damon24 Posted October 1, 2009 ID:136236 Share Posted October 1, 2009 Started up the computer and noticed Nod32 start to run and then just shut down. Started it up manually and WARNINGS came thick and fast. The WinUpdateMan.exe had started three other exe files. I shut this down, ended the process for Winupdateman and ran a full scan and hit the net.You guys popped up quickly with the best results so can someone please help me.I just ran the combo fix and the results are as follows. My question is "What do I do now??????" Last time I restarted the winupdateman took off again and I don't know how to get it out of the registery (I assume that is where it lives) as I do not know what the initial program is that starts it. Any help appreciated.So here is the combofix results.ComboFix 09-09-29.04 - Mr Me 01/10/2009 18:45.1.2 - NTFSx86Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1190 [GMT 10:00]Running from: c:\documents and settings\Mr Me\Desktop\Combo-Fix.exeAV: ESET NOD32 antivirus system 2.70 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0} * Resident AV is active.((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))).c:\windows\Installer\24cee.mspc:\windows\Installer\24cef.mspc:\windows\Installer\24cf0.mspc:\windows\Installer\24cf1.mspc:\windows\Installer\24cf2.mspc:\windows\Installer\24cf3.mspc:\windows\Installer\24cf4.mspc:\windows\Installer\24cf5.mspc:\windows\Installer\24cf6.mspc:\windows\Installer\341a22.msic:\windows\Installer\341a23.mspc:\windows\Installer\341a24.mspc:\windows\Installer\341a25.mspc:\windows\Installer\341a26.mspc:\windows\Installer\341a27.mspc:\windows\Installer\341a28.mspc:\windows\Installer\341a29.mspc:\windows\Installer\341a2a.mspc:\windows\Installer\341a2b.mspc:\windows\system32\AutoRun.infc:\windows\system32\muzapp.exec:\windows\UA000106.DLL.((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))).-------\Legacy_IPRIP-------\Service_Iprip((((((((((((((((((((((((( Files Created from 2009-09-01 to 2009-10-01 ))))))))))))))))))))))))))))))).2009-09-30 14:23 . 2009-09-30 14:23 -------- d-----w- c:\documents and settings\Mr Me\Application Data\Malwarebytes2009-09-30 14:23 . 2009-09-10 04:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys2009-09-30 14:23 . 2009-09-30 14:23 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware2009-09-30 14:23 . 2009-09-30 14:23 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes2009-09-30 14:23 . 2009-09-10 04:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys2009-09-28 07:48 . 2009-09-28 07:48 -------- d-----w- c:\documents and settings\All Users\Application Data\eGames2009-09-28 07:47 . 2009-09-28 07:47 -------- d-----w- c:\documents and settings\Mr Me\Application Data\eGames2009-09-28 07:46 . 2009-09-28 07:46 -------- d-----w- c:\program files\LeeGTs Games2009-09-28 02:09 . 2009-09-28 02:09 -------- d-----w- c:\program files\Common Files\xing shared2009-09-09 21:32 . 2009-06-21 21:44 153088 -c----w- c:\windows\system32\dllcache\triedit.dll2009-09-09 11:40 . 2009-09-09 11:46 -------- d-----w- C:\etax20092009-09-07 03:12 . 2009-09-07 20:34 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS2009-09-07 03:05 . 2009-09-07 03:05 152576 ----a-w- c:\documents and settings\Mr Me\Application Data\Sun\Java\jre1.6.0_16\lzma.dll.(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))).2009-10-01 07:22 . 2008-07-22 04:23 145883 ----a-w- c:\windows\hpoins21.dat2009-09-30 14:31 . 2007-03-05 23:53 -------- d-----w- c:\program files\GetRight2009-09-28 02:09 . 2008-05-25 07:44 -------- d-----w- c:\program files\Common Files\Real2009-09-28 02:09 . 2003-03-19 03:14 499712 ----a-w- c:\windows\system32\msvcp71.dll2009-09-28 02:09 . 2008-05-25 07:44 -------- d-----w- c:\program files\Real2009-09-15 00:14 . 2007-03-06 22:49 -------- d-----w- c:\documents and settings\Mr Me\Application Data\AdobeUM2009-09-11 10:30 . 2007-04-07 00:32 -------- d-----w- c:\documents and settings\Mr Me\Application Data\Vso2009-09-10 21:46 . 2009-03-29 23:42 -------- d-----w- c:\program files\Microsoft Silverlight2009-09-10 21:05 . 2009-04-01 21:35 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help2009-09-07 03:06 . 2007-03-26 12:35 -------- d-----w- c:\program files\Java2009-08-08 06:56 . 2007-03-04 14:19 103040 ----a-w- c:\documents and settings\Mr Me\Local Settings\Application Data\GDIPFONTCACHEV1.DAT2009-08-07 21:02 . 2009-04-01 21:43 -------- d-----w- c:\program files\MSBuild2009-08-07 21:02 . 2009-08-07 21:02 -------- d-----w- c:\program files\Reference Assemblies2009-08-06 18:10 . 2009-08-06 18:10 86287 ----a-w- c:\windows\system32\WinUpdateMan.exe2009-08-06 17:48 . 2009-08-06 17:48 16384 ----a-w- c:\windows\system32\Msdirectx.exe2009-08-05 09:01 . 2004-08-04 12:00 204800 ----a-w- c:\windows\system32\mswebdvd.dll2009-08-04 20:17 . 2009-08-04 20:17 152576 ----a-w- c:\documents and settings\Mr Me\Application Data\Sun\Java\jre1.6.0_15\lzma.dll2009-08-03 10:11 . 2007-03-05 22:51 -------- d-----w- c:\program files\DivX2009-08-03 10:10 . 2009-08-03 10:10 -------- d-----w- c:\program files\Common Files\DivX Shared2009-07-31 05:23 . 2008-12-20 22:09 411368 ----a-w- c:\windows\system32\deploytk.dll2009-07-17 19:01 . 2004-08-04 12:00 58880 ----a-w- c:\windows\system32\atl.dll2009-07-13 13:43 . 2004-08-04 12:00 286208 ----a-w- c:\windows\system32\wmpdxm.dll2009-07-03 17:09 . 2004-08-04 12:00 915456 ----a-w- c:\windows\system32\wininet.dll2004-04-09 05:13 . 2007-05-23 22:04 114688 ----a-w- c:\program files\NETGEAR DG632 USB Driveruninstalldrv.exe.((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shown REGEDIT4[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2009-02-06 3885408]"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMBgMonitor.exe" [2007-08-03 202024]"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-04-07 68856]"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2005-05-31 1196032]"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2009-06-25 1414144]"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360][HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]"Shockwave Updater"="c:\windows\system32\Adobe\Shockwave 11\SwHelper_1150600.exe" [2009-06-05 468408][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"JMB36X Configure"="c:\windows\system32\JMRaidTool.exe" [2006-04-20 385024]"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480]"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 32768]"SNPSTD2"="c:\windows\vsnpstd2.exe" [2004-06-10 286720]"itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2006-11-21 813912]"nod32kui"="c:\program files\Eset\nod32kui.exe" [2007-06-13 949376]"NeroFilterCheck"="c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2007-03-01 153136]"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-08-07 1828136]"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-22 86016]"SMSTray"="c:\program files\Samsung\Samsung Media Studio 5\SMSTray.exe" [2007-02-23 126976]"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-23 33648]"UVS12 Preload"="c:\program files\Corel\Corel VideoStudio 12\uvPL.exe" [2008-06-09 397456]"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-31 149280]"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-09-28 198160]"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2006-10-22 1622016]"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" - c:\windows\KHALMNPR.Exe [2004-10-21 29696]"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-07-05 16380416]"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2008-04-14 110592]c:\documents and settings\All Users\Start Menu\Programs\Startup\Acrobat Assistant.lnk - c:\program files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [2003-5-15 217193]Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-6-5 113664]GetRight - Tray Icon.lnk - c:\program files\GetRight\getright.exe [2007-3-6 3794256]HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-3-11 210520]Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\KEM.exe [2007-3-25 581632][hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks][HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]@="Driver"[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ComproRemote.lnk]path=c:\documents and settings\All Users\Start Menu\Programs\Startup\ComproRemote.lnkbackup=c:\windows\pss\ComproRemote.lnkCommon Startup[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ComproSchedulerDTV.lnk]path=c:\documents and settings\All Users\Start Menu\Programs\Startup\ComproSchedulerDTV.lnkbackup=c:\windows\pss\ComproSchedulerDTV.lnkCommon Startup[HKLM\~\startupfolder\C:^Documents and Settings^Mr Me^Start Menu^Programs^Startup^Seagate 2GE2G537 Product Registration.lnk]path=c:\documents and settings\Mr Me\Start Menu\Programs\Startup\Seagate 2GE2G537 Product Registration.lnkbackup=c:\windows\pss\Seagate 2GE2G537 Product Registration.lnkStartup[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]"%windir%\\system32\\sessmgr.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe"="c:\\Program Files\\Microsoft Games\\Rise of Nations\\rise.exe"="c:\\Program Files\\Microsoft Games\\Rise of Nations\\thrones.exe"="c:\\Program Files\\THQ\\Gas Powered Games\\Supreme Commander - Forged Alliance\\bin\\ForgedAlliance.exe"="c:\\Program Files\\THQ\\Gas Powered Games\\GPGNet\\GPG.Multiplayer.Client.exe"="c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"="c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"="c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"="c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"="c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"="c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"="c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"="c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"="c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"="c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"="c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"="c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"="c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"="c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"="c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"="c:\\Program Files\\EA GAMES\\Battlefield 1942\\BF1942.exe"="c:\\WINDOWS\\system32\\dpvsetup.exe"="c:\\Program Files\\Rosetta Stone\\Rosetta Stone V3\\support\\bin\\win\\RosettaStoneLtdServices.exe"="c:\\Program Files\\Rosetta Stone\\Rosetta Stone V3\\RosettaStoneVersion3.exe"="c:\\Program Files\\GetRight\\getright.exe"="c:\\WINDOWS\\system32\\WinUpdateMan.exe"=[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service"<NO NAME>"= R1 nod32drv;nod32drv;c:\windows\system32\drivers\nod32drv.sys [11/05/2007 8:10 AM 15424]S2 gupdate1c9f2cf35c86f50;Google Update Service (gupdate1c9f2cf35c86f50);c:\program files\Google\Update\GoogleUpdate.exe [22/06/2009 10:20 AM 133104]S3 MarkFun_NT;MarkFun_NT;c:\program files\GIGABYTE\@BIOS\markfun.w32 [7/01/2008 7:12 PM 17912][HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP.Contents of the 'Scheduled Tasks' folder2009-10-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job- c:\program files\Google\Update\GoogleUpdate.exe [2009-06-22 00:20]2009-10-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job- c:\program files\Google\Update\GoogleUpdate.exe [2009-06-22 00:20]2009-09-28 c:\windows\Tasks\OGADaily.job- c:\windows\system32\OGAVerify.exe [2008-12-31 07:04]2009-10-01 c:\windows\Tasks\OGALogon.job- c:\windows\system32\OGAVerify.exe [2008-12-31 07:04]..------- Supplementary Scan -------.uStart Page = hxxp://www.easynews.com/login/uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8uSearchURL,(Default) = hxxp://www.google.com/search?q=%sIE: Download All Files by HiDownload - c:\program files\StreamingStar\HiDownload\HDGetAll.htmIE: Download by HiDownload - c:\program files\StreamingStar\HiDownload\HDGet.htmIE: Download with GetRight Pro - c:\program files\GetRight\GRdownload.htmIE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000IE: Open with GetRight Pro Browser - c:\program files\GetRight\GRbrowse.htmLSP: c:\windows\system32\imon.dllDPF: {0EC4C9E3-EC6A-11CF-8E3B-444553540000} - file://c:\downloads\1-49b7a-guitar\Riff Interactive - Beginning Guitar I (The Very Beginning)\setup\RiffLick.cab.- - - - ORPHANS REMOVED - - - -AddRemove-AviSynth - c:\program files\AviSynth 2.5\Uninstall.exe**************************************************************************catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.netRootkit scan 2009-10-01 18:53Windows 5.1.2600 Service Pack 3 NTFSscanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfullyhidden files: 0**************************************************************************[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MarkFun_NT]"ImagePath"="\??\c:\program files\Gigabyte\@BIOS\markfun.w32".--------------------- LOCKED REGISTRY KEYS ---------------------[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]@Denied: (A 2) (Everyone)@="FlashBroker""LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101"[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]"Enabled"=dword:00000001[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe"[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]@Denied: (A 2) (Everyone)@="IFlashBroker3"[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]@="{00020424-0000-0000-C000-000000000046}"[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}""Version"="1.0".--------------------- DLLs Loaded Under Running Processes ---------------------- - - - - - - > 'lsass.exe'(916)c:\windows\system32\imon.dll- - - - - - - > 'explorer.exe'(3408)c:\windows\system32\WININET.dllc:\program files\Logitech\SetPoint\lgscroll.dllc:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\MSVCR80.dllc:\windows\system32\ieframe.dllc:\windows\system32\webcheck.dllc:\windows\system32\hnetcfg.dllc:\windows\system32\imon.dllc:\windows\system32\WPDShServiceObj.dllc:\program files\Nokia\Nokia PC Suite 7\PhoneBrowser.dllc:\program files\Nokia\Nokia PC Suite 7\NGSCM.DLLc:\program files\Nokia\Nokia PC Suite 7\Lang\PhoneBrowser_eng.nlrc:\program files\Nokia\Nokia PC Suite 7\Resource\PhoneBrowser_Nokia.ngrc:\windows\system32\PortableDeviceTypes.dllc:\windows\system32\PortableDeviceApi.dll.------------------------ Other Running Processes ------------------------.c:\windows\system32\rundll32.exec:\program files\Java\jre6\bin\jqs.exec:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXEc:\program files\Nero\Nero8\Nero BackItUp\NBService.exec:\progra~1\MI3AA1~1\rapimgr.exec:\program files\Logitech\SetPoint\KHALMNPR.exec:\program files\ESET\nod32krn.exec:\windows\system32\nvsvc32.exec:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exec:\program files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exec:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exec:\program files\Common Files\Nero\Lib\NMIndexingService.exec:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exec:\program files\PC Connectivity Solution\ServiceLayer.exec:\program files\PC Connectivity Solution\Transports\NclUSBSrv.exec:\program files\PC Connectivity Solution\Transports\NclRSSrv.exec:\program files\HP\Digital Imaging\bin\hpqste08.exe.**************************************************************************.Completion time: 2009-10-01 19:00 - machine was rebootedComboFix-quarantined-files.txt 2009-10-01 09:00Pre-Run: 3,197,313,024 bytes freePost-Run: 3,109,605,376 bytes freeWindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe[boot loader]timeout=2default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS[operating systems]c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdconsmulti(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect285 --- E O F --- 2009-09-10 21:08 Link to post Share on other sites More sharing options...
damon24 Posted October 1, 2009 Author ID:136274 Share Posted October 1, 2009 Oh fogot the Hijackit file - attached now Link to post Share on other sites More sharing options...
damon24 Posted October 1, 2009 Author ID:136275 Share Posted October 1, 2009 try again - won't let me upload it so here it isLogfile of Trend Micro HijackThis v2.0.2Scan saved at 9:09:29 PM, on 1/10/2009Platform: Windows XP SP3 (WinNT 5.01.2600)MSIE: Internet Explorer v8.00 (8.00.6001.18702)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\CyberLink\PowerDVD\PDVDServ.exeC:\Program Files\Microsoft IntelliType Pro\itype.exeC:\Program Files\Eset\nod32kui.exeC:\WINDOWS\RTHDCPL.EXEC:\WINDOWS\system32\rundll32.exeC:\Program Files\Microsoft Office\Office12\GrooveMonitor.exeC:\Program Files\Java\jre6\bin\jusched.exeC:\Program Files\Common Files\Real\Update_OB\realsched.exeC:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exeC:\Program Files\Java\jre6\bin\jqs.exeC:\Program Files\Microsoft ActiveSync\wcescomm.exeC:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXEC:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exeC:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exeC:\PROGRA~1\MI3AA1~1\rapimgr.exeC:\Program Files\GetRight\getright.exeC:\Program Files\HP\Digital Imaging\bin\hpqtra08.exeC:\Program Files\Logitech\SetPoint\KEM.exeC:\Program Files\Logitech\SetPoint\KHALMNPR.EXEC:\WINDOWS\System32\svchost.exeC:\Program Files\Eset\nod32krn.exeC:\WINDOWS\system32\nvsvc32.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exeC:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exeC:\Program Files\Common Files\Nero\Lib\NMIndexingService.exeC:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exeC:\Program Files\PC Connectivity Solution\ServiceLayer.exeC:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exeC:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exeC:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exeC:\WINDOWS\system32\wuauclt.exeC:\WINDOWS\system32\ctfmon.exeC:\WINDOWS\explorer.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Trend Micro\HijackThis\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.easynews.com/login/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dllO2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dllO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dllO2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - c:\program files\real\realplayer\rpbrowserrecordplugin.dllO2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dllO2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dllO2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dllO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dllO2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dllO2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dllO2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dllO2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dllO2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dllO3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dllO3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dllO4 - HKLM\..\Run: [JMB36X Configure] C:\WINDOWS\system32\JMRaidTool.exe bootO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"O4 - HKLM\..\Run: [sNPSTD2] C:\WINDOWS\vsnpstd2.exeO4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXEO4 - HKLM\..\Run: [itype] "C:\Program Files\Microsoft IntelliType Pro\itype.exe"O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICEO4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exeO4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInitO4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXEO4 - HKLM\..\Run: [bluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgentO4 - HKLM\..\Run: [sMSTray] C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exeO4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"O4 - HKLM\..\Run: [uVS12 Preload] C:\Program Files\Corel\Corel VideoStudio 12\uvPL.exeO4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osbootO4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscriptO4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /backgroundO4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe"O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytrayO4 - HKCU\..\RunOnce: [shockwave Updater] C:\WINDOWS\system32\Adobe\Shockwave 11\SwHelper_1150600.exe -Update -1150600 -"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB6; .NET CLR 2.0.50727; InfoPath.2; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" -"http://funschool.kaboose.com/fun-blaster/girl-power/games/game-sleek-boutique.html"O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exeO4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exeO4 - Global Startup: GetRight - Tray Icon.lnk = C:\Program Files\GetRight\getright.exeO4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exeO4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exeO8 - Extra context menu item: Download All Files by HiDownload - C:\Program Files\StreamingStar\HiDownload\HDGetAll.htmO8 - Extra context menu item: Download by HiDownload - C:\Program Files\StreamingStar\HiDownload\HDGet.htmO8 - Extra context menu item: Download with GetRight Pro - C:\Program Files\GetRight\GRdownload.htmO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000O8 - Extra context menu item: Open with GetRight Pro Browser - C:\Program Files\GetRight\GRbrowse.htmO9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dllO9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dllO9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dllO9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dllO9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dllO9 - Extra button: HP Clipbook - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dllO9 - Extra button: HP Smart Select - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dllO9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLLO9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra button: HiDownload - {F4FBA929-A891-492C-A0F6-5C79CC4F1742} - C:\Program Files\StreamingStar\HiDownload\hidownload.exe (HKCU)O16 - DPF: {0EC4C9E3-EC6A-11CF-8E3B-444553540000} (WaveTab Control) - file://C:\Downloads\1-49b7a-guitar\Riff Interactive - Beginning Guitar I (The Very Beginning)\setup\RiffLick.cabO16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.6.108.cabO16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cabO16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cabO16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo...otoUploader.cabO16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cabO18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dllO18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dllO23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exeO23 - Service: Google Update Service (gupdate1c9f2cf35c86f50) (gupdate1c9f2cf35c86f50) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exeO23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exeO23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exeO23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exeO23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exeO23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exeO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exeO23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exeO23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exeO23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exeO23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exeO23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe--End of file - 13251 bytes Link to post Share on other sites More sharing options...
Recommended Posts