoterm.exe

O4 - HKLM\..\Run: [shStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE

O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE

O4 - HKLM\..\Run: [instantBurn] C:\PROGRA~1\CYBERL~1\INSTAN~1\Win2K\IBurn.exe

O4 - HKLM\..\Run: [LGODDFU] "C:\Program Files\lg_fwupdate\fwupdate.exe" blrun

O4 - HKLM\..\Run: [startCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

O4 - HKLM\..\Run: [bDRegion] C:\Program Files\Cyberlink\Shared Files\brs.exe

O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"

O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [PMCS] "C:\Program Files\Pinnacle\Shared Files\Programs\MediaCenterService\PMC.Service.Main.exe"

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden

O4 - HKCU\..\Run: [bitTorrent DNA] "C:\Program Files\DNA\btdna.exe"

O4 - HKCU\..\Run: [rundll32.exe] rundll32.exe "C:\Documents and Settings\Josh\Application Data\Macromedia\Common\8047e04c1.dll""

O4 - HKUS\S-1-5-20\..\Run: [belizunaze] Rundll32.exe "C:\WINDOWS\system32\resevine.dll",s (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [rundll32.exe] rundll32.exe "C:\Documents and Settings\NetworkService\Application Data\Macromedia\Common\8047e04c1.dll"" (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [rundll32.exe] rundll32.exe "C:\Documents and Settings\Josh\Application Data\Macromedia\Common\8047e04c1.dll"" (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [rundll32.exe] rundll32.exe "C:\Documents and Settings\Josh\Application Data\Macromedia\Common\8047e04c1.dll"" (User 'Default user')

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe

O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab

O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Solit...wn.cab56986.cab

O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-US/a-UNO1/GAME_UNO1.cab

O16 - DPF: {8FD07749-EFFA-48C6-947C-45A8D7BF422F} (UpdateAdvisor Control) - http://docs.cyberlink.com/multi/patch/prog/UpdateAdvisor.cab

O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} -

O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll

O20 - AppInit_DLLs: bvqzjx.dll c:\windows\system32\bepaleju.dll c:\windows\system32\hozegupo.dll pjhyth.dll xgcsby.dll

O20 - Winlogon Notify: iiffCTLe - iiffCTLe.dll (file missing)

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe

O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe

O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe

O23 - Service: Pinnacle Systems Media Service (PinnacleSys.MediaServer) - Pinnacle Systems - C:\Program Files\Pinnacle\Shared Files\Programs\MediaServer\PMSHost.exe

O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

--

End of file - 9786 bytes

Tigger93 · February 27, 2009

Hi. :rolleyes:

Download ComboFix from one of the locations below, and save it to your Desktop.

Link 1

Link 2

Double click combofix.exe and follow the prompts. Please, never rename Combofix unless instructed.

When finished, it shall produce a log for you. Post that log and a HijackThis log in your next reply

Note: Do not mouseclick Combofix's window while its running. That may cause it to stall

If it will not run, try renaming it to something else and see if it will.

NightSky · February 27, 2009

neither Firefox or Internet Explorer can find the site/server for both downloads. Tried downloading threw another site and the same thing happened. Downloaded it to a USB drive threw my laptop and it says i need to install a clean copy due to files missing

NightSky · February 27, 2009

Nevermind, tried putting it on my USB from a different site and it seems to be running fine now. working threw the steps

NightSky · February 27, 2009

ComboFix Log-

ComboFix 09-02-26.02 - Josh 2009-02-27 13:45:01.1 - NTFSx86 NETWORK

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1534.1197 [GMT -6:00]

Running from: c:\documents and settings\Josh\Desktop\h8ft5.exe

AV: McAfee VirusScan Enterprise *On-access scanning enabled* (Updated)

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\IE4 Error Log.txt

c:\windows\system32\drivers\UACduptxuwn.sys

c:\windows\system32\iehelper.dll

c:\windows\system32\UACbgrdlrvd.dll

c:\windows\system32\UAClvhwiwxh.log

c:\windows\system32\UACoequyqws.log

c:\windows\system32\UACprmhluya.dll

c:\windows\system32\UACqgudjbpj.log

c:\windows\system32\UACsmlhbmqh.dat

c:\windows\system32\UACtymhskda.dll

c:\windows\system32\UACyibogexb.dll

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Service_UACd.sys

((((((((((((((((((((((((( Files Created from 2009-01-27 to 2009-02-27 )))))))))))))))))))))))))))))))

.

2009-02-27 13:19 . 2009-02-27 13:30 <DIR> d-------- C:\Info

2009-02-26 21:33 . 2009-02-26 21:33 <DIR> d-------- c:\documents and settings\Administrator\Application Data\ATI

2009-02-26 21:32 . 2009-02-26 21:32 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Logitech

2009-02-26 21:32 . 2009-02-26 21:32 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Creative

2009-02-26 20:33 . 2009-02-26 20:33 5,120 --ahs---- c:\windows\system32\Thumbs.db

2009-02-26 20:17 . 2009-02-26 20:17 5,516 --a------ c:\windows\system32\uacinit.dll

2009-02-19 15:46 . 2009-02-19 15:46 <DIR> d-------- c:\windows\$SQLUninstallSQL2000-KB960082-v8.00.2055-x86-ENU$

2009-02-18 23:24 . 2009-02-27 13:49 <DIR> d-------- c:\program files\DNA

2009-02-18 23:24 . 2009-02-27 13:49 <DIR> d-------- c:\documents and settings\Josh\Application Data\DNA

2009-02-09 11:42 . 2009-02-26 20:34 11,776 --ahs---- c:\windows\Thumbs.db

2009-02-05 21:25 . 2009-02-05 21:25 <DIR> d-------- c:\documents and settings\All Users\Application Data\LightScribe

2009-02-02 10:07 . 2009-02-02 10:07 <DIR> d-------- c:\documents and settings\Josh\Application Data\Malwarebytes

2009-02-02 10:07 . 2009-02-02 10:07 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes

2009-02-02 08:40 . 2009-02-02 08:40 <DIR> d-------- c:\program files\Trend Micro

2009-02-02 00:10 . 2009-02-02 00:10 2,713 ---hs---- c:\windows\system32\jemajidi.dll

2009-01-31 15:14 . 2009-01-31 15:14 2,713 ---hs---- c:\windows\system32\varofeje.dll

2009-01-29 15:49 . 2009-01-29 15:49 2,713 ---hs---- c:\windows\system32\ketoyibo.dll

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-02-27 19:49 --------- d-----w c:\program files\lg_fwupdate

2009-02-27 06:43 --------- d-----w c:\program files\Spybot - Search & Destroy

2009-02-27 06:43 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

2009-02-27 02:30 --------- d-----w c:\program files\Xvid

2009-02-27 02:30 --------- d-----w c:\program files\Windows Media Connect 2

2009-02-27 02:30 --------- d-----w c:\program files\DivX

2009-02-06 03:16 --------- d-----w c:\program files\Common Files\LightScribe

2009-01-29 15:35 --------- d-----w c:\program files\Common Files\AOL

2009-01-21 18:10 --------- d-----w c:\documents and settings\All Users\Application Data\Skype

2009-01-21 00:41 --------- d--h--w c:\program files\InstallShield Installation Information

2009-01-21 00:40 --------- d-----w c:\program files\Common Files\Apple

2009-01-19 05:41 --------- d-----w c:\program files\CyberLink

2009-01-18 06:18 --------- d-----w c:\documents and settings\All Users\Application Data\ATI

2009-01-18 06:10 --------- d-----w c:\program files\ATI Technologies

2009-01-18 05:26 --------- d-----w c:\documents and settings\All Users\Application Data\SlySoft

2009-01-16 03:01 --------- d-----w c:\program files\LightScribeODK

2009-01-16 02:58 --------- d-----w c:\documents and settings\All Users\Application Data\CyberLink

2009-01-06 04:11 0 ---ha-w c:\windows\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf

2009-01-06 04:10 0 ---ha-w c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf

2009-01-06 04:10 0 ---ha-w c:\windows\system32\drivers\Msft_Kernel_LHidFilt_01005.Wdf

2009-01-06 04:01 --------- d-----w c:\documents and settings\Josh\Application Data\Logitech

2009-01-06 03:58 --------- d-----w c:\program files\Common Files\Logishrd

2009-01-06 03:58 --------- d-----w c:\documents and settings\Josh\Application Data\Leadertech

2009-01-06 03:57 130,208 ------r c:\windows\bwUnin-8.1.1.87-8876480SL.exe

2009-01-06 03:57 --------- d-----w c:\program files\Logitech

2009-01-06 03:55 --------- d-----w c:\documents and settings\All Users\Application Data\Logitech

2009-01-06 03:54 --------- d-----w c:\documents and settings\All Users\Application Data\LogiShrd

2008-08-31 01:20 22,328 ----a-w c:\documents and settings\Josh\Application Data\PnkBstrK.sys

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

"PMCS"="c:\program files\Pinnacle\Shared Files\Programs\MediaCenterService\PMC.Service.Main.exe" [2006-06-08 65536]

"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296]

"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]

"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2009-01-27 2387968]

"BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2009-02-18 318272]

"rundll32.exe"="c:\documents and settings\Josh\Application Data\Macromedia\Common\8047e04c1.dll" [2009-02-27 64512]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-03-15 122933]

"Creative WebCam Tray"="c:\program files\Creative\Shared Files\CAMTRAY.EXE" [2004-04-29 245760]

"PCMService"="c:\program files\Dell\Media Experience\PCMService.exe" [2004-04-11 290816]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-15 136600]

"PinnacleDriverCheck"="c:\windows\system32\PSDrvCheck.exe" [2003-11-10 406016]

"PMCRemote"="c:\program files\Pinnacle\Shared Files\Programs\Remote\Remoterm.exe" [2006-06-08 90112]

"ShStatEXE"="c:\program files\McAfee\VirusScan Enterprise\SHSTAT.EXE" [2008-01-24 111952]

"McAfeeUpdaterUI"="c:\program files\McAfee\Common Framework\UdaterUI.exe" [2007-10-25 136512]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-11-04 413696]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]

"InstantBurn"="c:\progra~1\CYBERL~1\INSTAN~1\Win2K\IBurn.exe" [2007-06-04 599600]

"LGODDFU"="c:\program files\lg_fwupdate\fwupdate.exe" [2009-01-15 548864]

"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-29 61440]

"BDRegion"="c:\program files\Cyberlink\Shared Files\brs.exe" [2008-10-07 75048]

"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2008-07-21 87336]

"LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2008-05-14 62760]

"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-02-29 c:\windows\KHALMNPR.Exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"rundll32.exe"="c:\documents and settings\Josh\Application Data\Macromedia\Common\8047e04c1.dll" [2009-02-27 64512]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]

Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2009-01-05 91440]

Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2009-01-05 805392]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]

2008-05-02 02:42 72208 c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"wave1"= c:\docume~1\Josh\APPLIC~1\MACROM~1\Common\8047e04c1.dll

"midi1"= c:\docume~1\Josh\APPLIC~1\MACROM~1\Common\8047e04c1.dll

"mixer1"= c:\docume~1\Josh\APPLIC~1\MACROM~1\Common\8047e04c1.dll

"aux1"= c:\docume~1\Josh\APPLIC~1\MACROM~1\Common\8047e04c1.dll

"wave2"= c:\docume~1\Josh\APPLIC~1\MACROM~1\Common\8047e04c1.dll

"midi2"= c:\docume~1\Josh\APPLIC~1\MACROM~1\Common\8047e04c1.dll

"mixer2"= c:\docume~1\Josh\APPLIC~1\MACROM~1\Common\8047e04c1.dll

"msacm.clmp3enc"= c:\progra~1\CYBERL~1\Power2Go\CLMP3Enc.ACM

"aux2"= c:\docume~1\Josh\APPLIC~1\MACROM~1\Common\8047e04c1.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]

@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

"c:\\WINDOWS\\system32\\PnkBstrA.exe"=

"c:\\WINDOWS\\system32\\PnkBstrB.exe"=

"c:\\Program Files\\McAfee\\Common Framework\\FrameworkService.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=

"%windir%\\system32\\drivers\\svchost.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\Program Files\\DNA\\btdna.exe"=

R1 CLBStor;InstantBurn Storage Helper Driver;c:\windows\system32\drivers\CLBStor.sys [2009-01-15 16048]

R3 AtiHdmiService;ATI Function Driver for HDMI Service;c:\windows\system32\drivers\AtiHdmi.sys [2007-07-20 84992]

R3 P0630VID;Creative WebCam Live!;c:\windows\system32\drivers\P0630Vid.sys [2008-06-27 91797]

S2 {95808DC4-FA4A-4C74-92FE-5B863F82066B};{95808DC4-FA4A-4C74-92FE-5B863F82066B};c:\program files\CyberLink\PowerDVD\000.fcl [2009-01-18 23:42:36 61424]

S2 CLBUDF;CyberLink InstantBurn UDF Filesystem;c:\windows\system32\drivers\CLBUDF.sys [2009-01-15 162096]

S2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2008-09-11 24652]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]

\Shell\AutoRun\command - E:\Autorun.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]

"c:\program files\Common Files\LightScribe\LSRunOnce.exe"

.

Contents of the 'Scheduled Tasks' folder

2009-02-13 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

.

- - - - ORPHANS REMOVED - - - -

BHO-{56038DE5-E66A-4145-B69A-9DAD6110621B} - (no file)

BHO-{5ACFE904-8346-4943-ADA4-9AFA6B2F1224} - (no file)

BHO-{90464fbb-9284-45dc-ad60-f7371966cf92} - (no file)

HKCU-Run-Power2GoExpress - (no file)

HKLM-Run-Pinnacle WebUpdater - c:\program files\Pinnacle\Shared Files\Programs\WebUpdater\WebUpdater.exe -s -f=UpdateVersion.xml

Notify-iiffCTLe - iiffCTLe.dll

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.alagaesia.com/index.php

uSearchMigratedDefaultURL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}

uInternet Settings,ProxyOverride = *.local

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

Trusted Zone: aol.com\free

Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll

DPF: {8FD07749-EFFA-48C6-947C-45A8D7BF422F} - hxxp://docs.cyberlink.com/multi/patch/prog/UpdateAdvisor.cab

FF - ProfilePath - c:\documents and settings\Josh\Application Data\Mozilla\Firefox\Profiles\uve8ckjr.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-tyc7&p=

FF - prefs.js: browser.search.selectedEngine - Yahoo

FF - prefs.js: browser.startup.homepage - hxxp://www.alagaesia.com/index.php

FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-tyc7&p=

FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll

FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll

.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-02-27 13:49:37

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{95808DC4-FA4A-4C74-92FE-5B863F82066B}]

"ImagePath"="\??\c:\program files\CyberLink\PowerDVD\000.fcl"

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1993962763-1229272821-839522115-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID]

@Denied: (Full) (LocalSystem)

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"cd042efbbd7f7af1647644e76e06692b"=hex:c8,28,51,af,b0,29,a3,98,a2,ef,17,9f,80,

70,d2,6b,c8,28,51,af,b0,29,a3,98,20,3f,13,be,0c,e1,16,e3,e2,63,26,f1,3f,c8,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"bca643cdc5c2726b20d2ecedcc62c59b"=hex:71,3b,04,66,8b,46,0d,96,b2,42,21,ce,ab,

47,0e,58,71,3b,04,66,8b,46,0d,96,8d,71,35,b9,f6,d7,f7,f7,6a,9c,d6,61,af,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"2c81e34222e8052573023a60d06dd016"=hex:ff,7c,85,e0,43,d4,0e,fe,0e,f7,0e,ca,17,

99,17,52,25,da,ec,7e,55,20,c9,26,0e,dd,47,62,aa,ba,e4,26,ff,7c,85,e0,43,d4,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"2582ae41fb52324423be06337561aa48"=hex:86,8c,21,01,be,91,eb,e7,2e,44,36,ca,af,

36,37,fb,3e,1e,9e,e0,57,5a,93,61,7f,11,bf,73,91,1a,5c,c0,86,8c,21,01,be,91,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"caaeda5fd7a9ed7697d9686d4b818472"=hex:cd,44,cd,b9,a6,33,6c,cd,8b,2d,d6,11,fd,

77,e1,c3,cd,44,cd,b9,a6,33,6c,cd,2d,71,41,77,5f,ac,73,d3,f5,1d,4d,73,a8,13,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:b0,18,ed,a7,3f,8d,37,a4,b8,fc,fc,8d,08,

50,bf,ff,b0,18,ed,a7,3f,8d,37,a4,11,47,e5,6b,f9,6e,d2,6d,df,20,58,62,78,6b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"4d370831d2c43cd13623e232fed27b7b"=hex:31,77,e1,ba,b1,f8,68,02,47,91,aa,4a,98,

5b,70,55,31,77,e1,ba,b1,f8,68,02,53,4a,a9,f5,f8,d2,67,75,fb,a7,78,e6,12,2f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"1d68fe701cdea33e477eb204b76f993d"=hex:83,6c,56,8b,a0,85,96,ab,cf,90,a6,1f,df,

2b,eb,fb,83,6c,56,8b,a0,85,96,ab,0f,b6,2d,90,38,b7,37,19,01,3a,48,fc,e8,04,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"1fac81b91d8e3c5aa4b0a51804d844a3"=hex:51,fa,6e,91,28,9e,14,cc,5b,08,5e,2c,1e,

ec,59,14,51,fa,6e,91,28,9e,14,cc,14,9a,fe,e3,bf,26,47,fb,f6,0f,4e,58,98,5b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"f5f62a6129303efb32fbe080bb27835b"=hex:b1,cd,45,5a,a8,c4,f8,b9,58,4a,99,da,53,

6f,30,9b,b1,cd,45,5a,a8,c4,f8,b9,e9,21,8a,62,13,6d,63,4b,3d,ce,ea,26,2d,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:2a,b7,cc,b5,b9,7f,41,e7,31,c8,6a,c8,ff,

67,82,d8,e3,0e,66,d5,eb,bc,2f,6b,2d,8c,36,c3,90,1f,37,e4,2a,b7,cc,b5,b9,7f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"8a8aec57dd6508a385616fbc86791ec2"=hex:fa,ea,66,7f,d4,3b,6b,70,43,2c,0a,98,7e,

6c,55,ed,fa,ea,66,7f,d4,3b,6b,70,6c,70,a0,6b,7b,a1,55,7e,6c,43,2d,1e,aa,22,\

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(652)

c:\windows\system32\Ati2evxx.dll

c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll

c:\program files\common files\logishrd\bluetooth\LBTServ.dll

.

------------------------ Other Running Processes ------------------------

.

c:\program files\McAfee\Common Framework\Mctray.exe

c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

c:\h8ft5\hidec.exe

c:\program files\Common Files\Logishrd\KHAL2\KHALMNPR.exe

c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

c:\program files\Pinnacle\Shared Files\Programs\PclePvr\VideoControl.exe

c:\h8ft5\Catchme.tmp

.

**************************************************************************

.

Completion time: 2009-02-27 13:55:06 - machine was rebooted [Josh]

ComboFix-quarantined-files.txt 2009-02-27 19:53:48

Pre-Run: 45,685,481,472 bytes free

Post-Run: 46,829,191,168 bytes free

283 --- E O F --- 2009-02-26 06:56:26

HJT Log-

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 1:57:43 PM, on 2/27/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16791)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Dell\Media Experience\PCMService.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\Pinnacle\Shared Files\Programs\Remote\Remoterm.exe

C:\Program Files\McAfee\Common Framework\UdaterUI.exe

C:\Program Files\McAfee\Common Framework\McTray.exe

C:\Program Files\lg_fwupdate\fwupdate.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

C:\Program Files\Cyberlink\Shared Files\brs.exe

C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Pinnacle\Shared Files\Programs\MediaCenterService\PMC.Service.Main.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\Program Files\Windows Live\Messenger\msnmsgr.exe

C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe

C:\Program Files\DNA\btdna.exe

C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe

C:\Program Files\Logitech\SetPoint\SetPoint.exe

C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe

C:\Program Files\Pinnacle\Shared Files\Programs\PclePvr\VideoControl.exe

C:\WINDOWS\explorer.exe