SHeur2

militaryman73 · March 8, 2009

Ok, First time use so please be gentle. Today I started to receive avg warnings for SHeur2 infections. I have tried AVG, SpyBot S&D, and Malawarebytes Anti-Malaware to no avail. The warning keeps coming back.

Thanks for any assistance.

Phill

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 6:16:13 PM, on 8/03/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16791)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

C:\WINDOWS\system32\CTsvcCDA.EXE

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Common Files\LightScribe\LSSrvc.exe

C:\Program Files\Common Files\Seagate\Schedule2\schedul2.exe

C:\PROGRA~1\AVG\AVG8\avgrsx.exe

C:\PROGRA~1\AVG\AVG8\avgnsx.exe

C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe

C:\PROGRA~1\AVG\AVG8\avgemc.exe

C:\Program Files\Analog Devices\SoundMAX\Smax4.exe

C:\PROGRA~1\AVG\AVG8\avgtray.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\WINDOWS\VM_STI.EXE

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I3H2.EXE

C:\Program Files\Seagate\DiscWizard\DiscWizardMonitor.exe

C:\Program Files\Seagate\DiscWizard\TimounterMonitor.exe

C:\Program Files\Common Files\Seagate\Schedule2\schedhlp.exe

C:\Program Files\QuickTime\qttask.exe

C:\Program Files\PowerISO\PWRISOVM.EXE

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\AVG\AVG8\avgcsrvx.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe

C:\Program Files\DAEMON Tools\daemon.exe

C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe

C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe

C:\Program Files\VIA\RAID\raid_tool.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

C:\Program Files\MSN Messenger\msnmsgr.exe

C:\Program Files\MSN Messenger\usnsvc.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.news.com.au

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.news.com.au

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/

O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: Grab Pro - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files\Orbitdownloader\GrabPro.dll

O4 - HKLM\..\Run: [soundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe

O4 - HKLM\..\Run: [soundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray

O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"

O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [bigDogPath] C:\WINDOWS\VM_STI.EXE Vimicro USB PC Camera (ZC0301PL)

O4 - HKLM\..\Run: [EPSON Stylus Photo R210 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I3H2.EXE /P30 "EPSON Stylus Photo R210 Series" /O6 "USB002" /M "Stylus Photo R210"

O4 - HKLM\..\Run: [DiscWizardMonitor.exe] C:\Program Files\Seagate\DiscWizard\DiscWizardMonitor.exe

O4 - HKLM\..\Run: [AcronisTimounterMonitor] C:\Program Files\Seagate\DiscWizard\TimounterMonitor.exe

O4 - HKLM\..\Run: [seagate Scheduler2 Service] "C:\Program Files\Common Files\Seagate\Schedule2\schedhlp.exe"

O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [uVS12 Preload] D:\ulead 12\uvPL.exe

O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"

O4 - HKCU\..\Run: [EPSON Stylus Photo R210 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I3H2.EXE /P30 "EPSON Stylus Photo R210 Series" /M "Stylus Photo R210" /EF "HKCU"

O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe

O8 - Extra context menu item: &Download by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201

O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204

O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203

O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O8 - Extra context menu item: Locate Spot on Map by GPS - C:\Program Files\Opanda\IExif 2.3\IExifMap.htm

O8 - Extra context menu item: View Exif/GPS/IPTC with IExif - C:\Program Files\Opanda\IExif 2.3\IExifCom.htm

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1215936131296

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll

O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe

O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

O23 - Service: PunkBuster (PnkBstrA) - Unknown owner - E:\Medal of honour\UnrealEngine3\MOHAGame\pb\PnkBstrA.exe

O23 - Service: Seagate Scheduler2 Service (SgtSch2Svc) - Seagate - C:\Program Files\Common Files\Seagate\Schedule2\schedul2.exe

O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

--

End of file - 10323 bytes

AdvancedSetup · March 8, 2009

Please post the MBAM log.

Update and Scan with Malwarebytes' Anti-Malware

Start MalwareBytes AntiMalware (Vista users must Right click and choose RunAs Admin)
Please DO NOT run MBAM in Safe Mode unless requested to, you MUST run it in normal Windows mode.
- Update Malwarebytes' Anti-Malware
- Select the Update tab
- Click Update
[*]When the update is complete, select the Scanner tab
[*]Select Perform quick scan, then click Scan.
[*]When the scan is complete, click OK, then Show Results to view the results.
[*]Be sure that everything is checked, and click Remove Selected.
[*]When completed, a log will open in Notepad. please copy and paste the log into your next reply
- If you accidently close it, the log file is saved here and will be named like this:
- C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt

Then post back the MBAM log and a new Hijackthis log.

Download

DDS

and save it to your desktop

http://download.bleepingcomputer.com/sUBs/dds.scr

Disable any script blocker if your Anti-Virus/Anti-Malware has it.

Once downloaded you can disconnect from the Internet and disable your Ant-Virus temporarily if needed.

Then double click

dds.scr

to run the tool.

When done, the

DDS.txt

will open.

Click Yes at the next prompt for Optional Scan.

When done, DDS will open two (2) logs:

DDS.txt
Attach.txt

Save both reports to your desktop
Please include the following logs in your next reply:
DDS.txt
and
Attach.txt

militaryman73 · March 8, 2009

Here is the MBAM log as requested.

Thanks again.

Malwarebytes' Anti-Malware 1.34

Database version: 1826

Windows 5.1.2600 Service Pack 3

8/03/2009 9:04:30 PM

mbam-log-2009-03-08 (21-04-30).txt

Scan type: Full Scan (C:\|)

Objects scanned: 128810

Time elapsed: 43 minute(s), 38 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 4

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\WINDOWS\system32\3.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\4.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\5.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\7.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

AdvancedSetup · March 9, 2009

Please post the DDS as requested as well.

I will probably also need to get a bootlog from the system too.

Please create a BOOTLOG

Restart the computer and press F8 when Windows start booting. This will bring up the startup options.
Select "Enable Boot Logging" option and press enter.
Windows prompts you to select a Windows Installation (even if there is only one windows installation)
This boots windows normally and creates a boot log named ntbtlog.txt and saves it to C:\Windows
If you're already running inside Windows you can enable it the following way.
Click on START - RUN and type in MSCONFIG go to the BOOT.INI tab and place a check mark by /BOOTLOG
Click on OK and you will be prompted to RESTART Windows. Please do restart now.
After Windows restarts open the file C:\Windows\ntbtlog.txt with Notepad
From the Edit menu choose Select All then Edit, COPY and post that back on your next reply.
Note: Vista users can type in the Search and it will show on the menu, then Right click and choose Run as Adminsitrator
The tab is called BOOT on Vista. Then choose Boot log

militaryman73 · March 9, 2009

Thanks for your help so far. DDS and Bootlog as requested.

Cheers Phill

DDS (Ver_09-02-01.01) - NTFSx86

Run by phill at 16:37:04.28 on Mon 09/03/2009

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1208 [GMT 11:00]

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated)

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup

C:\WINDOWS\system32\Ati2evxx.exe

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

C:\WINDOWS\system32\CTsvcCDA.EXE

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Common Files\LightScribe\LSSrvc.exe

E:\Medal of honour\UnrealEngine3\MOHAGame\pb\PnkBstrA.exe

C:\Program Files\Common Files\Seagate\Schedule2\schedul2.exe

C:\PROGRA~1\AVG\AVG8\avgrsx.exe

C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

C:\PROGRA~1\AVG\AVG8\avgnsx.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe

C:\PROGRA~1\AVG\AVG8\avgemc.exe

C:\Program Files\Analog Devices\SoundMAX\Smax4.exe

C:\PROGRA~1\AVG\AVG8\avgtray.exe

C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\WINDOWS\VM_STI.EXE

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I3H2.EXE

C:\Program Files\Seagate\DiscWizard\DiscWizardMonitor.exe

C:\Program Files\Seagate\DiscWizard\TimounterMonitor.exe

C:\Program Files\Common Files\Seagate\Schedule2\schedhlp.exe

C:\Program Files\QuickTime\qttask.exe

C:\Program Files\PowerISO\PWRISOVM.EXE

C:\Program Files\AVG\AVG8\avgcsrvx.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe

C:\Program Files\DAEMON Tools\daemon.exe

C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe

C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe

C:\Program Files\VIA\RAID\raid_tool.exe

C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

svchost.exe C:\WINDOWS\TEMP\VRT2.tmp

C:\Program Files\Internet Explorer\iexplore.exe

C:\Documents and Settings\phill\Desktop\dds.scr

C:\Program Files\AVG\AVG8\avgcsrvx.exe

============== Pseudo HJT Report ===============

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\viarai~1.lnk - c:\program files\via\raid\raid_tool.exe

============= SERVICES / DRIVERS ===============

R0 viaraid;viaraid;c:\windows\system32\drivers\viaraid.sys [2008-7-13 72192]

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-7-14 325128]

R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2008-7-14 27656]

R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-7-14 107272]

R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe [2008-7-14 903960]

R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2008-7-14 298264]

R2 SgtSch2Svc;Seagate Scheduler2 Service;c:\program files\common files\seagate\schedule2\schedul2.exe [2008-6-24 431384]

S3 AIDA32Driver;AIDA32Driver;\??\c:\docume~1\phill\locals~1\temp\rar$ex00.875\aida32.sys --> c:\docume~1\phill\locals~1\temp\rar$ex00.875\aida32.sys [?]

=============== Created Last 30 ================

2009-03-09 16:31 25,601 a------- c:\windows\system32\7.tmp

2009-03-09 16:31 80 a------- c:\windows\system32\4.tmp

2009-03-09 04:56 25,601 a------- c:\windows\system32\5.tmp

2009-03-09 04:56 80 a------- c:\windows\system32\3.tmp

2009-03-08 17:37 <DIR> --d----- c:\program files\CCleaner

2009-03-08 17:35 <DIR> --d----- c:\program files\Trend Micro

2009-03-08 14:40 38,913 a------- c:\windows\system32\17.tmp

2009-03-08 14:40 80 a------- c:\windows\system32\15.tmp

2009-03-08 08:38 38,913 a------- c:\windows\system32\45D.tmp

2009-03-08 08:38 80 a------- c:\windows\system32\45B.tmp

2009-03-08 08:08 60 a------- c:\windows\wininit.ini

2009-03-08 07:49 351 a------- c:\windows\xccwinsys.ini

2009-03-08 07:49 <DIR> --d----- c:\windows\system32\inf

2009-03-08 07:49 0 a------- c:\windows\system32\443.tmp

2009-03-08 07:49 25,601 a------- c:\windows\system32\442.tmp

2009-03-08 07:49 80 a------- c:\windows\system32\43E.tmp

2009-02-25 18:53 1,668 a------- c:\docume~1\phill\applic~1\filterclsid.dat

2009-02-25 17:21 <DIR> --d----- c:\docume~1\phill\applic~1\Samsung

2009-02-25 17:20 174,592 a------- c:\windows\system32\framedyn.dll

2009-02-25 17:20 5,632 a------- c:\windows\system32\drivers\StarOpen.sys

2009-02-25 17:18 106,792 a------- c:\windows\system32\drivers\sscdmdm.sys

2009-02-25 17:18 80,552 a------- c:\windows\system32\drivers\sscdbus.sys

2009-02-25 17:18 11,944 a------- c:\windows\system32\drivers\sscdmdfl.sys

2009-02-25 17:18 9,256 a------- c:\windows\system32\drivers\sscdwhnt.sys

2009-02-25 17:18 9,256 a------- c:\windows\system32\drivers\sscdwh.sys

2009-02-25 17:18 9,256 a------- c:\windows\system32\drivers\sscdcmnt.sys

2009-02-25 17:18 9,256 a------- c:\windows\system32\drivers\sscdcm.sys

2009-02-25 17:18 <DIR> --d----- c:\windows\system32\Samsung_USB_Drivers

2009-02-25 17:18 766 a------- c:\windows\system32\Uninstall.ico

2009-02-25 17:18 <DIR> --d----- c:\program files\Samsung

2009-02-18 18:37 <DIR> --d----- c:\program files\PowerISO

2009-02-17 07:30 <DIR> --d----- c:\program files\EZ-Rent

2009-02-17 07:29 90,624 a------- c:\windows\ST6UNST.EXE

2009-02-10 18:38 <DIR> --d----- c:\program files\NCH Software

2009-02-10 18:38 <DIR> --d----- c:\program files\NCH Swift Sound

==================== Find3M ====================

2009-02-12 04:43 325,128 a------- c:\windows\system32\drivers\avgldx86.sys

2009-02-12 04:43 10,520 a------- c:\windows\system32\avgrsstx.dll

2009-02-12 04:43 107,272 a------- c:\windows\system32\drivers\avgtdix.sys

2009-02-11 10:19 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys

2009-02-11 10:19 15,504 a------- c:\windows\system32\drivers\mbam.sys

2008-12-21 10:15 826,368 a------- c:\windows\system32\wininet.dll

2008-12-19 05:34 410,984 a------- c:\windows\system32\deploytk.dll

2008-12-16 19:53 107,888 a------- c:\windows\system32\CmdLineExt.dll

2003-07-31 20:53 147,456 a------- c:\windows\inf\EL2K_XP.sys

2003-07-31 20:50 448,768 a------- c:\windows\inf\EL2K_N64.sys

2003-07-31 20:43 147,456 a------- c:\windows\inf\EL2K_2K.sys

============= FINISH: 16:37:32.01 ===============

BOOTLOG

Service Pack 3 3 9 2009 16:50:53.375

Loaded driver \WINDOWS\system32\ntoskrnl.exe

Loaded driver \WINDOWS\system32\hal.dll

Loaded driver \WINDOWS\system32\KDCOM.DLL

Loaded driver \WINDOWS\system32\BOOTVID.dll

Loaded driver sptd.sys

Loaded driver \WINDOWS\System32\Drivers\WMILIB.SYS

Loaded driver \WINDOWS\System32\Drivers\SCSIPORT.SYS

Loaded driver ACPI.sys

Loaded driver pci.sys

Loaded driver ohci1394.sys

Loaded driver \WINDOWS\system32\DRIVERS\1394BUS.SYS

Loaded driver isapnp.sys

Loaded driver PCIIde.sys

Loaded driver \WINDOWS\System32\Drivers\PCIIDEX.SYS

Loaded driver intelide.sys

Loaded driver MountMgr.sys

Loaded driver ftdisk.sys

Loaded driver dmload.sys

Loaded driver dmio.sys

Loaded driver PartMgr.sys

Loaded driver VolSnap.sys

Loaded driver atapi.sys

Loaded driver viaraid.sys

Loaded driver disk.sys

Loaded driver \WINDOWS\system32\DRIVERS\CLASSPNP.SYS

Loaded driver fltmgr.sys

Loaded driver KSecDD.sys

Loaded driver WudfPf.sys

Loaded driver Ntfs.sys

Loaded driver NDIS.sys

Loaded driver timntr.sys

Loaded driver tdrpman.sys

Loaded driver snapman.sys

Loaded driver Mup.sys

Loaded driver agp440.sys

Loaded driver \SystemRoot\system32\DRIVERS\intelppm.sys

Loaded driver \SystemRoot\system32\DRIVERS\ati2mtag.sys

Loaded driver \SystemRoot\system32\DRIVERS\usbuhci.sys

Loaded driver \SystemRoot\system32\DRIVERS\usbehci.sys

Loaded driver \SystemRoot\system32\DRIVERS\nic1394.sys

Loaded driver \SystemRoot\system32\DRIVERS\EL2K_XP.sys

Loaded driver \SystemRoot\system32\DRIVERS\i8042prt.sys

Loaded driver \SystemRoot\system32\DRIVERS\kbdclass.sys

Loaded driver \SystemRoot\system32\DRIVERS\mouclass.sys

Loaded driver \SystemRoot\system32\DRIVERS\serial.sys

Loaded driver \SystemRoot\system32\DRIVERS\serenum.sys

Loaded driver \SystemRoot\system32\DRIVERS\fdc.sys

Loaded driver \SystemRoot\system32\DRIVERS\parport.sys

Loaded driver \SystemRoot\system32\DRIVERS\imapi.sys

Loaded driver \SystemRoot\system32\drivers\ASAPIW2k.sys

Loaded driver \SystemRoot\system32\DRIVERS\cdrom.sys

Loaded driver \SystemRoot\system32\DRIVERS\redbook.sys

Loaded driver \SystemRoot\system32\drivers\smwdm.sys

Loaded driver \SystemRoot\system32\drivers\aeaudio.sys

Loaded driver \SystemRoot\System32\Drivers\a0fkm4wt.SYS

Loaded driver \SystemRoot\system32\DRIVERS\splitcam.sys

Loaded driver \SystemRoot\system32\DRIVERS\audstub.sys

Loaded driver \SystemRoot\system32\DRIVERS\rasl2tp.sys

Loaded driver \SystemRoot\system32\DRIVERS\ndistapi.sys

Loaded driver \SystemRoot\system32\DRIVERS\ndiswan.sys

Loaded driver \SystemRoot\system32\DRIVERS\raspppoe.sys

Loaded driver \SystemRoot\system32\DRIVERS\raspptp.sys

Loaded driver \SystemRoot\system32\DRIVERS\msgpc.sys

Loaded driver \SystemRoot\System32\drivers\dmboot.sys

Loaded driver \SystemRoot\system32\DRIVERS\psched.sys

Loaded driver \SystemRoot\system32\DRIVERS\ptilink.sys

Loaded driver \SystemRoot\system32\DRIVERS\raspti.sys

Loaded driver \SystemRoot\system32\DRIVERS\rdpdr.sys

Loaded driver \SystemRoot\system32\DRIVERS\termdd.sys

Loaded driver \SystemRoot\system32\DRIVERS\swenum.sys

Loaded driver \SystemRoot\system32\DRIVERS\update.sys

Loaded driver \SystemRoot\system32\DRIVERS\mssmbios.sys

Loaded driver \SystemRoot\system32\DRIVERS\MarvinBus.sys

Loaded driver \SystemRoot\System32\Drivers\NDProxy.SYS

Did not load driver \SystemRoot\System32\Drivers\NDProxy.SYS

Loaded driver \SystemRoot\system32\DRIVERS\usbhub.sys

Loaded driver \SystemRoot\system32\DRIVERS\flpydisk.sys

Did not load driver \SystemRoot\System32\Drivers\lbrtfdc.SYS

Did not load driver \SystemRoot\System32\Drivers\Sfloppy.SYS

Did not load driver \SystemRoot\System32\Drivers\i2omgmt.SYS

Did not load driver \SystemRoot\System32\Drivers\Changer.SYS

Did not load driver \SystemRoot\System32\Drivers\Cdaudio.SYS

Loaded driver \SystemRoot\System32\Drivers\Fs_Rec.SYS

Loaded driver \SystemRoot\System32\Drivers\Null.SYS

Loaded driver \SystemRoot\System32\Drivers\Beep.SYS

Loaded driver \SystemRoot\System32\drivers\vga.sys

Loaded driver \SystemRoot\System32\Drivers\mnmdd.SYS

Loaded driver \SystemRoot\System32\DRIVERS\RDPCDD.sys

Loaded driver \SystemRoot\System32\Drivers\Msfs.SYS

Loaded driver \SystemRoot\System32\Drivers\Npfs.SYS

Loaded driver \SystemRoot\system32\DRIVERS\rasacd.sys

Loaded driver \SystemRoot\system32\DRIVERS\ipsec.sys

Loaded driver \SystemRoot\system32\DRIVERS\tcpip.sys

Loaded driver \SystemRoot\system32\DRIVERS\netbt.sys

Loaded driver \SystemRoot\system32\DRIVERS\wanarp.sys

Loaded driver \SystemRoot\System32\Drivers\avgtdix.sys

Loaded driver \SystemRoot\system32\DRIVERS\arp1394.sys

Loaded driver \SystemRoot\System32\drivers\afd.sys

Loaded driver \SystemRoot\system32\DRIVERS\netbios.sys

Loaded driver \SystemRoot\System32\Drivers\StarOpen.SYS

Did not load driver \SystemRoot\System32\Drivers\PCIDump.SYS

Loaded driver \SystemRoot\System32\Drivers\SCDEmu.SYS

Loaded driver \SystemRoot\system32\DRIVERS\rdbss.sys

Loaded driver \??\C:\WINDOWS\system32\drivers\pclepci.sys

Loaded driver \SystemRoot\system32\DRIVERS\mrxsmb.sys

Loaded driver \SystemRoot\System32\Drivers\Fips.SYS

Loaded driver \SystemRoot\System32\Drivers\avgmfx86.sys

Loaded driver \SystemRoot\system32\DRIVERS\usbprint.sys

Loaded driver \SystemRoot\system32\DRIVERS\USBSTOR.SYS

Loaded driver \SystemRoot\System32\Drivers\avgldx86.sys

Loaded driver \SystemRoot\System32\Drivers\Fastfat.SYS

Loaded driver \SystemRoot\System32\Drivers\Udfs.SYS

Loaded driver \SystemRoot\system32\DRIVERS\tifsfilt.sys

Loaded driver \SystemRoot\system32\DRIVERS\ndisuio.sys

Did not load driver \SystemRoot\system32\DRIVERS\rdbss.sys

Did not load driver \SystemRoot\system32\DRIVERS\mrxsmb.sys

Loaded driver \SystemRoot\system32\drivers\wdmaud.sys

Loaded driver \SystemRoot\system32\drivers\sysaudio.sys

Loaded driver \SystemRoot\system32\drivers\splitter.sys

Loaded driver \SystemRoot\system32\drivers\aec.sys

Loaded driver \SystemRoot\system32\drivers\swmidi.sys

Loaded driver \SystemRoot\system32\drivers\DMusic.sys

Loaded driver \SystemRoot\system32\drivers\MidiSyn.sys

Loaded driver \SystemRoot\system32\drivers\kmixer.sys

Loaded driver \SystemRoot\system32\drivers\drmkaud.sys

Loaded driver \SystemRoot\system32\DRIVERS\mrxdav.sys

Loaded driver \SystemRoot\System32\Drivers\ParVdm.SYS

Loaded driver \??\C:\WINDOWS\system32\drivers\PfModNT.sys

Loaded driver \SystemRoot\system32\DRIVERS\srv.sys

Loaded driver \SystemRoot\System32\Drivers\Cdfs.SYS

Loaded driver \SystemRoot\system32\drivers\kmixer.sys

Loaded driver \SystemRoot\System32\Drivers\HTTP.sys

Attach.zip

AdvancedSetup · March 9, 2009

The Attach.txt file has been edited. Please post the full log as reported or I will close the post. Sorry not trying to be difficult but I don't have time to play either. There are way too many other users requesting help that this takes time away from.

Thank you for your understanding.

militaryman73 · March 9, 2009

Sorry. Not sure what you mean by edited. all i did was zip it up. Here it is as it was in the txt.

Thanks Phill

DDS (Ver_09-02-01.01)

Microsoft Windows XP Professional

Boot Device: \Device\HarddiskVolume1

Install Date: 13/07/2008 4:23:33 PM

System Uptime: 3/09/2009 4:28:23 PM (-4272 hours ago)

Motherboard: ASUSTeK Computer Inc. | | P4P800

Processor: Intel® Pentium® 4 CPU 3.00GHz | CPU 1 | 2998/200mhz

==== Disk Partitions =========================

A: is Removable

C: is FIXED (NTFS) - 90 GiB total, 65.628 GiB free.

D: is FIXED (NTFS) - 37 GiB total, 21.904 GiB free.

E: is FIXED (NTFS) - 37 GiB total, 13.775 GiB free.

F: is FIXED (NTFS) - 37 GiB total, 29.535 GiB free.

G: is FIXED (NTFS) - 234 GiB total, 5.948 GiB free.

H: is FIXED (NTFS) - 38 GiB total, 11.386 GiB free.

I: is FIXED (NTFS) - 37 GiB total, 6.093 GiB free.

J: is FIXED (NTFS) - 37 GiB total, 2.162 GiB free.

K: is FIXED (NTFS) - 38 GiB total, 11.236 GiB free.

L: is CDROM ()

M: is Removable

N: is Removable

O: is Removable

P: is FIXED (NTFS) - 142 GiB total, 129.985 GiB free.

Q: is CDROM (CDFS)

R: is CDROM (UDF)

S: is Removable

T: is CDROM ()

U: is FIXED (NTFS) - 466 GiB total, 328.235 GiB free.

==== Disabled Device Manager Items =============

Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}

Description: Network Controller

Device ID: PCI\VEN_1814&DEV_0101&SUBSYS_01261043&REV_00\4&2E98101C&0&68F0

Manufacturer:

Name: Network Controller

PNP Device ID: PCI\VEN_1814&DEV_0101&SUBSYS_01261043&REV_00\4&2E98101C&0&68F0

Service:

==== System Restore Points ===================

No restore point in system.

==== Installed Programs ======================

==== Event Viewer Messages From Past Week ========

2/03/2009 8:40:08 PM, error: Service Control Manager [7034] - The NMIndexingService service terminated unexpectedly. It has done this 1 time(s).

8/03/2009 10:26:00 AM, error: Srv [2019] - The server was unable to allocate from the system nonpaged pool because the pool was empty.

8/03/2009 1:36:44 PM, error: System Error [1003] - Error code 100000d4, parameter1 a98c0038, parameter2 0000001c, parameter3 00000001, parameter4 804e163c.

8/03/2009 3:09:42 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.

8/03/2009 3:09:42 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.

8/03/2009 3:09:42 PM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning.

8/03/2009 3:09:42 PM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.

8/03/2009 3:09:42 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD AvgLdx86 AvgMfx86 AvgTdiX Fips intelppm IPSec MRxSmb NetBIOS NetBT PCLEPCI RasAcd Rdbss SCDEmu StarOpen Tcpip

8/03/2009 3:09:53 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

8/03/2009 3:09:58 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}

8/03/2009 6:09:07 PM, error: Service Control Manager [7034] - The PunkBuster service terminated unexpectedly. It has done this 1 time(s).

8/03/2009 5:11:16 PM, information: Windows File Protection [64016] - Windows File Protection file scan was started.

8/03/2009 5:11:18 PM, information: Windows File Protection [64017] - Windows File Protection file scan completed successfully.

==== End Of File ===========================

AdvancedSetup · March 9, 2009

This portion here:

==== Installed Programs ======================

It is blank and of the thousands of logs I've done I've never seen it blank before.

So that leads me to believe it was edited or that something very odd is going on.

Please try this tool then and let's see what it reports.

Please download Lop S&D

Double-click on Lop S&D.exe

Choose the language, then choose Option 1 (Search)

Wait till the end of the scan

Post the log which is created: (%SystemDrive%\lopR.txt), typcially C:\lopR.txt

militaryman73 · March 9, 2009

Log as required

Thanks again Phill

--------------------\\ Lop S&D 4.2.5-0 XP/Vista

Microsoft Windows XP Professional ( v5.1.2600 ) Service Pack 3

X86-based PC ( Multiprocessor Free : Intel® Pentium® 4 CPU 3.00GHz )

BIOS : BIOS Date: 02/23/04 12:18:46 Ver: 08.00.09

USER : phill ( Administrator )

BOOT : Normal boot

Antivirus : AVG Anti-Virus Free 8.0 (Activated)

A:\ (USB)

C:\ (Local Disk) - NTFS - Total:89 Go (Free:65 Go)

D:\ (Local Disk) - NTFS - Total:37 Go (Free:21 Go)

E:\ (Local Disk) - NTFS - Total:37 Go (Free:13 Go)

F:\ (Local Disk) - NTFS - Total:37 Go (Free:29 Go)

G:\ (Local Disk) - NTFS - Total:233 Go (Free:5 Go)

H:\ (Local Disk) - NTFS - Total:37 Go (Free:11 Go)

I:\ (Local Disk) - NTFS - Total:37 Go (Free:6 Go)

J:\ (Local Disk) - NTFS - Total:37 Go (Free:2 Go)

K:\ (Local Disk) - NTFS - Total:37 Go (Free:11 Go)

L:\ (CD or DVD)

M:\ (USB)

N:\ (USB)

O:\ (USB) - FAT - Total:1936 Mo (Free:1 Go)

P:\ (Local Disk) - NTFS - Total:142 Go (Free:129 Go)

Q:\ (CD or DVD)

R:\ (CD or DVD) - UDF - Total:7 Go (Free:0 Go)

S:\ (USB)

T:\ (CD or DVD)

U:\ (Local Disk) - NTFS - Total:465 Go (Free:328 Go)

"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )

Option : [1] ( Mon 09/03/2009|17:29 )

--------------------\\ Listing folders in APPLIC~1

[08/03/2009|04:03] C:\DOCUME~1\ADMINI~1\APPLIC~1\<DIR> Malwarebytes

[08/03/2009|03:09] C:\DOCUME~1\ADMINI~1\APPLIC~1\<DIR> Microsoft

[08/03/2009|04:54] C:\DOCUME~1\ADMINI~1\APPLIC~1\<DIR> Mozilla

[23/07/2008|06:18] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Adobe

[12/02/2009|04:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> avg8

[28/12/2008|09:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Creative

[21/08/2008|01:06] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> EPSON

[26/10/2008|05:58] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> InterVideo

[25/07/2008|04:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Malwarebytes

[16/12/2008|07:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Microsoft

[10/02/2009|06:39] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> NCH Swift Sound

[10/08/2008|04:19] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Nero

[19/10/2008|06:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Pinnacle

[11/12/2008|04:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> QuickTime

[02/10/2008|04:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Seagate

[08/03/2009|06:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Spybot - Search & Destroy

[21/08/2008|02:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> UDL

[26/10/2008|05:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Ulead Systems

[13/07/2008|05:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Windows Genuine Advantage

[13/07/2008|07:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> WLInstaller

[14/07/2008|07:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Yahoo!

[13/07/2008|05:21] C:\DOCUME~1\DEFAUL~1\APPLIC~1\<DIR> Microsoft

[14/07/2008|05:34] C:\DOCUME~1\LOCALS~1\APPLIC~1\<DIR> Microsoft

[14/07/2008|05:34] C:\DOCUME~1\NETWOR~1\APPLIC~1\<DIR> Microsoft

[27/07/2008|08:42] C:\DOCUME~1\phill\APPLIC~1\<DIR> Adobe

[10/08/2008|04:46] C:\DOCUME~1\phill\APPLIC~1\<DIR> Ahead

[13/07/2008|06:23] C:\DOCUME~1\phill\APPLIC~1\<DIR> ATI

[26/01/2009|07:00] C:\DOCUME~1\phill\APPLIC~1\<DIR> Command & Conquer 3 Tiberium Wars

[28/12/2008|10:18] C:\DOCUME~1\phill\APPLIC~1\<DIR> Creative

[21/12/2008|07:43] C:\DOCUME~1\phill\APPLIC~1\<DIR> Desktopicon

[08/03/2009|05:49] C:\DOCUME~1\phill\APPLIC~1\<DIR> FVZilla

[27/07/2008|03:52] C:\DOCUME~1\phill\APPLIC~1\<DIR> Google

[08/02/2009|05:17] C:\DOCUME~1\phill\APPLIC~1\<DIR> GrabPro

[21/08/2008|03:56] C:\DOCUME~1\phill\APPLIC~1\<DIR> Help

[13/07/2008|05:26] C:\DOCUME~1\phill\APPLIC~1\<DIR> Identities

[13/07/2008|06:04] C:\DOCUME~1\phill\APPLIC~1\<DIR> Macromedia

[25/07/2008|04:55] C:\DOCUME~1\phill\APPLIC~1\<DIR> Malwarebytes

[07/02/2009|01:48] C:\DOCUME~1\phill\APPLIC~1\<DIR> Microsoft

[14/07/2008|06:34] C:\DOCUME~1\phill\APPLIC~1\<DIR> Mozilla

[10/02/2009|06:38] C:\DOCUME~1\phill\APPLIC~1\<DIR> NCH Swift Sound

[08/03/2009|08:13] C:\DOCUME~1\phill\APPLIC~1\<DIR> Orbit

[30/09/2008|01:19] C:\DOCUME~1\phill\APPLIC~1\<DIR> Real

[25/02/2009|05:21] C:\DOCUME~1\phill\APPLIC~1\<DIR> Samsung

[16/12/2008|07:53] C:\DOCUME~1\phill\APPLIC~1\<DIR> SecuROM

[31/01/2009|12:28] C:\DOCUME~1\phill\APPLIC~1\<DIR> SPORE Creature Creator

[09/08/2008|07:22] C:\DOCUME~1\phill\APPLIC~1\<DIR> Sun

[26/10/2008|01:10] C:\DOCUME~1\phill\APPLIC~1\<DIR> Ulead Systems

[08/03/2009|08:48] C:\DOCUME~1\phill\APPLIC~1\<DIR> uTorrent

[31/07/2008|10:32] C:\DOCUME~1\phill\APPLIC~1\<DIR> vlc

--------------------\\ Scheduled Tasks located in C:\WINDOWS\Tasks

[07/03/2009 11:00 PM][--a------] C:\WINDOWS\tasks\Spybot - Search & Destroy Updater - Scheduled Task.job

[08/03/2009 05:40 AM][--a------] C:\WINDOWS\tasks\Spybot - Search & Destroy - Scheduled Task.job

[09/03/2009 04:51 PM][--ah-----] C:\WINDOWS\tasks\SA.DAT

[04/08/2004 11:00 PM][-r-h-----] C:\WINDOWS\tasks\desktop.ini

--------------------\\ Listing Folders in C:\Program Files

[13/07/2008|07:11] C:\Program Files\<DIR> ACW

[27/07/2008|08:35] C:\Program Files\<DIR> Adobe

[27/12/2008|05:22] C:\Program Files\<DIR> AGEIA Technologies

[13/07/2008|05:29] C:\Program Files\<DIR> Analog Devices

[13/07/2008|06:12] C:\Program Files\<DIR> ATI Technologies

[14/07/2008|05:38] C:\Program Files\<DIR> AVG

[08/03/2009|05:37] C:\Program Files\<DIR> CCleaner

[02/11/2008|07:46] C:\Program Files\<DIR> Common Files

[13/07/2008|05:18] C:\Program Files\<DIR> ComPlus Applications

[28/12/2008|09:53] C:\Program Files\<DIR> Creative

[22/12/2008|05:42] C:\Program Files\<DIR> DAEMON Tools

[21/08/2008|02:26] C:\Program Files\<DIR> EPSON

[21/08/2008|02:25] C:\Program Files\<DIR> EPSON Print CD

[08/03/2009|08:34] C:\Program Files\<DIR> EZ-Rent

[08/03/2009|05:49] C:\Program Files\<DIR> Free Video Zilla

[27/07/2008|03:51] C:\Program Files\<DIR> Google

[25/02/2009|05:19] C:\Program Files\<DIR> InstallShield Installation Information

[12/02/2009|03:00] C:\Program Files\<DIR> Internet Explorer

[19/12/2008|05:34] C:\Program Files\<DIR> Java

[14/07/2008|06:23] C:\Program Files\<DIR> K-Lite Codec Pack

[26/02/2009|03:06] C:\Program Files\<DIR> Magic Video Converter

[08/03/2009|01:38] C:\Program Files\<DIR> Malwarebytes' Anti-Malware

[13/07/2008|07:16] C:\Program Files\<DIR> Messenger

[02/11/2008|07:46] C:\Program Files\<DIR> Microsoft ActiveSync

[13/07/2008|05:21] C:\Program Files\<DIR> microsoft frontpage

[02/11/2008|07:45] C:\Program Files\<DIR> Microsoft Office

[13/07/2008|05:56] C:\Program Files\<DIR> Movie Maker

[09/03/2009|05:20] C:\Program Files\<DIR> Mozilla Firefox

[13/07/2008|05:17] C:\Program Files\<DIR> MSN

[13/07/2008|05:18] C:\Program Files\<DIR> MSN Gaming Zone

[13/07/2008|07:25] C:\Program Files\<DIR> MSN Messenger

[20/10/2008|08:38] C:\Program Files\<DIR> MSXML 4.0

[10/02/2009|06:38] C:\Program Files\<DIR> NCH Software

[10/02/2009|06:38] C:\Program Files\<DIR> NCH Swift Sound

[10/08/2008|04:19] C:\Program Files\<DIR> Nero

[13/07/2008|05:54] C:\Program Files\<DIR> NetMeeting

[13/07/2008|05:18] C:\Program Files\<DIR> Online Services

[06/01/2009|06:52] C:\Program Files\<DIR> Opanda

[25/11/2008|07:27] C:\Program Files\<DIR> OpenSource Flash Video Splitter

[13/07/2008|05:54] C:\Program Files\<DIR> Outlook Express

[06/09/2008|04:29] C:\Program Files\<DIR> PeerGuardian2

[05/03/2009|06:54] C:\Program Files\<DIR> PhotoWatermark Professional 6

[19/10/2008|06:45] C:\Program Files\<DIR> Pinnacle

[08/03/2009|08:06] C:\Program Files\<DIR> PowerISO

[27/02/2009|04:22] C:\Program Files\<DIR> QuickTime

[08/11/2008|05:28] C:\Program Files\<DIR> Ratbag

[25/02/2009|05:18] C:\Program Files\<DIR> Samsung

[02/10/2008|11:37] C:\Program Files\<DIR> Seagate

[06/09/2008|10:36] C:\Program Files\<DIR> Skin Designer

[24/10/2008|12:53] C:\Program Files\<DIR> SplitCam

[17/02/2009|04:36] C:\Program Files\<DIR> Spybot - Search & Destroy

[21/08/2008|01:33] C:\Program Files\<DIR> SSC Service Utility

[15/08/2008|06:01] C:\Program Files\<DIR> Sun

[08/03/2009|08:09] C:\Program Files\<DIR> TibEd 2

[08/03/2009|05:35] C:\Program Files\<DIR> Trend Micro

[14/07/2008|06:47] C:\Program Files\<DIR> Ulead Systems

[13/07/2008|05:26] C:\Program Files\<DIR> Uninstall Information

[25/07/2008|01:28] C:\Program Files\<DIR> uTorrent

[13/07/2008|05:34] C:\Program Files\<DIR> VIA

[31/07/2008|10:29] C:\Program Files\<DIR> VideoLAN

[10/08/2008|04:52] C:\Program Files\<DIR> Vimicro

[14/07/2008|07:33] C:\Program Files\<DIR> Windows Media Components

[17/07/2008|07:16] C:\Program Files\<DIR> Windows Media Connect 2

[17/07/2008|07:16] C:\Program Files\<DIR> Windows Media Player

[13/07/2008|05:54] C:\Program Files\<DIR> Windows NT

[13/07/2008|05:20] C:\Program Files\<DIR> WindowsUpdate

[21/08/2008|02:10] C:\Program Files\<DIR> WinRAR

[13/07/2008|05:21] C:\Program Files\<DIR> xerox

[30/09/2008|01:17] C:\Program Files\<DIR> Xilisoft

[14/07/2008|07:00] C:\Program Files\<DIR> Yahoo!

--------------------\\ Listing Folders in C:\Program Files\Common Files

[27/07/2008|08:35] C:\Program Files\Common Files\<DIR> Adobe

[10/08/2008|04:22] C:\Program Files\Common Files\<DIR> Ahead

[13/07/2008|06:10] C:\Program Files\Common Files\<DIR> ATI Technologies

[02/11/2008|07:46] C:\Program Files\Common Files\<DIR> Designer

[14/07/2008|06:46] C:\Program Files\Common Files\<DIR> InstallShield

[29/07/2008|05:44] C:\Program Files\Common Files\<DIR> Java

[10/08/2008|04:44] C:\Program Files\Common Files\<DIR> LightScribe

[23/11/2008|03:00] C:\Program Files\Common Files\<DIR> Microsoft Shared

[13/07/2008|05:19] C:\Program Files\Common Files\<DIR> MSSoap

[14/07/2008|02:50] C:\Program Files\Common Files\<DIR> ODBC

[02/10/2008|03:59] C:\Program Files\Common Files\<DIR> Seagate

[13/07/2008|05:19] C:\Program Files\Common Files\<DIR> Services

[14/07/2008|06:47] C:\Program Files\Common Files\<DIR> SONY Digital Images

[14/07/2008|02:50] C:\Program Files\Common Files\<DIR> SpeechEngines

[02/11/2008|07:45] C:\Program Files\Common Files\<DIR> System

[26/10/2008|05:57] C:\Program Files\Common Files\<DIR> Ulead Systems

[13/07/2008|06:32] C:\Program Files\Common Files\<DIR> WindowsLiveInstaller

[27/12/2008|05:22] C:\Program Files\Common Files\<DIR> Wise Installation Wizard

--------------------\\ Process

( 59 Processes )

IEXPLORE.EXE ~ [PID:167016]

iexplore.exe ~ [PID:167824]

--------------------\\ Searching with S_Lop

No Lop folder found !

--------------------\\ Searching for Lop Files - Folders

No Lop folder found !

--------------------\\ Searching within the Registry

..... OK !

--------------------\\ Checking the Hosts file

Hosts file CLEAN

--------------------\\ Searching for hidden files with Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-03-09 17:32:06

Windows 5.1.2600 Service Pack 3 NTFS

detected NTDLL code modification:

ZwOpenFile

scanning hidden processes ...

? [13564]

? [15500]

? [26556]

? [22960]

? [36752]

? [9036]

? [24572]

scanning hidden files ...

scan completed successfully

hidden processes: 7

hidden files: 38

--------------------\\ Searching for other infections

No other infections found !

[F:2538][D:27]-> C:\DOCUME~1\phill\LOCALS~1\Temp

[F:35][D:0]-> C:\DOCUME~1\phill\Cookies

[F:1088][D:4]-> C:\DOCUME~1\phill\LOCALS~1\TEMPOR~1\content.IE5

1 - "C:\Lop SD\LopR_1.txt" - Mon 09/03/2009|17:32 - Option : [1]

--------------------\\ Scan completed at 17:32:59

AdvancedSetup · March 9, 2009

Okay you have something loading that should not be.

Please run the following tool and we'll scan more and remove it.

Please uninstall your uTorrent software and any other Peer2Peer file sharing software while we're working on your computer. When we're done you can re-install it if you want.

Please visit this webpage for instructions for downloading ComboFix to your

DESKTOP

:

how-to-use-combofix

Please ensure you read this guide carefully and install the Recovery Console first.

NOTE!!:

You must save and run

ComboFix.exe

on your DESKTOP and not from any other folder.

Also,

DO NOT

click the mouse or launch any other applications while this is running or it may stall the program

Additional links to download the tool:

ComboFix.exe

Note:

The

Windows Recovery Console

will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

Once installed, you should see a blue screen prompt that says:

The Recovery Console was successfully installed.

Please continue as follows:

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
Click
Yes
to allow ComboFix to continue scanning for malware.
When the tool is finished, it will produce a report for you.
Please post the
C:\ComboFix.txt
along with a
new HijackThis log
so we may continue cleaning the system.

militaryman73 · March 9, 2009

Thanks for your help so far. When running combifix, i had a warning to say that AVG was still running. I had alreaddy exited from AVG. Using windows task manager to close the running AVG applications, the automatically restarted after I had ended the process.

Here are the two logs.

Thanks again Phill

ComboFix 09-03-06.02 - phill 2009-03-09 17:57:12.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.587 [GMT 11:00]

Running from: c:\documents and settings\phill\Desktop\ComboFix.exe

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated)

* Created a new restore point

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat

c:\documents and settings\phill\reader_s.exe

c:\windows\file.bat

c:\windows\services.exe

c:\windows\system32\5.tmp

c:\windows\system32\7.tmp

c:\windows\system32\9.tmp

c:\windows\system32\B.tmp

c:\windows\system32\inf\rundll33.exe

c:\windows\system32\reader_s.exe

c:\windows\xccwinsys.ini

----- BITS: Possible infected sites -----

hxxp://bondsoul.com

c:\windows\system32\userinit.exe . . . is infected!!

c:\windows\system32\svchost.exe . . . is infected!!

c:\windows\system32\spoolsv.exe . . . is infected!!

c:\windows\explorer.exe . . . is infected!!

.

((((((((((((((((((((((((( Files Created from 2009-02-09 to 2009-03-09 )))))))))))))))))))))))))))))))

.

2009-03-09 18:03 . 2009-03-09 18:03 80 --a------ c:\windows\system32\2.tmp

2009-03-09 17:29 . 2009-03-09 17:32 <DIR> d-------- C:\Lop SD

2009-03-09 16:53 . 2009-03-09 16:53 80 --a------ c:\windows\system32\8.tmp

2009-03-09 16:47 . 2009-03-09 16:48 80 --a------ c:\windows\system32\6.tmp

2009-03-09 16:31 . 2009-03-09 16:31 80 --a------ c:\windows\system32\4.tmp

2009-03-09 04:56 . 2009-03-09 04:56 80 --a------ c:\windows\system32\3.tmp

2009-03-08 17:37 . 2009-03-08 17:37 <DIR> d-------- c:\program files\CCleaner

2009-03-08 17:35 . 2009-03-08 17:35 <DIR> d-------- c:\program files\Trend Micro

2009-03-08 16:03 . 2009-03-08 16:03 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Malwarebytes

2009-03-08 15:09 . 2009-03-08 15:09 <DIR> d-------- c:\documents and settings\Administrator

2009-03-08 14:40 . 2009-03-08 14:40 38,913 --a------ c:\windows\system32\17.tmp

2009-03-08 14:40 . 2009-03-08 14:40 80 --a------ c:\windows\system32\15.tmp

2009-03-08 08:38 . 2009-03-08 08:38 38,913 --a------ c:\windows\system32\45D.tmp

2009-03-08 08:38 . 2009-03-08 08:38 80 --a------ c:\windows\system32\45B.tmp

2009-03-08 08:08 . 2009-03-08 08:08 60 --a------ c:\windows\wininit.ini

2009-03-08 07:49 . 2009-03-09 17:57 <DIR> d-------- c:\windows\system32\inf

2009-03-08 07:49 . 2009-03-08 07:49 25,601 --a------ c:\windows\system32\442.tmp

2009-03-08 07:49 . 2009-03-08 07:49 80 --a------ c:\windows\system32\43E.tmp

2009-03-08 07:49 . 2009-03-08 07:49 0 --a------ c:\windows\system32\443.tmp

2009-02-25 18:53 . 2009-02-25 20:41 1,668 --a------ c:\documents and settings\phill\Application Data\filterclsid.dat

2009-02-25 17:21 . 2009-02-25 17:21 <DIR> d-------- c:\documents and settings\phill\Application Data\Samsung

2009-02-25 17:20 . 2006-05-03 22:53 174,592 --a------ c:\windows\system32\framedyn.dll

2009-02-25 17:20 . 2006-07-24 16:05 5,632 --a------ c:\windows\system32\drivers\StarOpen.sys

2009-02-25 17:18 . 2009-02-25 17:18 <DIR> d-------- c:\windows\system32\Samsung_USB_Drivers

2009-02-25 17:18 . 2009-02-25 17:18 <DIR> d-------- c:\program files\Samsung

2009-02-25 17:18 . 2007-07-03 16:58 106,792 --a------ c:\windows\system32\drivers\sscdmdm.sys

2009-02-25 17:18 . 2007-07-03 16:54 80,552 --a------ c:\windows\system32\drivers\sscdbus.sys

2009-02-25 17:18 . 2007-07-03 16:57 11,944 --a------ c:\windows\system32\drivers\sscdmdfl.sys

2009-02-25 17:18 . 2007-07-03 17:00 9,256 --a------ c:\windows\system32\drivers\sscdwhnt.sys

2009-02-25 17:18 . 2007-07-03 17:00 9,256 --a------ c:\windows\system32\drivers\sscdwh.sys

2009-02-25 17:18 . 2007-07-03 16:56 9,256 --a------ c:\windows\system32\drivers\sscdcmnt.sys

2009-02-25 17:18 . 2007-07-03 16:56 9,256 --a------ c:\windows\system32\drivers\sscdcm.sys

2009-02-25 17:18 . 2005-08-28 20:51 766 --a------ c:\windows\system32\Uninstall.ico

2009-02-18 18:37 . 2009-03-08 08:06 <DIR> d-------- c:\program files\PowerISO

2009-02-17 07:30 . 2009-03-08 08:34 <DIR> d-------- c:\program files\EZ-Rent

2009-02-17 07:29 . 2009-02-17 07:29 90,624 --a------ c:\windows\ST6UNST.EXE

2009-02-10 18:39 . 2009-02-10 18:39 <DIR> d-------- c:\documents and settings\All Users\Application Data\NCH Swift Sound

2009-02-10 18:38 . 2009-02-10 18:38 <DIR> d-------- c:\program files\NCH Swift Sound

2009-02-10 18:38 . 2009-02-10 18:38 <DIR> d-------- c:\program files\NCH Software

2009-02-10 18:38 . 2009-02-10 18:38 <DIR> d-------- c:\documents and settings\phill\Application Data\NCH Swift Sound

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-03-09 07:03 24,577 ----a-w c:\windows\services.exe

2009-03-09 06:53 38,913 ----a-w c:\windows\system32\25.tmp

2009-03-08 09:13 --------- d-----w c:\documents and settings\phill\Application Data\Orbit

2009-03-08 07:00 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

2009-03-08 06:49 --------- d-----w c:\program files\Free Video Zilla

2009-03-08 06:49 --------- d-----w c:\documents and settings\phill\Application Data\FVZilla

2009-03-08 02:38 --------- d-----w c:\program files\Malwarebytes' Anti-Malware

2009-03-07 21:48 --------- d-----w c:\documents and settings\phill\Application Data\uTorrent

2009-03-07 21:09 --------- d-----w c:\program files\TibEd 2

2009-03-05 07:54 --------- d-----w c:\program files\PhotoWatermark Professional 6

2009-02-26 17:22 --------- d-----w c:\program files\QuickTime

2009-02-25 16:06 --------- d-----w c:\program files\Magic Video Converter

2009-02-25 06:19 --------- d--h--w c:\program files\InstallShield Installation Information

2009-02-16 17:36 --------- d-----w c:\program files\Spybot - Search & Destroy

2009-02-11 17:43 325,128 ----a-w c:\windows\system32\drivers\avgldx86.sys

2009-02-11 17:43 107,272 ----a-w c:\windows\system32\drivers\avgtdix.sys

2009-02-11 17:43 10,520 ----a-w c:\windows\system32\avgrsstx.dll

2009-02-11 17:43 --------- d-----w c:\documents and settings\All Users\Application Data\avg8

2009-02-10 23:19 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys

2009-02-10 23:19 15,504 ----a-w c:\windows\system32\drivers\mbam.sys

2009-02-07 18:17 --------- d-----w c:\documents and settings\phill\Application Data\GrabPro

2009-01-31 01:28 --------- d-----w c:\documents and settings\phill\Application Data\SPORE Creature Creator

2009-01-26 08:00 --------- d-----w c:\documents and settings\phill\Application Data\Command & Conquer 3 Tiberium Wars

2008-12-20 23:15 826,368 ----a-w c:\windows\system32\wininet.dll

2008-12-18 18:34 410,984 ----a-w c:\windows\system32\deploytk.dll

2008-12-16 08:53 107,888 ----a-w c:\windows\system32\CmdLineExt.dll

2003-07-31 09:53 147,456 ----a-w c:\windows\inf\EL2K_XP.sys

2003-07-31 09:50 448,768 ----a-w c:\windows\inf\EL2K_N64.sys

2003-07-31 09:43 147,456 ----a-w c:\windows\inf\EL2K_2K.sys

.

------- Sigcheck -------

2004-08-04 23:00 31744 f9fa5072359b3b9f906c5d659c89df6e c:\windows\$NtServicePackUninstall$\svchost.exe

2008-04-14 11:12 31744 d624f1044fedf53e9ecb4056e397e750 c:\windows\ServicePackFiles\i386\svchost.exe

2008-04-14 11:12 31744 053356ed8db405fb5bd0cb7fb76b3e1b c:\windows\system32\svchost.exe

2008-04-14 11:12 1051136 955481f59284d247fcfe7ed462d6b073 c:\windows\explorer.exe

2004-08-04 23:00 1049600 6d773c6422a361e03decf67a768541d4 c:\windows\$NtServicePackUninstall$\explorer.exe

2008-04-14 11:12 1051136 33adfe661ebf8f33ffcacec43ee21510 c:\windows\ServicePackFiles\i386\explorer.exe

2004-08-04 23:00 32768 b6110d4138d84bf0c223d660e6b6442b c:\windows\$NtServicePackUninstall$\ctfmon.exe

2008-04-14 11:12 32768 3ff85fd13a9dc980473028d0d49481d8 c:\windows\ServicePackFiles\i386\ctfmon.exe

2008-04-14 11:12 32768 5840404a031f9a3e43eb89e82cfd3529 c:\windows\system32\ctfmon.exe

2004-08-04 23:00 75264 0e45e7557d645830f6312d6a2735032a c:\windows\$NtServicePackUninstall$\spoolsv.exe

2008-04-14 11:12 75264 a39aac4fd568a0341811fc0aa726d919 c:\windows\ServicePackFiles\i386\spoolsv.exe

2008-04-14 11:12 75264 589dc330b8db819fa4681d3eaca13a11 c:\windows\system32\spoolsv.exe

2004-08-04 23:00 42496 52600fcca917842060f84e685fcd75c6 c:\windows\$NtServicePackUninstall$\userinit.exe

2008-04-14 11:12 43520 b0e8b419adb02a8cdf3c354d5f7657a3 c:\windows\ServicePackFiles\i386\userinit.exe

2008-04-14 11:12 43520 f7b06df4b5914c2fda7c536d91482187 c:\windows\system32\userinit.exe

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 32768]

"Yahoo! Pager"="c:\progra~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" [2007-08-30 4670704]

"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]

"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-12-23 163840]

"EPSON Stylus Photo R210 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_S4I3H2.EXE" [2003-09-11 117248]

"DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2006-11-12 157592]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2003-05-29 811008]

"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-09-25 110592]

"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-02-12 1601304]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-19 136600]

"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 176128]

"BigDogPath"="c:\windows\VM_STI.EXE" [2005-02-28 73728]

"EPSON Stylus Photo R210 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_S4I3H2.EXE" [2003-09-11 117248]

"DiscWizardMonitor.exe"="c:\program files\Seagate\DiscWizard\DiscWizardMonitor.exe" [2008-06-24 1325848]

"AcronisTimounterMonitor"="c:\program files\Seagate\DiscWizard\TimounterMonitor.exe" [2008-06-24 904768]

"Seagate Scheduler2 Service"="c:\program files\Common Files\Seagate\Schedule2\schedhlp.exe" [2008-06-24 136472]

"PinnacleDriverCheck"="c:\windows\system32\PSDrvCheck.exe" [2004-03-10 423424]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-10-19 118784]

"UVS12 Preload"="d:\ulead 12\uvPL.exe" [2008-06-09 397456]

"PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2008-11-02 188416]

"MSConfig"="c:\windows\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2008-04-14 187392]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 32768]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-07-27 131072]

Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]

VIA RAID TOOL.lnk - c:\program files\VIA\RAID\raid_tool.exe [2008-07-13 585728]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]

"Userinit"="c:\windows\explorer.exe,"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]

2009-02-12 04:43 10520 c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"VIDC.X264"= x264vfw.dll

"VIDC.3iv2"= 3ivxVfWCodec.dll

"msacm.dvacm"= c:\progra~1\COMMON~1\ULEADS~1\Vio\Dvacm.acm

"VIDC.MJPG"= Pvmjpg21.dll

"VIDC.PIM1"= pclepim1.dll

"msacm.MPEGacm"= c:\progra~1\COMMON~1\ULEADS~1\MPEG\MPEGacm.acm

"msacm.ulmp3acm"= c:\progra~1\COMMON~1\ULEADS~1\MPEG\ulmp3acm.acm

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"FirewallOverride"=dword:00000001

R0 viaraid;viaraid;c:\windows\system32\drivers\viaraid.sys [2008-07-13 72192]

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-07-14 325128]

R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-07-14 107272]

R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-07-14 903960]

R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-07-14 298264]

R2 SgtSch2Svc;Seagate Scheduler2 Service;c:\program files\Common Files\Seagate\Schedule2\schedul2.exe [2008-06-24 431384]

S3 AIDA32Driver;AIDA32Driver;\??\c:\docume~1\phill\LOCALS~1\Temp\Rar$EX00.875\aida32.sys --> c:\docume~1\phill\LOCALS~1\Temp\Rar$EX00.875\aida32.sys [?]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{38a65df1-c34a-11dd-b6bb-000ea63d51db}]

\Shell\AutoRun\command - T:\DTSP_Launcher.exe

.

Contents of the 'Scheduled Tasks' folder

2009-03-07 c:\windows\Tasks\Spybot - Search & Destroy - Scheduled Task.job

- c:\program files\Spybot - Search & Destroy\SpybotSD.exe [2009-01-26 15:31]

2009-03-07 c:\windows\Tasks\Spybot - Search & Destroy Updater - Scheduled Task.job

- c:\program files\Spybot - Search & Destroy\SDUpdate.exe [2009-01-26 15:31]

.

- - - - ORPHANS REMOVED - - - -

HKLM-Run-c:\program files\Free Video Zilla\FVZilla.exe - (no file)

HKU-Default-Run-nidle - c:\documents and settings\phill\Application Data\nidle\nidle.exe

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.news.com.au

mStart Page = hxxp://www.news.com.au

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000

IE: Locate Spot on Map by GPS - c:\program files\Opanda\IExif 2.3\IExifMap.htm

IE: View Exif/GPS/IPTC with IExif - c:\program files\Opanda\IExif 2.3\IExifCom.htm

Trusted Zone: microsoft.com\download.windowsupdate

Trusted Zone: microsoft.com\update

FF - ProfilePath - c:\documents and settings\phill\Application Data\Mozilla\Firefox\Profiles\zkwlh7gi.default\

.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-03-09 18:06:24

Windows 5.1.2600 Service Pack 3 NTFS

detected NTDLL code modification:

ZwOpenFile

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

c:\windows\system32\C.tmp 33280 bytes executable

scan completed successfully

hidden files: 1

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1004336348-1364589140-839522115-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]

"??"=hex:66,94,cc,f3,0c,5e,a5,d8,bb,b4,9e,29,d1,b5,ab,55,2d,74,af,58,3b,88,42,

b4,53,fc,7d,45,62,06,5a,f7,9e,9c,95,9c,0c,a9,11,d0,18,f7,08,70,f7,72,9e,37,\

"??"=hex:2f,b6,6f,45,ee,e2,ec,0a,29,d5,69,d3,55,fd,2c,18

[HKEY_USERS\S-1-5-21-1004336348-1364589140-839522115-1003\Software\SecuROM\License information*]

"datasecu"=hex:df,f4,07,a6,e3,cd,8f,92,4c,6a,a5,88,20,37,0f,89,a9,65,27,89,be,

f6,db,f1,ee,1f,cb,8b,56,50,c9,06,2e,3b,a3,48,c6,28,b1,d3,fc,29,75,6f,d7,50,\

"rkeysecu"=hex:49,ad,0a,06,c6,9f,3b,a1,ac,01,13,5b,fa,e9,24,10

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]

"ThreadingModel"="Apartment"