SarahReed Posted April 8, 2009 ID:71422 Share Posted April 8, 2009 Malwarebytes scrubbed some of the virus, but it is still hampering my PC.Here is my ComboFix log:ComboFix 09-04-04.01 - Owner 2009-04-08 1:57:29.3 - NTFSx86Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1015.573 [GMT -5:00]Running from: c:\documents and settings\Owner\Desktop\ComboFix.exeAV: AVG 7.5.557 *On-access scanning enabled* (Updated)AV: Norton AntiVirus *On-access scanning enabled* (Outdated).((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))).c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.datc:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat----- BITS: Possible infected sites -----hxxp://updates.swarmcast.net.((((((((((((((((((((((((( Files Created from 2009-03-08 to 2009-04-08 ))))))))))))))))))))))))))))))).2009-04-07 18:14 . 2009-04-07 18:37 <DIR> d-------- c:\documents and settings\Owner\DoctorWeb2009-04-07 11:54 . 2009-04-07 11:54 <DIR> d-------- C:\VundoFix Backups2009-04-07 09:29 . 2009-04-07 11:11 <DIR> d-------- c:\windows\system32\CatRoot_bak2009-04-07 09:27 . 2008-05-01 09:30 331,776 -----c--- c:\windows\system32\dllcache\msadce.dll2009-04-07 09:27 . 2008-06-13 08:10 272,128 -----c--- c:\windows\system32\dllcache\bthport.sys2009-04-07 09:26 . 2008-08-14 04:51 138,368 -----c--- c:\windows\system32\dllcache\afd.sys2009-04-07 04:54 . 2008-12-20 18:15 6,066,688 -----c--- c:\windows\system32\dllcache\ieframe.dll2009-04-07 04:54 . 2007-04-17 04:32 2,455,488 -----c--- c:\windows\system32\dllcache\ieapfltr.dat2009-04-07 04:54 . 2007-03-08 00:10 991,232 -----c--- c:\windows\system32\dllcache\ieframe.dll.mui2009-04-07 04:54 . 2008-12-20 18:15 459,264 -----c--- c:\windows\system32\dllcache\msfeeds.dll2009-04-07 04:54 . 2008-12-20 18:15 383,488 -----c--- c:\windows\system32\dllcache\ieapfltr.dll2009-04-07 04:54 . 2008-12-20 18:15 267,776 -----c--- c:\windows\system32\dllcache\iertutil.dll2009-04-07 04:54 . 2008-12-20 18:15 63,488 -----c--- c:\windows\system32\dllcache\icardie.dll2009-04-07 04:54 . 2008-12-20 18:15 52,224 -----c--- c:\windows\system32\dllcache\msfeedsbs.dll2009-04-07 04:54 . 2008-12-19 04:10 13,824 -----c--- c:\windows\system32\dllcache\ieudinit.exe2009-04-07 04:48 . 2007-08-13 18:54 33,792 --a--c--- c:\windows\system32\dllcache\custsat.dll2009-04-07 00:45 . 2009-04-07 00:45 <DIR> d-------- c:\documents and settings\Administrator.GARY\Application Data\SUPERAntiSpyware.com2009-04-07 00:37 . 2009-04-07 00:37 <DIR> d-------- c:\program files\SUPERAntiSpyware2009-04-07 00:37 . 2009-04-07 00:37 <DIR> d-------- c:\documents and settings\Owner\Application Data\SUPERAntiSpyware.com2009-04-07 00:37 . 2009-04-07 00:37 <DIR> d-------- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com2009-04-07 00:32 . 2009-04-07 00:32 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard2009-04-06 22:11 . 2009-04-06 22:11 <DIR> d-------- c:\program files\Trend Micro2009-04-06 19:28 . 2009-04-06 19:28 <DIR> d-------- c:\documents and settings\Administrator.GARY\Application Data\Malwarebytes2009-04-06 19:24 . 2003-10-11 07:30 <DIR> d-------- c:\documents and settings\Administrator.GARY\WINDOWS2009-04-06 19:24 . 2003-10-14 08:31 <DIR> d-------- c:\documents and settings\Administrator.GARY\Application Data\Symantec2009-04-06 19:24 . 2003-10-11 07:06 <DIR> d-------- c:\documents and settings\Administrator.GARY\Application Data\Sonic2009-04-06 19:24 . 2003-10-11 08:03 <DIR> d-------- c:\documents and settings\Administrator.GARY\Application Data\SampleView2009-04-06 19:24 . 2003-10-14 08:35 <DIR> d-------- c:\documents and settings\Administrator.GARY\Application Data\interMute2009-04-06 19:24 . 2009-04-06 19:24 <DIR> d-------- c:\documents and settings\Administrator.GARY2009-04-06 17:35 . 2009-04-06 19:11 <DIR> d-------- c:\documents and settings\Administrator\Application Data\AVG72009-04-06 16:24 . 2009-04-06 16:24 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Malwarebytes2009-04-06 16:23 . 2003-10-11 07:06 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Sonic2009-04-06 16:23 . 2003-10-14 08:35 <DIR> d-------- c:\documents and settings\Administrator\Application Data\interMute2009-04-06 16:23 . 2009-04-06 19:11 <DIR> d---s---- c:\documents and settings\Administrator.(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))).2009-04-07 09:30 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy2009-04-07 08:18 --------- d-----w c:\program files\Google2009-04-07 03:24 --------- d-----w c:\program files\Spybot - Search & Destroy2009-04-07 02:56 --------- d-----w c:\program files\Malwarebytes' Anti-Malware2009-04-07 01:56 --------- d--h--w c:\documents and settings\All Users\Application Data\{9E97B640-FCFE-4900-B18A-72FAE662D6B7}2009-04-06 20:32 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys2009-04-06 20:32 15,504 ----a-w c:\windows\system32\drivers\mbam.sys2009-04-04 14:11 --------- d-----w c:\documents and settings\Owner\Application Data\AVG72009-03-10 15:50 --------- d-----w c:\program files\Microsoft Silverlight2009-03-02 23:16 --------- d-----w c:\documents and settings\Owner\Application Data\eAcceleration.((((((((((((((((((((((((((((( SnapShot@2009-04-06_21.42.39.34 ))))))))))))))))))))))))))))))))))))))))).+ 2008-06-13 13:10:50 272,128 ------w c:\windows\Driver Cache\i386\bthport.sys- 2006-05-05 09:41:45 453,120 ------w c:\windows\Driver Cache\i386\mrxsmb.sys+ 2008-10-24 11:10:42 453,632 ------w c:\windows\Driver Cache\i386\mrxsmb.sys- 2007-02-28 09:08:48 2,136,064 ------w c:\windows\Driver Cache\i386\ntkrnlmp.exe+ 2008-08-14 09:58:27 2,136,064 ------w c:\windows\Driver Cache\i386\ntkrnlmp.exe- 2007-02-28 08:38:55 2,057,600 ------w c:\windows\Driver Cache\i386\ntkrnlpa.exe+ 2008-08-14 09:22:13 2,057,728 ------w c:\windows\Driver Cache\i386\ntkrnlpa.exe- 2007-02-28 08:38:57 2,015,744 ------w c:\windows\Driver Cache\i386\ntkrpamp.exe+ 2008-08-14 09:22:14 2,015,744 ------w c:\windows\Driver Cache\i386\ntkrpamp.exe- 2007-02-28 09:10:57 2,180,352 ------w c:\windows\Driver Cache\i386\ntoskrnl.exe+ 2008-08-14 10:00:45 2,180,352 ------w c:\windows\Driver Cache\i386\ntoskrnl.exe+ 2004-08-04 07:56:41 61,440 -c--a-w c:\windows\ie7\admparse.dll+ 2004-08-04 07:56:41 99,840 -c--a-w c:\windows\ie7\advpack.dll+ 2004-08-04 07:56:41 35,328 -c--a-w c:\windows\ie7\corpol.dll+ 2006-06-03 11:40:49 33,792 -c--a-w c:\windows\ie7\custsat.dll+ 2008-02-16 08:59:35 357,888 -c--a-w c:\windows\ie7\dxtmsft.dll+ 2008-02-16 08:59:35 205,312 -c--a-w c:\windows\ie7\dxtrans.dll+ 2008-02-16 08:59:35 55,808 -c--a-w c:\windows\ie7\extmgr.dll+ 2004-08-04 07:56:42 38,912 -c--a-w c:\windows\ie7\hmmapi.dll+ 2004-08-04 07:56:50 34,304 -c--a-w c:\windows\ie7\ie4uinit.exe+ 2004-08-04 07:56:42 139,264 -c--a-w c:\windows\ie7\ieakeng.dll+ 2004-08-04 07:56:42 216,576 -c--a-w c:\windows\ie7\ieaksie.dll+ 2002-08-29 12:00:00 221,184 -c--a-w c:\windows\ie7\ieakui.dll+ 2004-08-04 07:56:42 323,584 -c--a-w c:\windows\ie7\iedkcs32.dll+ 2008-02-15 09:23:37 18,432 -c--a-w c:\windows\ie7\iedw.exe+ 2004-08-04 07:56:42 81,920 -c--a-w c:\windows\ie7\ieencode.dll+ 2008-02-16 08:59:35 251,392 -c--a-w c:\windows\ie7\iepeers.dll+ 2004-08-04 07:56:42 48,640 -c--a-w c:\windows\ie7\iernonce.dll+ 2004-08-04 07:56:42 62,976 -c--a-w c:\windows\ie7\iesetup.dll+ 2004-08-04 07:56:50 93,184 -c--a-w c:\windows\ie7\iexplore.exe+ 2004-08-04 07:56:42 35,840 -c--a-w c:\windows\ie7\imgutil.dll+ 2008-02-16 08:59:35 96,256 -c--a-w c:\windows\ie7\inseng.dll+ 2007-12-18 14:40:58 450,560 -c--a-w c:\windows\ie7\jscript.dll+ 2008-02-16 08:59:35 16,384 -c--a-w c:\windows\ie7\jsproxy.dll+ 2004-08-04 07:56:42 22,016 -c--a-w c:\windows\ie7\licmgr10.dll+ 2004-08-04 07:56:53 29,184 -c--a-w c:\windows\ie7\mshta.exe+ 2008-02-16 22:29:38 3,059,712 -c--a-w c:\windows\ie7\mshtml.dll+ 2008-02-16 08:59:37 449,024 -c--a-w c:\windows\ie7\mshtmled.dll+ 2004-08-04 07:56:14 56,832 -c--a-w c:\windows\ie7\mshtmler.dll+ 2002-08-29 12:00:00 146,432 -c--a-w c:\windows\ie7\msls31.dll+ 2008-02-16 08:59:37 146,432 -c--a-w c:\windows\ie7\msrating.dll+ 2008-02-16 08:59:37 532,480 -c--a-w c:\windows\ie7\mstime.dll+ 2004-08-04 07:56:44 96,256 -c--a-w c:\windows\ie7\occache.dll+ 2008-02-16 08:59:37 39,424 -c--a-w c:\windows\ie7\pngfilt.dll+ 2007-08-13 23:54:42 32,960 -c--a-w c:\windows\ie7\spuninst\iecustom.dll+ 2007-08-13 23:52:06 66,048 -c--a-w c:\windows\ie7\spuninst\ieResetIcons.exe+ 2006-09-06 22:43:16 213,216 -c--a-w c:\windows\ie7\spuninst\spuninst.exe+ 2006-09-06 22:43:18 371,424 -c--a-w c:\windows\ie7\spuninst\updspapi.dll+ 2004-08-04 07:56:46 37,888 -c--a-w c:\windows\ie7\url.dll+ 2008-02-16 08:59:38 615,936 -c--a-w c:\windows\ie7\urlmon.dll+ 2007-12-18 14:40:58 417,792 -c--a-w c:\windows\ie7\vbscript.dll+ 2007-06-26 15:13:22 851,968 -c--a-w c:\windows\ie7\vgx.dll+ 2004-08-04 07:56:46 276,480 -c--a-w c:\windows\ie7\webcheck.dll+ 2008-02-16 08:59:39 659,456 -c--a-w c:\windows\ie7\wininet.dll+ 2007-08-13 23:39:00 123,904 -c----w c:\windows\ie7updates\KB956390-IE7\advpack.dll+ 2007-08-13 23:39:00 123,904 -c----w c:\windows\ie7updates\KB956390-IE7\advpack.dll.000+ 2007-08-13 23:35:46 346,624 -c----w c:\windows\ie7updates\KB956390-IE7\dxtmsft.dll+ 2007-08-13 23:35:38 214,528 -c----w c:\windows\ie7updates\KB956390-IE7\dxtrans.dll+ 2007-08-13 23:54:10 131,584 -c----w c:\windows\ie7updates\KB956390-IE7\extmgr.dll+ 2007-08-13 23:36:26 61,952 -c----w c:\windows\ie7updates\KB956390-IE7\icardie.dll+ 2007-08-13 23:39:06 54,784 -c----w c:\windows\ie7updates\KB956390-IE7\ie4uinit.exe+ 2007-08-13 23:39:06 54,784 -c----w c:\windows\ie7updates\KB956390-IE7\ie4uinit.exe.000+ 2007-08-13 23:39:26 152,064 -c----w c:\windows\ie7updates\KB956390-IE7\ieakeng.dll+ 2007-08-13 23:39:26 152,064 -c----w c:\windows\ie7updates\KB956390-IE7\ieakeng.dll.000+ 2007-08-13 23:39:54 229,376 -c----w c:\windows\ie7updates\KB956390-IE7\ieaksie.dll+ 2007-08-13 23:39:54 229,376 -c----w c:\windows\ie7updates\KB956390-IE7\ieaksie.dll.000+ 2007-08-13 22:56:54 161,792 -c----w c:\windows\ie7updates\KB956390-IE7\ieakui.dll+ 2007-02-12 21:10:12 2,451,312 -c----w c:\windows\ie7updates\KB956390-IE7\ieapfltr.dat+ 2007-07-11 17:27:48 383,488 -c----w c:\windows\ie7updates\KB956390-IE7\ieapfltr.dll+ 2007-08-13 23:39:50 382,976 -c----w c:\windows\ie7updates\KB956390-IE7\iedkcs32.dll+ 2007-08-13 23:39:50 382,976 -c----w c:\windows\ie7updates\KB956390-IE7\iedkcs32.dll.000+ 2007-08-13 23:54:10 6,049,280 -c----w c:\windows\ie7updates\KB956390-IE7\ieframe.dll+ 2007-08-13 23:39:10 43,008 -c----w c:\windows\ie7updates\KB956390-IE7\iernonce.dll+ 2007-08-13 23:39:10 43,008 -c----w c:\windows\ie7updates\KB956390-IE7\iernonce.dll.000+ 2007-08-13 23:34:04 266,752 -c----w c:\windows\ie7updates\KB956390-IE7\iertutil.dll+ 2007-08-13 23:39:10 13,312 -c----w c:\windows\ie7updates\KB956390-IE7\ieudinit.exe+ 2007-08-13 23:43:56 622,080 -c----w c:\windows\ie7updates\KB956390-IE7\iexplore.exe+ 2007-08-13 23:43:56 622,080 -c----w c:\windows\ie7updates\KB956390-IE7\iexplore.exe.000+ 2007-08-13 23:54:10 27,136 -c----w c:\windows\ie7updates\KB956390-IE7\jsproxy.dll+ 2007-08-13 23:54:10 458,752 -c----w c:\windows\ie7updates\KB956390-IE7\msfeeds.dll+ 2007-08-13 23:54:10 50,688 -c----w c:\windows\ie7updates\KB956390-IE7\msfeedsbs.dll+ 2007-08-13 23:54:12 3,578,368 -c----w c:\windows\ie7updates\KB956390-IE7\mshtml.dll+ 2007-08-13 23:54:10 475,648 -c----w c:\windows\ie7updates\KB956390-IE7\mshtmled.dll+ 2007-08-13 23:44:26 192,000 -c----w c:\windows\ie7updates\KB956390-IE7\msrating.dll+ 2007-08-13 23:54:10 670,720 -c----w c:\windows\ie7updates\KB956390-IE7\mstime.dll+ 2007-08-13 23:44:06 101,376 -c----w c:\windows\ie7updates\KB956390-IE7\occache.dll+ 2007-08-13 23:44:06 101,376 -c----w c:\windows\ie7updates\KB956390-IE7\occache.dll.000+ 2007-08-13 23:36:12 44,544 -c----w c:\windows\ie7updates\KB956390-IE7\pngfilt.dll+ 2007-03-06 01:22:39 213,216 -c----w c:\windows\ie7updates\KB956390-IE7\spuninst\spuninst.exe+ 2007-03-06 01:23:51 371,424 -c----w c:\windows\ie7updates\KB956390-IE7\spuninst\updspapi.dll+ 2007-08-13 23:44:30 105,984 -c----w c:\windows\ie7updates\KB956390-IE7\url.dll+ 2007-08-13 23:44:30 105,984 -c----w c:\windows\ie7updates\KB956390-IE7\url.dll.000+ 2007-08-13 23:54:10 1,162,240 -c----w c:\windows\ie7updates\KB956390-IE7\urlmon.dll+ 2007-08-13 23:54:10 231,424 -c----w c:\windows\ie7updates\KB956390-IE7\webcheck.dll+ 2007-08-13 23:54:10 231,424 -c----w c:\windows\ie7updates\KB956390-IE7\webcheck.dll.000+ 2007-08-13 23:54:10 818,688 -c----w c:\windows\ie7updates\KB956390-IE7\wininet.dll+ 2008-08-26 07:24:28 124,928 -c----w c:\windows\ie7updates\KB961260-IE7\advpack.dll+ 2008-08-26 07:24:28 124,928 -c----w c:\windows\ie7updates\KB961260-IE7\advpack.dll.000+ 2008-08-26 07:24:28 347,136 -c----w c:\windows\ie7updates\KB961260-IE7\dxtmsft.dll+ 2008-08-26 07:24:28 214,528 -c----w c:\windows\ie7updates\KB961260-IE7\dxtrans.dll+ 2008-08-26 07:24:28 133,120 -c----w c:\windows\ie7updates\KB961260-IE7\extmgr.dll+ 2008-08-26 07:24:28 63,488 -c----w c:\windows\ie7updates\KB961260-IE7\icardie.dll+ 2008-08-26 07:24:28 63,488 -c----w c:\windows\ie7updates\KB961260-IE7\icardie.dll.000+ 2008-08-25 08:37:59 70,656 -c----w c:\windows\ie7updates\KB961260-IE7\ie4uinit.exe+ 2008-08-26 07:24:28 153,088 -c----w c:\windows\ie7updates\KB961260-IE7\ieakeng.dll+ 2008-08-26 07:24:28 230,400 -c----w c:\windows\ie7updates\KB961260-IE7\ieaksie.dll+ 2008-08-23 05:54:51 161,792 -c----w c:\windows\ie7updates\KB961260-IE7\ieakui.dll+ 2007-04-17 09:32:38 2,455,488 -c----w c:\windows\ie7updates\KB961260-IE7\ieapfltr.dat+ 2008-08-26 07:24:28 383,488 -c----w c:\windows\ie7updates\KB961260-IE7\ieapfltr.dll+ 2008-08-26 07:24:28 383,488 -c----w c:\windows\ie7updates\KB961260-IE7\ieapfltr.dll.000+ 2008-08-26 07:24:29 384,512 -c----w c:\windows\ie7updates\KB961260-IE7\iedkcs32.dll+ 2008-10-03 17:41:15 6,066,176 -c----w c:\windows\ie7updates\KB961260-IE7\ieframe.dll+ 2008-10-03 17:41:15 6,066,176 -c----w c:\windows\ie7updates\KB961260-IE7\ieframe.dll.000+ 2008-08-26 07:24:29 44,544 -c----w c:\windows\ie7updates\KB961260-IE7\iernonce.dll+ 2008-08-26 07:24:29 267,776 -c----w c:\windows\ie7updates\KB961260-IE7\iertutil.dll+ 2008-08-26 07:24:29 267,776 -c----w c:\windows\ie7updates\KB961260-IE7\iertutil.dll.000+ 2008-08-25 08:38:00 13,824 -c----w c:\windows\ie7updates\KB961260-IE7\ieudinit.exe+ 2008-08-23 05:56:15 635,848 -c----w c:\windows\ie7updates\KB961260-IE7\iexplore.exe+ 2008-08-26 07:24:30 27,648 -c----w c:\windows\ie7updates\KB961260-IE7\jsproxy.dll+ 2008-08-26 07:24:30 459,264 -c----w c:\windows\ie7updates\KB961260-IE7\msfeeds.dll+ 2008-08-26 07:24:30 459,264 -c----w c:\windows\ie7updates\KB961260-IE7\msfeeds.dll.000+ 2008-08-26 07:24:30 52,224 -c----w c:\windows\ie7updates\KB961260-IE7\msfeedsbs.dll+ 2008-08-26 07:24:30 52,224 -c----w c:\windows\ie7updates\KB961260-IE7\msfeedsbs.dll.000+ 2008-08-27 18:54:32 3,593,216 -c----w c:\windows\ie7updates\KB961260-IE7\mshtml.dll+ 2008-08-27 18:54:32 3,593,216 -c----w c:\windows\ie7updates\KB961260-IE7\mshtml.dll.000+ 2008-08-26 07:24:30 477,696 -c----w c:\windows\ie7updates\KB961260-IE7\mshtmled.dll+ 2008-08-26 07:24:30 477,696 -c----w c:\windows\ie7updates\KB961260-IE7\mshtmled.dll.000+ 2008-08-26 07:24:30 193,024 -c----w c:\windows\ie7updates\KB961260-IE7\msrating.dll+ 2008-08-26 07:24:30 671,232 -c----w c:\windows\ie7updates\KB961260-IE7\mstime.dll+ 2008-08-26 07:24:30 102,912 -c----w c:\windows\ie7updates\KB961260-IE7\occache.dll+ 2008-08-26 07:24:30 44,544 -c----w c:\windows\ie7updates\KB961260-IE7\pngfilt.dll+ 2008-08-26 07:24:30 44,544 -c----w c:\windows\ie7updates\KB961260-IE7\pngfilt.dll.000+ 2007-03-06 01:22:41 213,216 -c----w c:\windows\ie7updates\KB961260-IE7\spuninst\spuninst.exe+ 2007-03-06 01:23:51 371,424 -c----w c:\windows\ie7updates\KB961260-IE7\spuninst\updspapi.dll+ 2008-08-26 07:24:30 105,984 -c----w c:\windows\ie7updates\KB961260-IE7\url.dll+ 2008-08-26 07:24:30 105,984 -c----w c:\windows\ie7updates\KB961260-IE7\url.dll.000+ 2008-08-26 07:24:31 1,159,680 -c----w c:\windows\ie7updates\KB961260-IE7\urlmon.dll+ 2008-08-26 07:24:31 1,159,680 -c----w c:\windows\ie7updates\KB961260-IE7\urlmon.dll.000+ 2008-08-26 07:24:31 233,472 -c----w c:\windows\ie7updates\KB961260-IE7\webcheck.dll+ 2008-08-26 07:24:31 233,472 -c----w c:\windows\ie7updates\KB961260-IE7\webcheck.dll.000+ 2008-08-26 07:24:31 826,368 -c----w c:\windows\ie7updates\KB961260-IE7\wininet.dll+ 2008-08-26 07:24:31 826,368 -c----w c:\windows\ie7updates\KB961260-IE7\wininet.dll.000- 2008-04-26 22:49:15 593,920 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\accicons.exe+ 2009-04-08 04:11:51 593,920 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\accicons.exe- 2008-04-26 22:49:15 12,288 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\cagicon.exe+ 2009-04-08 04:11:51 12,288 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\cagicon.exe- 2008-04-26 22:49:16 86,016 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\inficon.exe+ 2009-04-08 04:11:51 86,016 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\inficon.exe- 2008-04-26 22:49:15 135,168 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\misc.exe+ 2009-04-08 04:11:50 135,168 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\misc.exe- 2008-04-26 22:49:16 11,264 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\mspicons.exe+ 2009-04-08 04:11:51 11,264 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\mspicons.exe- 2008-04-26 22:49:16 27,136 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\oisicon.exe+ 2009-04-08 04:11:52 27,136 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\oisicon.exe- 2008-04-26 22:49:16 4,096 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\opwicon.exe+ 2009-04-08 04:11:52 4,096 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\opwicon.exe- 2008-04-26 22:49:16 794,624 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\outicon.exe+ 2009-04-08 04:11:52 794,624 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\outicon.exe- 2008-04-26 22:49:15 249,856 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pptico.exe+ 2009-04-08 04:11:51 249,856 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pptico.exe- 2008-04-26 22:49:15 61,440 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pubs.exe+ 2009-04-08 04:11:50 61,440 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pubs.exe- 2008-04-26 22:49:16 23,040 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\unbndico.exe+ 2009-04-08 04:11:52 23,040 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\unbndico.exe- 2008-04-26 22:49:14 286,720 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\wordicon.exe+ 2009-04-08 04:11:50 286,720 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\wordicon.exe- 2008-04-26 22:49:14 409,600 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\xlicons.exe+ 2009-04-08 04:11:50 409,600 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\xlicons.exe+ 2009-04-07 05:37:53 18,944 ----a-r c:\windows\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF13.exe+ 2009-04-07 05:37:54 65,024 ----a-r c:\windows\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF15.exe+ 2006-06-03 11:40:49 33,792 ------w c:\windows\network diagnostic\custsat.dll+ 2006-10-10 12:44:50 557,568 ------w c:\windows\network diagnostic\xpnetdiag.exe- 2004-08-04 07:56:41 61,440 ----a-w c:\windows\system32\admparse.dll+ 2007-08-13 23:39:20 71,680 ----a-w c:\windows\system32\admparse.dll- 2004-08-04 07:56:41 99,840 ----a-w c:\windows\system32\advpack.dll+ 2008-12-20 23:15:11 124,928 ----a-w c:\windows\system32\advpack.dll+ 2007-08-13 23:39:20 71,680 -c----w c:\windows\system32\dllcache\admparse.dll+ 2008-12-20 23:15:11 124,928 -c----w c:\windows\system32\dllcache\advpack.dll+ 2007-08-13 23:42:54 17,408 -c----w c:\windows\system32\dllcache\corpol.dll- 2008-02-16 08:59:35 357,888 -c----w c:\windows\system32\dllcache\dxtmsft.dll+ 2008-12-20 23:15:12 347,136 -c----w c:\windows\system32\dllcache\dxtmsft.dll- 2008-02-16 08:59:35 205,312 -c----w c:\windows\system32\dllcache\dxtrans.dll+ 2008-12-20 23:15:13 214,528 -c----w c:\windows\system32\dllcache\dxtrans.dll+ 2008-07-07 20:32:22 253,952 -c----w c:\windows\system32\dllcache\es.dll- 2008-02-16 08:59:35 55,808 -c----w c:\windows\system32\dllcache\extmgr.dll+ 2008-12-20 23:15:13 133,120 -c----w c:\windows\system32\dllcache\extmgr.dll+ 2007-08-13 23:18:02 60,416 -c----w c:\windows\system32\dllcache\hmmapi.dll+ 2008-12-19 09:10:15 70,656 -c----w c:\windows\system32\dllcache\ie4uinit.exe+ 2008-12-20 23:15:14 153,088 -c----w c:\windows\system32\dllcache\ieakeng.dll+ 2008-12-20 23:15:14 230,400 -c----w c:\windows\system32\dllcache\ieaksie.dll- 2002-08-29 12:00:00 221,184 -c--a-w c:\windows\system32\dllcache\ieakui.dll+ 2008-12-19 05:23:56 161,792 -c----w c:\windows\system32\dllcache\ieakui.dll+ 2008-12-20 23:15:16 384,512 -c----w c:\windows\system32\dllcache\iedkcs32.dll- 2008-02-15 09:23:37 18,432 -c----w c:\windows\system32\dllcache\iedw.exe+ 2007-08-13 23:44:02 69,120 -c--a-w c:\windows\system32\dllcache\iedw.exe+ 2007-08-13 23:45:18 78,336 -c----w c:\windows\system32\dllcache\ieencode.dll- 2008-02-16 08:59:35 251,392 -c----w c:\windows\system32\dllcache\iepeers.dll+ 2007-08-13 23:54:10 191,488 -c--a-w c:\windows\system32\dllcache\iepeers.dll+ 2008-12-20 23:15:21 44,544 -c----w c:\windows\system32\dllcache\iernonce.dll+ 2007-08-13 23:39:12 55,296 -c----w c:\windows\system32\dllcache\iesetup.dll+ 2008-12-19 05:25:25 634,024 -c----w c:\windows\system32\dllcache\iexplore.exe+ 2007-08-13 23:36:06 36,352 -c----w c:\windows\system32\dllcache\imgutil.dll- 2007-08-21 06:15:44 683,520 -c----w c:\windows\system32\dllcache\inetcomm.dll+ 2008-04-11 18:50:43 683,520 -c----w c:\windows\system32\dllcache\inetcomm.dll- 2008-02-16 08:59:35 96,256 -c----w c:\windows\system32\dllcache\inseng.dll+ 2007-08-13 23:39:02 92,672 -c--a-w c:\windows\system32\dllcache\inseng.dll- 2007-12-18 14:40:58 450,560 -c----w c:\windows\system32\dllcache\jscript.dll+ 2007-08-13 23:38:04 491,520 -c--a-w c:\windows\system32\dllcache\jscript.dll- 2008-02-16 08:59:35 16,384 -c----w c:\windows\system32\dllcache\jsproxy.dll+ 2008-12-20 23:15:23 27,648 -c----w c:\windows\system32\dllcache\jsproxy.dll+ 2007-08-13 23:44:18 40,960 -c----w c:\windows\system32\dllcache\licmgr10.dll- 2006-10-19 01:03:58 100,864 -c--a-w c:\windows\system32\dllcache\logagent.exe+ 2008-06-18 06:09:22 100,864 -c--a-w c:\windows\system32\dllcache\logagent.exe- 2006-05-05 09:41:45 453,120 -c----w c:\windows\system32\dllcache\mrxsmb.sys+ 2008-10-24 11:10:42 453,632 -c----w c:\windows\system32\dllcache\mrxsmb.sys+ 2008-06-24 16:23:05 74,240 -c----w c:\windows\system32\dllcache\mscms.dll+ 2007-08-13 23:32:30 45,568 -c----w c:\windows\system32\dllcache\mshta.exe- 2008-02-16 22:29:38 3,059,712 -c----w c:\windows\system32\dllcache\mshtml.dll+ 2009-01-17 02:35:14 3,594,752 -c----w c:\windows\system32\dllcache\mshtml.dll- 2008-02-16 08:59:37 449,024 -c----w c:\windows\system32\dllcache\mshtmled.dll+ 2008-12-20 23:15:30 477,696 -c----w c:\windows\system32\dllcache\mshtmled.dll+ 2007-08-13 23:01:12 48,128 -c----w c:\windows\system32\dllcache\mshtmler.dll- 2002-08-29 12:00:00 146,432 -c--a-w c:\windows\system32\dllcache\msls31.dll+ 2007-08-13 23:54:10 156,160 -c--a-w c:\windows\system32\dllcache\msls31.dll- 2008-02-16 08:59:37 146,432 -c----w c:\windows\system32\dllcache\msrating.dll+ 2008-12-20 23:15:31 193,024 -c----w c:\windows\system32\dllcache\msrating.dll- 2008-02-16 08:59:37 532,480 -c----w c:\windows\system32\dllcache\mstime.dll+ 2008-12-20 23:15:32 671,232 -c----w c:\windows\system32\dllcache\mstime.dll- 2007-06-26 06:08:16 1,104,896 -c----w c:\windows\system32\dllcache\msxml3.dll+ 2008-09-04 16:42:02 1,106,944 -c----w c:\windows\system32\dllcache\msxml3.dll- 2006-08-17 12:28:27 332,288 -c----w c:\windows\system32\dllcache\netapi32.dll+ 2008-10-15 16:57:55 332,800 -c----w c:\windows\system32\dllcache\netapi32.dll- 2007-02-28 09:08:48 2,136,064 -c----w c:\windows\system32\dllcache\ntkrnlmp.exe+ 2008-08-14 09:58:27 2,136,064 -c----w c:\windows\system32\dllcache\ntkrnlmp.exe- 2007-02-28 08:38:55 2,057,600 -c----w c:\windows\system32\dllcache\ntkrnlpa.exe+ 2008-08-14 09:22:13 2,057,728 -c----w c:\windows\system32\dllcache\ntkrnlpa.exe- 2007-02-28 08:38:57 2,015,744 -c----w c:\windows\system32\dllcache\ntkrpamp.exe+ 2008-08-14 09:22:14 2,015,744 -c----w c:\windows\system32\dllcache\ntkrpamp.exe- 2007-02-28 09:10:57 2,180,352 -c----w c:\windows\system32\dllcache\ntoskrnl.exe+ 2008-08-14 10:00:45 2,180,352 -c----w c:\windows\system32\dllcache\ntoskrnl.exe+ 2008-12-20 23:15:38 102,912 -c----w c:\windows\system32\dllcache\occache.dll- 2008-02-16 08:59:37 39,424 -c----w c:\windows\system32\dllcache\pngfilt.dll+ 2008-12-20 23:15:38 44,544 -c----w c:\windows\system32\dllcache\pngfilt.dll- 2007-10-29 22:43:03 1,287,680 -c----w c:\windows\system32\dllcache\quartz.dll+ 2008-05-07 05:18:48 1,287,680 -c----w c:\windows\system32\dllcache\quartz.dll- 2006-07-13 08:48:58 202,240 -c--a-w c:\windows\system32\dllcache\rmcast.sys+ 2008-05-08 12:28:49 202,752 -c--a-w c:\windows\system32\dllcache\rmcast.sys- 2007-04-25 14:21:15 144,896 -c----w c:\windows\system32\dllcache\schannel.dll+ 2008-12-05 07:12:45 144,896 -c----w c:\windows\system32\dllcache\schannel.dll- 2007-10-26 03:36:51 8,454,656 -c----w c:\windows\system32\dllcache\shell32.dll+ 2008-07-03 13:16:57 8,454,656 -c----w c:\windows\system32\dllcache\shell32.dll- 2006-08-14 10:34:41 332,928 -c----w c:\windows\system32\dllcache\srv.sys+ 2008-12-11 11:57:21 333,184 -c----w c:\windows\system32\dllcache\srv.sys- 2006-08-21 14:52:08 246,814 -c----w c:\windows\system32\dllcache\strmdll.dll+ 2008-10-03 10:15:47 247,326 -c----w c:\windows\system32\dllcache\strmdll.dll+ 2008-12-20 23:15:39 105,984 -c----w c:\windows\system32\dllcache\url.dll- 2008-02-16 08:59:38 615,936 -c----w c:\windows\system32\dllcache\urlmon.dll+ 2008-12-20 23:15:40 1,160,192 -c----w c:\windows\system32\dllcache\urlmon.dll- 2007-12-18 14:40:58 417,792 -c----w c:\windows\system32\dllcache\vbscript.dll+ 2007-08-13 23:54:10 413,696 -c--a-w c:\windows\system32\dllcache\vbscript.dll- 2007-06-26 15:13:22 851,968 -c----w c:\windows\system32\dllcache\vgx.dll+ 2007-08-13 23:54:10 765,952 -c--a-w c:\windows\system32\dllcache\VGX.dll+ 2008-12-20 23:15:40 233,472 -c----w c:\windows\system32\dllcache\webcheck.dll- 2008-03-19 09:47:00 1,845,248 -c----w c:\windows\system32\dllcache\win32k.sys+ 2009-02-09 10:19:34 1,846,272 -c----w c:\windows\system32\dllcache\win32k.sys- 2008-02-16 08:59:39 659,456 -c----w c:\windows\system32\dllcache\wininet.dll+ 2008-12-20 23:15:41 826,368 -c----w c:\windows\system32\dllcache\wininet.dll- 2006-10-19 02:47:20 937,984 -c--a-w c:\windows\system32\dllcache\WMNetMgr.dll+ 2008-06-18 10:03:08 938,496 -c--a-w c:\windows\system32\dllcache\WMNetmgr.dll- 2006-10-19 02:47:22 2,450,944 -c--a-w c:\windows\system32\dllcache\wmvcore.dll+ 2008-06-18 10:03:14 2,458,112 -c--a-w c:\windows\system32\dllcache\WMVCore.dll- 2004-08-04 06:14:14 138,496 ----a-w c:\windows\system32\drivers\afd.sys+ 2008-08-14 09:51:43 138,368 ----a-w c:\windows\system32\drivers\afd.sys- 2004-08-04 06:10:37 274,304 ------w c:\windows\system32\drivers\bthport.sys+ 2008-06-13 13:10:50 272,128 ------w c:\windows\system32\drivers\bthport.sys- 2006-05-05 09:41:45 453,120 ----a-w c:\windows\system32\drivers\mrxsmb.sys+ 2008-10-24 11:10:42 453,632 ----a-w c:\windows\system32\drivers\mrxsmb.sys- 2006-07-13 08:48:58 202,240 ----a-w c:\windows\system32\drivers\rmcast.sys+ 2008-05-08 12:28:49 202,752 ----a-w c:\windows\system32\drivers\rmcast.sys- 2006-08-14 10:34:41 332,928 ----a-w c:\windows\system32\drivers\srv.sys+ 2008-12-11 11:57:21 333,184 ----a-w c:\windows\system32\drivers\srv.sys- 2008-02-16 08:59:35 357,888 ----a-w c:\windows\system32\dxtmsft.dll+ 2008-12-20 23:15:12 347,136 ------w c:\windows\system32\dxtmsft.dll- 2008-02-16 08:59:35 205,312 ----a-w c:\windows\system32\dxtrans.dll+ 2008-12-20 23:15:13 214,528 ------w c:\windows\system32\dxtrans.dll- 2005-07-26 04:39:45 243,200 ----a-w c:\windows\system32\es.dll+ 2008-07-07 20:32:22 253,952 ----a-w c:\windows\system32\es.dll- 2008-02-16 08:59:35 55,808 ------w c:\windows\system32\extmgr.dll+ 2008-12-20 23:15:13 133,120 ------w c:\windows\system32\extmgr.dll- 2008-04-27 00:21:58 208,896 ----a-w c:\windows\system32\FNTCACHE.DAT+ 2009-04-08 04:14:52 208,896 ----a-w c:\windows\system32\FNTCACHE.DAT+ 2008-12-20 23:15:13 63,488 ----a-w c:\windows\system32\icardie.dll+ 2006-06-29 13:05:44 26,112 ------w c:\windows\system32\idndl.dll- 2004-08-04 07:56:50 34,304 ----a-w c:\windows\system32\ie4uinit.exe+ 2008-12-19 09:10:15 70,656 ------w c:\windows\system32\ie4uinit.exe- 2004-08-04 07:56:42 139,264 ----a-w c:\windows\system32\ieakeng.dll+ 2008-12-20 23:15:14 153,088 ------w c:\windows\system32\ieakeng.dll- 2004-08-04 07:56:42 216,576 ----a-w c:\windows\system32\ieaksie.dll+ 2008-12-20 23:15:14 230,400 ------w c:\windows\system32\ieaksie.dll- 2002-08-29 12:00:00 221,184 ----a-w c:\windows\system32\ieakui.dll+ 2008-12-19 05:23:56 161,792 ------w c:\windows\system32\ieakui.dll+ 2007-04-17 09:32:38 2,455,488 ----a-w c:\windows\system32\ieapfltr.dat+ 2008-12-20 23:15:15 383,488 ----a-w c:\windows\system32\ieapfltr.dll- 2004-08-04 07:56:42 323,584 ----a-w c:\windows\system32\iedkcs32.dll+ 2008-12-20 23:15:16 384,512 ------w c:\windows\system32\iedkcs32.dll- 2004-08-04 07:56:42 81,920 ------w c:\windows\system32\ieencode.dll+ 2007-08-13 23:45:18 78,336 ----a-w c:\windows\system32\ieencode.dll+ 2008-12-20 23:15:21 6,066,688 ----a-w c:\windows\system32\ieframe.dll- 2008-02-16 08:59:35 251,392 ----a-w c:\windows\system32\iepeers.dll+ 2007-08-13 23:54:10 191,488 ----a-w c:\windows\system32\iepeers.dll- 2004-08-04 07:56:42 48,640 ----a-w c:\windows\system32\iernonce.dll+ 2008-12-20 23:15:21 44,544 ------w c:\windows\system32\iernonce.dll+ 2008-12-20 23:15:22 267,776 ----a-w c:\windows\system32\iertutil.dll- 2004-08-04 07:56:42 62,976 ----a-w c:\windows\system32\iesetup.dll+ 2007-08-13 23:39:12 55,296 ----a-w c:\windows\system32\iesetup.dll+ 2008-12-19 09:10:15 13,824 ----a-w c:\windows\system32\ieudinit.exe+ 2007-08-13 23:54:10 180,736 ------w c:\windows\system32\ieui.dll- 2004-08-04 07:56:42 35,840 ----a-w c:\windows\system32\imgutil.dll+ 2007-08-13 23:36:06 36,352 ----a-w c:\windows\system32\imgutil.dll- 2007-08-21 06:15:44 683,520 ----a-w c:\windows\system32\inetcomm.dll+ 2008-04-11 18:50:43 683,520 ----a-w c:\windows\system32\inetcomm.dll- 2008-02-16 08:59:35 96,256 ----a-w c:\windows\system32\inseng.dll+ 2007-08-13 23:39:02 92,672 ----a-w c:\windows\system32\inseng.dll- 2007-12-18 14:40:58 450,560 ----a-w c:\windows\system32\jscript.dll+ 2007-08-13 23:38:04 491,520 ----a-w c:\windows\system32\jscript.dll- 2008-02-16 08:59:35 16,384 ----a-w c:\windows\system32\jsproxy.dll+ 2008-12-20 23:15:23 27,648 ------w c:\windows\system32\jsproxy.dll- 2004-08-04 07:56:42 22,016 ----a-w c:\windows\system32\licmgr10.dll+ 2007-08-13 23:44:18 40,960 ----a-w c:\windows\system32\licmgr10.dll- 2006-10-19 01:03:58 100,864 ----a-w c:\windows\system32\logagent.exe+ 2008-06-18 06:09:22 100,864 ----a-w c:\windows\system32\logagent.exe- 2009-04-07 02:33:48 2,849 --sha-w c:\windows\system32\mmf.sys+ 2009-04-08 07:04:01 2,849 --sha-w c:\windows\system32\mmf.sys- 2008-04-06 05:56:20 19,836,024 ----a-w c:\windows\system32\MRT.exe+ 2009-02-25 17:55:00 24,768,960 ----a-w c:\windows\system32\MRT.exe- 2005-06-29 01:46:00 74,240 ----a-w c:\windows\system32\mscms.dll+ 2008-06-24 16:23:05 74,240 ----a-w c:\windows\system32\mscms.dll+ 2008-12-20 23:15:23 459,264 ----a-w c:\windows\system32\msfeeds.dll+ 2008-12-20 23:15:24 52,224 ----a-w c:\windows\system32\msfeedsbs.dll+ 2007-08-13 23:36:40 12,288 ------w c:\windows\system32\msfeedssync.exe- 2004-08-04 07:56:53 29,184 ----a-w c:\windows\system32\mshta.exe+ 2007-08-13 23:32:30 45,568 ----a-w c:\windows\system32\mshta.exe- 2008-02-16 22:29:38 3,059,712 ----a-w c:\windows\system32\mshtml.dll+ 2009-01-17 02:35:14 3,594,752 ----a-w c:\windows\system32\mshtml.dll- 2008-02-16 08:59:37 449,024 ----a-w c:\windows\system32\mshtmled.dll+ 2008-12-20 23:15:30 477,696 ----a-w c:\windows\system32\mshtmled.dll- 2004-08-04 07:56:14 56,832 ----a-w c:\windows\system32\mshtmler.dll+ 2007-08-13 23:01:12 48,128 ----a-w c:\windows\system32\mshtmler.dll- 2002-08-29 12:00:00 146,432 ----a-w c:\windows\system32\msls31.dll+ 2007-08-13 23:54:10 156,160 ----a-w c:\windows\system32\msls31.dll- 2008-02-16 08:59:37 146,432 ----a-w c:\windows\system32\msrating.dll+ 2008-12-20 23:15:31 193,024 ------w c:\windows\system32\msrating.dll- 2008-02-16 08:59:37 532,480 ----a-w c:\windows\system32\mstime.dll+ 2008-12-20 23:15:32 671,232 ------w c:\windows\system32\mstime.dll- 2007-06-26 06:08:16 1,104,896 ----a-w c:\windows\system32\msxml3.dll+ 2008-09-04 16:42:02 1,106,944 ----a-w c:\windows\system32\msxml3.dll- 2006-08-17 12:28:27 332,288 ----a-w c:\windows\system32\netapi32.dll+ 2008-10-15 16:57:55 332,800 ----a-w c:\windows\system32\netapi32.dll+ 2006-06-28 22:59:26 24,576 ------w c:\windows\system32\nlsdl.dll+ 2006-06-29 13:05:44 23,552 ------w c:\windows\system32\normaliz.dll- 2007-02-28 08:38:55 2,057,600 ----a-w c:\windows\system32\ntkrnlpa.exe+ 2008-08-14 09:22:13 2,057,728 ----a-w c:\windows\system32\ntkrnlpa.exe- 2007-02-28 09:10:57 2,180,352 ----a-w c:\windows\system32\ntoskrnl.exe+ 2008-08-14 10:00:45 2,180,352 ----a-w c:\windows\system32\ntoskrnl.exe- 2004-08-04 07:56:44 96,256 ----a-w c:\windows\system32\occache.dll+ 2008-12-20 23:15:38 102,912 ------w c:\windows\system32\occache.dll- 2008-02-16 08:59:37 39,424 ----a-w c:\windows\system32\pngfilt.dll+ 2008-12-20 23:15:38 44,544 ----a-w c:\windows\system32\pngfilt.dll- 2007-10-29 22:43:03 1,287,680 ----a-w c:\windows\system32\quartz.dll+ 2008-05-07 05:18:48 1,287,680 ----a-w c:\windows\system32\quartz.dll- 2007-04-25 14:21:15 144,896 ----a-w c:\windows\system32\schannel.dll+ 2008-12-05 07:12:45 144,896 ----a-w c:\windows\system32\schannel.dll- 2007-10-26 03:36:51 8,454,656 ----a-w c:\windows\system32\shell32.dll+ 2008-07-03 13:16:57 8,454,656 ----a-w c:\windows\system32\shell32.dll- 2006-09-25 22:58:48 14,640 ------w c:\windows\system32\spmsg.dll+ 2007-11-30 11:18:51 17,272 ------w c:\windows\system32\spmsg.dll- 2006-09-25 22:58:48 23,856 ----a-w c:\windows\system32\spupdsvc.exe+ 2007-07-27 14:41:38 26,488 ----a-w c:\windows\system32\spupdsvc.exe- 2006-08-21 14:52:08 246,814 ----a-w c:\windows\system32\strmdll.dll+ 2008-10-03 10:15:47 247,326 ----a-w c:\windows\system32\strmdll.dll- 2007-11-13 11:31:11 60,416 ------w c:\windows\system32\tzchange.exe+ 2008-10-22 09:47:07 62,976 ------w c:\windows\system32\tzchange.exe- 2004-08-04 07:56:46 37,888 ----a-w c:\windows\system32\url.dll+ 2008-12-20 23:15:39 105,984 ----a-w c:\windows\system32\url.dll- 2008-02-16 08:59:38 615,936 ----a-w c:\windows\system32\urlmon.dll+ 2008-12-20 23:15:40 1,160,192 ----a-w c:\windows\system32\urlmon.dll- 2007-12-18 14:40:58 417,792 ----a-w c:\windows\system32\vbscript.dll+ 2007-08-13 23:54:10 413,696 ----a-w c:\windows\system32\vbscript.dll- 2004-08-04 07:56:46 49,152 ----a-w c:\windows\system32\wdigest.dll+ 2006-03-24 04:37:50 49,152 ----a-w c:\windows\system32\wdigest.dll- 2004-08-04 07:56:46 276,480 ----a-w c:\windows\system32\webcheck.dll+ 2008-12-20 23:15:40 233,472 ----a-w c:\windows\system32\webcheck.dll- 2008-03-19 09:47:00 1,845,248 ----a-w c:\windows\system32\win32k.sys+ 2009-02-09 10:19:34 1,846,272 ----a-w c:\windows\system32\win32k.sys+ 2007-08-13 23:45:16 206,336 ------w c:\windows\system32\WinFXDocObj.exe- 2008-02-16 08:59:39 659,456 ----a-w c:\windows\system32\wininet.dll+ 2008-12-20 23:15:41 826,368 ----a-w c:\windows\system32\wininet.dll- 2006-10-19 02:47:20 937,984 ----a-w c:\windows\system32\WMNetMgr.dll+ 2008-06-18 10:03:08 938,496 ----a-w c:\windows\system32\WMNetmgr.dll- 2007-06-12 04:51:12 10,834,944 ----a-w c:\windows\system32\wmp.dll+ 2008-11-11 23:34:42 10,838,016 ----a-w c:\windows\system32\wmp.dll- 2006-10-19 02:47:20 295,936 ------w c:\windows\system32\wmpeffects.dll+ 2008-06-24 23:12:58 295,936 ------w c:\windows\system32\wmpeffects.dll- 2006-10-19 02:47:22 2,450,944 ----a-w c:\windows\system32\wmvcore.dll+ 2008-06-18 10:03:14 2,458,112 ----a-w c:\windows\system32\WMVCore.dll+ 2006-07-14 15:51:51 121,856 ------w c:\windows\system32\xmllite.dll+ 2008-04-15 17:54:19 1,724,416 ----a-w c:\windows\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.3352_x-ww_81af8e88\GdiPlus.dll.-- Snapshot reset to current date --.((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shown REGEDIT4[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-24 68856]"Anonymizer"="c:\program files\Anonymizer\Anonymizer Software\Anonymizer.exe" [2008-04-15 1557176]"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]"Google Update"="c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-09-02 133104]"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2008-11-05 4347120]"NVIEW"="nview.dll" [2003-08-19 c:\windows\system32\nview.dll][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-08-20 118784]"CamMonitor"="c:\program files\HP\Digital Imaging\Unload\hpqcmon.exe" [2002-10-07 90112]"HPHmon05"="c:\windows\System32\hphmon05.exe" [2003-05-23 483328]"KBD"="c:\hp\KBD\KBD.EXE" [2003-02-11 61440]"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 110592]"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-13 212992]"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2004-09-14 70776]"PS2"="c:\windows\system32\ps2.exe" [2002-07-31 81920]"Reminder"="c:\windows\Creator\Remind_XP.exe" [2003-06-17 118784]"Motive SmartBridge"="c:\progra~1\VERIZO~1\SUPPOR~1\SMARTB~1\MotiveSB.exe" [2004-12-28 385024]"Verizon Control Pad"="c:\program files\Verizon Online\ControlPad\cpad.exe" [2002-06-13 7376896]"mmtask"="c:\program files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe" [2003-07-23 53248]"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2004-05-20 98304]"HPDJ Taskbar Utility"="c:\windows\System32\spool\drivers\w32x86\3\hpztsb08.exe" [2003-03-12 172032]"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-08-20 155648]"MSConfig"="c:\windows\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2004-08-04 158208]"AVG7_CC"="c:\progra~1\Grisoft\AVG7\avgcc.exe" [2009-02-24 590848]"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2002-08-29 59392]"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2002-08-29 455168]"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2002-08-29 455168]"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2007-06-17 185896]"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2006-11-21 842584]"WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-01-15 37376]"LTMSG"="LTMSG.exe" [2003-07-14 c:\windows\ltmsg.exe]"AlcxMonitor"="ALCXMNTR.EXE" [2004-09-07 c:\windows\ALCXMNTR.EXE][HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]"AVG7_Run"="c:\progra~1\Grisoft\AVG7\avgw.exe" [2007-10-25 219136][HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]"RunNarrator"="Narrator.exe" [2004-08-04 c:\windows\system32\narrator.exe]c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 29696]Compaq Connections.lnk - c:\program files\Compaq Connections\1940576\Program\BackWeb-1940576.exe [2003-10-11 16384]HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2003-07-07 233472]Microsoft Office OneNote 2003 Quick Launch.lnk - c:\program files\Microsoft Office\OFFICE11\ONENOTEM.EXE [2003-08-06 51776]MLB.TV NexDef Plug-in.lnk - c:\program files\Autobahn\mlb-nexdef-autobahn.exe [2008-03-28 799496]Verizon Online Support Center.lnk - c:\program files\Verizon Online\SupportCenter\bin\matcli.exe [2004-05-06 204800][hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824][HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]2008-12-22 12:05 356352 c:\program files\SUPERAntiSpyware\SASWINLO.dll[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]Notification Packages REG_MULTI_SZ scecli dpnocfg.dll[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Quicken Scheduled Updates.lnk]path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Quicken Scheduled Updates.lnkbackup=c:\windows\pss\Quicken Scheduled Updates.lnkCommon Startup[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^spamsubtract.lnk]path=c:\documents and settings\Owner\Start Menu\Programs\Startup\spamsubtract.lnkbackup=c:\windows\pss\spamsubtract.lnkStartup[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]--a------ 2004-12-18 00:20 278528 c:\program files\iTunes\iTunesHelper.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]--a------ 2003-02-19 23:49 2185800 c:\program files\MSN Messenger\msnmsgr.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealPlayer]--a------ 2007-06-17 10:37 214560 c:\program files\Real\RealOne Player\realplay.exe[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]"DisableMonitoring"=dword:00000001[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]"%windir%\\system32\\sessmgr.exe"="c:\\Program Files\\Compaq Connections\\1940576\\Program\\BackWeb-1940576.exe"="c:\\Program Files\\Kazaa Lite K++\\KazaaLite.kpp"="c:\\Program Files\\WinMX\\WinMX.exe"="c:\\Program Files\\iTunes\\iTunes.exe"="c:\\Program Files\\Real\\RealOne Player\\realplay.exe"="c:\\Program Files\\Mozilla Firefox\\firefox.exe"="c:\\WINDOWS\\system32\\fxsclnt.exe"="c:\\Program Files\\Real\\RealOne Player\\realplayer.exe"="c:\\Program Files\\Netscape\\Netscape Browser\\netscape.exe"="c:\\Program Files\\Real\\RealOne Player\\trueplay.exe"="c:\\Program Files\\Grisoft\\AVG7\\avginet.exe"="c:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"="c:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"="c:\\Program Files\\Windows Media Player\\wmplayer.exe"="c:\\Program Files\\Anonymizer\\Anonymizer Software\\common\\AnonProxy.exe"="c:\\Program Files\\Autobahn\\mlb-nexdef-autobahn.exe"="c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe"=R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2009-03-23 9968]R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2009-03-23 72944]R2 LicCtrlService;LicCtrl Service;c:\windows\Runservice.exe [2005-12-10 2560]S2 AnonAswSvc;Anonymizer Anti-Spyware Service;c:\program files\Anonymizer\Anonymizer Software\AnonASW\AnonAswSvc.exe [2007-10-22 37560]S2 AnonMgmtSvc;Anonymizer Management Service;c:\program files\Anonymizer\Anonymizer Software\Common\AnonMgmtSvc.exe [2007-10-22 37560]S2 kiehbaeg;PnP ISA/EISA Bus Support;c:\windows\System32\svchost.exe -k netsvcs [2003-10-31 14336]S2 mrtRate;mrtRate; [x]S2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2007-01-11 24652]S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2009-03-23 7408]S3 ZD1211BU(SMC);802.11g Wireless USB2.0 Adapter Driver(SMC);c:\windows\system32\drivers\ZD1211BU.sys [2006-08-24 477696]--- Other Services/Drivers In Memory ---*Deregistered* - IPVNMonHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcskiehbaeg.Contents of the 'Scheduled Tasks' folder2009-04-07 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1866085676-2795454385-2280570241-1003.job- c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-02 18:05]2009-04-04 c:\windows\Tasks\Norton AntiVirus - Scan my computer.job- c:\progra~1\NORTON~1\Navw32.exe [2003-12-04 17:22]2009-04-08 c:\windows\Tasks\Symantec NetDetect.job- c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2004-07-19 16:26]..------- Supplementary Scan -------.uStart Page = hxxp://www.google.com/uDefault_Search_URL = hxxp://srch-qus10.hpwis.com/uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8mSearch Bar = hxxp://srch-qus10.hpwis.com/uInternet Settings,ProxyOverride = localhostuSearchURL,(Default) = hxxp://www.google.com/search?q=%sIE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000IE: {{28D44DAC-D1FC-4d4f-BB1B-ADF037C8DDBC} - c:\program files\Verizon Online\ControlPad\Misc\a_menu.exeLSP: SpSubLSP.dllDPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cabFF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\m8peguoh.default\FF - prefs.js: browser.startup.homepage - hxxp://www.google.comFF - plugin: c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\1.2.141.5\npGoogleOneClick7.dllFF - plugin: c:\program files\Java\j2re1.4.2\bin\NPJava11.dllFF - plugin: c:\program files\Java\j2re1.4.2\bin\NPJava12.dllFF - plugin: c:\program files\Java\j2re1.4.2\bin\NPJava13.dllFF - plugin: c:\program files\Java\j2re1.4.2\bin\NPJava14.dllFF - plugin: c:\program files\Java\j2re1.4.2\bin\NPJava32.dllFF - plugin: c:\program files\Java\j2re1.4.2\bin\NPJPI142.dllFF - plugin: c:\program files\Java\j2re1.4.2\bin\NPOJI610.dllFF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dllFF - plugin: c:\program files\Mozilla Firefox\plugins\NPAdbESD.dllFF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dllFF - plugin: c:\program files\Mozilla Firefox\plugins\NPTURNMED.dllFF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint_03050024.dllFF - plugin: c:\program files\Real\RealOne Player\Netscape6\nppl3260.dllFF - plugin: c:\program files\Real\RealOne Player\Netscape6\nprjplug.dllFF - plugin: c:\program files\Real\RealOne Player\Netscape6\nprpjplug.dllFF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll.**************************************************************************catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.netRootkit scan 2009-04-08 02:06:27Windows 5.1.2600 Service Pack 2 NTFSscanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... c:\windows\TEMP\Perflib_Perfdata_c1c.dat 16384 bytesscan completed successfullyhidden files: 1**************************************************************************.--------------------- LOCKED REGISTRY KEYS ---------------------[HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&y@^t! #^$ g9^$&pgb SDB36o \103076C71E8172E2]"1"=hex:f3,63,02,17,10,0f,8c,72,44,b1,bf,31,22,25,c4,7d,41,89,c7,a7,5f,90,bb, a2"2"=hex:05,42,30,42,a7,15,e9,31,44,4c,e8,ce,26,93,4c,ff,dc,fd,7a,28,38,0d,79, b8"3"=hex:f3,63,02,17,10,0f,8c,72,44,b1,bf,31,22,25,c4,7d,38,a8,bc,ca,16,d6,08, eb,9c,8b,9c,0d,35,8b,99,e4,25,24,80,ac,1f,d3,6a,72[HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&y@^t! #^$ g9^$&pgb SDB36o \103076C71E8172E2\103076C71E8172E2]"1"=hex:33,08,da,55,f6,12,dc,ab,f4,e9,74,73,21,3e,6a,85,2f,ad,11,35,1e,74,d2, f6,35,6d,98,1b,b3,42,db,57"2"=hex:ff,46,a9,cd,53,d2,ef,98[HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&y@^t! #^$ g9^$&pgb SDB36o \103076C71E8172E2\E2D78D07BA1CEFC607EE825C5DE445EF]"1"=hex:33,08,da,55,f6,12,dc,ab,f4,e9,74,73,21,3e,6a,85,2f,ad,11,35,1e,74,d2, f6,35,6d,98,1b,b3,42,db,57"2"=hex:a6,61,c0,40,f8,08,be,24"3"=hex:5e,44,b2,f8,79,f8,c3,56,fc,84,9a,8b,51,82,df,9b,2f,77,5f,6d,51,02,c1, db,2d,28,1f,b8,51,ed,45,02,c0,a2,38,83,13,a9,5d,2b,4f,3b,09,30,26,d4,2b,79,\"4"=hex:2f,ad,a2,e7,8a,bf,05,5e"5"=hex:bf,e5,23,7b,b0,66,d6,fc,b8,e8,6b,a0,96,52,f7,32,80,09,8f,24,b7,b3,55, 1a,98,d1,47,16,02,43,61,1c,b9,d5,8f,2a,7b,81,b1,fb,95,22,f8,b3,2c,53,9d,ae,\"6"=hex:33,08,da,55,f6,12,dc,ab,f4,e9,74,73,21,3e,6a,85,2f,ad,11,35,1e,74,d2, f6,22,52,65,d3,e6,83,ee,c9,ec,ed,f3,43,55,72,5a,1c,5c,40,c9,af,48,22,30,c1,\"7"=hex:33,08,da,55,f6,12,dc,ab,f4,e9,74,73,21,3e,6a,85,2f,ad,11,35,1e,74,d2, f6,db,b7,35,cf,1a,ec,25,5d,ef,3a,0f,de,ed,ad,54,53,c0,07,76,18,d4,8c,6c,4e,\"8"=hex:9d,9e,b2,b9,a7,a5,f4,ae,4d,29,c2,a3,c0,78,c4,c5,86,15,ba,ba,a8,7c,30, 6e,e7,be,f3,4e,5c,b8,67,18,68,d2,34,71,6e,be,6a,68,12,55,ff,37,2b,86,ac,b7,\"9"=hex:81,20,8f,ab,28,6a,52,9c"18"=hex:4b,72,8f,bc,6c,3f,e4,15"10"=hex:81,20,8f,ab,28,6a,52,9c"11"=hex:81,20,8f,ab,28,6a,52,9c"12"=hex:d4,45,36,60,18,fd,62,00,dc,8a,32,fa,cd,78,aa,51,cc,14,2a,00,21,9b,8a, 16,b3,d6,f3,a1,9a,14,87,a9,ee,d6,e6,02,aa,d2,3b,5c,89,9b,74,15,d6,0f,71,a9,\"13"=hex:27,5b,ae,74,82,ae,9c,95,c3,ad,74,46,28,ff,30,51,70,9d,48,a6,d6,41,95, 16"14"=hex:83,34,31,f7,8e,d5,03,43,db,41,e1,35,0d,b6,15,0b,18,9e,8c,27,2c,08,ed, cf"24"=hex:81,20,8f,ab,28,6a,52,9c"26"=hex:81,20,8f,ab,28,6a,52,9c"27"=hex:81,20,8f,ab,28,6a,52,9c"19"=hex:fb,ef,44,17,f0,2e,d6,25,2c,32,20,ab,3c,6d,4d,1b"22"=hex:81,20,8f,ab,28,6a,52,9c"15"=hex:ec,2f,5c,9a,be,84,57,07,f3,e7,f3,94,99,93,5e,61,0f,03,00,e0,a8,20,bc, 99,03,35,e0,7c,0f,f3,3d,7d,96,49,c6,d5,37,7d,0c,78,24,93,16,5c,49,31,9b,8a,\[HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&y@^t! #^$ g9^$&pgb SDB36o \501529F2142DBB50]"1"=hex:55,71,d5,88,d4,e8,c4,23,86,c5,84,77,3a,01,80,8c"2"=hex:e7,27,cf,42,f4,44,fe,c6,7c,92,71,43,d3,fc,2b,88,fa,d9,fe,5d,52,9c,ef, 9a,2a,6d,72,a6,74,ac,7c,c2"3"=hex:55,71,d5,88,d4,e8,c4,23,fd,b6,60,5b,fa,86,28,a7,15,7e,26,7e,15,53,b1, 53,45,c5,e4,e2,cb,6f,56,41,9f,13,40,18,4a,19,41,af,82,2c,15,9b,68,3b,4e,c0[HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&y@^t! #^$ g9^$&pgb SDB36o \501529F2142DBB50\A9E17DC1A54D1D28BB40F338A2C6273E]"1"=hex:80,21,ee,d1,6b,60,09,6f,f8,87,24,43,64,25,4c,aa,b2,18,c8,df,6b,eb,72, a3,0a,b2,c0,1f,52,da,0b,fb"2"=hex:81,20,8f,ab,28,6a,52,9c"3"=hex:41,61,9c,ec,5d,71,e3,51,a4,97,a7,f3,c0,fb,4c,a8,48,9b,b2,7d,90,0f,24, dd,46,c6,46,00,0e,10,34,dc,2f,c8,76,36,62,f2,90,0e,e9,7e,e6,ad,f6,0f,1e,63,\"4"=hex:2f,ad,a2,e7,8a,bf,05,5e"5"=hex:bf,e5,23,7b,b0,66,d6,fc,b8,e8,6b,a0,96,52,f7,32,80,09,8f,24,b7,b3,55, 1a,98,d1,47,16,02,43,61,1c,b9,d5,8f,2a,7b,81,b1,fb,95,22,f8,b3,2c,53,9d,ae,\"6"=hex:80,21,ee,d1,6b,60,09,6f,f8,87,24,43,64,25,4c,aa,b2,18,c8,df,6b,eb,72, a3,c2,b5,a5,be,18,5e,8d,12,a5,96,30,c8,e8,9b,a0,07,34,11,26,76,4a,05,43,f8,\"7"=hex:80,21,ee,d1,6b,60,09,6f,f8,87,24,43,64,25,4c,aa,b2,18,c8,df,6b,eb,72, a3,0a,b2,c0,1f,52,da,0b,fb"8"=hex:9d,9e,b2,b9,a7,a5,f4,ae,4d,29,c2,a3,c0,78,c4,c5,65,47,71,48,e9,1d,9d, ae,8d,a8,42,08,32,10,f7,67,cf,df,52,86,31,35,e0,07,c7,f4,11,f0,ed,74,e2,7b,\"9"=hex:81,20,8f,ab,28,6a,52,9c"18"=hex:4b,72,8f,bc,6c,3f,e4,15"10"=hex:b3,b5,ff,62,ba,b6,61,46"11"=hex:81,20,8f,ab,28,6a,52,9c"12"=hex:7e,53,02,59,ed,97,fb,2f,85,9e,9d,15,b0,2c,ad,9d,88,a7,15,e4,c0,c5,d1, 1e,24,44,79,79,8c,4d,d5,49,f9,ed,a7,ec,df,31,12,51,6c,95,86,4c,48,f0,58,42,\"13"=hex:82,b4,e2,1e,09,ec,b3,44,b6,98,fa,e2,b3,0d,58,fb,16,03,3d,50,79,69,0a, 22"14"=hex:a6,c1,97,cd,4d,ca,f1,2d"24"=hex:81,20,8f,ab,28,6a,52,9c"26"=hex:81,20,8f,ab,28,6a,52,9c"27"=hex:81,20,8f,ab,28,6a,52,9c"19"=hex:40,51,15,fc,cf,fd,6d,bb,0a,b5,3c,be,52,e9,4a,4d"22"=hex:81,20,8f,ab,28,6a,52,9c"15"=hex:66,7b,70,f8,d9,9e,1b,e5,5a,f4,29,e2,11,1e,aa,d6,be,8b,8d,c8,66,cb,b0, af,ba,4c,5e,bc,fe,13,09,c4,5d,8d,7e,09,02,2a,ff,a9,77,58,ef,54,d0,f8,e2,89,\.--------------------- DLLs Loaded Under Running Processes ---------------------- - - - - - - > 'winlogon.exe'(632)c:\program files\SUPERAntiSpyware\SASWINLO.dll- - - - - - - > 'lsass.exe'(688)c:\windows\system32\SpSubLSP.dll.------------------------ Other Running Processes ------------------------.c:\progra~1\Grisoft\AVG7\avgamsvr.exec:\progra~1\Grisoft\AVG7\avgupsvc.exec:\program files\Norton AntiVirus\NAVAPSVC.EXEc:\windows\system32\notepad.exec:\program files\Verizon Online\SupportCenter\bin\mpbtn.exec:\windows\system32\taskmgr.exe.**************************************************************************.Completion time: 2009-04-08 2:16:12 - machine was rebootedComboFix-quarantined-files.txt 2009-04-08 07:16:08ComboFix2.txt 2009-04-07 05:25:10ComboFix3.txt 2009-04-07 02:43:41Pre-Run: 10,348,634,112 bytes freePost-Run: 10,334,871,552 bytes free741 --- E O F --- 2009-04-08 04:12:59 Link to post Share on other sites More sharing options...
SarahReed Posted April 8, 2009 Author ID:71434 Share Posted April 8, 2009 And here is my HiJackThis log:Logfile of Trend Micro HijackThis v2.0.2Scan saved at 02:32:12, on 4/8/2009Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v7.00 (7.00.6000.16791)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\PROGRA~1\Grisoft\AVG7\avgamsvr.exeC:\PROGRA~1\Grisoft\AVG7\avgupsvc.exeC:\WINDOWS\runservice.exec:\Program Files\Norton AntiVirus\navapsvc.exeC:\windows\system\hpsysdrv.exeC:\WINDOWS\system32\hkcmd.exeC:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exeC:\WINDOWS\LTMSG.exeC:\PROGRA~1\VERIZO~1\SUPPOR~1\SMARTB~1\MotiveSB.exeC:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exeC:\Program Files\QuickTime\qttask.exeC:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exeC:\WINDOWS\system32\igfxtray.exeC:\WINDOWS\ALCXMNTR.EXEC:\PROGRA~1\Grisoft\AVG7\avgcc.exeC:\Program Files\Microsoft IntelliPoint\ipoint.exeC:\Program Files\Messenger\msmsgs.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exeC:\Documents and Settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exeC:\Program Files\HP\Digital Imaging\bin\hpqtra08.exeC:\Program Files\Verizon Online\SupportCenter\bin\mpbtn.exeC:\WINDOWS\explorer.exeC:\WINDOWS\system32\notepad.exeC:\WINDOWS\system32\wuauclt.exeC:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\Application\chrome.exeC:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\Application\chrome.exeC:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\Application\chrome.exeC:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\Application\chrome.exeC:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\Application\chrome.exeC:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\Application\chrome.exeC:\Program Files\Trend Micro\HijackThis\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-qus10.hpwis.com/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-qus10.hpwis.com/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhostO2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dllO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dllO2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dllO2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton AntiVirus\NavShExt.dllO2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dllO2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton AntiVirus\NavShExt.dllO3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dllO4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exeO4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exeO4 - HKLM\..\Run: [CamMonitor] c:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exeO4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exeO4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXEO4 - HKLM\..\Run: [updateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /rO4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXEO4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exeO4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\VERIZO~1\SUPPOR~1\SMARTB~1\MotiveSB.exeO4 - HKLM\..\Run: [Verizon Control Pad] C:\Program Files\Verizon Online\ControlPad\cpad.exe #SPLASHO4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exeO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exeO4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exeO4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXEO4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /autoO4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUPO4 - HKLM\..\Run: [iMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNCO4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNCO4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMENameO4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osbootO4 - HKLM\..\Run: [intelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exeO4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHookO4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /backgroundO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exeO4 - HKCU\..\Run: [Anonymizer] C:\Program Files\Anonymizer\Anonymizer Software\Anonymizer.exe -noguiO4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /cO4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quietO4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exeO4 - Global Startup: Compaq Connections.lnk = C:\Program Files\Compaq Connections\1940576\Program\BackWeb-1940576.exeO4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exeO4 - Global Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXEO4 - Global Startup: MLB.TV NexDef Plug-in.lnk = C:\Program Files\Autobahn\mlb-nexdef-autobahn.exeO4 - Global Startup: Verizon Online Support Center.lnk = C:\Program Files\Verizon Online\SupportCenter\bin\matcli.exeO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dllO9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dllO9 - Extra button: Control Pad - {28D44DAC-D1FC-4d4f-BB1B-ADF037C8DDBC} - C:\Program Files\Verizon Online\ControlPad\Misc\a_menu.exeO9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLLO9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cabO16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecal...ivex/hcImpl.cabO16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1159493326328O16 - DPF: {C606BA60-AB76-48B6-96A7-2C4D5C386F70} (PreQualifier Class) - file://E:\Bin\html\files\MotivePreQual.cabO20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dllO23 - Service: Anonymizer Anti-Spyware Service (AnonAswSvc) - Anonymizer - C:\Program Files\Anonymizer\Anonymizer Software\AnonASW\AnonAswSvc.exeO23 - Service: Anonymizer Management Service (AnonMgmtSvc) - Anonymizer - C:\Program Files\Anonymizer\Anonymizer Software\Common\AnonMgmtSvc.exeO23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exeO23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exeO23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeO23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exeO23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exeO23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exeO23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINDOWS\runservice.exeO23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - c:\Program Files\Norton AntiVirus\navapsvc.exeO23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exeO23 - Service: SAVScan - Symantec Corporation - c:\Program Files\Norton AntiVirus\SAVScan.exeO23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exeO23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe--End of file - 11674 bytes Link to post Share on other sites More sharing options...
Staff miekiemoes Posted April 8, 2009 Staff ID:71437 Share Posted April 8, 2009 Hi,Not sure if you have been using the 1.36 version of malwarebytes though..Anyway, some notes first..I notice from your log that there's more than 1 Antivirus installed. AVG and NortonNever install more than one Antivirus and Firewall! Rather than giving you extra protection, it will decrease the reliability of it seriously! The reason for this is that if both products have their automatic (Real-Time) protection switched on, your system may lock up due to both software products attempting to access the same file at the same time. Also because more than one Antivirus and Firewall installed are not compatible with eachother, it can cause system performance problems and a serious system slowdown. So you have to make a decision here and keep the Antivirus you prefer and uninstall the other one. You should uninstall AVG anyway since it's outdated. If you want to keep AVG, uninstall Norton and install latest AVG version.Then reboot after uninstalling.Also, I see you have Viewpoint installed...Viewpoint Manager is considered as foistware instead of malware since it is installed without users approval but doesn't spy or do anything "bad". This will change from what we know in 2006 read this article: http://www.clickz.com/news/article.php/3561546I suggest you remove the program now. Go to Start > Settings > Control Panel > Add/Remove Programs and remove the following programs if present.ViewpointViewpoint ManagerViewpoint Media PlayerThen, Start MalwareBytes and click the Update tab. There click "Check for updates"In case you can't update the database via the update option, please download and install the database from here. Only do this when the update option doesn't work.Once the updates are downloaded, perform a full scan again.The scan may take some time to finish,so please be patient.When the scan is complete, click OK, then Show Results to view the results.Make sure that everything is checked, and click Remove Selected.When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.Copy&Paste the entire report in your next reply along with a fresh HijackThis log, then we'll proceed from there with new steps.Extra Note:If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly. Link to post Share on other sites More sharing options...
SarahReed Posted April 8, 2009 Author ID:71464 Share Posted April 8, 2009 Mieke,Removed Norton. Updated AVG to 8.5, and removed the Viewpoint files.Ran the MBAM - here is the log:Malwarebytes' Anti-Malware 1.36Database version: 1951Windows 5.1.2600 Service Pack 24/8/2009 4:50:22 AMmbam-log-2009-04-08 (04-50-22).txtScan type: Full Scan (C:\|)Objects scanned: 192115Time elapsed: 1 hour(s), 13 minute(s), 47 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 0Files Infected: 0Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:(No malicious items detected)Registry Values Infected:(No malicious items detected)Registry Data Items Infected:(No malicious items detected)Folders Infected:(No malicious items detected)Files Infected:(No malicious items detected)and here is my latest "HijackThis" log:Logfile of Trend Micro HijackThis v2.0.2Scan saved at 04:54:05, on 4/8/2009Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v7.00 (7.00.6000.16791)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\Explorer.EXEC:\windows\system\hpsysdrv.exeC:\WINDOWS\system32\hkcmd.exeC:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exeC:\WINDOWS\System32\hphmon05.exeC:\HP\KBD\KBD.EXEC:\WINDOWS\LTMSG.exeC:\PROGRA~1\VERIZO~1\SUPPOR~1\SMARTB~1\MotiveSB.exeC:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exeC:\Program Files\QuickTime\qttask.exeC:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exeC:\WINDOWS\system32\igfxtray.exeC:\WINDOWS\ALCXMNTR.EXEC:\Program Files\Microsoft IntelliPoint\ipoint.exeC:\Program Files\Messenger\msmsgs.exeC:\WINDOWS\system32\ctfmon.exeC:\WINDOWS\runservice.exeC:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exeC:\Documents and Settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exeC:\Program Files\HP\Digital Imaging\bin\hpqtra08.exeThanks in advance.-Sarah Link to post Share on other sites More sharing options...
Staff miekiemoes Posted April 8, 2009 Staff ID:71465 Share Posted April 8, 2009 Hi,Your HijackThislog is incomplete. It's missing the half. Your Mbam scan log looks clean again btw, no more Vundo.HCan you also rescan with Combofix and post the new log please? Link to post Share on other sites More sharing options...
SarahReed Posted April 8, 2009 Author ID:71466 Share Posted April 8, 2009 Sorry about that.Here is my HiJackThis log:Logfile of Trend Micro HijackThis v2.0.2Scan saved at 05:03:27, on 4/8/2009Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v7.00 (7.00.6000.16791)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\Explorer.EXEC:\windows\system\hpsysdrv.exeC:\WINDOWS\system32\hkcmd.exeC:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exeC:\WINDOWS\System32\hphmon05.exeC:\HP\KBD\KBD.EXEC:\WINDOWS\LTMSG.exeC:\PROGRA~1\VERIZO~1\SUPPOR~1\SMARTB~1\MotiveSB.exeC:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exeC:\Program Files\QuickTime\qttask.exeC:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exeC:\WINDOWS\system32\igfxtray.exeC:\WINDOWS\ALCXMNTR.EXEC:\Program Files\Microsoft IntelliPoint\ipoint.exeC:\Program Files\Messenger\msmsgs.exeC:\WINDOWS\system32\ctfmon.exeC:\WINDOWS\runservice.exeC:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exeC:\Documents and Settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exeC:\Program Files\HP\Digital Imaging\bin\hpqtra08.exeC:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXEC:\Program Files\Autobahn\mlb-nexdef-autobahn.exeC:\WINDOWS\system32\taskmgr.exeC:\Program Files\Verizon Online\SupportCenter\bin\mpbtn.exeC:\WINDOWS\system32\wuauclt.exeC:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\Application\chrome.exeC:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\Application\chrome.exeC:\PROGRA~1\AVG\AVG8\avgwdsvc.exeC:\PROGRA~1\AVG\AVG8\avgrsx.exeC:\Program Files\AVG\AVG8\avgcsrvx.exeC:\Program Files\AVG\AVG8\avgtray.exeC:\PROGRA~1\AVG\AVG8\avgnsx.exeC:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\Application\chrome.exeC:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\Application\chrome.exeC:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\Application\chrome.exeC:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\Application\chrome.exeC:\WINDOWS\system32\NOTEPAD.EXEC:\Program Files\Trend Micro\HijackThis\HijackThis.exeC:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\Application\chrome.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-qus10.hpwis.com/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-qus10.hpwis.com/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhostO2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dllO2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dllO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dllO2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dllO2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dllO2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dllO4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exeO4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exeO4 - HKLM\..\Run: [CamMonitor] c:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exeO4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exeO4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXEO4 - HKLM\..\Run: [updateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /rO4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXEO4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exeO4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\VERIZO~1\SUPPOR~1\SMARTB~1\MotiveSB.exeO4 - HKLM\..\Run: [Verizon Control Pad] C:\Program Files\Verizon Online\ControlPad\cpad.exe #SPLASHO4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exeO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exeO4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exeO4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXEO4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /autoO4 - HKLM\..\Run: [iMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNCO4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNCO4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMENameO4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osbootO4 - HKLM\..\Run: [intelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exeO4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exeO4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHookO4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /backgroundO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exeO4 - HKCU\..\Run: [Anonymizer] C:\Program Files\Anonymizer\Anonymizer Software\Anonymizer.exe -noguiO4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /cO4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quietO4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exeO4 - Global Startup: Compaq Connections.lnk = C:\Program Files\Compaq Connections\1940576\Program\BackWeb-1940576.exeO4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exeO4 - Global Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXEO4 - Global Startup: MLB.TV NexDef Plug-in.lnk = C:\Program Files\Autobahn\mlb-nexdef-autobahn.exeO4 - Global Startup: Verizon Online Support Center.lnk = C:\Program Files\Verizon Online\SupportCenter\bin\matcli.exeO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dllO9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dllO9 - Extra button: Control Pad - {28D44DAC-D1FC-4d4f-BB1B-ADF037C8DDBC} - C:\Program Files\Verizon Online\ControlPad\Misc\a_menu.exeO9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLLO9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cabO16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecal...ivex/hcImpl.cabO16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1159493326328O16 - DPF: {C606BA60-AB76-48B6-96A7-2C4D5C386F70} (PreQualifier Class) - file://E:\Bin\html\files\MotivePreQual.cabO18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dllO20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dllO20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dllO23 - Service: Anonymizer Anti-Spyware Service (AnonAswSvc) - Anonymizer - C:\Program Files\Anonymizer\Anonymizer Software\AnonASW\AnonAswSvc.exeO23 - Service: Anonymizer Management Service (AnonMgmtSvc) - Anonymizer - C:\Program Files\Anonymizer\Anonymizer Software\Common\AnonMgmtSvc.exeO23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exeO23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exeO23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINDOWS\runservice.exeO23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exeO23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe--End of file - 10888 bytes Link to post Share on other sites More sharing options...
Staff miekiemoes Posted April 8, 2009 Staff ID:71467 Share Posted April 8, 2009 Ok There's still something else I want to check, so rescan with Combofix and post the new log in your next reply Link to post Share on other sites More sharing options...
SarahReed Posted April 8, 2009 Author ID:71471 Share Posted April 8, 2009 Ok There's still something else I want to check, so rescan with Combofix and post the new log in your next reply New ComboFix log:ComboFix 09-04-04.01 - Owner 2009-04-08 5:13:21.4 - NTFSx86Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1015.353 [GMT -5:00]Running from: c:\documents and settings\Owner\Desktop\ComboFix.exeAV: AVG Anti-Virus Free *On-access scanning enabled* (Updated).((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))).c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.datc:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat----- BITS: Possible infected sites -----hxxp://updates.swarmcast.net.((((((((((((((((((((((((( Files Created from 2009-03-08 to 2009-04-08 ))))))))))))))))))))))))))))))).2009-04-08 05:11 . 2006-03-02 23:42 73,728 --a------ C:\pv.exe2009-04-08 05:10 . 2009-04-08 05:12 <DIR> d-------- C:\32788R22FWJFW2009-04-08 03:30 . 2009-04-08 03:30 108,552 --a------ c:\windows\system32\drivers\avgtdix.sys2009-04-08 03:30 . 2009-04-08 03:30 10,520 --a------ c:\windows\system32\avgrsstx.dll2009-04-08 03:29 . 2009-04-08 03:31 <DIR> d-------- c:\windows\system32\drivers\Avg2009-04-08 03:29 . 2009-04-08 03:29 <DIR> d-------- c:\program files\AVG2009-04-08 03:29 . 2009-04-08 03:29 <DIR> d-------- c:\documents and settings\All Users\Application Data\avg82009-04-08 03:29 . 2009-04-08 03:29 325,640 --a------ c:\windows\system32\drivers\avgldx86.sys2009-04-07 18:14 . 2009-04-07 18:37 <DIR> d-------- c:\documents and settings\Owner\DoctorWeb2009-04-07 11:54 . 2009-04-07 11:54 <DIR> d-------- C:\VundoFix Backups2009-04-07 09:29 . 2009-04-07 11:11 <DIR> d-------- c:\windows\system32\CatRoot_bak2009-04-07 09:27 . 2008-05-01 09:30 331,776 -----c--- c:\windows\system32\dllcache\msadce.dll2009-04-07 09:27 . 2008-06-13 08:10 272,128 -----c--- c:\windows\system32\dllcache\bthport.sys2009-04-07 09:26 . 2008-08-14 04:51 138,368 -----c--- c:\windows\system32\dllcache\afd.sys2009-04-07 04:54 . 2008-12-20 18:15 6,066,688 -----c--- c:\windows\system32\dllcache\ieframe.dll2009-04-07 04:54 . 2007-04-17 04:32 2,455,488 -----c--- c:\windows\system32\dllcache\ieapfltr.dat2009-04-07 04:54 . 2007-03-08 00:10 991,232 -----c--- c:\windows\system32\dllcache\ieframe.dll.mui2009-04-07 04:54 . 2008-12-20 18:15 459,264 -----c--- c:\windows\system32\dllcache\msfeeds.dll2009-04-07 04:54 . 2008-12-20 18:15 383,488 -----c--- c:\windows\system32\dllcache\ieapfltr.dll2009-04-07 04:54 . 2008-12-20 18:15 267,776 -----c--- c:\windows\system32\dllcache\iertutil.dll2009-04-07 04:54 . 2008-12-20 18:15 63,488 -----c--- c:\windows\system32\dllcache\icardie.dll2009-04-07 04:54 . 2008-12-20 18:15 52,224 -----c--- c:\windows\system32\dllcache\msfeedsbs.dll2009-04-07 04:54 . 2008-12-19 04:10 13,824 -----c--- c:\windows\system32\dllcache\ieudinit.exe2009-04-07 04:48 . 2007-08-13 18:54 33,792 --a--c--- c:\windows\system32\dllcache\custsat.dll2009-04-07 00:45 . 2009-04-07 00:45 <DIR> d-------- c:\documents and settings\Administrator.GARY\Application Data\SUPERAntiSpyware.com2009-04-07 00:37 . 2009-04-07 00:37 <DIR> d-------- c:\program files\SUPERAntiSpyware2009-04-07 00:37 . 2009-04-07 00:37 <DIR> d-------- c:\documents and settings\Owner\Application Data\SUPERAntiSpyware.com2009-04-07 00:37 . 2009-04-07 00:37 <DIR> d-------- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com2009-04-07 00:32 . 2009-04-07 00:32 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard2009-04-06 22:11 . 2009-04-06 22:11 <DIR> d-------- c:\program files\Trend Micro2009-04-06 19:28 . 2009-04-06 19:28 <DIR> d-------- c:\documents and settings\Administrator.GARY\Application Data\Malwarebytes2009-04-06 19:24 . 2003-10-11 07:30 <DIR> d-------- c:\documents and settings\Administrator.GARY\WINDOWS2009-04-06 19:24 . 2003-10-14 08:31 <DIR> d-------- c:\documents and settings\Administrator.GARY\Application Data\Symantec2009-04-06 19:24 . 2003-10-11 07:06 <DIR> d-------- c:\documents and settings\Administrator.GARY\Application Data\Sonic2009-04-06 19:24 . 2003-10-11 08:03 <DIR> d-------- c:\documents and settings\Administrator.GARY\Application Data\SampleView2009-04-06 19:24 . 2003-10-14 08:35 <DIR> d-------- c:\documents and settings\Administrator.GARY\Application Data\interMute2009-04-06 19:24 . 2009-04-08 03:30 <DIR> d-------- c:\documents and settings\Administrator.GARY2009-04-06 17:35 . 2009-04-06 19:11 <DIR> d-------- c:\documents and settings\Administrator\Application Data\AVG72009-04-06 16:24 . 2009-04-06 16:24 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Malwarebytes2009-04-06 16:23 . 2003-10-11 07:06 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Sonic2009-04-06 16:23 . 2003-10-14 08:35 <DIR> d-------- c:\documents and settings\Administrator\Application Data\interMute2009-04-06 16:23 . 2009-04-06 19:11 <DIR> d---s---- c:\documents and settings\Administrator.(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))).2009-04-08 08:34 --------- d-----w c:\program files\Viewpoint2009-04-08 08:34 --------- d-----w c:\documents and settings\All Users\Application Data\Viewpoint2009-04-08 08:09 --------- d-----w c:\program files\Common Files\Symantec Shared2009-04-08 08:07 --------- d-----w c:\program files\Symantec2009-04-08 08:07 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec2009-04-07 09:30 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy2009-04-07 08:18 --------- d-----w c:\program files\Google2009-04-07 03:24 --------- d-----w c:\program files\Spybot - Search & Destroy2009-04-07 02:56 --------- d-----w c:\program files\Malwarebytes' Anti-Malware2009-04-07 01:56 --------- d--h--w c:\documents and settings\All Users\Application Data\{9E97B640-FCFE-4900-B18A-72FAE662D6B7}2009-04-06 20:32 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys2009-04-06 20:32 15,504 ----a-w c:\windows\system32\drivers\mbam.sys2009-03-10 15:50 --------- d-----w c:\program files\Microsoft Silverlight2009-03-02 23:16 --------- d-----w c:\documents and settings\Owner\Application Data\eAcceleration.((((((((((((((((((((((((((((( SnapShot_2009-04-08_ 2.15.15.03 ))))))))))))))))))))))))))))))))))))))))).- 2007-12-20 23:08:48 26,952 ----a-w c:\windows\system32\drivers\avgmfx86.sys+ 2009-04-08 08:29:55 27,656 ----a-w c:\windows\system32\drivers\avgmfx86.sys- 2009-04-08 07:04:01 2,849 --sha-w c:\windows\system32\mmf.sys+ 2009-04-08 10:19:57 2,849 --sha-w c:\windows\system32\mmf.sys.((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shown REGEDIT4[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-24 68856]"Anonymizer"="c:\program files\Anonymizer\Anonymizer Software\Anonymizer.exe" [2008-04-15 1557176]"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]"Google Update"="c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-09-02 133104]"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2008-11-05 4347120]"NVIEW"="nview.dll" [2003-08-19 c:\windows\system32\nview.dll][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-08-20 118784]"CamMonitor"="c:\program files\HP\Digital Imaging\Unload\hpqcmon.exe" [2002-10-07 90112]"HPHmon05"="c:\windows\System32\hphmon05.exe" [2003-05-23 483328]"KBD"="c:\hp\KBD\KBD.EXE" [2003-02-11 61440]"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 110592]"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-13 212992]"PS2"="c:\windows\system32\ps2.exe" [2002-07-31 81920]"Reminder"="c:\windows\Creator\Remind_XP.exe" [2003-06-17 118784]"Motive SmartBridge"="c:\progra~1\VERIZO~1\SUPPOR~1\SMARTB~1\MotiveSB.exe" [2004-12-28 385024]"Verizon Control Pad"="c:\program files\Verizon Online\ControlPad\cpad.exe" [2002-06-13 7376896]"mmtask"="c:\program files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe" [2003-07-23 53248]"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2004-05-20 98304]"HPDJ Taskbar Utility"="c:\windows\System32\spool\drivers\w32x86\3\hpztsb08.exe" [2003-03-12 172032]"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-08-20 155648]"MSConfig"="c:\windows\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2004-08-04 158208]"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2002-08-29 59392]"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2002-08-29 455168]"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2002-08-29 455168]"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2007-06-17 185896]"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2006-11-21 842584]"WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-01-15 37376]"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-04-08 1932568]"LTMSG"="LTMSG.exe" [2003-07-14 c:\windows\ltmsg.exe]"AlcxMonitor"="ALCXMNTR.EXE" [2004-09-07 c:\windows\ALCXMNTR.EXE][HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]"RunNarrator"="Narrator.exe" [2004-08-04 c:\windows\system32\narrator.exe]c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 29696]Compaq Connections.lnk - c:\program files\Compaq Connections\1940576\Program\BackWeb-1940576.exe [2003-10-11 16384]HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2003-07-07 233472]Microsoft Office OneNote 2003 Quick Launch.lnk - c:\program files\Microsoft Office\OFFICE11\ONENOTEM.EXE [2003-08-06 51776]MLB.TV NexDef Plug-in.lnk - c:\program files\Autobahn\mlb-nexdef-autobahn.exe [2008-03-28 799496]Verizon Online Support Center.lnk - c:\program files\Verizon Online\SupportCenter\bin\matcli.exe [2004-05-06 204800][hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824][HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]2008-12-22 12:05 356352 c:\program files\SUPERAntiSpyware\SASWINLO.dll[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]2009-04-08 03:30 10520 c:\windows\system32\avgrsstx.dll[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]Notification Packages REG_MULTI_SZ scecli dpnocfg.dll[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Quicken Scheduled Updates.lnk]path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Quicken Scheduled Updates.lnkbackup=c:\windows\pss\Quicken Scheduled Updates.lnkCommon Startup[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^spamsubtract.lnk]path=c:\documents and settings\Owner\Start Menu\Programs\Startup\spamsubtract.lnkbackup=c:\windows\pss\spamsubtract.lnkStartup[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]--a------ 2004-12-18 00:20 278528 c:\program files\iTunes\iTunesHelper.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]--a------ 2003-02-19 23:49 2185800 c:\program files\MSN Messenger\msnmsgr.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealPlayer]--a------ 2007-06-17 10:37 214560 c:\program files\Real\RealOne Player\realplay.exe[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]"%windir%\\system32\\sessmgr.exe"="c:\\Program Files\\Compaq Connections\\1940576\\Program\\BackWeb-1940576.exe"="c:\\Program Files\\Kazaa Lite K++\\KazaaLite.kpp"="c:\\Program Files\\WinMX\\WinMX.exe"="c:\\Program Files\\iTunes\\iTunes.exe"="c:\\Program Files\\Real\\RealOne Player\\realplay.exe"="c:\\Program Files\\Mozilla Firefox\\firefox.exe"="c:\\WINDOWS\\system32\\fxsclnt.exe"="c:\\Program Files\\Real\\RealOne Player\\realplayer.exe"="c:\\Program Files\\Netscape\\Netscape Browser\\netscape.exe"="c:\\Program Files\\Real\\RealOne Player\\trueplay.exe"="c:\\Program Files\\Windows Media Player\\wmplayer.exe"="c:\\Program Files\\Anonymizer\\Anonymizer Software\\common\\AnonProxy.exe"="c:\\Program Files\\Autobahn\\mlb-nexdef-autobahn.exe"="c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe"="c:\\Program Files\\AVG\\AVG8\\avgupd.exe"="c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-04-08 325640]R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-04-08 108552]R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2009-03-23 9968]R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2009-03-23 72944]R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-04-08 298264]R2 LicCtrlService;LicCtrl Service;c:\windows\Runservice.exe [2005-12-10 2560]S2 AnonAswSvc;Anonymizer Anti-Spyware Service;c:\program files\Anonymizer\Anonymizer Software\AnonASW\AnonAswSvc.exe [2007-10-22 37560]S2 AnonMgmtSvc;Anonymizer Management Service;c:\program files\Anonymizer\Anonymizer Software\Common\AnonMgmtSvc.exe [2007-10-22 37560]S2 kiehbaeg;PnP ISA/EISA Bus Support;c:\windows\System32\svchost.exe -k netsvcs [2003-10-31 14336]S2 mrtRate;mrtRate; [x]S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2009-03-23 7408]S3 ZD1211BU(SMC);802.11g Wireless USB2.0 Adapter Driver(SMC);c:\windows\system32\drivers\ZD1211BU.sys [2006-08-24 477696]--- Other Services/Drivers In Memory ---*Deregistered* - IPVNMonHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcskiehbaeg.Contents of the 'Scheduled Tasks' folder2009-04-08 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1866085676-2795454385-2280570241-1003.job- c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-02 18:05]2009-04-08 c:\windows\Tasks\Symantec NetDetect.job- c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2004-07-19 16:26]..------- Supplementary Scan -------.uStart Page = hxxp://www.google.com/uDefault_Search_URL = hxxp://srch-qus10.hpwis.com/uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8mSearch Bar = hxxp://srch-qus10.hpwis.com/uInternet Settings,ProxyOverride = localhostuSearchURL,(Default) = hxxp://www.google.com/search?q=%sIE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000IE: {{28D44DAC-D1FC-4d4f-BB1B-ADF037C8DDBC} - c:\program files\Verizon Online\ControlPad\Misc\a_menu.exeLSP: SpSubLSP.dllDPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cabFF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\m8peguoh.default\FF - prefs.js: browser.startup.homepage - hxxp://www.google.comFF - plugin: c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\1.2.141.5\npGoogleOneClick7.dllFF - plugin: c:\program files\Java\j2re1.4.2\bin\NPJava11.dllFF - plugin: c:\program files\Java\j2re1.4.2\bin\NPJava12.dllFF - plugin: c:\program files\Java\j2re1.4.2\bin\NPJava13.dllFF - plugin: c:\program files\Java\j2re1.4.2\bin\NPJava14.dllFF - plugin: c:\program files\Java\j2re1.4.2\bin\NPJava32.dllFF - plugin: c:\program files\Java\j2re1.4.2\bin\NPJPI142.dllFF - plugin: c:\program files\Java\j2re1.4.2\bin\NPOJI610.dllFF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dllFF - plugin: c:\program files\Mozilla Firefox\plugins\NPAdbESD.dllFF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dllFF - plugin: c:\program files\Mozilla Firefox\plugins\NPTURNMED.dllFF - plugin: c:\program files\Real\RealOne Player\Netscape6\nppl3260.dllFF - plugin: c:\program files\Real\RealOne Player\Netscape6\nprjplug.dllFF - plugin: c:\program files\Real\RealOne Player\Netscape6\nprpjplug.dll.**************************************************************************catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.netRootkit scan 2009-04-08 05:22:07Windows 5.1.2600 Service Pack 2 NTFSscanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfullyhidden files: 0**************************************************************************.--------------------- LOCKED REGISTRY KEYS ---------------------[HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&y@^t! #^$ g9^$&pgb SDB36o \103076C71E8172E2]"1"=hex:f3,63,02,17,10,0f,8c,72,44,b1,bf,31,22,25,c4,7d,41,89,c7,a7,5f,90,bb, a2"2"=hex:05,42,30,42,a7,15,e9,31,44,4c,e8,ce,26,93,4c,ff,dc,fd,7a,28,38,0d,79, b8"3"=hex:f3,63,02,17,10,0f,8c,72,44,b1,bf,31,22,25,c4,7d,38,a8,bc,ca,16,d6,08, eb,9c,8b,9c,0d,35,8b,99,e4,25,24,80,ac,1f,d3,6a,72[HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&y@^t! #^$ g9^$&pgb SDB36o \103076C71E8172E2\103076C71E8172E2]"1"=hex:33,08,da,55,f6,12,dc,ab,f4,e9,74,73,21,3e,6a,85,2f,ad,11,35,1e,74,d2, f6,35,6d,98,1b,b3,42,db,57"2"=hex:ff,46,a9,cd,53,d2,ef,98[HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&y@^t! #^$ g9^$&pgb SDB36o \103076C71E8172E2\E2D78D07BA1CEFC607EE825C5DE445EF]"1"=hex:33,08,da,55,f6,12,dc,ab,f4,e9,74,73,21,3e,6a,85,2f,ad,11,35,1e,74,d2, f6,35,6d,98,1b,b3,42,db,57"2"=hex:a6,61,c0,40,f8,08,be,24"3"=hex:5e,44,b2,f8,79,f8,c3,56,fc,84,9a,8b,51,82,df,9b,2f,77,5f,6d,51,02,c1, db,2d,28,1f,b8,51,ed,45,02,c0,a2,38,83,13,a9,5d,2b,4f,3b,09,30,26,d4,2b,79,\"4"=hex:2f,ad,a2,e7,8a,bf,05,5e"5"=hex:bf,e5,23,7b,b0,66,d6,fc,b8,e8,6b,a0,96,52,f7,32,80,09,8f,24,b7,b3,55, 1a,98,d1,47,16,02,43,61,1c,b9,d5,8f,2a,7b,81,b1,fb,95,22,f8,b3,2c,53,9d,ae,\"6"=hex:33,08,da,55,f6,12,dc,ab,f4,e9,74,73,21,3e,6a,85,2f,ad,11,35,1e,74,d2, f6,22,52,65,d3,e6,83,ee,c9,ec,ed,f3,43,55,72,5a,1c,5c,40,c9,af,48,22,30,c1,\"7"=hex:33,08,da,55,f6,12,dc,ab,f4,e9,74,73,21,3e,6a,85,2f,ad,11,35,1e,74,d2, f6,db,b7,35,cf,1a,ec,25,5d,ef,3a,0f,de,ed,ad,54,53,c0,07,76,18,d4,8c,6c,4e,\"8"=hex:9d,9e,b2,b9,a7,a5,f4,ae,4d,29,c2,a3,c0,78,c4,c5,86,15,ba,ba,a8,7c,30, 6e,e7,be,f3,4e,5c,b8,67,18,68,d2,34,71,6e,be,6a,68,12,55,ff,37,2b,86,ac,b7,\"9"=hex:81,20,8f,ab,28,6a,52,9c"18"=hex:4b,72,8f,bc,6c,3f,e4,15"10"=hex:81,20,8f,ab,28,6a,52,9c"11"=hex:81,20,8f,ab,28,6a,52,9c"12"=hex:d4,45,36,60,18,fd,62,00,dc,8a,32,fa,cd,78,aa,51,cc,14,2a,00,21,9b,8a, 16,b3,d6,f3,a1,9a,14,87,a9,ee,d6,e6,02,aa,d2,3b,5c,89,9b,74,15,d6,0f,71,a9,\"13"=hex:27,5b,ae,74,82,ae,9c,95,c3,ad,74,46,28,ff,30,51,70,9d,48,a6,d6,41,95, 16"14"=hex:83,34,31,f7,8e,d5,03,43,db,41,e1,35,0d,b6,15,0b,18,9e,8c,27,2c,08,ed, cf"24"=hex:81,20,8f,ab,28,6a,52,9c"26"=hex:81,20,8f,ab,28,6a,52,9c"27"=hex:81,20,8f,ab,28,6a,52,9c"19"=hex:fb,ef,44,17,f0,2e,d6,25,2c,32,20,ab,3c,6d,4d,1b"22"=hex:81,20,8f,ab,28,6a,52,9c"15"=hex:ec,2f,5c,9a,be,84,57,07,f3,e7,f3,94,99,93,5e,61,0f,03,00,e0,a8,20,bc, 99,03,35,e0,7c,0f,f3,3d,7d,96,49,c6,d5,37,7d,0c,78,24,93,16,5c,49,31,9b,8a,\[HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&y@^t! #^$ g9^$&pgb SDB36o \501529F2142DBB50]"1"=hex:55,71,d5,88,d4,e8,c4,23,86,c5,84,77,3a,01,80,8c"2"=hex:e7,27,cf,42,f4,44,fe,c6,7c,92,71,43,d3,fc,2b,88,fa,d9,fe,5d,52,9c,ef, 9a,2a,6d,72,a6,74,ac,7c,c2"3"=hex:55,71,d5,88,d4,e8,c4,23,fd,b6,60,5b,fa,86,28,a7,15,7e,26,7e,15,53,b1, 53,45,c5,e4,e2,cb,6f,56,41,9f,13,40,18,4a,19,41,af,82,2c,15,9b,68,3b,4e,c0[HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&y@^t! #^$ g9^$&pgb SDB36o \501529F2142DBB50\A9E17DC1A54D1D28BB40F338A2C6273E]"1"=hex:80,21,ee,d1,6b,60,09,6f,f8,87,24,43,64,25,4c,aa,b2,18,c8,df,6b,eb,72, a3,0a,b2,c0,1f,52,da,0b,fb"2"=hex:81,20,8f,ab,28,6a,52,9c"3"=hex:41,61,9c,ec,5d,71,e3,51,a4,97,a7,f3,c0,fb,4c,a8,48,9b,b2,7d,90,0f,24, dd,46,c6,46,00,0e,10,34,dc,2f,c8,76,36,62,f2,90,0e,e9,7e,e6,ad,f6,0f,1e,63,\"4"=hex:2f,ad,a2,e7,8a,bf,05,5e"5"=hex:bf,e5,23,7b,b0,66,d6,fc,b8,e8,6b,a0,96,52,f7,32,80,09,8f,24,b7,b3,55, 1a,98,d1,47,16,02,43,61,1c,b9,d5,8f,2a,7b,81,b1,fb,95,22,f8,b3,2c,53,9d,ae,\"6"=hex:80,21,ee,d1,6b,60,09,6f,f8,87,24,43,64,25,4c,aa,b2,18,c8,df,6b,eb,72, a3,c2,b5,a5,be,18,5e,8d,12,a5,96,30,c8,e8,9b,a0,07,34,11,26,76,4a,05,43,f8,\"7"=hex:80,21,ee,d1,6b,60,09,6f,f8,87,24,43,64,25,4c,aa,b2,18,c8,df,6b,eb,72, a3,0a,b2,c0,1f,52,da,0b,fb"8"=hex:9d,9e,b2,b9,a7,a5,f4,ae,4d,29,c2,a3,c0,78,c4,c5,65,47,71,48,e9,1d,9d, ae,8d,a8,42,08,32,10,f7,67,cf,df,52,86,31,35,e0,07,c7,f4,11,f0,ed,74,e2,7b,\"9"=hex:81,20,8f,ab,28,6a,52,9c"18"=hex:4b,72,8f,bc,6c,3f,e4,15"10"=hex:b3,b5,ff,62,ba,b6,61,46"11"=hex:81,20,8f,ab,28,6a,52,9c"12"=hex:7e,53,02,59,ed,97,fb,2f,85,9e,9d,15,b0,2c,ad,9d,88,a7,15,e4,c0,c5,d1, 1e,24,44,79,79,8c,4d,d5,49,f9,ed,a7,ec,df,31,12,51,6c,95,86,4c,48,f0,58,42,\"13"=hex:82,b4,e2,1e,09,ec,b3,44,b6,98,fa,e2,b3,0d,58,fb,16,03,3d,50,79,69,0a, 22"14"=hex:a6,c1,97,cd,4d,ca,f1,2d"24"=hex:81,20,8f,ab,28,6a,52,9c"26"=hex:81,20,8f,ab,28,6a,52,9c"27"=hex:81,20,8f,ab,28,6a,52,9c"19"=hex:40,51,15,fc,cf,fd,6d,bb,0a,b5,3c,be,52,e9,4a,4d"22"=hex:81,20,8f,ab,28,6a,52,9c"15"=hex:66,7b,70,f8,d9,9e,1b,e5,5a,f4,29,e2,11,1e,aa,d6,be,8b,8d,c8,66,cb,b0, af,ba,4c,5e,bc,fe,13,09,c4,5d,8d,7e,09,02,2a,ff,a9,77,58,ef,54,d0,f8,e2,89,\.--------------------- DLLs Loaded Under Running Processes ---------------------- - - - - - - > 'winlogon.exe'(628)c:\program files\SUPERAntiSpyware\SASWINLO.dll- - - - - - - > 'lsass.exe'(684)c:\windows\system32\SpSubLSP.dll.------------------------ Other Running Processes ------------------------.c:\program files\AVG\AVG8\avgrsx.exec:\progra~1\AVG\AVG8\avgnsx.exec:\windows\system32\notepad.exec:\program files\Verizon Online\SupportCenter\bin\mpbtn.exec:\windows\system32\taskmgr.exe.**************************************************************************.Completion time: 2009-04-08 5:31:46 - machine was rebootedComboFix-quarantined-files.txt 2009-04-08 10:31:43ComboFix2.txt 2009-04-08 07:16:17ComboFix3.txt 2009-04-07 05:25:10ComboFix4.txt 2009-04-07 02:43:41Pre-Run: 10,265,276,416 bytes freePost-Run: 10,254,970,880 bytes free340 --- E O F --- 2009-04-08 04:12:59Also, I don't know if this makes a difference, but I wanted to let you know about it - each time I reboot, I get a "Notepad" pop-up that launches when I reboot - it goes by "desktop.exe" and this is the message that the notepad says each time:[.ShellClassInfo]LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21787Again, I am not sure if that is relevant to my problem or not, but I wanted to let you know about it, just in case.Thanks in advance. Link to post Share on other sites More sharing options...
Staff miekiemoes Posted April 8, 2009 Staff ID:71472 Share Posted April 8, 2009 Hi,it goes by "desktop.exe" and this is the message that the notepad says each timeI assume you mean desktop.ini ?To resolve this issue, see here:http://support.microsoft.com/kb/330132To deal with the rest of your malware, * Open notepad - don't use any other texteditor than notepad or the script will fail.Copy/paste the text in the quotebox below into notepad:NetSvc::kiehbaegDriver::kiehbaegRegistry::[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]"Notification Packages"=hex(7):73,63,65,63,6c,69,00,00Save this as txtfile CFScript Then drag the CFScript into ComboFix.exe as you see in the screenshot below.This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply. Link to post Share on other sites More sharing options...
SarahReed Posted April 8, 2009 Author ID:71476 Share Posted April 8, 2009 Mieke,This will sound like a dumb question: how do I disable the AVG scanner, as ComboFix is asking me to do?Thanks in advance. Link to post Share on other sites More sharing options...
Staff miekiemoes Posted April 8, 2009 Staff ID:71479 Share Posted April 8, 2009 No dumb question.. To disable AVG, Please open the AVG 8 Control Center, by right clicking on the AVG 8 icon on task bar. * Click on Tools. * Select Advanced. * In the left hand pane, scroll down to "Resident Shield". * In the main pane, deselect the option to "Enable Resident Shield." To re-enable AVG 8, please select "Enable Resident Shield" again.It could be possible that, even though when you've disabled AVG that Combofix still gives that message. Then just ignore it and let combofix proceed. Link to post Share on other sites More sharing options...
SarahReed Posted April 8, 2009 Author ID:71483 Share Posted April 8, 2009 Thanks Mieke.I followed the instructions and the CombpFix window has been open for 20 minutes with just a blank blue screen and a cursor - is that OK or did I do something wrong? Link to post Share on other sites More sharing options...
Staff miekiemoes Posted April 8, 2009 Staff ID:71485 Share Posted April 8, 2009 Hi,It may be a good idea to run Combofix from Windows safe mode, because I guess something is still interfering here (security programs). Link to post Share on other sites More sharing options...
SarahReed Posted April 8, 2009 Author ID:71487 Share Posted April 8, 2009 I ran it in Safe Mode and here is the log:ComboFix 09-04-04.01 - Owner 2009-04-08 7:17:24.5 - NTFSx86 MINIMALMicrosoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1015.817 [GMT -5:00]Running from: c:\documents and settings\Owner\Desktop\ComboFix.exeCommand switches used :: c:\documents and settings\Owner\Desktop\CFScript.txtAV: AVG Anti-Virus Free *On-access scanning disabled* (Updated).((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))).c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.datc:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat----- BITS: Possible infected sites -----hxxp://updates.swarmcast.net.((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))).-------\Legacy_KIEHBAEG-------\Service_kiehbaeg((((((((((((((((((((((((( Files Created from 2009-03-08 to 2009-04-08 ))))))))))))))))))))))))))))))).2009-04-08 03:30 . 2009-04-08 03:30 108,552 --a------ c:\windows\system32\drivers\avgtdix.sys2009-04-08 03:30 . 2009-04-08 03:30 10,520 --a------ c:\windows\system32\avgrsstx.dll2009-04-08 03:29 . 2009-04-08 03:31 <DIR> d-------- c:\windows\system32\drivers\Avg2009-04-08 03:29 . 2009-04-08 03:29 <DIR> d-------- c:\program files\AVG2009-04-08 03:29 . 2009-04-08 03:29 <DIR> d-------- c:\documents and settings\All Users\Application Data\avg82009-04-08 03:29 . 2009-04-08 03:29 325,640 --a------ c:\windows\system32\drivers\avgldx86.sys2009-04-07 18:14 . 2009-04-07 18:37 <DIR> d-------- c:\documents and settings\Owner\DoctorWeb2009-04-07 11:54 . 2009-04-07 11:54 <DIR> d-------- C:\VundoFix Backups2009-04-07 09:29 . 2009-04-07 11:11 <DIR> d-------- c:\windows\system32\CatRoot_bak2009-04-07 09:27 . 2008-05-01 09:30 331,776 -----c--- c:\windows\system32\dllcache\msadce.dll2009-04-07 09:27 . 2008-06-13 08:10 272,128 -----c--- c:\windows\system32\dllcache\bthport.sys2009-04-07 09:26 . 2008-08-14 04:51 138,368 -----c--- c:\windows\system32\dllcache\afd.sys2009-04-07 04:54 . 2008-12-20 18:15 6,066,688 -----c--- c:\windows\system32\dllcache\ieframe.dll2009-04-07 04:54 . 2007-04-17 04:32 2,455,488 -----c--- c:\windows\system32\dllcache\ieapfltr.dat2009-04-07 04:54 . 2007-03-08 00:10 991,232 -----c--- c:\windows\system32\dllcache\ieframe.dll.mui2009-04-07 04:54 . 2008-12-20 18:15 459,264 -----c--- c:\windows\system32\dllcache\msfeeds.dll2009-04-07 04:54 . 2008-12-20 18:15 383,488 -----c--- c:\windows\system32\dllcache\ieapfltr.dll2009-04-07 04:54 . 2008-12-20 18:15 267,776 -----c--- c:\windows\system32\dllcache\iertutil.dll2009-04-07 04:54 . 2008-12-20 18:15 63,488 -----c--- c:\windows\system32\dllcache\icardie.dll2009-04-07 04:54 . 2008-12-20 18:15 52,224 -----c--- c:\windows\system32\dllcache\msfeedsbs.dll2009-04-07 04:54 . 2008-12-19 04:10 13,824 -----c--- c:\windows\system32\dllcache\ieudinit.exe2009-04-07 04:48 . 2007-08-13 18:54 33,792 --a--c--- c:\windows\system32\dllcache\custsat.dll2009-04-07 00:45 . 2009-04-07 00:45 <DIR> d-------- c:\documents and settings\Administrator.GARY\Application Data\SUPERAntiSpyware.com2009-04-07 00:37 . 2009-04-07 00:37 <DIR> d-------- c:\program files\SUPERAntiSpyware2009-04-07 00:37 . 2009-04-07 00:37 <DIR> d-------- c:\documents and settings\Owner\Application Data\SUPERAntiSpyware.com2009-04-07 00:37 . 2009-04-07 00:37 <DIR> d-------- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com2009-04-07 00:32 . 2009-04-07 00:32 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard2009-04-06 22:11 . 2009-04-06 22:11 <DIR> d-------- c:\program files\Trend Micro2009-04-06 19:28 . 2009-04-06 19:28 <DIR> d-------- c:\documents and settings\Administrator.GARY\Application Data\Malwarebytes2009-04-06 19:24 . 2003-10-11 07:30 <DIR> d-------- c:\documents and settings\Administrator.GARY\WINDOWS2009-04-06 19:24 . 2003-10-14 08:31 <DIR> d-------- c:\documents and settings\Administrator.GARY\Application Data\Symantec2009-04-06 19:24 . 2003-10-11 07:06 <DIR> d-------- c:\documents and settings\Administrator.GARY\Application Data\Sonic2009-04-06 19:24 . 2003-10-11 08:03 <DIR> d-------- c:\documents and settings\Administrator.GARY\Application Data\SampleView2009-04-06 19:24 . 2003-10-14 08:35 <DIR> d-------- c:\documents and settings\Administrator.GARY\Application Data\interMute2009-04-06 19:24 . 2009-04-08 03:30 <DIR> d-------- c:\documents and settings\Administrator.GARY2009-04-06 17:35 . 2009-04-06 19:11 <DIR> d-------- c:\documents and settings\Administrator\Application Data\AVG72009-04-06 16:24 . 2009-04-06 16:24 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Malwarebytes2009-04-06 16:23 . 2003-10-11 07:06 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Sonic2009-04-06 16:23 . 2003-10-14 08:35 <DIR> d-------- c:\documents and settings\Administrator\Application Data\interMute2009-04-06 16:23 . 2009-04-06 19:11 <DIR> d---s---- c:\documents and settings\Administrator.(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))).2009-04-08 10:19 --------- d-----w c:\program files\Viewpoint2009-04-08 08:34 --------- d-----w c:\documents and settings\All Users\Application Data\Viewpoint2009-04-08 08:09 --------- d-----w c:\program files\Common Files\Symantec Shared2009-04-08 08:07 --------- d-----w c:\program files\Symantec2009-04-08 08:07 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec2009-04-07 09:30 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy2009-04-07 08:18 --------- d-----w c:\program files\Google2009-04-07 03:24 --------- d-----w c:\program files\Spybot - Search & Destroy2009-04-07 02:56 --------- d-----w c:\program files\Malwarebytes' Anti-Malware2009-04-07 01:56 --------- d--h--w c:\documents and settings\All Users\Application Data\{9E97B640-FCFE-4900-B18A-72FAE662D6B7}2009-04-06 20:32 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys2009-04-06 20:32 15,504 ----a-w c:\windows\system32\drivers\mbam.sys2009-03-10 15:50 --------- d-----w c:\program files\Microsoft Silverlight2009-03-02 23:16 --------- d-----w c:\documents and settings\Owner\Application Data\eAcceleration.((((((((((((((((((((((((((((( SnapShot_2009-04-08_ 2.15.15.03 ))))))))))))))))))))))))))))))))))))))))).- 2007-12-20 23:08:48 26,952 ----a-w c:\windows\system32\drivers\avgmfx86.sys+ 2009-04-08 08:29:55 27,656 ----a-w c:\windows\system32\drivers\avgmfx86.sys- 2009-04-08 07:04:01 2,849 --sha-w c:\windows\system32\mmf.sys+ 2009-04-08 12:24:53 2,849 --sha-w c:\windows\system32\mmf.sys+ 2009-04-08 12:28:53 16,384 ----atw c:\windows\temp\Perflib_Perfdata_828.dat.((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shown REGEDIT4[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-24 68856]"Anonymizer"="c:\program files\Anonymizer\Anonymizer Software\Anonymizer.exe" [2008-04-15 1557176]"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]"Google Update"="c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-09-02 133104]"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2008-11-05 4347120]"NVIEW"="nview.dll" [2003-08-19 c:\windows\system32\nview.dll][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-08-20 118784]"CamMonitor"="c:\program files\HP\Digital Imaging\Unload\hpqcmon.exe" [2002-10-07 90112]"HPHmon05"="c:\windows\System32\hphmon05.exe" [2003-05-23 483328]"KBD"="c:\hp\KBD\KBD.EXE" [2003-02-11 61440]"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 110592]"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-13 212992]"PS2"="c:\windows\system32\ps2.exe" [2002-07-31 81920]"Reminder"="c:\windows\Creator\Remind_XP.exe" [2003-06-17 118784]"Motive SmartBridge"="c:\progra~1\VERIZO~1\SUPPOR~1\SMARTB~1\MotiveSB.exe" [2004-12-28 385024]"Verizon Control Pad"="c:\program files\Verizon Online\ControlPad\cpad.exe" [2002-06-13 7376896]"mmtask"="c:\program files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe" [2003-07-23 53248]"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2004-05-20 98304]"HPDJ Taskbar Utility"="c:\windows\System32\spool\drivers\w32x86\3\hpztsb08.exe" [2003-03-12 172032]"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-08-20 155648]"MSConfig"="c:\windows\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2004-08-04 158208]"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2002-08-29 59392]"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2002-08-29 455168]"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2002-08-29 455168]"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2007-06-17 185896]"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2006-11-21 842584]"WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-01-15 37376]"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-04-08 1932568]"LTMSG"="LTMSG.exe" [2003-07-14 c:\windows\ltmsg.exe]"AlcxMonitor"="ALCXMNTR.EXE" [2004-09-07 c:\windows\ALCXMNTR.EXE][HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]"RunNarrator"="Narrator.exe" [2004-08-04 c:\windows\system32\narrator.exe]c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 29696]Compaq Connections.lnk - c:\program files\Compaq Connections\1940576\Program\BackWeb-1940576.exe [2003-10-11 16384]HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2003-07-07 233472]Microsoft Office OneNote 2003 Quick Launch.lnk - c:\program files\Microsoft Office\OFFICE11\ONENOTEM.EXE [2003-08-06 51776]MLB.TV NexDef Plug-in.lnk - c:\program files\Autobahn\mlb-nexdef-autobahn.exe [2008-03-28 799496]Verizon Online Support Center.lnk - c:\program files\Verizon Online\SupportCenter\bin\matcli.exe [2004-05-06 204800][hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824][HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]2008-12-22 12:05 356352 c:\program files\SUPERAntiSpyware\SASWINLO.dll[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]2009-04-08 03:30 10520 c:\windows\system32\avgrsstx.dll[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Quicken Scheduled Updates.lnk]path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Quicken Scheduled Updates.lnkbackup=c:\windows\pss\Quicken Scheduled Updates.lnkCommon Startup[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^spamsubtract.lnk]path=c:\documents and settings\Owner\Start Menu\Programs\Startup\spamsubtract.lnkbackup=c:\windows\pss\spamsubtract.lnkStartup[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]--a------ 2004-12-18 00:20 278528 c:\program files\iTunes\iTunesHelper.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]--a------ 2003-02-19 23:49 2185800 c:\program files\MSN Messenger\msnmsgr.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealPlayer]--a------ 2007-06-17 10:37 214560 c:\program files\Real\RealOne Player\realplay.exe[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]"%windir%\\system32\\sessmgr.exe"="c:\\Program Files\\Compaq Connections\\1940576\\Program\\BackWeb-1940576.exe"="c:\\Program Files\\Kazaa Lite K++\\KazaaLite.kpp"="c:\\Program Files\\WinMX\\WinMX.exe"="c:\\Program Files\\iTunes\\iTunes.exe"="c:\\Program Files\\Real\\RealOne Player\\realplay.exe"="c:\\Program Files\\Mozilla Firefox\\firefox.exe"="c:\\WINDOWS\\system32\\fxsclnt.exe"="c:\\Program Files\\Real\\RealOne Player\\realplayer.exe"="c:\\Program Files\\Netscape\\Netscape Browser\\netscape.exe"="c:\\Program Files\\Real\\RealOne Player\\trueplay.exe"="c:\\Program Files\\Windows Media Player\\wmplayer.exe"="c:\\Program Files\\Anonymizer\\Anonymizer Software\\common\\AnonProxy.exe"="c:\\Program Files\\Autobahn\\mlb-nexdef-autobahn.exe"="c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe"="c:\\Program Files\\AVG\\AVG8\\avgupd.exe"="c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-04-08 325640]R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-04-08 108552]R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2009-03-23 9968]R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2009-03-23 72944]R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-04-08 298264]R2 LicCtrlService;LicCtrl Service;c:\windows\Runservice.exe [2005-12-10 2560]S2 AnonAswSvc;Anonymizer Anti-Spyware Service;c:\program files\Anonymizer\Anonymizer Software\AnonASW\AnonAswSvc.exe [2007-10-22 37560]S2 AnonMgmtSvc;Anonymizer Management Service;c:\program files\Anonymizer\Anonymizer Software\Common\AnonMgmtSvc.exe [2007-10-22 37560]S2 mrtRate;mrtRate; [x]S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2009-03-23 7408]S3 ZD1211BU(SMC);802.11g Wireless USB2.0 Adapter Driver(SMC);c:\windows\system32\drivers\ZD1211BU.sys [2006-08-24 477696]--- Other Services/Drivers In Memory ---*Deregistered* - IPVNMon.Contents of the 'Scheduled Tasks' folder2009-04-08 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1866085676-2795454385-2280570241-1003.job- c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-02 18:05]2009-04-08 c:\windows\Tasks\Symantec NetDetect.job- c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2004-07-19 16:26]..------- Supplementary Scan -------.uStart Page = hxxp://www.google.com/uDefault_Search_URL = hxxp://srch-qus10.hpwis.com/uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8mSearch Bar = hxxp://srch-qus10.hpwis.com/uInternet Settings,ProxyOverride = localhostuSearchURL,(Default) = hxxp://www.google.com/search?q=%sIE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000IE: {{28D44DAC-D1FC-4d4f-BB1B-ADF037C8DDBC} - c:\program files\Verizon Online\ControlPad\Misc\a_menu.exeLSP: SpSubLSP.dllDPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cabFF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\m8peguoh.default\FF - prefs.js: browser.startup.homepage - hxxp://www.google.com.**************************************************************************catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.netRootkit scan 2009-04-08 07:25:35Windows 5.1.2600 Service Pack 2 NTFSscanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfullyhidden files: 0**************************************************************************.--------------------- LOCKED REGISTRY KEYS ---------------------[HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&y@^t! #^$ g9^$&pgb SDB36o \103076C71E8172E2]"1"=hex:f3,63,02,17,10,0f,8c,72,44,b1,bf,31,22,25,c4,7d,41,89,c7,a7,5f,90,bb, a2"2"=hex:05,42,30,42,a7,15,e9,31,44,4c,e8,ce,26,93,4c,ff,dc,fd,7a,28,38,0d,79, b8"3"=hex:f3,63,02,17,10,0f,8c,72,44,b1,bf,31,22,25,c4,7d,38,a8,bc,ca,16,d6,08, eb,9c,8b,9c,0d,35,8b,99,e4,25,24,80,ac,1f,d3,6a,72[HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&y@^t! #^$ g9^$&pgb SDB36o \103076C71E8172E2\103076C71E8172E2]"1"=hex:33,08,da,55,f6,12,dc,ab,f4,e9,74,73,21,3e,6a,85,2f,ad,11,35,1e,74,d2, f6,35,6d,98,1b,b3,42,db,57"2"=hex:ff,46,a9,cd,53,d2,ef,98[HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&y@^t! #^$ g9^$&pgb SDB36o \103076C71E8172E2\E2D78D07BA1CEFC607EE825C5DE445EF]"1"=hex:33,08,da,55,f6,12,dc,ab,f4,e9,74,73,21,3e,6a,85,2f,ad,11,35,1e,74,d2, f6,35,6d,98,1b,b3,42,db,57"2"=hex:a6,61,c0,40,f8,08,be,24"3"=hex:5e,44,b2,f8,79,f8,c3,56,fc,84,9a,8b,51,82,df,9b,2f,77,5f,6d,51,02,c1, db,2d,28,1f,b8,51,ed,45,02,c0,a2,38,83,13,a9,5d,2b,4f,3b,09,30,26,d4,2b,79,\"4"=hex:2f,ad,a2,e7,8a,bf,05,5e"5"=hex:bf,e5,23,7b,b0,66,d6,fc,b8,e8,6b,a0,96,52,f7,32,80,09,8f,24,b7,b3,55, 1a,98,d1,47,16,02,43,61,1c,b9,d5,8f,2a,7b,81,b1,fb,95,22,f8,b3,2c,53,9d,ae,\"6"=hex:33,08,da,55,f6,12,dc,ab,f4,e9,74,73,21,3e,6a,85,2f,ad,11,35,1e,74,d2, f6,22,52,65,d3,e6,83,ee,c9,ec,ed,f3,43,55,72,5a,1c,5c,40,c9,af,48,22,30,c1,\"7"=hex:33,08,da,55,f6,12,dc,ab,f4,e9,74,73,21,3e,6a,85,2f,ad,11,35,1e,74,d2, f6,db,b7,35,cf,1a,ec,25,5d,ef,3a,0f,de,ed,ad,54,53,c0,07,76,18,d4,8c,6c,4e,\"8"=hex:9d,9e,b2,b9,a7,a5,f4,ae,4d,29,c2,a3,c0,78,c4,c5,86,15,ba,ba,a8,7c,30, 6e,e7,be,f3,4e,5c,b8,67,18,68,d2,34,71,6e,be,6a,68,12,55,ff,37,2b,86,ac,b7,\"9"=hex:81,20,8f,ab,28,6a,52,9c"18"=hex:4b,72,8f,bc,6c,3f,e4,15"10"=hex:81,20,8f,ab,28,6a,52,9c"11"=hex:81,20,8f,ab,28,6a,52,9c"12"=hex:d4,45,36,60,18,fd,62,00,dc,8a,32,fa,cd,78,aa,51,cc,14,2a,00,21,9b,8a, 16,b3,d6,f3,a1,9a,14,87,a9,ee,d6,e6,02,aa,d2,3b,5c,89,9b,74,15,d6,0f,71,a9,\"13"=hex:27,5b,ae,74,82,ae,9c,95,c3,ad,74,46,28,ff,30,51,70,9d,48,a6,d6,41,95, 16"14"=hex:83,34,31,f7,8e,d5,03,43,db,41,e1,35,0d,b6,15,0b,18,9e,8c,27,2c,08,ed, cf"24"=hex:81,20,8f,ab,28,6a,52,9c"26"=hex:81,20,8f,ab,28,6a,52,9c"27"=hex:81,20,8f,ab,28,6a,52,9c"19"=hex:fb,ef,44,17,f0,2e,d6,25,2c,32,20,ab,3c,6d,4d,1b"22"=hex:81,20,8f,ab,28,6a,52,9c"15"=hex:ec,2f,5c,9a,be,84,57,07,f3,e7,f3,94,99,93,5e,61,0f,03,00,e0,a8,20,bc, 99,03,35,e0,7c,0f,f3,3d,7d,96,49,c6,d5,37,7d,0c,78,24,93,16,5c,49,31,9b,8a,\[HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&y@^t! #^$ g9^$&pgb SDB36o \501529F2142DBB50]"1"=hex:55,71,d5,88,d4,e8,c4,23,86,c5,84,77,3a,01,80,8c"2"=hex:e7,27,cf,42,f4,44,fe,c6,7c,92,71,43,d3,fc,2b,88,fa,d9,fe,5d,52,9c,ef, 9a,2a,6d,72,a6,74,ac,7c,c2"3"=hex:55,71,d5,88,d4,e8,c4,23,fd,b6,60,5b,fa,86,28,a7,15,7e,26,7e,15,53,b1, 53,45,c5,e4,e2,cb,6f,56,41,9f,13,40,18,4a,19,41,af,82,2c,15,9b,68,3b,4e,c0[HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&y@^t! #^$ g9^$&pgb SDB36o \501529F2142DBB50\A9E17DC1A54D1D28BB40F338A2C6273E]"1"=hex:80,21,ee,d1,6b,60,09,6f,f8,87,24,43,64,25,4c,aa,b2,18,c8,df,6b,eb,72, a3,0a,b2,c0,1f,52,da,0b,fb"2"=hex:81,20,8f,ab,28,6a,52,9c"3"=hex:41,61,9c,ec,5d,71,e3,51,a4,97,a7,f3,c0,fb,4c,a8,48,9b,b2,7d,90,0f,24, dd,46,c6,46,00,0e,10,34,dc,2f,c8,76,36,62,f2,90,0e,e9,7e,e6,ad,f6,0f,1e,63,\"4"=hex:2f,ad,a2,e7,8a,bf,05,5e"5"=hex:bf,e5,23,7b,b0,66,d6,fc,b8,e8,6b,a0,96,52,f7,32,80,09,8f,24,b7,b3,55, 1a,98,d1,47,16,02,43,61,1c,b9,d5,8f,2a,7b,81,b1,fb,95,22,f8,b3,2c,53,9d,ae,\"6"=hex:80,21,ee,d1,6b,60,09,6f,f8,87,24,43,64,25,4c,aa,b2,18,c8,df,6b,eb,72, a3,c2,b5,a5,be,18,5e,8d,12,a5,96,30,c8,e8,9b,a0,07,34,11,26,76,4a,05,43,f8,\"7"=hex:80,21,ee,d1,6b,60,09,6f,f8,87,24,43,64,25,4c,aa,b2,18,c8,df,6b,eb,72, a3,0a,b2,c0,1f,52,da,0b,fb"8"=hex:9d,9e,b2,b9,a7,a5,f4,ae,4d,29,c2,a3,c0,78,c4,c5,65,47,71,48,e9,1d,9d, ae,8d,a8,42,08,32,10,f7,67,cf,df,52,86,31,35,e0,07,c7,f4,11,f0,ed,74,e2,7b,\"9"=hex:81,20,8f,ab,28,6a,52,9c"18"=hex:4b,72,8f,bc,6c,3f,e4,15"10"=hex:b3,b5,ff,62,ba,b6,61,46"11"=hex:81,20,8f,ab,28,6a,52,9c"12"=hex:7e,53,02,59,ed,97,fb,2f,85,9e,9d,15,b0,2c,ad,9d,88,a7,15,e4,c0,c5,d1, 1e,24,44,79,79,8c,4d,d5,49,f9,ed,a7,ec,df,31,12,51,6c,95,86,4c,48,f0,58,42,\"13"=hex:82,b4,e2,1e,09,ec,b3,44,b6,98,fa,e2,b3,0d,58,fb,16,03,3d,50,79,69,0a, 22"14"=hex:a6,c1,97,cd,4d,ca,f1,2d"24"=hex:81,20,8f,ab,28,6a,52,9c"26"=hex:81,20,8f,ab,28,6a,52,9c"27"=hex:81,20,8f,ab,28,6a,52,9c"19"=hex:40,51,15,fc,cf,fd,6d,bb,0a,b5,3c,be,52,e9,4a,4d"22"=hex:81,20,8f,ab,28,6a,52,9c"15"=hex:66,7b,70,f8,d9,9e,1b,e5,5a,f4,29,e2,11,1e,aa,d6,be,8b,8d,c8,66,cb,b0, af,ba,4c,5e,bc,fe,13,09,c4,5d,8d,7e,09,02,2a,ff,a9,77,58,ef,54,d0,f8,e2,89,\.--------------------- DLLs Loaded Under Running Processes ---------------------- - - - - - - > 'winlogon.exe'(636)c:\program files\SUPERAntiSpyware\SASWINLO.dll- - - - - - - > 'lsass.exe'(692)c:\windows\system32\SpSubLSP.dll.------------------------ Other Running Processes ------------------------.c:\program files\AVG\AVG8\avgrsx.exec:\progra~1\AVG\AVG8\avgnsx.exec:\windows\system32\wscntfy.exec:\program files\Verizon Online\SupportCenter\bin\mpbtn.exec:\program files\Yahoo!\Messenger\Ymsgr_tray.exe.**************************************************************************.Completion time: 2009-04-08 7:33:58 - machine was rebootedComboFix-quarantined-files.txt 2009-04-08 12:33:55ComboFix2.txt 2009-04-08 10:31:48ComboFix3.txt 2009-04-08 07:16:17ComboFix4.txt 2009-04-07 05:25:10ComboFix5.txt 2009-04-08 12:16:28Pre-Run: 11,316,699,136 bytes freePost-Run: 10,236,755,968 bytes free325 --- E O F --- 2009-04-08 04:12:59Also, when I rebooted out of safe mode, I got this message: msw/sctaskbar.cpp(323): assert "msg == gs_msgTaskbar" failed in WindowProc(). Do you want to stop the program? You can also choose [Cancel] to suppress further warnings Link to post Share on other sites More sharing options...
SarahReed Posted April 8, 2009 Author ID:71489 Share Posted April 8, 2009 On the [bmsw/sctaskbar.cpp(323): assert "msg == gs_msgTaskbar" failed in WindowProc(). Do you want to stop the program? You can also choose [Cancel] to suppress further warnings], it is giving me the option of pressing "yes," "no," or "cancel." Link to post Share on other sites More sharing options...
Staff miekiemoes Posted April 8, 2009 Staff ID:71490 Share Posted April 8, 2009 Hi,This looks OK again.* Go to start > run and copy and paste next command in the field:ComboFix /uMake sure there's a space between Combofix and /Then hit enter.This will uninstall Combofix, delete its related folders and files, reset your clock settings, hide file extensions, hide the system/hidden files and resets System Restore again.Also, when I rebooted out of safe mode, I got this message: msw/sctaskbar.cpp(323): assert "msg == gs_msgTaskbar" failed in WindowProc(). Do you want to stop the program? You can also choose [Cancel] to suppress further warningsI've seen this error quite a lot with HP Printers/scanners etc...but I also see you have this mlb-nexdef-autobahn.exe installed. Found another thread where the same error was present and after comparing logs, I see both have this.Please reboot once again and let me know if you're still getting that error. Link to post Share on other sites More sharing options...
SarahReed Posted April 8, 2009 Author ID:71491 Share Posted April 8, 2009 Mieke,YOU FIXED IT!!! Thank you so very much for your help!!!You are amazing - I have been struggling with this virus for 2 days now - I was about to scrub my hard drive and reboot Windows XP from scratch - you have no idea how much I appreciate what you just did.Thank you again!!!-Sarah Link to post Share on other sites More sharing options...
Staff miekiemoes Posted April 8, 2009 Staff ID:71493 Share Posted April 8, 2009 Glad I could help. Please read my Prevention page with lots of info and tips how to prevent this in the future.And if you want to improve speed/system performance after malware removal, take a look here.Extra note: Make sure your programs are up to date - because older versions may contain Security Leaks. To find out what programs need to be updated, please run the Secunia Software Inspector Scan.Happy Surfing again! Link to post Share on other sites More sharing options...
Staff miekiemoes Posted April 10, 2009 Staff ID:71951 Share Posted April 10, 2009 Since this issue appears resolved ... this Topic is closed.If you need this topic reopened for continuations of existing problems, please request this by sending me a PM with the address of the thread. This applies only to the original topic starter.Everyone else please begin a New Topic. Link to post Share on other sites More sharing options...
Recommended Posts