Lost Icons and right click

msager · March 9, 2009

Windows Explorer and Internet Explorer errors at startup, also no icons on the desktop. Unable to right click anything in the start menu. Cannot save anything to the desktop and cannot access thumb drives. Some programs in the start menu will run. Can run some commands from task manager, but not many. Windows XP Pro SP3

AdvancedSetup · March 9, 2009

Please try to download and burn this from a friends computer or work computer and run it.

Avira AntiVir Rescue System

Requires access to a working computer with a CD/DVD burner to create a bootable CD.

Download the
Avira AntiVir Rescue System
from
here
Place a blank CD in your burner and double-click on the downloaded file.
The program will automatically burn the CD for you.
Place the burned CD into the affected computer and start the computer from this CD.
On the bottom left side of the screen there are 2 flags. Using your mouse click on the British flag to use English.
Click on the
Configuration
button.
- Select
  Scan all files
- Select
  Try to repair infected files
  and
  Rename files, if they cannot be removed
- Select
  Scan for dialers
- Select
  Scan for joke programs (Jokes)
- Select
  Scan for games
- Select
  Scan for spyware (SPR)
[*]
Click on
Virus scanner
[*]
Click on
Start scanner
at the bottom of the screen
[*]
Currently the program does not support saving a log. Write down the amount of items for Records, Suspect files, and Warnings

The Avira AntiVir Rescue System is a Linux-based application that allows accessing computers that cannot be booted anymore and is updated several times a day so that the most recent security updates are always available.

Screen resolution problems

Please see the post

here

if you're unable to view the entire screen of Avira.

msager · March 9, 2009

Please try to download and burn this from a friends computer or work computer and run it.
Avira AntiVir Rescue System
Requires access to a working computer with a CD/DVD burner to create a bootable CD.
Download the
Avira AntiVir Rescue System
from
here
Place a blank CD in your burner and double-click on the downloaded file.
The program will automatically burn the CD for you.
Place the burned CD into the affected computer and start the computer from this CD.
On the bottom left side of the screen there are 2 flags. Using your mouse click on the British flag to use English.
Click on the
Configuration
button.
Select
Scan all files
Select
Try to repair infected files
and
Rename files, if they cannot be removed
Select
Scan for dialers
Select
Scan for joke programs (Jokes)
Select
Scan for games
Select
Scan for spyware (SPR)
[*]
Click on
Virus scanner
[*]
Click on
Start scanner
at the bottom of the screen
[*]
Currently the program does not support saving a log. Write down the amount of items for Records, Suspect files, and Warnings
The Avira AntiVir Rescue System is a Linux-based application that allows accessing computers that cannot be booted anymore and is updated several times a day so that the most recent security updates are always available.
Screen resolution problems
Please see the post
here
http://forum.avira.com/wbb/index.php?page=Thread&threadID=82578' rel="external nofollow">
if you're unable to view the entire screen of Avira.

I ran the program and the following is what the log said:

Checking the master boot record of drive 128

Error(2) cannot read record

Checking the master boot record of drive 129

Error(2) cannot read record

Checking the master boot record of drive 130

Error(2) cannot read record

directories 13

scanned files 35

alerts 0

suspicios 0

(Table at bottom) Listed 1 less file??

Scanned files 34

scanned directories 13

Rebooted after and same results, it seems that symantec and avg load then when CA antispyware loads the windows explorer error pops up.

msager · March 9, 2009

ran the program and the following is what the log said:

Checking the master boot record of drive 128

Error(2) cannot read record

Checking the master boot record of drive 129

Error(2) cannot read record

Checking the master boot record of drive 130

Error(2) cannot read record

directories 13

scanned files 35

alerts 0

suspicios 0

(Table at bottom) Listed 1 less file??

Scanned files 34

scanned directories 13

Rebooted after and same results, it seems that symantec and avg load then when CA antispyware loads the windows explorer error pops up.

msager · March 10, 2009

Tried the Boot record repair from Avira and still no luck, also I'm running a striped raid, not sure if that makes a difference or not

AdvancedSetup · March 11, 2009

Okay well I need to know which one you want to work on and I'll close the other post for now until we get one cleaned.

Take these off of the network from each other and don't allow them to share devices such as USB drives if both are infected. Keep them isolated and use a CD if you need to for cleaning/scanning for now.

Well it depends on if the Linux portion saw and mounted your RAID properly. RAID is fast but can add to trouble for repairs.

Choose a system to work on and let me know please.

msager · March 13, 2009

I'm only working on one computer with all these problems, sorry I didn't just add to the same posting, I'm new at this. I will wait for further instructions on what it is you would like for me to do. Thank you for all your help.

AdvancedSetup · March 13, 2009

Okay I'll remove your other post then - maybe you accidentally double posted.

Let's try a Disk Check on the drive then first off and work from there. Let me know if the disk check runs or not please.

You may have corrupted files on your disk. Please try running the following.

First close ALL Applications as this routine will automatically restart your computer.

Click on START - RUN and copy / paste the following entry into the box and click OK

CMD /C ECHO Y|CHKDSK C: /F | SHUTDOWN /R /T 30

msager · March 13, 2009

I cannot click Start - Run, most items in the start menu don't open. I can open the task manager and run some commands there. I can run cmd.exe and open a dos window to type your command if that will work. The cmd prompt is the only way I can get to the cd drive or the usb drives to run programs that you request to be run. I can't put anything on the desktop or open My Computer. The Start Menu is also hosed in the safe mode.

msager · March 14, 2009

I ran the script above from the task manager and it rebooted after it ran chkdsk, no change , i ran a rootkit unhooker and symantec finds a trojan each time I scan with the rootkit unhooker that is in the windows\system32 folder. It changes numbers and letters each time but it's an *********.exe each time.

AdvancedSetup · March 14, 2009

So can you copy and run programs in Windows normal or safe mode?

Please try this if you can.

Please download to your Desktop: Dr.Web CureIt

After the file has downloaded, disable your current Anti-Virus and disconnect from the Internet
Doubleclick the drweb-cureit.exe file, then click the Start button, then the OK button to perform an Express Scan.
This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it.
Once the short scan has finished, Click on the Complete scan radio button.
Then click on the Settings menu on top, the select Change Settings or press the F9 key. You can also change the Language
Choose the Scanning tab and I recomend leaving the Heuristic analysis enabled (this can lead to False Positives though)
On the File types tab ensure you select All files
Click on the Actions tab and set the following:
- Objects Infected objects = Cure, Incurable objects = Move, Suspicious objects = Report
- Infected packages Archive = Move, E-mails = Report, Containers = Move
- Malware Adware = Move, Dialers = Move, Jokes = Move, Riskware = Move, Hacktools = Move
- Do not change the Rename extension - default is: #??
- Leave the default save path for Moved files here: %USERPROFILE%\DoctorWeb\Quarantine\
- Leave prompt on Action checked
[*]On the Log file tab leave the Log to file checked.
[*]Leave the log file path alone: %USERPROFILE%\DoctorWeb\CureIt.log
[*]Log mode = Append
[*]Encoding = ANSI
[*]Details Leave Names of file packers and Statistics checked.
[*]Limit log file size = 2048 KB and leave the check mark on the Maximum log file size.
[*]On the General tab leave the Scan Priority on High
[*]Click the Apply button at the bottom, and then the OK button.
[*]On the right side under the Dr Web Anti-Virus Logo you will see 3 little buttons. Click the left VCR style Start button.
[*]In this mode it will scan Boot sectors of all disks, All removable media, and all local drives
[*]The more files and folders you have the longer the scan will take. On large drives it can take hours to complete.
[*]When the Cure option is selected, an additional context menu will open. Select the necessary action of the program, if the curing fails.
[*]Click 'Yes to all' if it asks if you want to cure/move the files.
[*]This will move it to the %USERPROFILE%\DoctorWeb\Quarantine\ folder if it can't be cured. (in this case we need samples)
[*]After selecting, in the Dr.Web CureIt menu on top, click file and choose save report list
[*]Save the report to your Desktop. The report will be called DrWeb.csv
[*]Close Dr.Web Cureit.
[*]Reboot your computer!! Because it could be possible that files in use will be moved/deleted during reboot.
[*]After reboot, post the contents of the log from Dr.Web you saved previously to your Desktop in your next reply with a new hijackthis log.

msager · March 15, 2009

Hijackthis log, I ran the DrWeb but I can't get to the report, now the task manager is locked up and I can't get to teh cmd propt. I'll have to reboot in the safe made and try and coipy the file to a thumb drive and then send it from another computer

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 8:37:23 PM, on 3/14/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16791)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Windows Defender\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe

C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe

C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Symantec AntiVirus\DefWatch.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

C:\WINDOWS\system32\PnkBstrA.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Symantec AntiVirus\Rtvscan.exe

C:\Program Files\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe

C:\PROGRA~1\AVG\AVG8\avgrsx.exe

C:\PROGRA~1\AVG\AVG8\avgnsx.exe

C:\WINDOWS\system32\SearchIndexer.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\system32\taskmgr.exe

C:\WINDOWS\Explorer.exe

C:\WINDOWS\system32\dwwin.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\WINDOWS\system32\wuauclt.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.html

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll

O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll

O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\RunOnce: [WUAppSetup] C:\Program Files\Common Files\logishrd\WUApp32.exe -v 0x046d -p 0x08d7 -f video -m logitech -d 10.5.1.2023 (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')

O4 - HKUS\.DEFAULT\..\RunOnce: [WUAppSetup] C:\Program Files\Common Files\logishrd\WUApp32.exe -v 0x046d -p 0x08d7 -f video -m logitech -d 10.5.1.2023 (User 'Default user')

O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1151004321390

O16 - DPF: {B49C4597-8721-4789-9250-315DFBD9F525} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/radio/ampx/ampx2.6.1.11_en_dl.cab

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll

O23 - Service: 0E988D8D - Unknown owner - C:\WINDOWS\system32\0E988D8D.exe (file missing)

O23 - Service: 158E506C - Unknown owner - C:\WINDOWS\system32\158E506C.exe (file missing)

O23 - Service: 15A52599 - Unknown owner - C:\WINDOWS\system32\15A52599.exe (file missing)

O23 - Service: 2BF94419 - Unknown owner - C:\WINDOWS\system32\2BF94419.exe (file missing)

O23 - Service: 30D465A3 - Unknown owner - C:\WINDOWS\system32\30D465A3.exe (file missing)

O23 - Service: 31ED6D9B - Unknown owner - C:\WINDOWS\system32\31ED6D9B.exe (file missing)

O23 - Service: 4248ECE6 - Unknown owner - C:\WINDOWS\system32\4248ECE6.exe (file missing)

O23 - Service: 4414E65E - Unknown owner - C:\WINDOWS\system32\4414E65E.exe (file missing)

O23 - Service: 45A8C6C4 - Unknown owner - C:\WINDOWS\system32\45A8C6C4.exe (file missing)

O23 - Service: 56C0A6EF - Unknown owner - C:\WINDOWS\system32\56C0A6EF.exe (file missing)

O23 - Service: 591DF56E - Unknown owner - C:\WINDOWS\system32\591DF56E.exe (file missing)

O23 - Service: 5E18568A - Unknown owner - C:\WINDOWS\system32\5E18568A.exe (file missing)

O23 - Service: 60D372E4 - Unknown owner - C:\WINDOWS\system32\60D372E4.exe (file missing)

O23 - Service: 60DBFA3C - Unknown owner - C:\WINDOWS\system32\60DBFA3C.exe (file missing)

O23 - Service: 688304B2 - Unknown owner - C:\WINDOWS\system32\688304B2.exe (file missing)

O23 - Service: 68B0EC3A - Unknown owner - C:\WINDOWS\system32\68B0EC3A.exe (file missing)

O23 - Service: 69633044 - Unknown owner - C:\WINDOWS\system32\69633044.exe (file missing)

O23 - Service: 780C87AC - Unknown owner - C:\WINDOWS\system32\780C87AC.exe (file missing)

O23 - Service: 831CB1F1 - Unknown owner - C:\WINDOWS\system32\831CB1F1.exe (file missing)

O23 - Service: 89DE770E - Unknown owner - C:\WINDOWS\system32\89DE770E.exe (file missing)

O23 - Service: 90947B6B - Unknown owner - C:\WINDOWS\system32\90947B6B.exe (file missing)

O23 - Service: 96865B4E - Unknown owner - C:\WINDOWS\system32\96865B4E.exe (file missing)

O23 - Service: A7B5AA42 - Unknown owner - C:\WINDOWS\system32\A7B5AA42.exe (file missing)

O23 - Service: A87A50BF - Unknown owner - C:\WINDOWS\system32\A87A50BF.exe (file missing)

O23 - Service: A91F1F66 - Unknown owner - C:\WINDOWS\system32\A91F1F66.exe (file missing)

O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe

O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe

O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

O23 - Service: B0C37D52 - Unknown owner - C:\WINDOWS\system32\B0C37D52.exe (file missing)

O23 - Service: B0ECF3AD - Unknown owner - C:\WINDOWS\system32\B0ECF3AD.exe (file missing)

O23 - Service: B10F43E4 - Unknown owner - C:\WINDOWS\system32\B10F43E4.exe (file missing)

O23 - Service: BED63A58 - Unknown owner - C:\WINDOWS\system32\BED63A58.exe (file missing)

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: C2851EEA - Unknown owner - C:\WINDOWS\system32\C2851EEA.exe (file missing)

O23 - Service: C8006BAF - Unknown owner - C:\WINDOWS\system32\C8006BAF.exe (file missing)

O23 - Service: CB4B32DE - Unknown owner - C:\WINDOWS\system32\CB4B32DE.exe (file missing)

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

O23 - Service: D2A599DE - Unknown owner - C:\WINDOWS\system32\D2A599DE.exe (file missing)

O23 - Service: D2D5F759 - Unknown owner - C:\WINDOWS\system32\D2D5F759.exe (file missing)

O23 - Service: D9AE45EE - Unknown owner - C:\WINDOWS\system32\D9AE45EE.exe (file missing)

O23 - Service: DB9F6DBA - Unknown owner - C:\WINDOWS\system32\DB9F6DBA.exe (file missing)

O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe

O23 - Service: E23B2A84 - Unknown owner - C:\WINDOWS\system32\E23B2A84.exe (file missing)

O23 - Service: EBF6A547 - Unknown owner - C:\WINDOWS\system32\EBF6A547.exe (file missing)

O23 - Service: EF045108 - Unknown owner - C:\WINDOWS\system32\EF045108.exe (file missing)

O23 - Service: EFD8A1E7 - Unknown owner - C:\WINDOWS\system32\EFD8A1E7.exe (file missing)

O23 - Service: F133DFE1 - Unknown owner - C:\WINDOWS\system32\F133DFE1.exe (file missing)

O23 - Service: F98DBD8C - Unknown owner - C:\WINDOWS\system32\F98DBD8C.exe (file missing)

O23 - Service: FC4B0C77 - Unknown owner - C:\WINDOWS\system32\FC4B0C77.exe (file missing)

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe

O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe

O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

O23 - Service: Acronis Try And Decide Service (TryAndDecideService) - Unknown owner - C:\Program Files\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe

--

End of file - 13309 bytes

msager · March 15, 2009

It did not save a Drweb fil eto the desktop, anytime you try to do anything to the desktop or a drive it closes the application running, I did find a CureIt.log which is attached as a word document.

CureItlog.doc

AdvancedSetup · March 15, 2009

Please see if you can run this in Safe Mode then.

Please visit this webpage for instructions for downloading ComboFix to your

DESKTOP

:

how-to-use-combofix

Please ensure you read this guide carefully and install the Recovery Console first.

NOTE!!:

You must save and run

ComboFix.exe

on your DESKTOP and not from any other folder.

Also,

DO NOT

click the mouse or launch any other applications while this is running or it may stall the program

Additional links to download the tool:

ComboFix.exe

Note:

The

Windows Recovery Console

will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

Once installed, you should see a blue screen prompt that says:

The Recovery Console was successfully installed.

Please continue as follows:

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
Click
Yes
to allow ComboFix to continue scanning for malware.
When the tool is finished, it will produce a report for you.
Please post the
C:\ComboFix.txt
along with a
new HijackThis log
so we may continue cleaning the system.

msager · March 16, 2009

ComboFix 09-03-14.02 - Administrator 2009-03-15 19:14:15.1 - NTFSx86 MINIMAL

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1024.819 [GMT -6:00]

Running from: c:\documents and settings\Administrator\Desktop\combofix.exe

AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated)

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

((((((((((((((((((((((((( Files Created from 2009-02-16 to 2009-03-16 )))))))))))))))))))))))))))))))

.

2009-03-14 16:15 . 2009-03-14 16:15 <DIR> d-------- c:\documents and settings\Andrew\Application Data\Windows Search

2009-03-14 11:26 . 2009-03-14 13:07 <DIR> d-------- c:\documents and settings\Andrew\DoctorWeb

2009-03-14 08:17 . 2009-03-14 07:40 13,003,144 --a------ C:\drweb-cureit.exe

2009-03-13 22:32 . 2009-03-13 22:32 <DIR> d-------- c:\program files\Avira GmbH

2009-03-13 22:31 . 2009-03-13 22:32 <DIR> d-------- C:\antivir_rootkit

2009-03-13 22:03 . 2009-03-13 21:48 99,328 --a------ C:\rku.exe

2009-03-11 03:00 . 2009-03-11 03:00 1,374 --a------ c:\windows\imsins.BAK

2009-03-08 12:40 . 2009-03-08 12:40 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Malwarebytes

2009-03-07 23:56 . 2009-03-07 23:56 <DIR> d-------- c:\documents and settings\Andrew\Application Data\Uniblue

2009-03-07 23:55 . 2009-03-07 23:55 <DIR> d-------- c:\program files\Uniblue

2009-03-07 23:54 . 2009-03-07 23:55 <DIR> d--h-c--- c:\documents and settings\All Users\Application Data\{B46E1EF5-0B37-4DB4-A4E2-9F2B41036185}

2009-03-07 23:18 . 2009-03-07 23:19 <DIR> d-------- c:\program files\CCleaner

2009-03-07 21:29 . 2009-03-07 21:30 <DIR> d-------- c:\program files\Spybot - Search & Destroy

2009-03-07 21:29 . 2009-03-08 20:07 <DIR> d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

2009-03-07 21:21 . 2009-03-07 21:21 <DIR> d-------- c:\documents and settings\Andrew\Application Data\Malwarebytes

2009-03-07 21:21 . 2009-02-11 11:19 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys

2009-03-07 21:21 . 2009-02-11 11:19 15,504 --a------ c:\windows\system32\drivers\mbam.sys

2009-03-07 21:14 . 2009-03-07 21:14 <DIR> d-------- c:\program files\Trend Micro

2009-03-07 14:38 . 2009-03-07 15:04 <DIR> d-------- c:\documents and settings\Andrew\.housecall6.6

2009-03-07 14:27 . 2009-03-07 19:46 <DIR> d-------- c:\windows\BDOSCAN8

2009-03-07 12:13 . 2009-03-07 21:21 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware

2009-03-07 12:13 . 2009-03-07 12:13 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes

2009-03-07 05:15 . 2009-01-09 13:19 1,089,593 -----c--- c:\windows\system32\dllcache\ntprint.cat

2009-03-06 21:55 . 2009-03-07 07:55 <DIR> d--h----- C:\$AVG8.VAULT$

2009-03-06 21:16 . 2009-03-13 17:30 <DIR> d-------- c:\windows\system32\drivers\Avg

2009-03-06 21:16 . 2009-03-06 21:16 <DIR> d-------- c:\program files\AVG

2009-03-06 21:16 . 2009-03-06 21:20 <DIR> d-------- c:\documents and settings\Andrew\Application Data\AVGTOOLBAR

2009-03-06 21:16 . 2009-03-07 07:59 <DIR> d-------- c:\documents and settings\All Users\Application Data\avg8

2009-03-06 21:16 . 2009-03-06 21:16 325,640 --a------ c:\windows\system32\drivers\avgldx86.sys

2009-03-06 21:16 . 2009-03-06 21:16 107,912 --a------ c:\windows\system32\drivers\avgtdix.sys

2009-03-06 21:16 . 2009-03-06 21:16 10,520 --a------ c:\windows\system32\avgrsstx.dll

2009-03-06 17:03 . 2009-03-06 17:03 127 --a------ c:\windows\system32\MRT.INI

2009-03-06 16:51 . 2009-03-06 16:51 <DIR> d-------- C:\013e50114eb824a75dd8

2009-03-06 16:50 . 2009-03-06 17:10 <DIR> d-------- c:\windows\SxsCaPendDel

2009-03-05 22:34 . 2009-03-13 21:02 <DIR> d-------- c:\program files\Exterminate It!

2009-03-05 22:21 . 2009-03-05 22:21 <DIR> d-------- c:\program files\Windows Defender

2009-03-05 16:10 . 2009-03-05 16:10 2 --a------ C:\739352304

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-03-16 01:18 --------- d-----w c:\program files\Symantec AntiVirus

2009-03-14 04:32 --------- d--h--w c:\program files\InstallShield Installation Information

2009-03-07 01:00 --------- d-----w c:\program files\Norton Security Scan

2009-03-06 23:10 --------- d-----w c:\program files\Microsoft Silverlight

2009-02-06 22:05 --------- d-----w c:\documents and settings\Andrew\Application Data\Apple Computer

2009-01-29 05:58 26,464 -c--a-w c:\documents and settings\Andrew\Application Data\GDIPFONTCACHEV1.DAT

2008-10-03 03:02 0 ----a-w c:\documents and settings\Andrew\jagex_runescape_preferences.dat

2007-12-22 18:37 32 ----a-w c:\documents and settings\All Users\Application Data\ezsid.dat

2008-05-24 20:53 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008052420080525\index.dat

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-08-26 279944]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]

[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-08-26 279944]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]

[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2008-04-17 9117696]

"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 39264]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"WUAppSetup"="c:\program files\Common Files\logishrd\WUApp32.exe" [2007-02-03 435736]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]

2009-03-06 21:16 10520 c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"vidc.iv41"= ir41_32.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk

backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Windows Search.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Windows Search.lnk

backup=c:\windows\pss\Windows Search.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Wireless PCI Card Config Utility.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Wireless PCI Card Config Utility.lnk

backup=c:\windows\pss\Wireless PCI Card Config Utility.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Andrew^Start Menu^Programs^Startup^Axis & Allies Registration.lnk]

path=c:\documents and settings\Andrew\Start Menu\Programs\Startup\Axis & Allies Registration.lnk

backup=c:\windows\pss\Axis & Allies Registration.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acronis Scheduler2 Service]

--a------ 2007-09-14 03:55 140568 c:\program files\Common Files\Acronis\Schedule2\schedhlp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AcronisTimounterMonitor]

--a------ 2007-09-14 04:02 905056 c:\program files\Acronis\TrueImageHome\TimounterMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]

--a------ 2007-03-09 11:09 63712 c:\program files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

--a------ 2008-01-11 22:16 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOLDialer]

-ra------ 2006-10-23 06:50 71216 c:\program files\Common Files\AOL\ACS\AOLDial.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]

--a------ 2008-10-01 12:57 111936 c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG8_TRAY]

--a------ 2009-03-06 21:16 1932568 c:\progra~1\AVG\AVG8\avgtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]

--a------ 2004-02-29 16:44 66680 c:\program files\Common Files\Symantec Shared\ccApp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]

--a------ 2008-04-13 18:12 15360 c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DiscWizardMonitor.exe]

--a------ 2007-08-08 18:47 1169456 c:\program files\Seagate\DiscWizard\DiscWizardMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eTrustPPAP]

--a------ 2006-06-23 14:24 131072 c:\program files\CA\eTrust PestPatrol\PPActiveDetection.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]

--a------ 2006-09-25 18:52 50736 c:\program files\Common Files\AOL\1151024143\EE\aolsoftware.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IPHSend]

--a------ 2006-03-27 09:57 126104 c:\program files\Common Files\AOL\IPHSend\IPHSend.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

--a------ 2008-11-20 14:20 290088 c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LVCOMSX]

--a------ 2007-02-06 18:43 252704 c:\program files\Common Files\LogiShrd\LComMgr\LVComSX.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MySpaceIM]

--a------ 2008-04-17 17:27 9117696 c:\program files\MySpace\IM\MySpaceIM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

--a------ 2008-11-04 11:30 413696 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]

--a------ 2006-06-22 18:57 26112 c:\program files\Real\RealPlayer\realplay.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]

-rahs---- 2009-01-26 16:31 2144088 c:\program files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]

--a--c--- 2006-11-10 12:35 90112 c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]

--a--c--- 2007-06-29 11:51 1258744 c:\program files\Steam\Steam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

--a------ 2008-12-20 17:44 136600 c:\program files\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]

--a------ 2007-06-28 16:05 68856 c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TrueImageMonitor.exe]

--a------ 2007-10-30 21:06 2595616 c:\program files\Acronis\TrueImageHome\TrueImageMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\vptray]

--a------ 2004-03-12 15:18 124128 c:\progra~1\SYMANT~1\VPTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]

--a------ 2006-11-03 20:20 866584 c:\program files\Windows Defender\MSASCui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]

--------- 2006-10-18 20:05 204288 c:\program files\Windows Media Player\wmpnscfg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]

--a------ 2007-08-30 18:43 4670704 c:\program files\Yahoo!\Messenger\YahooMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LTMSG]

--a------ 2003-07-14 10:52 40960 c:\windows\ltmsg.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=

"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=

"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=

"c:\\Program Files\\America Online 9.0\\waol.exe"=

"c:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltsmon.exe"=

"c:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltpspd.exe"=

"c:\\Program Files\\Common Files\\AOL\\1151024143\\EE\\AOLServiceHost.exe"=

"c:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe"=

"c:\\Program Files\\Electronic Arts\\The Battle for Middle-earth II\\game.dat"=

"c:\\Program Files\\Activision\\Empires Dawn of the Modern World\\Empires_DMW.exe"=

"c:\\Program Files\\Hasbro Interactive\\RollerCoaster Tycoon\\rct.exe"=

"c:\\Program Files\\Microsoft Games\\Age of Mythology\\aomx.exe"=

"c:\\Program Files\\Electronic Arts\\The Battle for Middle-earth II\\patchget.dat"=

"c:\\Program Files\\Microsoft Games\\Age of Empires II\\age2_x1\\AGE2_X1.ICD"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Microsoft Games\\Age of Empires III\\age3.exe"=

"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=

"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=

"c:\\Program Files\\Common Files\\AOL\\1151024143\\EE\\aolsoftware.exe"=

"c:\\WINDOWS\\system32\\mmc.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

"c:\\Program Files\\Electronic Arts\\The Lord of the Rings, The Rise of the Witch-king\\game.dat"=

"c:\\Program Files\\Sierra Entertainment\\World in Conflict\\wic.exe"=

"c:\\Program Files\\Sierra Entertainment\\World in Conflict\\wic_online.exe"=

"c:\\Program Files\\Sierra Entertainment\\World in Conflict\\wic_ds.exe"=

"c:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=

R0 SI3112r;Silicon Image SiI 3512 SATARaid Controller;c:\windows\system32\drivers\SI3112r.sys [2007-11-08 116264]

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-03-06 325640]

R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-03-06 107912]

R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-03-06 298264]

R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [2006-11-03 13592]

R3 ISLP2;Intersil 802.11 Wireless LAN Driver;c:\windows\system32\drivers\islp2nds.sys [2002-10-03 611840]

S3 0E988D8D;0E988D8D;c:\windows\system32\0E988D8D.exe --> c:\windows\system32\0E988D8D.exe [?]

S3 158E506C;158E506C;c:\windows\system32\158E506C.exe --> c:\windows\system32\158E506C.exe [?]

S3 15A52599;15A52599;c:\windows\system32\15A52599.exe --> c:\windows\system32\15A52599.exe [?]

S3 2BF94419;2BF94419;c:\windows\system32\2BF94419.exe --> c:\windows\system32\2BF94419.exe [?]

S3 30D465A3;30D465A3;c:\windows\system32\30D465A3.exe --> c:\windows\system32\30D465A3.exe [?]

S3 31ED6D9B;31ED6D9B;c:\windows\system32\31ED6D9B.exe --> c:\windows\system32\31ED6D9B.exe [?]

S3 4248ECE6;4248ECE6;c:\windows\system32\4248ECE6.exe --> c:\windows\system32\4248ECE6.exe [?]

S3 4414E65E;4414E65E;c:\windows\system32\4414E65E.exe --> c:\windows\system32\4414E65E.exe [?]

S3 45A8C6C4;45A8C6C4;c:\windows\system32\45A8C6C4.exe --> c:\windows\system32\45A8C6C4.exe [?]

S3 56C0A6EF;56C0A6EF;c:\windows\system32\56C0A6EF.exe --> c:\windows\system32\56C0A6EF.exe [?]

S3 591DF56E;591DF56E;c:\windows\system32\591DF56E.exe --> c:\windows\system32\591DF56E.exe [?]

S3 5E18568A;5E18568A;c:\windows\system32\5E18568A.exe --> c:\windows\system32\5E18568A.exe [?]

S3 60D372E4;60D372E4;c:\windows\system32\60D372E4.exe --> c:\windows\system32\60D372E4.exe [?]

S3 60DBFA3C;60DBFA3C;c:\windows\system32\60DBFA3C.exe --> c:\windows\system32\60DBFA3C.exe [?]

S3 688304B2;688304B2;c:\windows\system32\688304B2.exe --> c:\windows\system32\688304B2.exe [?]

S3 68B0EC3A;68B0EC3A;c:\windows\system32\68B0EC3A.exe --> c:\windows\system32\68B0EC3A.exe [?]

S3 69633044;69633044;c:\windows\system32\69633044.exe --> c:\windows\system32\69633044.exe [?]

S3 780C87AC;780C87AC;c:\windows\system32\780C87AC.exe --> c:\windows\system32\780C87AC.exe [?]

S3 831CB1F1;831CB1F1;c:\windows\system32\831CB1F1.exe --> c:\windows\system32\831CB1F1.exe [?]

S3 89DE770E;89DE770E;c:\windows\system32\89DE770E.exe --> c:\windows\system32\89DE770E.exe [?]

S3 90947B6B;90947B6B;c:\windows\system32\90947B6B.exe --> c:\windows\system32\90947B6B.exe [?]

S3 96865B4E;96865B4E;c:\windows\system32\96865B4E.exe --> c:\windows\system32\96865B4E.exe [?]

S3 A7B5AA42;A7B5AA42;c:\windows\system32\A7B5AA42.exe --> c:\windows\system32\A7B5AA42.exe [?]

S3 A87A50BF;A87A50BF;c:\windows\system32\A87A50BF.exe --> c:\windows\system32\A87A50BF.exe [?]

S3 A91F1F66;A91F1F66;c:\windows\system32\A91F1F66.exe --> c:\windows\system32\A91F1F66.exe [?]

S3 B0C37D52;B0C37D52;c:\windows\system32\B0C37D52.exe --> c:\windows\system32\B0C37D52.exe [?]

S3 B0ECF3AD;B0ECF3AD;c:\windows\system32\B0ECF3AD.exe --> c:\windows\system32\B0ECF3AD.exe [?]

S3 B10F43E4;B10F43E4;c:\windows\system32\B10F43E4.exe --> c:\windows\system32\B10F43E4.exe [?]

S3 BED63A58;BED63A58;c:\windows\system32\BED63A58.exe --> c:\windows\system32\BED63A58.exe [?]

S3 C2851EEA;C2851EEA;c:\windows\system32\C2851EEA.exe --> c:\windows\system32\C2851EEA.exe [?]

S3 C8006BAF;C8006BAF;c:\windows\system32\C8006BAF.exe --> c:\windows\system32\C8006BAF.exe [?]

S3 CB4B32DE;CB4B32DE;c:\windows\system32\CB4B32DE.exe --> c:\windows\system32\CB4B32DE.exe [?]

S3 D2A599DE;D2A599DE;c:\windows\system32\D2A599DE.exe --> c:\windows\system32\D2A599DE.exe [?]

S3 D2D5F759;D2D5F759;c:\windows\system32\D2D5F759.exe --> c:\windows\system32\D2D5F759.exe [?]

S3 D9AE45EE;D9AE45EE;c:\windows\system32\D9AE45EE.exe --> c:\windows\system32\D9AE45EE.exe [?]

S3 DB9F6DBA;DB9F6DBA;c:\windows\system32\DB9F6DBA.exe --> c:\windows\system32\DB9F6DBA.exe [?]

S3 E23B2A84;E23B2A84;c:\windows\system32\E23B2A84.exe --> c:\windows\system32\E23B2A84.exe [?]

S3 EBF6A547;EBF6A547;c:\windows\system32\EBF6A547.exe --> c:\windows\system32\EBF6A547.exe [?]

S3 EF045108;EF045108;c:\windows\system32\EF045108.exe --> c:\windows\system32\EF045108.exe [?]

S3 EFD8A1E7;EFD8A1E7;c:\windows\system32\EFD8A1E7.exe --> c:\windows\system32\EFD8A1E7.exe [?]

S3 F133DFE1;F133DFE1;c:\windows\system32\F133DFE1.exe --> c:\windows\system32\F133DFE1.exe [?]

S3 F98DBD8C;F98DBD8C;c:\windows\system32\F98DBD8C.exe --> c:\windows\system32\F98DBD8C.exe [?]

S3 FC4B0C77;FC4B0C77;c:\windows\system32\FC4B0C77.exe --> c:\windows\system32\FC4B0C77.exe [?]

S3 LSWLNDS;Instant Wireless Driver;c:\windows\system32\drivers\LSWLNDS.sys [2006-06-20 50417]

S3 SavRoam;SAVRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [2004-03-12 169192]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b82f0a8e-87d4-11db-bac8-000625039bb5}]

\Shell\AutoRun\command - F:\setupSNK.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e0f925b6-2bb4-11db-ba6b-00038a000015}]

\Shell\AutoRun\command - F:\setupSNK.exe

.

Contents of the 'Scheduled Tasks' folder

2009-03-10 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]

2009-03-16 c:\windows\Tasks\MP Scheduled Scan.job

- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 20:20]

2009-03-14 c:\windows\Tasks\Norton Security Scan for Andrew.job

- c:\program files\Norton Security Scan\Nss.exe [2008-09-19 04:18]

.

- - - - ORPHANS REMOVED - - - -

MSConfigStartUp-a4lg0y4k48xii2y8n5wsab8eci8d7eh3nsylbcrvyhsma - c:\docume~1\Andrew\LOCALS~1\Temp\h2ewuzi.exe

MSConfigStartUp-a7xsbisghe0e44c9u3ud - c:\docume~1\Andrew\LOCALS~1\Temp\i5ubkx8b.exe

MSConfigStartUp-AOL Spyware Protection - c:\progra~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe

MSConfigStartUp-ATI DeviceDetect - c:\program files\ATI Multimedia\main\ATIDtct.EXE

MSConfigStartUp-ATI Launchpad - c:\program files\ATI Multimedia\main\launchpd.exe

MSConfigStartUp-ATI Remote Control - c:\program files\ATI Multimedia\RemCtrl\ATIRW.exe

MSConfigStartUp-ATIPTA - c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe

MSConfigStartUp-ddtlwz70s3jujcgt91uix - c:\docume~1\Andrew\LOCALS~1\Temp\j6u70js.exe

MSConfigStartUp-e0qkj9i1kbl64w9r3ege6ykzm2et24cwmo6bl3h38hc6pdvzh - c:\docume~1\Andrew\LOCALS~1\Temp\yallan91f.exe

MSConfigStartUp-g3irszw53skby2w0dl5hj41amvuvkhy3 - c:\docume~1\Andrew\LOCALS~1\Temp\h05febd2.exe

MSConfigStartUp-gfyfc6rbc5eu36g4oh8fzcgi448b4 - c:\docume~1\Andrew\LOCALS~1\Temp\e6808xm3t.exe

MSConfigStartUp-gxuu4rjljgu0zjhjm20e7o3qvm2lwt236ub962l7gx - c:\docume~1\Andrew\LOCALS~1\Temp\v5qqcvh.exe

MSConfigStartUp-hrz9g06p27d5mx2fzecvbr8ubpg - c:\docume~1\Andrew\LOCALS~1\Temp\twz3ii.exe

MSConfigStartUp-hwn5sxv367z89jtpk2tu - c:\docume~1\Andrew\LOCALS~1\Temp\cj6kvrmecsl3u.exe

MSConfigStartUp-jsf8uiw3jnjgffght - c:\docume~1\Andrew\LOCALS~1\Temp\winlognn.exe

MSConfigStartUp-ka5xwep4xzdcrxtu21 - c:\docume~1\Andrew\LOCALS~1\Temp\nzh2pil2qzs8r.exe

MSConfigStartUp-kwz624v4pp8ahu70acu4liblnbw735t2lvjt3ki - c:\docume~1\Andrew\LOCALS~1\Temp\j5dghdjuh.exe

MSConfigStartUp-muc87lavj19zg - c:\docume~1\Andrew\LOCALS~1\Temp\de8kkixu1gf.exe

MSConfigStartUp-nd4virtjoxyfi7zxzmk5dl - c:\docume~1\Andrew\LOCALS~1\Temp\ev4fovzjlov6j.exe

MSConfigStartUp-Pure Networks Port Magic - c:\progra~1\PURENE~1\PORTMA~1\PortAOL.exe

MSConfigStartUp-s6y6pcyba35ef3kkgz0bm7avxy2mqb8whrmogw1cvdk - c:\docume~1\Andrew\LOCALS~1\Temp\k6do7qajahat1.exe

MSConfigStartUp-Wbikipugo - c:\windows\Fhizusezej.dll

MSConfigStartUp-wuiptchc59l0hemn1x35cyk2otrlpd0uz7fbgas0qu7lxy - c:\docume~1\Andrew\LOCALS~1\Temp\v0eulfjdpm.exe

MSConfigStartUp-x2zob3c0tzjbph5lvuyroojmo89jyqg7k6piqhbxo - c:\docume~1\Andrew\LOCALS~1\Temp\rvjzhpv13.exe

MSConfigStartUp-xc3oxhs0hmcpvsn - c:\docume~1\Andrew\LOCALS~1\Temp\pekg622hd.exe

MSConfigStartUp-xiqokrhljtwoqpu446sayvorzuvmd9t84tyb2xscwg2pt8xe - c:\docume~1\Andrew\LOCALS~1\Temp\ittll4gdi0y8.exe

MSConfigStartUp-yiige53ipuvm8vjafy0ztgmb - c:\docume~1\Andrew\LOCALS~1\Temp\f5os8rtnzkyp2.exe

MSConfigStartUp-zhwipez8ddzrmt9 - c:\docume~1\Andrew\LOCALS~1\Temp\ipr0cavl.exe

MSConfigStartUp-Framework Windows - frmwrk32.exe

MSConfigStartUp-ISLP2STA - ISLP2STA.EXE

.

------- Supplementary Scan -------

.

uInternet Settings,ProxyOverride = *.local

uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com

.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-03-15 19:19:52

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(728)

c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'lsass.exe'(784)

c:\windows\system32\relog_ap.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\ati2evxx.exe

c:\program files\Common Files\Symantec Shared\ccSetMgr.exe

c:\program files\Common Files\Symantec Shared\ccEvtMgr.exe

c:\program files\Common Files\Acronis\Schedule2\schedul2.exe

c:\program files\Common Files\AOL\ACS\AOLacsd.exe

c:\program files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe

c:\program files\Common Files\AOL\TopSpeed\2.0\aoltpspd.exe

c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\program files\Symantec AntiVirus\DefWatch.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

c:\windows\system32\PnkBstrA.exe

c:\program files\Symantec AntiVirus\Rtvscan.exe

c:\program files\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe

c:\program files\AVG\AVG8\avgrsx.exe

c:\progra~1\AVG\AVG8\avgnsx.exe

c:\windows\system32\searchindexer.exe

c:\program files\Windows Media Player\wmpnetwk.exe

c:\windows\system32\wscntfy.exe

.

**************************************************************************

.

Completion time: 2009-03-15 19:24:05 - machine was rebooted [Andrew]

ComboFix-quarantined-files.txt 2009-03-16 01:24:00

Pre-Run: 196,613,386,240 bytes free

Post-Run: 196,553,093,120 bytes free

334 --- E O F --- 2009-03-15 02:43:44

msager · March 16, 2009

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 19:37, on 2009-03-15

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16791)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Windows Defender\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe

C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe

C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Symantec AntiVirus\DefWatch.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

C:\WINDOWS\system32\PnkBstrA.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Symantec AntiVirus\Rtvscan.exe

C:\Program Files\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe

C:\PROGRA~1\AVG\AVG8\avgrsx.exe

C:\PROGRA~1\AVG\AVG8\avgnsx.exe

C:\WINDOWS\system32\SearchIndexer.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\dwwin.exe

C:\WINDOWS\system32\notepad.exe

C:\WINDOWS\system32\taskmgr.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE