hi there below is the combo fix report "lonewolf" - 07-03-31 10:29:13 Service Pack 2 ComboFix 07-03-27.4.2 - Running from: "C:\Documents and Settings\lonewolf\Desktop" (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\Program Files\Common Files\Microsoft Shared\MSInfo\system.2dt C:\WINDOWS\system32\AlxRes070326.exe C:\WINDOWS\system32\KB95842.log C:\WINDOWS\system32\scrsys070326.scr C:\WINDOWS\system32\scrsys16_070326.scr C:\WINDOWS\system32\scrsys16_070326.scr C:\WINDOWS\system32\winsys16_070326.dll C:\WINDOWS\system32\2006102123560920796.dll C:\WINDOWS\system32\grouppolicy\machine\scripts\scripts.ini C:\WINDOWS\system32\lylk.dat C:\WINDOWS\system32\mprmsgse.axz C:\WINDOWS\system32\mywebhit.ini.tmp C:\WINDOWS\system32\tpxdwn.dll C:\WINDOWS\mrgtask.ini C:\WINDOWS\mywinsys.ini C:\WINDOWS\vbarun.dll C:\WINDOWS\mppds.exe C:\WINDOWS\system32\components C:\Program Files\Common Files\{BCCFA~1 C:\Program Files\Common Files\microsoft shared\msinfo\NewInfo.rxk C:\WINDOWS\system32\mppds.dll ((((((((((((((((((((((((((((((( Files Created from 2007-02-28 to 2007-03-31 )))))))))))))))))))))))))))))))))) 2007-03-31 01:31 <DIR> d-------- C:\DOCUME~1\123\APPLIC~1\Talkback 2007-03-31 01:29 221,184 --a------ C:\WINDOWS\system32\wmpns.dll 2007-03-31 01:29 1,048,576 --ah----- C:\DOCUME~1\123\NTUSER.DAT 2007-03-31 00:43 <DIR> d-------- C:\VundoFix Backups 2007-03-31 00:00 14,336 --a------ C:\WINDOWS\system32\COMCTV.exe 2007-03-30 23:58 512,096 --a------ C:\WINDOWS\system32\drivers\amon.sys 2007-03-30 23:58 298,104 --a------ C:\WINDOWS\system32\imon.dll 2007-03-30 23:58 15,424 --a------ C:\WINDOWS\system32\drivers\nod32drv.sys 2007-03-30 21:47 <DIR> d-------- C:\Program Files\BDWin32 2007-03-30 20:42 <DIR> d-------- C:\DOCUME~1\lonewolf\APPLIC~1\Lavasoft 2007-03-30 20:15 10,240 --a------ C:\WINDOWS\system32\winform.dll 2007-03-30 09:59 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy 2007-03-29 15:50 5,505,024 --a------ C:\DOCUME~1\lonewolf\ntuser.dat 2007-03-29 01:23 <DIR> d-------- C:\DOCUME~1\lonewolf\GhostSoul 2007-03-26 12:30 <DIR> d-------- C:\S.T.A.L.K.E.R. - Shadow of Chernobyl 2007-03-25 17:27 <DIR> d-------- C:\DOCUME~1\lonewolf\APPLIC~1\Megaupload 2007-03-25 17:26 <DIR> d-------- C:\DOCUME~1\lonewolf\APPLIC~1\InstallShield 2007-03-21 21:08 <DIR> d-------- C:\Program Files\Pcsx2 2007-03-20 19:20 <DIR> d-------- C:\DOCUME~1\lonewolf\APPLIC~1\Atari 2007-03-20 19:00 197,120 --a------ C:\WINDOWS\patchw32.dll 2007-03-20 19:00 <DIR> d-------- C:\Program Files\Common Files\PocketSoft 2007-03-20 18:57 <DIR> d-------- C:\roller 2007-03-10 17:29 2,560 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys 2007-03-10 17:29 2,432 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys 2007-03-10 17:29 129,784 --------- C:\WINDOWS\system32\pxafs.dll 2007-03-10 17:24 <DIR> d-------- C:\Program Files\Badongo (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-03-31 10:27 -------- d-------- C:\Program Files\flashget 2007-03-31 00:48 3302 --a------ C:\WINDOWS\system32\tmp.reg 2007-03-30 23:31 -------- d-------- C:\Program Files\microsoft frontpage 2007-03-30 21:00 -------- d-------- C:\DOCUME~1\lonewolf\APPLIC~1\utorrent 2007-03-29 23:52 -------- d-------- C:\Program Files\ewido anti-spyware 4.0 2007-03-29 23:50 -------- d-------- C:\Program Files\pplive 2007-03-29 15:56 -------- d-------- C:\Program Files\utorrent 2007-03-29 15:56 -------- d-------- C:\Program Files\tvuplayer 2007-03-28 21:53 -------- d-------- C:\Program Files\openoffice.org1.1.5 2007-03-26 13:02 108144 --a------ C:\WINDOWS\system32\cmdlineext.dll 2007-03-25 17:26 -------- d--h----- C:\Program Files\installshield installation information 2007-03-10 17:29 -------- d-------- C:\Program Files\divx 2007-03-05 17:24 -------- d-------- C:\Program Files\Common Files\wise installation wizard 2007-02-23 19:37 -------- d-------- C:\Program Files\apple software update 2007-02-23 12:29 524288 --a------ C:\WINDOWS\system32\divxsm.exe 2007-02-23 12:29 36624 --------- C:\WINDOWS\system32\drivers\PxHelp20.sys 2007-02-23 12:29 3596288 --a------ C:\WINDOWS\system32\qt-dx331.dll 2007-02-23 12:29 200704 --a------ C:\WINDOWS\system32\ssldivx.dll 2007-02-23 12:29 118520 --------- C:\WINDOWS\system32\pxinsi64.exe 2007-02-23 12:29 116472 --------- C:\WINDOWS\system32\pxcpyi64.exe 2007-02-23 12:29 1044480 --a------ C:\WINDOWS\system32\libdivx.dll 2007-02-23 12:25 823296 --a------ C:\WINDOWS\system32\divx_xx0c.dll 2007-02-23 12:25 823296 --a------ C:\WINDOWS\system32\divx_xx07.dll 2007-02-23 12:25 802816 --a------ C:\WINDOWS\system32\divx_xx11.dll 2007-02-23 12:25 73728 --a------ C:\WINDOWS\system32\dpl100.dll 2007-02-23 12:25 639066 --a------ C:\WINDOWS\system32\divx.dll 2007-02-23 12:25 593920 --a------ C:\WINDOWS\system32\dpugui11.dll 2007-02-23 12:25 57344 --a------ C:\WINDOWS\system32\dpv11.dll 2007-02-23 12:25 53248 --a------ C:\WINDOWS\system32\dpugui10.dll 2007-02-23 12:25 344064 --a------ C:\WINDOWS\system32\dpus11.dll 2007-02-23 12:25 294912 --a------ C:\WINDOWS\system32\dpu11.dll 2007-02-23 12:25 294912 --a------ C:\WINDOWS\system32\dpu10.dll 2007-02-23 12:25 196608 --a------ C:\WINDOWS\system32\dtu100.dll 2007-02-23 01:17 -------- d-------- C:\DOCUME~1\lonewolf\APPLIC~1\adobeum 2007-02-19 09:48 -------- d-------- C:\Program Files\quicktime 2007-02-16 09:40 124472 --a------ C:\WINDOWS\system32\divxcodecupdatechecker.exe 2007-02-16 02:12 -------- d-------- C:\DOCUME~1\lonewolf\APPLIC~1\pplive 2007-02-16 02:11 -------- d-------- C:\Program Files\msn messenger 2007-02-16 02:00 -------- d-------- C:\Program Files\tvants 2007-02-16 01:37 -------- d-------- C:\Program Files\roguescanfix 2007-02-13 22:58 3117 --a------ C:\WINDOWS\mozver.dat 2007-01-31 01:12 359040 --a------ C:\WINDOWS\system32\drivers\TCPIP.SYS 2007-01-30 22:11 897 --a------ C:\WINDOWS\checkip.dat 2007-01-29 23:56 -------- d-------- C:\Program Files\eraser 2007-01-28 12:43 -------- d-------- C:\Program Files\tuneup utilities 2006 2007-01-19 07:45 66048 -r-hs---- C:\WINDOWS\2006key.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "msnmsgr"="\"C:\\Program Files\\MSN Messenger\\MsnMsgr.Exe\" /background" "Veoh"="\"D:\\veoh\\VeohClient.exe\" /VeohHide" @="" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe" "EPSON Stylus Photo RX530 Series"="C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\E_FATIAGP.exe /P31 \"EPSON Stylus Photo RX530 Series\" /O6 \"USB001\" /M \"Stylus Photo RX530\"" "IMJPMIG8.1"="\"C:\\WINDOWS\\IME\\imjp8_1\\IMJPMIG.EXE\" /Spoil /RemAdvDef /Migration32" "MSPY2002"="C:\\WINDOWS\\system32\\IME\\PINTLGNT\\ImScInst.exe /SYNC" "PHIME2002ASync"="C:\\WINDOWS\\system32\\IME\\TINTLGNT\\TINTSETP.exe /SYNC" "PHIME2002A"="C:\\WINDOWS\\system32\\IME\\TINTLGNT\\TINTSETP.exe /IMEName" "CONNECTScheduler"="\"C:\\Program Files\\Sony\\CONNECTAutoUpdate\\CONNECTScheduler.exe\" /RUN_SCHEDULER" "SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_10\\bin\\jusched.exe\"" "NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup" "nwiz"="nwiz.exe /install" "NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit" "DAEMON Tools"="\"C:\\Program Files\\DAEMON Tools\\daemon.exe\" -lang 1033" "Adobe Photo Downloader"="\"C:\\Program Files\\Adobe\\Photoshop Album Starter Edition\\3.0\\Apps\\apdproxy.exe\"" "SoundMan"="SOUNDMAN.EXE" "AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVG7\\avgcc.exe /STARTUP" "MessengerPlus3"="\"C:\\Program Files\\MessengerPlus! 3\\MsgPlus.exe\"" "avgnt"="\"C:\\Program Files\\AntiVir PersonalEdition Classic\\avgnt.exe\" /min" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "nod32kui"="\"C:\\Program Files\\Eset\\nod32kui.exe\" /WAITSERVICE" "ISP"="C:\\DOCUME~1\\123\\LOCALS~1\\Temp\\1631.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ABIT uGuru] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="uGuru" "hkey"="HKLM" "command"="C:\\Program Files\\ABIT\\ABIT uGuru\\uGuru.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\POP] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="1638" "hkey"="HKLM" "command"="C:\\DOCUME~1\\lonewolf\\LOCALS~1\\Temp\\1638.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="SOUNDMAN" "hkey"="HKLM" "command"="SOUNDMAN.EXE" "inimapping"="0" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "appinit_dlls"="MsgPlusLoader.dll" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="ewido anti-spyware 4.0" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "DisableTaskMgr"=dword:00000000 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoCDBurning"=dword:00000000 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] HTTPFilter REG_MULTI_SZ HTTPFilter\0\0 LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\C] Shell\AutoRun\command C:\WINDOWS\system32\RunDLL32.exe Shell32.DLL,ShellExec_RunDLL NTDETECT.exe c: [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\E] Shell\AutoRun\command C:\WINDOWS\system32\RunDLL32.exe Shell32.DLL,ShellExec_RunDLL NTDETECT.exe e: [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\G] Shell\AutoRun\command G:\setup.exe [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b0aaa44f-5d89-11db-95ed-00111a719fcb}] Shell\AutoRun\command H:\autorun.exe Contents of the 'Scheduled Tasks' folder C:\WINDOWS\tasks\1-Click Maintenance.job C:\WINDOWS\tasks\AppleSoftwareUpdate.job ******************************************************************** catchme 0.2 W2K/XP/Vista - userland rootkit detector by Gmer, 17 October 2006 http://www.gmer.net scanning hidden processes ... scanning hidden services ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 ******************************************************************** Completion time: 07-03-31 10:34:33

0

Please post a new Hijack This log.

0

hi there here is the new hijackthis log Logfile of HijackThis v1.99.1 Scan saved at 11:05:44, on 31/03/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.exe C:\Program Files\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\Program Files\ewido anti-spyware 4.0\guard.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAGP.exe C:\Program Files\Sony\CONNECTAutoUpdate\CONNECTScheduler.exe C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe C:\Program Files\DAEMON Tools\daemon.exe C:\PROGRA~1\Grisoft\AVG7\avgcc.exe C:\Program Files\MessengerPlus! 3\MsgPlus.exe C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe C:\Program Files\Eset\nod32kui.exe C:\Program Files\MSN Messenger\MsnMsgr.exe D:\veoh\VeohClient.exe C:\Program Files\Sony\CONNECTAutoUpdate\CONNECTAUTrayApp.exe C:\Program Files\Common Files\Sony Shared\GMR\GMRMan.exe C:\Program Files\Sony\CONNECTAutoUpdate\CONNECTAutoUpdate.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\lonewolf\Desktop\HijackThis.exe F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,rundll32.exe C:\WINDOWS\system32\winsys16_070326.dll start O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FlashGet\jccatch.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: (no name) - {69D23154-CA31-43E9-BEEB-F78E6D1642B3} - (no file) O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O2 - BHO: (no name) - {B10343BD-1DC6-442F-9BA2-D44C708CEE83} - (no file) O2 - BHO: MegaIEMn - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - D:\megamanager\MegaIEMn.dll O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - D:\veoh\Plugins\reg\VeohToolbar.dll O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [EPSON Stylus Photo RX530 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAGP.exe /P31 "EPSON Stylus Photo RX530 Series" /O6 "USB001" /M "Stylus Photo RX530" O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe /IMEName O4 - HKLM\..\Run: [CONNECTScheduler] "C:\Program Files\Sony\CONNECTAutoUpdate\CONNECTScheduler.exe" /RUN_SCHEDULER O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.exe C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.exe C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.exe O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [ISP] C:\DOCUME~1\123\LOCALS~1\Temp\1631.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.exe" /background O4 - HKCU\..\Run: [Veoh] "D:\veoh\VeohClient.exe" /VeohHide O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: CONNECTAUTrayApp.lnk = C:\Program Files\Sony\CONNECTAutoUpdate\CONNECTAUTrayApp.exe O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: Download Link Using Mega Manager... - C:\Program Files\Megaupload\Mega Manager\mm_file.htm O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binar... O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/h... O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games.com.my/com/EGamesPlugin.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binar... O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/active... O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binar... O17 - HKLM\System\CCS\Services\Tcpip\..\{BA058599-6087-463B-8A3F-C63A73E84284}: NameServer = 202.102.199.68,202.100.13.11 O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O20 - AppInit_DLLs: MsgPlusLoader.dll O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: WinFast(R) Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe O23 - Service: Sony SCSI Helper Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\Fsk\SonySCSIHelperService.exe O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe O23 - Service: ·À»ðǽ - Unknown owner - C:\WINDOWS\2006.exe (file missing)

0

Please download ATF-Cleaner to your desktop from this link http://www.atribune.org/content/view/19/2/ We will need it later in safe mode Download and install AVG Anti-Spyware We will need this later in safe mode Be sure to update AVG Anti- Spyware Go to start> control panel> administrative tools> services> scroll down to "Service: ·À»ðǽ - Unknown owner" and double clik it> click stop> click the drop down arrow on the far right of "startup type"> click disable>apply>ok. Next, please reboot your computer in Safe Mode by doing the following : Restart your computer After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually; Instead of Windows loading as normal, a menu with options should appear; Select the first option, to run Windows in Safe Mode, then press "Enter". Choose your usual account. Run Hijack This from safe mode, close all windows except Hijack This, place a check to the left of the following items and press "fix checked": F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,rundll32.exe C:\WINDOWS\system32\winsys16_070326.dll start O2 - BHO: (no name) - {69D23154-CA31-43E9-BEEB-F78E6D1642B3} - (no file) O2 - BHO: (no name) - {B10343BD-1DC6-442F-9BA2-D44C708CEE83} - (no file) O4 - HKLM\..\Run: [ISP] C:\DOCUME~1\123\LOCALS~1\Temp\1631.exe O23 - Service: ·À»ðǽ - Unknown owner - C:\WINDOWS\2006.exe (file missing) Exit Hijack This but remain in safe mode. Run Killbox from safe mode. Please double-click Killbox.exe to run it. Select: Delete on Reboot then Click on the All Files button. Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy): C:\WINDOWS\system32\winsys16_070326.dll C:\Documents and Settings\123\Local Settings\Temp\1631.exe C:\WINDOWS\2006.exe C:\WINDOWS\system32\NTDETECT.exe C:\WINDOWS\system32\winform.dll Return to Killbox, go to the File menu, and choose Paste from Clipboard. Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt. Click OK at any PendingFileRenameOperations prompt (and please let us know if you receive this message!). If your computer does not restart automatically, please restart it manually. Run ATF-Cleaner from safe mode.Double-click ATF-Cleaner.exe to run the program. Under Main choose: Select All Click the Empty Selected button. Empty the restore folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok. In Safe Mode, run AVG Anti-spyware and click on the Scanner tab at the top. Click the "Settings" tab and then change the recommended action to Quarantine and click Automatically generate report after every scan. Click back to the "Scan" tab and then click on Complete System Scan. This scan can take quite a while to run, so be prepared. AVG Anti-Spyware will list any infections found on the left hand side. When the scan has finished, it will automatically set the recommended action. Click the Apply all actions button. AVG Anti-Spyware will display "All actions have been applied" on the right hand side. Click on "Save Report", then "Save Report As". This will create a text file. Make sure you know where to find this file again (like on the Desktop).Post the AVG Antispyware report, a new combofix log and a new Hijack Ths log please.

0