Antivirus 2010 (Malwarebytes & HJT Inoperable)

Marcus2UVA06 · September 26, 2009

I recently contracted the Antivirus malware and it has locked up my antivirus/spyware programs from opening.

I downloaded and installed Malwarebytes' Anti-Malware and HijackThis but they won't open. The error message received when trying to open them is the following: "Windows cannot access the specified device, path, or file. You may not have the appropriate permissions to access the item."

Also, AVG will not open now as well. I rebooted in safe mode and ran the programs but nothing gets picked up.

PLEASE HELP!!!!

Marcus

screen317 · September 26, 2009

Hi and welcome to Malwarebytes.

Please visit this webpage for instructions for running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

When the tool is finished, it will produce a report for you.
Please post the C:\ComboFix.txt along with a new HijackThis log so we may continue cleaning the system.

-screen317

Marcus2UVA06 · September 27, 2009

Hi and welcome to Malwarebytes.
Please visit this webpage for instructions for running ComboFix:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix
When the tool is finished, it will produce a report for you.
Please post the C:\ComboFix.txt along with a new HijackThis log so we may continue cleaning the system.
-screen317

Thanks for the quick response!

Here is the Combofix text file:

ComboFix 09-09-25.01 - Marcus 09/26/2009 20:47.1.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2046.1573 [GMT -4:00]

Running from: c:\documents and settings\Marcus\Desktop\ComboFix.exe

AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\$recycle.bin\S-1-5-21-4117253376-465198573-4017034940-1000

c:\documents and settings\All Users\Application Data\mocemijoci.pif

c:\documents and settings\All Users\Documents\pygupiho.vbs

c:\documents and settings\All Users\Documents\rity.reg

c:\documents and settings\All Users\Documents\ymevimos.sys

c:\documents and settings\Marcus\Application Data\eradiqywe.sys

c:\documents and settings\Marcus\Application Data\Microsoft\Internet Explorer\Quick Launch\AntivirusPro_2010.lnk

c:\documents and settings\Marcus\Cookies\givy.com

c:\documents and settings\Marcus\Cookies\kofazekusa.dll

c:\documents and settings\Marcus\Cookies\ujagapulik.dll

c:\documents and settings\Marcus\Cookies\waxozaz.lib

c:\documents and settings\Marcus\Local Settings\Application Data\avuhysam._dl

c:\documents and settings\Marcus\Local Settings\Application Data\ijat.dll

c:\documents and settings\Marcus\Local Settings\Application Data\vejypakyg.bat

c:\documents and settings\Marcus\Local Settings\Application Data\yqobupez._dl

c:\documents and settings\Marcus\Local Settings\Application Data\yzikite._dl

c:\documents and settings\Marcus\Local Settings\Temporary Internet Files\ecilaxo.ban

c:\documents and settings\Marcus\Local Settings\Temporary Internet Files\ojerepogu.reg

c:\documents and settings\Marcus\Local Settings\Temporary Internet Files\yrak.com

c:\documents and settings\Marcus\Start Menu\Programs\AntivirusPro_2010

c:\documents and settings\Marcus\Start Menu\Programs\AntivirusPro_2010\AntivirusPro_2010.lnk

c:\documents and settings\Marcus\Start Menu\Programs\AntivirusPro_2010\Uninstall.lnk

c:\program files\WinPCap

c:\program files\WinPCap\daemon_mgm.exe

c:\program files\WinPCap\INSTALL.LOG

c:\program files\WinPCap\npf_mgm.exe

c:\program files\WinPCap\rpcapd.exe

c:\program files\WinPCap\Uninstall.exe

c:\recycler\S-1-5-21-993081466-2568998575-392820215-1005

c:\recycler\S-1-5-21-993081466-2568998575-392820215-500

c:\windows\Downloaded Program Files\IDropPTB.dll

c:\windows\Installer\100072f5.msi

c:\windows\Installer\100072f6.msi

c:\windows\Installer\10007308.msi

c:\windows\Installer\10007310.msi

c:\windows\Installer\10007311.msi

c:\windows\Installer\105310b.msi

c:\windows\Installer\1196d5.msi

c:\windows\Installer\11ec90.msi

c:\windows\Installer\123a4a.msi

c:\windows\Installer\123a59.msi

c:\windows\Installer\123c97.msi

c:\windows\Installer\123cb0.msi

c:\windows\Installer\123cc4.msi

c:\windows\Installer\123d03.msi

c:\windows\Installer\123d15.msi

c:\windows\Installer\123d7a.msi

c:\windows\Installer\123d8b.msi

c:\windows\Installer\123e88.msi

c:\windows\Installer\129a18f3.msp

c:\windows\Installer\13a6c3ba.msp

c:\windows\Installer\13a6c3da.msp

c:\windows\Installer\13a6c3e2.msi

c:\windows\Installer\13a6c446.msi

c:\windows\Installer\13a6c44e.msi

c:\windows\Installer\13a6c456.msi

c:\windows\Installer\13a6c45e.msi

c:\windows\Installer\13a6c46e.msi

c:\windows\Installer\15119a2b.msp

c:\windows\Installer\153ee5.msi

c:\windows\Installer\153eed.msi

c:\windows\Installer\153efb.msi

c:\windows\Installer\153f09.msi

c:\windows\Installer\156c4d6.msi

c:\windows\Installer\166c9ff1.msp

c:\windows\Installer\1730b7.msi

c:\windows\Installer\1730be.msi

c:\windows\Installer\17f717e6.msi

c:\windows\Installer\187b25e.msi

c:\windows\Installer\187b269.msi

c:\windows\Installer\1ab69ec.msi

c:\windows\Installer\1ab69f3.msi

c:\windows\Installer\1b7bb9.msi

c:\windows\Installer\1b9498b.msi

c:\windows\Installer\1c5eb42.msi

c:\windows\Installer\1c5eb50.msi

c:\windows\Installer\1c5eb57.msi

c:\windows\Installer\1d7df0c2.msp

c:\windows\Installer\1da0f85.msi

c:\windows\Installer\1da127c.msi

c:\windows\Installer\1da1283.msi

c:\windows\Installer\1da128a.msi

c:\windows\Installer\1da1291.msi

c:\windows\Installer\1da1298.msi

c:\windows\Installer\1da12c0.msi

c:\windows\Installer\1da12c7.msi

c:\windows\Installer\1da12d0.msi

c:\windows\Installer\1f12d.msi

c:\windows\Installer\23a8659.msi

c:\windows\Installer\242fab9.msi

c:\windows\Installer\2586cc98.msi

c:\windows\Installer\2586cf49.msi

c:\windows\Installer\2586d0de.msi

c:\windows\Installer\27c3e82.msp

c:\windows\Installer\2cf5127.msi

c:\windows\Installer\2f69b6d.msi

c:\windows\Installer\33880205.msp

c:\windows\Installer\352782a.msi

c:\windows\Installer\363c2e.msi

c:\windows\Installer\363c46.msi

c:\windows\Installer\383d755a.msi

c:\windows\Installer\383d7564.msi

c:\windows\Installer\45911d.msi

c:\windows\Installer\4ae8eb.msi

c:\windows\Installer\5351692.msi

c:\windows\Installer\54cd12.msi

c:\windows\Installer\54cd19.msi

c:\windows\Installer\54cd20.msi

c:\windows\Installer\54cd28.msi

c:\windows\Installer\54cd2f.msi

c:\windows\Installer\54cd3a.msi

c:\windows\Installer\54cd41.msi

c:\windows\Installer\54cd48.msi

c:\windows\Installer\54cd4f.msi

c:\windows\Installer\54cd56.msi

c:\windows\Installer\54cd5e.msi

c:\windows\Installer\54cd67.msi

c:\windows\Installer\54cd6e.msi

c:\windows\Installer\54cd75.msi

c:\windows\Installer\54cd7c.msi

c:\windows\Installer\54cd83.msi

c:\windows\Installer\54cd8a.msi

c:\windows\Installer\54cd91.msi

c:\windows\Installer\54da0c.msi

c:\windows\Installer\55b48.msp

c:\windows\Installer\5af58e.msi

c:\windows\Installer\5b612e3.msi

c:\windows\Installer\5d204b0.msp

c:\windows\Installer\5d204c9.msp

c:\windows\Installer\5d205a7.msp

c:\windows\Installer\5d205b1.msp

c:\windows\Installer\5d2060f.msp

c:\windows\Installer\5d20623.msp

c:\windows\Installer\5d2063b.msp

c:\windows\Installer\5d20644.msp

c:\windows\Installer\601c1.msp

c:\windows\Installer\601c9.msp

c:\windows\Installer\69405a5.msi

c:\windows\Installer\69405b4.msi

c:\windows\Installer\69405bc.msi

c:\windows\Installer\69405c9.msi

c:\windows\Installer\694a9f4.msi

c:\windows\Installer\694aa05.msi

c:\windows\Installer\694aa0f.msi

c:\windows\Installer\694aa2c.msi

c:\windows\Installer\694aa3d.msi

c:\windows\Installer\694aa45.msi

c:\windows\Installer\694aa4d.msi

c:\windows\Installer\694aa55.msi

c:\windows\Installer\7389778.msi

c:\windows\Installer\78a05.msp

c:\windows\Installer\78a10.msi

c:\windows\Installer\78a19.msi

c:\windows\Installer\78a37.msp

c:\windows\Installer\7dae2.msi

c:\windows\Installer\80924.msi

c:\windows\Installer\80927.msi

c:\windows\Installer\80937.msi

c:\windows\Installer\80941.msi

c:\windows\Installer\80949.msi

c:\windows\Installer\80968.msi

c:\windows\Installer\8097a.msi

c:\windows\Installer\809a5.msi

c:\windows\Installer\809ae.msi

c:\windows\Installer\809ba.msi

c:\windows\Installer\809c7.msi

c:\windows\Installer\809da.msi

c:\windows\Installer\809ed.msi

c:\windows\Installer\8808ba.msi

c:\windows\Installer\8808f8.msi

c:\windows\Installer\880932.msi

c:\windows\Installer\88093b.msi

c:\windows\Installer\8c3e0c.msi

c:\windows\Installer\8c7e8e.msi

c:\windows\Installer\8c7e96.msi

c:\windows\Installer\8c7e9e.msi

c:\windows\Installer\8c7ea6.msi

c:\windows\Installer\a1e2db9.msp

c:\windows\Installer\a47c15.msi

c:\windows\Installer\a86ef8.msi

c:\windows\Installer\aa14fa.msi

c:\windows\Installer\b69a2d.msi

c:\windows\Installer\c2d2785.msi

c:\windows\Installer\c2d28e9.msi

c:\windows\Installer\c86ccd.msi

c:\windows\Installer\c86cd4.msi

c:\windows\Installer\cc230cd.msi

c:\windows\Installer\cc230d5.msi

c:\windows\Installer\cc230dd.msi

c:\windows\Installer\cc230e5.msi

c:\windows\Installer\cc230ed.msi

c:\windows\Installer\cc230f5.msi

c:\windows\Installer\cc230fd.msi

c:\windows\Installer\cc23113.msi

c:\windows\Installer\cc2311b.msi

c:\windows\Installer\cc2312c.msi

c:\windows\Installer\cc23134.msi

c:\windows\Installer\cc2313c.msi

c:\windows\Installer\cc23144.msi

c:\windows\Installer\cc2314d.msi

c:\windows\Installer\cc23163.msi

c:\windows\Installer\cc2316b.msi

c:\windows\Installer\cc23185.msi

c:\windows\Installer\cc2318d.msi

c:\windows\Installer\cc23195.msi

c:\windows\Installer\cc2319d.msi

c:\windows\Installer\de513c.msp

c:\windows\Installer\de5155.msp

c:\windows\Installer\de516e.msp

c:\windows\Installer\de5188.msp

c:\windows\Installer\de51d2.msp

c:\windows\Installer\de51ed.msp

c:\windows\Installer\de5205.msp

c:\windows\Installer\de521f.msp

c:\windows\Installer\de5238.msp

c:\windows\Installer\de5241.msi

c:\windows\Installer\de5259.msp

c:\windows\Installer\de5278.msp

c:\windows\Installer\e1152b.msi

c:\windows\Installer\e28383.msi

c:\windows\Installer\ea21a7.msi

c:\windows\Installer\ea76a.msi

c:\windows\Nt_File_Temp

c:\windows\Nt_File_Temp\__write_ok__

c:\windows\ph401.dll

c:\windows\system32\_scui.cpl

c:\windows\system32\~.exe

c:\windows\system32\lylop.vbs

c:\windows\system32\udom.bat

c:\windows\system32\wonikubes.inf

F:\Autorun.inf

Infected copy of c:\windows\system32\eventlog.dll was found and disinfected

Restored copy from - c:\windows\system32\logevent.dll

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226ED}

((((((((((((((((((((((((( Files Created from 2009-08-27 to 2009-09-27 )))))))))))))))))))))))))))))))

.

2009-09-27 00:29 . 2009-09-27 00:29 -------- d-----w- c:\documents and settings\Marcus\Application Data\HP

2009-09-26 20:52 . 2009-09-26 20:52 -------- d-----w- c:\program files\Trend Micro

2009-09-26 20:03 . 2009-09-26 20:05 0 ----a-r- c:\windows\win32k.sys

2009-09-26 17:10 . 2009-09-26 17:10 -------- d-----w- c:\documents and settings\All Users\Application Data\SITEguard

2009-09-26 17:09 . 2009-09-26 17:09 -------- d-----w- c:\program files\STOPzilla!

2009-09-26 17:09 . 2009-09-26 17:09 -------- d-----w- c:\program files\Common Files\iS3

2009-09-26 17:09 . 2009-09-26 17:10 -------- d-----w- c:\documents and settings\All Users\Application Data\STOPzilla!

2009-09-26 16:58 . 2009-09-26 16:58 -------- d-----w- C:\_OTM

2009-09-26 04:30 . 2009-09-26 04:30 -------- d-----w- c:\documents and settings\Marcus\Application Data\Malwarebytes

2009-09-26 04:30 . 2009-09-10 18:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-09-26 04:30 . 2009-09-26 17:34 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2009-09-26 04:30 . 2009-09-26 04:30 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2009-09-26 04:30 . 2009-09-10 18:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-09-15 02:06 . 2009-09-15 02:06 -------- d-----w- c:\documents and settings\Marcus\Local Settings\Application Data\AVG Security Toolbar

2009-09-09 22:01 . 1995-03-08 13:58 97792 ----a-w- c:\windows\system\WINSYS.DLL

2009-09-09 22:01 . 1995-02-28 15:14 164928 ----a-w- c:\windows\system\BWCC.DLL

2009-09-09 22:01 . 2009-09-09 22:01 -------- d-----w- C:\IT

2009-09-09 22:01 . 1998-10-29 20:45 307004 ----a-w- c:\windows\ISUN16.EXE

2009-09-09 22:01 . 1995-07-13 22:43 26768 ----a-w- c:\windows\system\CTL3D.DLL

2009-09-09 22:01 . 2009-09-09 22:01 -------- d-----w- c:\documents and settings\Marcus\WINDOWS

2009-09-05 06:51 . 2009-09-05 15:28 -------- d-----w- c:\documents and settings\Marcus\Application Data\Audacity

2009-09-05 06:36 . 2009-09-05 06:36 -------- d-----w- c:\program files\Audacity 1.3 Beta (Unicode)

2009-09-05 06:32 . 2009-09-05 06:32 -------- d-----w- c:\documents and settings\Marcus\Application Data\Sony

2009-09-05 05:53 . 2009-09-05 05:54 -------- d-----w- c:\program files\HI-TECH Software

2009-09-05 05:32 . 2009-09-05 05:46 -------- d-----w- C:\VXIPNP

2009-09-05 05:31 . 2009-09-05 05:31 -------- d-----w- c:\program files\IVI

2009-09-05 05:12 . 2009-09-18 03:17 -------- d-----w- c:\documents and settings\All Users\Application Data\National Instruments

2009-09-05 05:10 . 2009-09-05 05:10 -------- d-----w- c:\windows\system32\cvirte

2009-09-05 05:08 . 2009-09-05 05:51 -------- d-----w- c:\program files\National Instruments

2009-09-04 01:03 . 2009-09-10 19:06 664 ----a-w- c:\windows\system32\d3d9caps.dat

2009-08-28 19:28 . 2009-08-28 19:28 -------- d-----w- c:\program files\Microsoft WSE

2009-08-28 19:27 . 2009-09-10 18:16 -------- d-----w- c:\documents and settings\Marcus\Application Data\Autodesk

2009-08-28 19:25 . 2009-09-11 00:42 -------- d-----w- c:\documents and settings\Marcus\Local Settings\Application Data\Autodesk

2009-08-28 19:25 . 2009-08-28 19:27 -------- d-----w- c:\program files\DWG TrueView 2010

2009-08-28 19:21 . 2009-08-28 19:45 -------- d-----w- c:\program files\Autodesk

2009-08-28 15:12 . 2009-08-28 15:12 -------- d-----w- C:\Autodesk

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-09-27 01:05 . 2009-01-05 17:21 -------- d-----w- c:\program files\DNA

2009-09-27 01:05 . 2009-01-05 17:21 -------- d-----w- c:\documents and settings\Marcus\Application Data\DNA

2009-09-27 00:30 . 2006-04-19 15:36 156856 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-09-26 20:20 . 2007-01-26 02:00 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help

2009-09-26 20:09 . 2009-09-26 04:09 230000 ----a-w- c:\documents and settings\Marcus\Application Data\lizkavd.exe

2009-09-26 04:10 . 2009-09-26 04:10 18597 ----a-w- c:\documents and settings\All Users\Application Data\noluxufyto.dat

2009-09-26 04:10 . 2009-09-26 04:10 19250 ----a-w- c:\documents and settings\Marcus\Application Data\sinafi.dat

2009-09-26 04:03 . 2009-09-26 04:03 329216 ----a-w- c:\documents and settings\Marcus\Application Data\svcst.exe

2009-09-26 04:03 . 2009-09-26 04:03 329216 ----a-w- c:\documents and settings\Marcus\Application Data\seres.exe

2009-09-24 06:11 . 2008-11-10 03:09 -------- d-----w- c:\documents and settings\Marcus\Application Data\U3

2009-09-18 03:16 . 2008-09-05 00:57 -------- d-----w- c:\program files\Microsoft Silverlight

2009-09-18 03:14 . 2009-03-05 17:04 1281264 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat

2009-09-15 02:05 . 2008-09-13 20:06 -------- d-----w- c:\documents and settings\Marcus\Application Data\Move Networks

2009-09-05 05:44 . 2006-10-16 17:03 -------- d-----w- c:\program files\Common Files\Merge Modules

2009-08-28 21:34 . 2007-04-25 01:57 -------- d-----w- c:\documents and settings\All Users\Application Data\FLEXnet

2009-08-28 19:43 . 2006-09-19 02:26 -------- d-----w- c:\documents and settings\All Users\Application Data\Autodesk

2009-08-28 19:42 . 2006-09-19 02:24 -------- d-----w- c:\program files\Common Files\Autodesk Shared

2009-08-28 05:36 . 2009-02-28 23:36 -------- d-----w- c:\program files\V CAST Music with Rhapsody

2009-08-18 21:43 . 2008-07-31 04:09 11952 ----a-w- c:\windows\system32\avgrsstx.dll

2009-08-18 21:43 . 2008-07-31 04:09 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys

2009-08-18 21:43 . 2008-07-31 04:09 335240 ----a-w- c:\windows\system32\drivers\avgldx86.sys

2009-08-17 02:59 . 2009-08-17 02:59 -------- d-----w- c:\program files\Western Digital

2009-07-20 18:57 . 2009-07-20 18:57 17408 ----a-r- c:\windows\system32\SZIO5.dll

2009-07-20 18:56 . 2009-07-20 18:56 311296 ----a-r- c:\windows\system32\SZBase5.dll

2009-07-20 18:56 . 2009-07-20 18:56 540672 ----a-r- c:\windows\system32\SZComp5.dll

2009-07-09 19:52 . 2009-07-09 19:52 126976 ----a-r- c:\windows\system32\IS3HTUI5.dll

2009-07-09 19:52 . 2009-07-09 19:52 393216 ----a-r- c:\windows\system32\IS3DBA5.dll

2009-07-09 19:51 . 2009-07-09 19:51 385024 ----a-r- c:\windows\system32\IS3UI5.dll

2009-07-09 19:51 . 2009-07-09 19:51 61440 ----a-r- c:\windows\system32\IS3Hks5.dll

2009-07-09 19:51 . 2009-07-09 19:51 23040 ----a-r- c:\windows\system32\IS3XDat5.dll

2009-07-09 19:50 . 2009-07-09 19:50 225280 ----a-r- c:\windows\system32\IS3Win325.dll

2009-07-09 19:50 . 2009-07-09 19:50 94208 ----a-r- c:\windows\system32\IS3Inet5.dll

2009-07-09 19:50 . 2009-07-09 19:50 90112 ----a-r- c:\windows\system32\IS3Svc5.dll

2009-07-09 19:47 . 2009-07-09 19:47 724992 ----a-r- c:\windows\system32\IS3Base5.dll

2006-11-29 01:17 . 2006-11-29 01:17 604 -c-ha-w- c:\program files\STLL Notifier

2004-03-15 21:51 . 2004-03-15 21:51 114688 ----a-w- c:\program files\internet explorer\plugins\LV71ActiveXControl.dll

2006-01-23 14:32 . 2006-01-23 14:32 131072 ----a-w- c:\program files\internet explorer\plugins\LV80ActiveXControl.dll

2007-02-08 14:48 . 2007-02-08 14:48 133920 ----a-w- c:\program files\internet explorer\plugins\LV82ActiveXControl.dll

2007-07-24 23:03 . 2007-07-24 23:03 118784 ----a-w- c:\program files\internet explorer\plugins\LV85ActiveXControl.dll

2009-09-17 01:56 . 2007-12-27 04:14 67688 ----a-w- c:\program files\mozilla firefox\components\jar50.dll

2009-09-17 01:56 . 2007-12-27 04:14 54368 ----a-w- c:\program files\mozilla firefox\components\jsd3250.dll

2009-09-17 01:56 . 2007-12-27 04:14 34944 ----a-w- c:\program files\mozilla firefox\components\myspell.dll

2009-09-17 01:56 . 2007-12-27 04:14 46712 ----a-w- c:\program files\mozilla firefox\components\spellchk.dll

2009-09-17 01:56 . 2007-12-27 04:14 172136 ----a-w- c:\program files\mozilla firefox\components\xpinstal.dll

2006-07-09 13:37 . 2006-07-09 10:37 22 -csha-w- c:\windows\SMINST\HPCD.sys

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-06-14 1004800]

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]

2009-06-14 20:07 1004800 ----a-w- c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-06-14 1004800]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-06-14 1004800]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Aim6"="c:\program files\AIM6\aim6.exe" [2008-03-25 50528]

"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]

"BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2009-01-05 342848]

"mserv"="c:\documents and settings\Marcus\Application Data\svcst.exe" [2009-09-26 329216]

"svchost"="c:\documents and settings\Marcus\Application Data\svcst.exe" [2009-09-26 329216]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-08-18 2007832]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-09-06 413696]

"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-09-04 111936]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-10-01 289576]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-18 136600]

"Antivirus Pro 2010"="c:\program files\AntivirusPro_2010\AntivirusPro_2010.exe" [2009-09-27 230000]

c:\documents and settings\Marcus\Start Menu\Programs\Startup\

OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-8-24 101784]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-4-23 29696]

VPN Client.lnk - c:\windows\Installer\{51FB15F4-AD27-43BC-AD4B-DD0354FB6BBD}\Icon3E5562ED7.ico [2009-9-13 6144]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

"ForceClassicControlPanel"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]

2009-08-18 21:43 11952 ----a-w- c:\windows\system32\avgrsstx.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Bluetooth.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Bluetooth.lnk

backup=c:\windows\pss\Bluetooth.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Photosmart Premier Fast Start.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Photosmart Premier Fast Start.lnk

backup=c:\windows\pss\HP Photosmart Premier Fast Start.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusDisableNotify"=dword:00000001

"FirewallDisableNotify"=dword:00000001

"UpdatesDisableNotify"=dword:00000001

"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=

"c:\\Program Files\\AIM6\\aim6.exe"=

"c:\\Program Files\\BitTorrent\\bittorrent.exe"=

"c:\\WINDOWS\\system32\\PnkBstrA.exe"=

"c:\\WINDOWS\\system32\\PnkBstrB.exe"=

"c:\\Documents and Settings\\All Users\\Application Data\\NexonUS\\NGM\\NGM.exe"=

"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=

"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

"c:\\Program Files\\LimeWire\\LimeWire.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\Program Files\\DNA\\btdna.exe"=

"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=

"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=

"c:\\Program Files\\MATLAB\\R2008a\\bin\\win32\\MATLAB.exe"=

R0 nipbcfk;National Instruments Class Upper Filter Driver;c:\windows\system32\drivers\nipbcfk.sys [7/10/2007 8:08 PM 15448]

R0 szkg5;szkg;c:\windows\system32\drivers\SZKG.sys [5/12/2009 2:13 PM 61328]

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [7/31/2008 12:09 AM 335240]

R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [7/31/2008 12:09 AM 108552]

R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [1/29/2009 8:58 PM 297752]

R2 NiViPxiK;NI-VISA PXI Driver;c:\windows\system32\drivers\NiViPxiKl.sys [7/19/2007 11:56 AM 11360]

R3 HSFHWATI;HSFHWATI;c:\windows\system32\drivers\HSFHWATI.sys [8/22/2005 5:06 AM 231424]

S2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [1/29/2009 8:58 PM 908056]

S3 nidimk;nidimk;c:\windows\system32\drivers\nidimkl.sys [7/12/2007 6:18 PM 11360]

S3 nipalfwedl;nipalfwedl;c:\windows\system32\drivers\nipalfwedl.sys [7/18/2007 9:11 PM 11904]

S3 nipalusbedl;nipalusbedl;c:\windows\system32\drivers\nipalusbedl.sys [7/18/2007 9:12 PM 11896]

S3 NiViFWK;NI-VISA FireWire Driver;c:\windows\system32\drivers\NiViFWKl.sys [7/19/2007 11:48 AM 11384]

S3 NiViPciK;NI-VISA PCI Driver;c:\windows\system32\drivers\NiViPciKl.sys [7/19/2007 11:56 AM 11360]

.

Contents of the 'Scheduled Tasks' folder

2009-09-26 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.yahoo.com/

uDefault_Search_URL = hxxp://www.google.com/ie

uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q106&bd=pavilion&pf=laptop

uInternet Settings,ProxyOverride = *.local

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

IE: Send To &Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm

FF - ProfilePath - c:\documents and settings\Marcus\Application Data\Mozilla\Firefox\Profiles\jffeotct.default\

FF - prefs.js: network.proxy.type - 2

FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll

FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils2.dll

FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll

FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll

FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\xpavgtbapi.dll

FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll

FF - component: c:\program files\Mozilla Firefox\extensions\talkback@mozilla.org\components\qfaservices.dll

.

- - - - ORPHANS REMOVED - - - -

HKCU-Run-MsnMsgr - c:\program files\Windows Live\Messenger\MsnMsgr.Exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-09-26 21:04

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

c:\windows\system32\pymiwy.pif 11350 bytes

c:\windows\system32\_scui.cpl 167424 bytes executable

c:\windows\system32\cygiv.exe 12639 bytes

scan completed successfully

hidden files: 3

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]

"ThreadingModel"="Apartment"