Help needed, on going virus

MM99 · May 9, 2009

A few days ago my computer randomly switched off, upon rebooting it i couldnt access any anti virus product websites, but i could access the AVG site, i downloaded this and ran a full system scan which found a few trojans. AVG dealt with them successfully, so i rebooted the computer again and ran another full scan, all clean. Also then ran a full scan with Malwarebytes which then found some more malicous items. Also dealt with them succesfully, however my computer still acts weird, for example i cant update Malwarebytes and and windows keeps giving me Windoes Security Alerts. Then i cam across this site and did what it told me to on 'pre-HJT' thread. So i uninstalled AVG (which also wouldnt update) and installed Avira AntiVir Personal instead.

So heres the log file for Avira:

Avira AntiVir Personal

Report file date: 05 May 2009 23:40

Scanning for 1284893 virus strains and unwanted programs.

Licensee : Avira AntiVir Personal - FREE Antivirus

Serial number : 0000149996-ADJIE-0000001

Platform : Windows XP

Windows version : (Service Pack 3) [5.1.2600]

Boot mode : Normally booted

Username : SYSTEM

Computer name : MOHAMMED

Version information:

BUILD.DAT : 9.0.0.394 17962 Bytes 17/04/2009 11:20:00

AVSCAN.EXE : 9.0.3.5 466689 Bytes 17/04/2009 08:57:30

AVSCAN.DLL : 9.0.3.0 40705 Bytes 27/02/2009 10:58:24

LUKE.DLL : 9.0.3.2 209665 Bytes 20/02/2009 11:35:49

LUKERES.DLL : 9.0.2.0 12033 Bytes 27/02/2009 10:58:52

ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 27/10/2008 12:30:36

ANTIVIR1.VDF : 7.1.2.12 3336192 Bytes 11/02/2009 20:33:26

ANTIVIR2.VDF : 7.1.2.105 513536 Bytes 03/03/2009 07:41:14

ANTIVIR3.VDF : 7.1.2.127 110592 Bytes 05/03/2009 14:58:20

Engineversion : 8.2.0.100

AEVDF.DLL : 8.1.1.0 106868 Bytes 27/01/2009 17:36:42

AESCRIPT.DLL : 8.1.1.56 352634 Bytes 26/02/2009 20:01:56

AESCN.DLL : 8.1.1.7 127347 Bytes 12/02/2009 11:44:25

AERDL.DLL : 8.1.1.3 438645 Bytes 29/10/2008 18:24:41

AEPACK.DLL : 8.1.3.10 397686 Bytes 04/03/2009 13:06:10

AEOFFICE.DLL : 8.1.0.36 196987 Bytes 26/02/2009 20:01:56

AEHEUR.DLL : 8.1.0.100 1618295 Bytes 25/02/2009 15:49:16

AEHELP.DLL : 8.1.2.2 119158 Bytes 26/02/2009 20:01:56

AEGEN.DLL : 8.1.1.24 336244 Bytes 04/03/2009 13:06:10

AEEMU.DLL : 8.1.0.9 393588 Bytes 09/10/2008 14:32:40

AECORE.DLL : 8.1.6.6 176501 Bytes 17/02/2009 14:22:44

AEBB.DLL : 8.1.0.3 53618 Bytes 09/10/2008 14:32:40

AVWINLL.DLL : 9.0.0.3 18177 Bytes 12/12/2008 08:47:59

AVPREF.DLL : 9.0.0.1 43777 Bytes 05/12/2008 10:32:15

AVREP.DLL : 8.0.0.3 155905 Bytes 20/01/2009 14:34:28

AVREG.DLL : 9.0.0.0 36609 Bytes 05/12/2008 10:32:09

AVARKT.DLL : 9.0.0.3 292609 Bytes 24/03/2009 15:05:41

AVEVTLOG.DLL : 9.0.0.7 167169 Bytes 30/01/2009 10:37:08

SQLITE3.DLL : 3.6.1.0 326401 Bytes 28/01/2009 15:03:49

SMTPLIB.DLL : 9.2.0.25 28417 Bytes 02/02/2009 08:21:33

NETNT.DLL : 9.0.0.0 11521 Bytes 05/12/2008 10:32:10

RCIMAGE.DLL : 9.0.0.21 2438401 Bytes 09/02/2009 11:45:45

RCTEXT.DLL : 9.0.37.0 86785 Bytes 17/04/2009 10:19:48

Configuration settings for the scan:

Jobname.............................: Complete system scan

Configuration file..................: c:\program files\avira\antivir desktop\sysscan.avp

Logging.............................: low

Primary action......................: interactive

Secondary action....................: ignore

Scan master boot sector.............: on

Scan boot sector....................: on

Boot sectors........................: C:, D:,

Process scan........................: on

Scan registry.......................: on

Search for rootkits.................: on

Integrity checking of system files..: off

Scan all files......................: All files

Scan archives.......................: on

Recursion depth.....................: 20

Smart extensions....................: on

Macro heuristic.....................: on

File heuristic......................: medium

Start of the scan: 05 May 2009 23:40

Starting search for hidden objects.

'74096' objects were checked, '0' hidden objects were found.

The scan of running processes will be started

Scan process 'avscan.exe' - '1' Module(s) have been scanned

Scan process 'avcenter.exe' - '1' Module(s) have been scanned

Scan process 'avgnt.exe' - '1' Module(s) have been scanned

Scan process 'sched.exe' - '1' Module(s) have been scanned

Scan process 'avguard.exe' - '1' Module(s) have been scanned

Scan process 'msiexec.exe' - '1' Module(s) have been scanned

Scan process 'GoogleToolbarNotifier.exe' - '1' Module(s) have been scanned

Scan process 'usnsvc.exe' - '1' Module(s) have been scanned

Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned

Scan process 'firefox.exe' - '1' Module(s) have been scanned

Scan process 'ctfmon.exe' - '1' Module(s) have been scanned

Scan process 'iPodService.exe' - '1' Module(s) have been scanned

Scan process 'AAWTray.exe' - '1' Module(s) have been scanned

Scan process 'explorer.exe' - '1' Module(s) have been scanned

Scan process 'wscntfy.exe' - '1' Module(s) have been scanned

Scan process 'wmiprvse.exe' - '1' Module(s) have been scanned

Scan process 'alg.exe' - '1' Module(s) have been scanned

Scan process 'unsecapp.exe' - '1' Module(s) have been scanned

Scan process 'VzFw.exe' - '1' Module(s) have been scanned

Scan process 'igfxsrvc.exe' - '1' Module(s) have been scanned

Scan process 'igfxext.exe' - '1' Module(s) have been scanned

Scan process 'VzCdbSvc.exe' - '1' Module(s) have been scanned

Scan process 'wmpnetwk.exe' - '1' Module(s) have been scanned

Scan process 'wanmpsvc.exe' - '1' Module(s) have been scanned

Scan process 'VCSW.exe' - '1' Module(s) have been scanned

Scan process 'VESMgr.exe' - '1' Module(s) have been scanned

Scan process 'symlcsvc.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'RegSrvc.exe' - '1' Module(s) have been scanned

Scan process 'jqs.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'mDNSResponder.exe' - '1' Module(s) have been scanned

Scan process 'AluSchedulerSvc.exe' - '1' Module(s) have been scanned

Scan process 'AppleMobileDeviceService.exe' - '1' Module(s) have been scanned

Scan process 'AOLacsd.exe' - '1' Module(s) have been scanned

Scan process 'PhotoshopElementsFileAgent.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'spoolsv.exe' - '1' Module(s) have been scanned

Scan process 'AAWService.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'S24EvMon.exe' - '1' Module(s) have been scanned

Scan process 'EvtEng.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'lsass.exe' - '1' Module(s) have been scanned

Scan process 'services.exe' - '1' Module(s) have been scanned

Scan process 'winlogon.exe' - '1' Module(s) have been scanned

Scan process 'csrss.exe' - '1' Module(s) have been scanned

Scan process 'smss.exe' - '1' Module(s) have been scanned

51 processes with 51 modules were scanned

Starting master boot sector scan:

Master boot sector HD0

[iNFO] No virus was found!

Master boot sector HD1

[iNFO] No virus was found!

Start scanning boot sectors:

Boot sector 'C:\'

[iNFO] No virus was found!

Boot sector 'D:\'

[iNFO] No virus was found!

Starting to scan executable files (registry).

The registry was scanned ( '77' files ).

Starting the file scan:

Begin scan in 'C:\' <VAIO>

C:\hiberfil.sys

[WARNING] The file could not be opened!

[NOTE] This file is a Windows system file.

[NOTE] This file cannot be opened for scanning.

C:\pagefile.sys

[WARNING] The file could not be opened!

[NOTE] This file is a Windows system file.

[NOTE] This file cannot be opened for scanning.

C:\Documents and Settings\Mohammed Moradi\Desktop\MsgPlusLive-470.exe

[0] Archive type: RSRC

--> Object

[1] Archive type: RAR

--> SponsorSetup.exe

[DETECTION] Is the TR/Swizzor.AAM Trojan

C:\Program Files\Common Files\AOL\Backup\ACS\Rollback\ACSLAN~1.EXE

[0] Archive type: NSIS

--> [PluginsDir]/utility.dll

[DETECTION] Is the TR/StartPage.bah.1 Trojan

C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcrst.dll

[WARNING] The file could not be opened!

C:\Program Files\ISP\BTPreload\DialBBSignUp.exe

[DETECTION] Contains recognition pattern of the DIAL/270336 dialer

C:\WINDOWS\system32\drivers\dtscsi.sys

[WARNING] The file could not be opened!

C:\WINDOWS\system32\drivers\sptd.sys

[WARNING] The file could not be opened!

C:\WINDOWS\system32\drivers\sptd9421.sys

[WARNING] The file could not be opened!

Begin scan in 'D:\' <VAIO>

Beginning disinfection:

C:\Documents and Settings\Mohammed Moradi\Desktop\MsgPlusLive-470.exe

[NOTE] The file was moved to '4a680305.qua'!

C:\Program Files\Common Files\AOL\Backup\ACS\Rollback\ACSLAN~1.EXE

[NOTE] The file was moved to '4a5402d5.qua'!

C:\Program Files\ISP\BTPreload\DialBBSignUp.exe

[DETECTION] Contains recognition pattern of the DIAL/270336 dialer

[NOTE] The file was moved to '4a6202fb.qua'!

End of the scan: 06 May 2009 04:22

Used time: 1:22:45 Hour(s)

The scan has been done completely.

13416 Scanned directories

475672 Files were scanned

3 Viruses and/or unwanted programs were found

0 Files were classified as suspicious

0 files were deleted

0 Viruses and unwanted programs were repaired

3 Files were moved to quarantine

0 Files were renamed

6 Files cannot be scanned

475663 Files not concerned

8217 Archives were scanned

6 Warnings

5 Notes

74096 Objects were scanned with rootkit scan

0 Hidden objects were found

Heres the latest log file for Malwarebytes

Malwarebytes' Anti-Malware 1.36

Database version: 2064

Windows 5.1.2600 Service Pack 3

09/05/2009 18:44:20

mbam-log-2009-05-09 (18-44-20).txt

Scan type: Full Scan (C:\|D:\|)

Objects scanned: 213788

Time elapsed: 1 hour(s), 54 minute(s), 7 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

Here's the HJT log file

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 16:48:03, on 09/05/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16827)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Avira\AntiVir Desktop\sched.exe

C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe

C:\Program Files\Avira\AntiVir Desktop\avguard.exe

C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

C:\Program Files\Sony\VAIO Event Service\VESMgr.exe

C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe

C:\WINDOWS\wanmpsvc.exe

C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe

C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\explorer.exe

C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Windows Live\Messenger\msnmsgr.exe

C:\Program Files\Windows Live\Messenger\usnsvc.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\WINDOWS\system32\notepad.exe

D:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll

O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll

O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll

O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [VAIOCameraUtility] "C:\Program Files\Sony\VAIO Camera Utility\VCUServe.exe"

O4 - HKLM\..\Run: [sonyPowerCfg] C:\Program Files\Sony\VAIO Power Management\SPMgr.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [PWRISOVM.EXE] D:\PowerISO\PWRISOVM.EXE

O4 - HKLM\..\Run: [VAIO Update 3] "C:\Program Files\Sony\VAIO Update 3\VAIOUpdt.exe" /Stationary

O4 - HKLM\..\Run: [iMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC

O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC

O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName

O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe

O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1152224365\ee\AOLSoftware.exe

O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe

O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe

O4 - HKLM\..\Run: [%FP%Friendly fts.exe] "C:\Program Files\VoyagerTest\fts.exe"

O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe

O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"

O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe

O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Program Files\SAP\SUPERAntiSpyware.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: AOL 9.0 Tray Icon.lnk = C:\Program Files\AOL 9.0a\aoltray.exe

O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll

O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll

O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll

O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll

O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O14 - IERESET.INF: START_PAGE_URL=http://www.club-vaio.com/en/

O15 - Trusted Zone: *.sony-europe.com

O15 - Trusted Zone: *.sonystyle-europe.com

O15 - Trusted Zone: *.vaio-link.com

O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab

O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/Facebo...toUploader5.cab

O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB

O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab

O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab

O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aolsvc.aol.co.uk/computercheckup/qdiagcc.cab

O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Solit...wn.cab56986.cab

O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-GB/a-UNO1/GAME_UNO1.cab

O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/...lscbase5036.cab

O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab56986.cab

O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Solit...wn.cab31267.cab

O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll

O20 - AppInit_DLLs: karna.dat

O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SAP\SASWINLO.dll

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe

O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe

O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe

O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: Image Converter video recording monitor for VAIO Entertainment - Sony Corporation - C:\Program Files\Sony\Image Converter 2\IcVzMon.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: KService - Unknown owner - C:\Program Files\Kontiki\KService.exe (file missing)

O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE

O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\Avlib\MSCSPTISRV.exe

O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\Avlib\PACSPTISVR.exe

O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\Avlib\SPTISRV.exe

O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\Avlib\SSScsiSV.exe

O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe

O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe

O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe

O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe

O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe

O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe

O23 - Service: VAIO Cooporated Initialisation (VCI) - Sony Corporation - C:\Program Files\Sony\VAIO Cooperated Initialisation\VCI_SVC.exe

O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe

O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe

O23 - Service: VAIO Entertainment File Import Service (VzFw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe

O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

--

End of file - 14878 bytes

miekiemoes · May 12, 2009

Hi,

I notice from your log that there's more than 1 Antivirus installed. Avira and Norton

Never install more than one Antivirus and Firewall! Rather than giving you extra protection, it will decrease the reliability of it seriously!

The reason for this is that if both products have their automatic (Real-Time) protection switched on, your system may lock up due to both software products attempting to access the same file at the same time.

Also because more than one Antivirus and Firewall installed are not compatible with eachother, it can cause system performance problems and a serious system slowdown.

So you have to make a decision here and keep the Antivirus you prefer and uninstall the other one.

Then reboot after uninstalling.

Also, I see you are running AdWatch.

I suggest you disable it because it can interfere with the fixes.

To disable AdWatch:

* Right click on the Ad-Watch icon in the system tray.

* At the bottom of the screen there will be two checkable items called Active and Automatic.

o Active: This will turn Ad-Watch On\Off without closing it.

o Automatic: Suspicious activity will be blocked automatically.

* Uncheck both of those boxes.

* (When done, you can re-enable it using the same steps but this time check both boxes.)

Then, * Please visit this webpage for instructions for downloading and running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Post the log from ComboFix in your next reply.

Please make sure you disable ALL of your Antivirus/Antispyware/Firewall before running ComboFix..This because Security Software may see some components ComboFix uses (prep.com for example) as suspicious and blocks the tool, or even deletes it. Please visit HERE if you don't know how.

MM99 · May 12, 2009

Hi,
I notice from your log that there's more than 1 Antivirus installed. Avira and Norton
Never install more than one Antivirus and Firewall! Rather than giving you extra protection, it will decrease the reliability of it seriously!
The reason for this is that if both products have their automatic (Real-Time) protection switched on, your system may lock up due to both software products attempting to access the same file at the same time.
Also because more than one Antivirus and Firewall installed are not compatible with eachother, it can cause system performance problems and a serious system slowdown.
So you have to make a decision here and keep the Antivirus you prefer and uninstall the other one.
Then reboot after uninstalling.
Also, I see you are running AdWatch.
I suggest you disable it because it can interfere with the fixes.
To disable AdWatch:
* Right click on the Ad-Watch icon in the system tray.
* At the bottom of the screen there will be two checkable items called Active and Automatic.
o Active: This will turn Ad-Watch On\Off without closing it.
o Automatic: Suspicious activity will be blocked automatically.
* Uncheck both of those boxes.
* (When done, you can re-enable it using the same steps but this time check both boxes.)
Then, * Please visit this webpage for instructions for downloading and running ComboFix:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix
Post the log from ComboFix in your next reply.
Please make sure you disable ALL of your Antivirus/Antispyware/Firewall before running ComboFix..This because Security Software may see some components ComboFix uses (prep.com for example) as suspicious and blocks the tool, or even deletes it. Please visit HERE if you don't know how.

Hi, thanks for the reply.

Got a few queries that i thought id best ask before proceeding with Combofix in case something goes wrong.

I dont actually have Norton installed, i used to but i had previously uninstalled it so at the moment ive only got Avira.

Also, i followed the link to disable Ad-Watch and Avira, but i dont actually have Ad-Watch installed, ive only got Ad-Aware in the system tray. Secondly, there isnt even an icon for Avira in the system tray so im not sure if its activated or already de-activated. Even when i open Avira there still isnt an icon of it in the system tray, something that i think is down to the malicous items on my computer.

miekiemoes · May 13, 2009

Hi,

If Norton is not installed anymore, then please uninstall every reference to it via add&remove programs, for example Symantec LiveUpdate.

Then reboot.

Ad-Watch is a part of Ad-Aware which you can disable via the app. If it's too confusing, just temporary uninstall AdAware.

For Avira, if for some reason the icon is missing, then open Avira and next to Antivir Guard, click the "deactivate" link.

MM99 · May 13, 2009

Here's the Combofix log:

ComboFix 09-05-12.06 - Mohammed Moradi 13/05/2009 15:42.1 - NTFSx86

Running from: c:\documents and settings\Mohammed Moradi\Desktop\ComboFix.exe

AV: AntiVir Desktop *On-access scanning disabled* (Outdated)

FW: Norton Internet Worm Protection *disabled*

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\nuljtp.vuy

c:\windows\system32\setting.ini

.

((((((((((((((((((((((((( Files Created from 2009-04-13 to 2009-05-13 )))))))))))))))))))))))))))))))

.

2009-05-09 10:40 . 2009-05-09 10:41 -------- d-----w c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}

2009-05-09 10:40 . 2009-05-09 10:41 -------- d-----w c:\program files\iTunes

2009-05-05 22:35 . 2009-03-24 15:08 55640 ----a-w c:\windows\system32\drivers\avgntflt.sys

2009-05-05 22:35 . 2009-05-05 22:35 -------- d-----w c:\documents and settings\All Users\Application Data\Avira

2009-05-05 22:35 . 2009-05-05 22:35 -------- d-----w c:\program files\Avira

2009-05-01 13:14 . 2009-05-04 11:31 -------- d--h--w C:\$AVG8.VAULT$

2009-04-26 12:14 . 2009-04-26 12:14 -------- d-----w c:\documents and settings\All Users\Application Data\TVU Networks

2009-04-21 21:30 . 2009-04-21 21:30 -------- d-----w c:\documents and settings\Mohammed Moradi\Application Data\ACD Systems

2009-04-21 21:23 . 2009-04-21 21:23 9856 ----a-w c:\windows\system32\drivers\pfc.sys

2009-04-15 13:06 . 2009-03-06 14:22 284160 -c----w c:\windows\system32\dllcache\pdh.dll

2009-04-15 13:06 . 2009-02-06 10:39 35328 -c----w c:\windows\system32\dllcache\sc.exe

2009-04-15 13:06 . 2009-02-09 12:10 401408 -c----w c:\windows\system32\dllcache\rpcss.dll

2009-04-15 13:06 . 2009-02-06 11:11 110592 -c----w c:\windows\system32\dllcache\services.exe

2009-04-15 13:06 . 2009-02-09 12:10 473600 -c----w c:\windows\system32\dllcache\fastprox.dll

2009-04-15 13:06 . 2009-02-06 10:10 227840 -c----w c:\windows\system32\dllcache\wmiprvse.exe

2009-04-15 13:06 . 2009-02-09 12:10 453120 -c----w c:\windows\system32\dllcache\wmiprvsd.dll

2009-04-15 13:06 . 2009-02-09 12:10 729088 -c----w c:\windows\system32\dllcache\lsasrv.dll

2009-04-15 13:06 . 2009-02-09 12:10 617472 -c----w c:\windows\system32\dllcache\advapi32.dll

2009-04-15 13:06 . 2009-02-09 12:10 714752 -c----w c:\windows\system32\dllcache\ntdll.dll

2009-04-15 13:03 . 2008-05-03 11:55 2560 ------w c:\windows\system32\xpsp4res.dll

2009-04-15 13:02 . 2008-04-21 12:08 215552 -c----w c:\windows\system32\dllcache\wordpad.exe

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-05-12 22:10 . 2006-03-06 20:14 -------- d-----w c:\program files\Common Files\Symantec Shared

2009-05-09 10:40 . 2006-07-15 19:28 -------- d-----w c:\program files\iPod

2009-05-09 10:40 . 2007-07-02 20:49 -------- d-----w c:\program files\Common Files\Apple

2009-05-01 12:33 . 2007-08-23 20:28 -------- d-----w c:\program files\Kaspersky Lab

2009-05-01 11:10 . 2009-02-28 17:07 -------- d-----w c:\program files\Malwarebytes' Anti-Malware

2009-05-01 01:32 . 2009-02-28 11:12 -------- d-----w c:\program files\SAP

2009-04-27 17:11 . 2009-03-02 17:57 64160 ----a-w c:\windows\system32\drivers\Lbd.sys

2009-04-11 14:12 . 2006-12-10 14:47 -------- d-----w c:\program files\SopCast

2009-04-06 14:32 . 2009-02-28 17:07 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys

2009-04-06 14:32 . 2009-02-28 17:07 15504 ----a-w c:\windows\system32\drivers\mbam.sys

2009-04-05 00:00 . 2009-04-05 00:00 -------- d-----w c:\program files\Bonjour

2009-04-04 23:59 . 2009-04-04 23:59 -------- d-----w c:\program files\QuickTime

2009-03-19 15:32 . 2008-01-29 11:01 23400 ----a-w c:\windows\system32\drivers\GEARAspiWDM.sys

2009-03-06 14:22 . 2006-03-06 06:15 284160 ----a-w c:\windows\system32\pdh.dll

2009-03-05 22:59 . 2009-04-04 23:56 1900544 ----a-w c:\windows\system32\usbaaplrc.dll

2009-03-05 22:59 . 2007-11-01 16:53 36864 ----a-w c:\windows\system32\drivers\usbaapl.sys

2009-03-05 19:58 . 2009-03-05 19:59 410984 ----a-w c:\windows\system32\deploytk.dll

2009-03-03 00:18 . 2006-03-06 06:16 826368 ----a-w c:\windows\system32\wininet.dll

2009-03-02 17:57 . 2009-03-02 18:40 15688 ----a-w c:\windows\system32\lsdelete.exe

2009-02-20 18:09 . 2006-03-06 06:15 78336 ----a-w c:\windows\system32\ieencode.dll

2009-02-18 15:37 . 2009-02-18 15:37 0 ----a-w C:\p3.bat

2006-12-10 15:03 . 2006-12-10 15:03 834126 ----a-w c:\program files\SopCastOcx.zip

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-18 68856]

"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]

"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 204288]

"SUPERAntiSpyware"="c:\program files\SAP\SUPERAntiSpyware.exe" [2009-05-01 1830128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-08-05 77824]

"VAIOCameraUtility"="c:\program files\Sony\VAIO Camera Utility\VCUServe.exe" [2005-12-27 69632]

"SonyPowerCfg"="c:\program files\Sony\VAIO Power Management\SPMgr.exe" [2005-10-19 184320]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-05 136600]

"PWRISOVM.EXE"="d:\poweriso\PWRISOVM.EXE" [2006-09-09 196608]

"VAIO Update 3"="c:\program files\Sony\VAIO Update 3\VAIOUpdt.exe" [2007-01-25 546936]

"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]

"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 59392]

"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]

"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]

"AzMixerSel"="c:\program files\Realtek\InstallShield\AzMixerSel.exe" [2005-06-11 53248]

"HostManager"="c:\program files\Common Files\AOL\1152224365\ee\AOLSoftware.exe" [2006-11-17 50736]

"AOLDialer"="c:\program files\Common Files\AOL\ACS\AOLDial.exe" [2007-12-07 71008]

"DSLAGENTEXE"="c:\program files\BT Voyager 105 ADSL Modem\dslagent.exe" [2003-08-19 16384]

"%FP%Friendly fts.exe"="c:\program files\VoyagerTest\fts.exe" [2003-05-06 72192]

"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-09-03 111936]

"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-04-27 516440]

"Apoint"="c:\program files\Apoint\Apoint.exe" [2004-11-17 118784]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]

"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.EXE [2005-08-09 14743552]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

AOL 9.0 Tray Icon.lnk - c:\program files\AOL 9.0a\aoltray.exe [2008-2-25 156784]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SAP\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]

2008-12-22 11:05 356352 ----a-w c:\program files\SAP\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]

2005-05-20 17:42 73728 ----a-w c:\windows\system32\VESWinlogon.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk

backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]

"swg"=c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

"Steam"="c:\program files\valve\steam\steam.exe" -silent

"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" /background

"WMPNSCFG"=c:\program files\Windows Media Player\WMPNSCFG.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"Acrobat Assistant 7.0"="c:\program files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime

"HP Software Update"=c:\program files\HP\HP Software Update\HPWuSchd2.exe

"igfxtray"=c:\windows\system32\igfxtray.exe

"ISBMgr.exe"=c:\program files\Sony\ISB Utility\ISBMgr.exe

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe"

"RealTray"=c:\program files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER

"Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions

"DSLSTATEXE"=c:\program files\BT Voyager 105 ADSL Modem\dslstat.exe icon

"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" -osboot

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Google\\Google Talk\\googletalk.exe"=

"c:\\Program Files\\LimeWire\\LimeWire.exe"=

"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLAcsd.exe"=

"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\AOL 9.0a\\waol.exe"=

"c:\\Program Files\\Azureus\\Azureus.exe"=

"c:\\Program Files\\SopCast\\adv\\SopAdver.exe"=

"c:\\Program Files\\SopCast\\SopCast.exe"=

"d:\\Program Files\\TVUPlayer\\TVUPlayer.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

"c:\\Program Files\\TVAnts\\Tvants.exe"=

"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager

"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager

"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"38293:UDP"= 38293:UDP:Mo2

"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [02/03/2009 18:57 64160]

R1 SASDIFSV;SASDIFSV;c:\program files\SAP\SASDIFSV.SYS [17/02/2009 12:43 9968]

R1 SASKUTIL;SASKUTIL;c:\program files\SAP\SASKUTIL.SYS [17/02/2009 12:43 55024]

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [05/05/2009 23:35 108289]

R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [18/01/2009 22:34 953168]

R3 SASENUM;SASENUM;c:\program files\SAP\SASENUM.SYS [17/02/2009 12:43 7408]

R3 SonyImgF;Sony Image Conversion Filter Driver;c:\windows\system32\drivers\SonyImgF.sys [06/03/2006 07:16 29184]

S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [28/02/2009 18:07 38496]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - ATWPKT2

*Deregistered* - ATWPKT2

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs

UxTuneUp

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c57ce618-3885-11dc-8c85-00038a000015}]

\Shell\AutoRun\command - fooool.exe

\Shell\explore\Command - fooool.exe

\Shell\open\Command - fooool.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e5c7ded1-3908-11dc-8c88-00038a000015}]

\Shell\AutoRun\command - I:\fooool.exe

\Shell\explore\Command - I:\fooool.exe

\Shell\open\Command - I:\fooool.exe

.

Contents of the 'Scheduled Tasks' folder

2009-05-08 c:\windows\Tasks\1-Click Maintenance.job

- c:\program files\TuneUp Utilities 2007\SystemOptimizer.exe [2006-12-19 05:51]

2009-05-11 c:\windows\Tasks\Ad-Aware Update (Weekly).job

- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-18 17:03]

2009-05-11 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 11:34]

.

- - - - ORPHANS REMOVED - - - -

Notify-NavLogon - (no file)

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.google.com

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

mStart Page = hxxp://www.google.com

uInternet Settings,ProxyOverride = *.local

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: &AOL Toolbar search - c:\program files\AOL Toolbar\toolbar.dll/SEARCH.HTML

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000

Trusted Zone: sony-europe.com

Trusted Zone: sonystyle-europe.com

Trusted Zone: vaio-link.com

Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll

FF - ProfilePath - c:\documents and settings\Mohammed Moradi\Application Data\Mozilla\Firefox\Profiles\9abyl9vw.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.uk

FF - plugin: c:\documents and settings\Mohammed Moradi\Application Data\Mozilla\Firefox\Profiles\9abyl9vw.default\extensions\firefox@tvunetworks.com\plugins\npTVUAx.dll

FF - plugin: c:\documents and settings\Mohammed Moradi\Application Data\Mozilla\Firefox\Profiles\9abyl9vw.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp07076007.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\NPTURNMED.dll

FF - plugin: c:\program files\Veetle\plugins\npVeetle.dll

FF - plugin: c:\program files\Veetle\VLC\npvlc.dll

FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-05-13 15:48

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\h

miekiemoes · May 13, 2009

Hi,

Open notepad and copy and paste next present in the quotebox below in it:

(don't forget to copy and paste REGEDIT4)

REGEDIT4
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c57ce618-3885-11dc-8c85-00038a000015}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e5c7ded1-3908-11dc-8c88-00038a000015}]

Save this as fix.reg Choose to save as *all files and place it on your desktop.

It should look like this:

Doubleclick on it and when it asks you if you want to merge the contents to the registry, click yes/ok.

Normally you should be able to update MalwareBytes as well now. This will detect the malware you were dealing with anyway.

Start MalwareBytes and click the Update tab. There click "Check for updates"
In case you can't update the database via the update option, please download and install the database from here. Only do this when the update option doesn't work.
Once the updates are downloaded, perform a full scan again.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply along with a fresh HijackThis log, then we'll proceed from there with new steps.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

MM99 · May 13, 2009

Here is the MBAM log:

Malwarebytes' Anti-Malware 1.36

Database version: 2124

Windows 5.1.2600 Service Pack 3

13/05/2009 17:39:40

mbam-log-2009-05-13 (17-39-40).txt

Scan type: Full Scan (C:\|D:\|)

Objects scanned: 210493

Time elapsed: 1 hour(s), 0 minute(s), 59 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 37

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\Documents and Settings\LocalService\Application Data\sony\myclubvaio\sections\software\shows\pre2_de.exe (Spyware.Banker) -> Quarantined and deleted successfully.

C:\Documents and Settings\LocalService\Application Data\sony\myclubvaio\sections\software\shows\pre2_en.exe (Spyware.Banker) -> Quarantined and deleted successfully.

C:\Documents and Settings\LocalService\Application Data\sony\myclubvaio\sections\software\shows\pre2_es.exe (Spyware.Banker) -> Quarantined and deleted successfully.

C:\Documents and Settings\LocalService\Application Data\sony\myclubvaio\sections\software\shows\pre2_fr.exe (Spyware.Banker) -> Quarantined and deleted successfully.

C:\Documents and Settings\LocalService\Application Data\sony\myclubvaio\sections\software\shows\pre2_it.exe (Spyware.Banker) -> Quarantined and deleted successfully.

C:\Documents and Settings\LocalService\Application Data\sony\myclubvaio\sections\software\shows\pre2_nl.exe (Spyware.Banker) -> Quarantined and deleted successfully.

C:\Documents and Settings\LocalService\Application Data\sony\myclubvaio\sections\software\shows\pse4_de.exe (Spyware.Banker) -> Quarantined and deleted successfully.

C:\Documents and Settings\LocalService\Application Data\sony\myclubvaio\sections\software\shows\pse4_en.exe (Spyware.Banker) -> Quarantined and deleted successfully.

C:\Documents and Settings\LocalService\Application Data\sony\myclubvaio\sections\software\shows\pse4_es.exe (Spyware.Banker) -> Quarantined and deleted successfully.

C:\Documents and Settings\LocalService\Application Data\sony\myclubvaio\sections\software\shows\pse4_fr.exe (Spyware.Banker) -> Quarantined and deleted successfully.

C:\Documents and Settings\LocalService\Application Data\sony\myclubvaio\sections\software\shows\pse4_it.exe (Spyware.Banker) -> Quarantined and deleted successfully.

C:\Documents and Settings\LocalService\Application Data\sony\myclubvaio\sections\software\shows\pse4_nl.exe (Spyware.Banker) -> Quarantined and deleted successfully.

C:\Documents and Settings\Mohammed Moradi\Application Data\sony\myclubvaio\sections\software\shows\pre2_de.exe (Spyware.Banker) -> Quarantined and deleted successfully.

C:\Documents and Settings\Mohammed Moradi\Application Data\sony\myclubvaio\sections\software\shows\pre2_en.exe (Spyware.Banker) -> Quarantined and deleted successfully.

C:\Documents and Settings\Mohammed Moradi\Application Data\sony\myclubvaio\sections\software\shows\pre2_es.exe (Spyware.Banker) -> Quarantined and deleted successfully.

C:\Documents and Settings\Mohammed Moradi\Application Data\sony\myclubvaio\sections\software\shows\pre2_fr.exe (Spyware.Banker) -> Quarantined and deleted successfully.

C:\Documents and Settings\Mohammed Moradi\Application Data\sony\myclubvaio\sections\software\shows\pre2_it.exe (Spyware.Banker) -> Quarantined and deleted successfully.

C:\Documents and Settings\Mohammed Moradi\Application Data\sony\myclubvaio\sections\software\shows\pre2_nl.exe (Spyware.Banker) -> Quarantined and deleted successfully.

C:\Documents and Settings\Mohammed Moradi\Application Data\sony\myclubvaio\sections\software\shows\pse4_de.exe (Spyware.Banker) -> Quarantined and deleted successfully.

C:\Documents and Settings\Mohammed Moradi\Application Data\sony\myclubvaio\sections\software\shows\pse4_en.exe (Spyware.Banker) -> Quarantined and deleted successfully.

C:\Documents and Settings\Mohammed Moradi\Application Data\sony\myclubvaio\sections\software\shows\pse4_es.exe (Spyware.Banker) -> Quarantined and deleted successfully.

C:\Documents and Settings\Mohammed Moradi\Application Data\sony\myclubvaio\sections\software\shows\pse4_fr.exe (Spyware.Banker) -> Quarantined and deleted successfully.

C:\Documents and Settings\Mohammed Moradi\Application Data\sony\myclubvaio\sections\software\shows\pse4_it.exe (Spyware.Banker) -> Quarantined and deleted successfully.

C:\Documents and Settings\Mohammed Moradi\Application Data\sony\myclubvaio\sections\software\shows\pse4_nl.exe (Spyware.Banker) -> Quarantined and deleted successfully.

C:\Program Files\Sony\MyClubVAIO\sections\software\shows\pre2_de.exe (Spyware.Banker) -> Quarantined and deleted successfully.

C:\Program Files\Sony\MyClubVAIO\sections\software\shows\pre2_en.exe (Spyware.Banker) -> Quarantined and deleted successfully.

C:\Program Files\Sony\MyClubVAIO\sections\software\shows\pre2_es.exe (Spyware.Banker) -> Quarantined and deleted successfully.

C:\Program Files\Sony\MyClubVAIO\sections\software\shows\pre2_fr.exe (Spyware.Banker) -> Quarantined and deleted successfully.

C:\Program Files\Sony\MyClubVAIO\sections\software\shows\pre2_it.exe (Spyware.Banker) -> Quarantined and deleted successfully.

C:\Program Files\Sony\MyClubVAIO\sections\software\shows\pre2_nl.exe (Spyware.Banker) -> Quarantined and deleted successfully.

C:\Program Files\Sony\MyClubVAIO\sections\software\shows\pse4_de.exe (Spyware.Banker) -> Quarantined and deleted successfully.

C:\Program Files\Sony\MyClubVAIO\sections\software\shows\pse4_en.exe (Spyware.Banker) -> Quarantined and deleted successfully.

C:\Program Files\Sony\MyClubVAIO\sections\software\shows\pse4_es.exe (Spyware.Banker) -> Quarantined and deleted successfully.

C:\Program Files\Sony\MyClubVAIO\sections\software\shows\pse4_fr.exe (Spyware.Banker) -> Quarantined and deleted successfully.

C:\Program Files\Sony\MyClubVAIO\sections\software\shows\pse4_it.exe (Spyware.Banker) -> Quarantined and deleted successfully.

C:\Program Files\Sony\MyClubVAIO\sections\software\shows\pse4_nl.exe (Spyware.Banker) -> Quarantined and deleted successfully.

C:\Program Files\GDS\Google Desktop Search.EXE (Rogue.Installer) -> Quarantined and deleted successfully.

And here's the HijackThis log:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 17:47:03, on 13/05/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16827)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Avira\AntiVir Desktop\sched.exe

C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe

C:\Program Files\Avira\AntiVir Desktop\avguard.exe

C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

C:\Program Files\Sony\VAIO Event Service\VESMgr.exe

C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe

C:\WINDOWS\wanmpsvc.exe

C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe

C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\Sony\VAIO Camera Utility\VCUServe.exe

C:\Program Files\Sony\VAIO Power Management\SPMgr.exe

C:\Program Files\Java\jre6\bin\jusched.exe

D:\PowerISO\PWRISOVM.EXE

C:\Program Files\Sony\VAIO Update 3\VAIOUpdt.exe

C:\WINDOWS\system32\wscntfy.exe

C:\Program Files\Common Files\AOL\1152224365\ee\AOLSoftware.exe

C:\Program Files\Common Files\AOL\ACS\AOLDial.exe

C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe

C:\Program Files\VoyagerTest\fts.exe

C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

C:\Program Files\Apoint\Apoint.exe

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\Microsoft ActiveSync\wcescomm.exe

C:\Program Files\Windows Media Player\WMPNSCFG.exe

C:\Program Files\SAP\SUPERAntiSpyware.exe

C:\Program Files\AOL 9.0a\aoltray.exe

C:\PROGRA~1\MICROS~4\rapimgr.exe

C:\Program Files\Apoint\Apntex.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\iPod\bin\iPodService.exe

c:\program files\common files\aol\1152224365\ee\services\antiSpywareApp\ver2_0_12\AOLSP Scheduler.exe

c:\program files\common files\aol\1152224365\ee\aolsoftware.exe

C:\Program Files\Mozilla Firefox\firefox.exe

D:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896