POS.tmp files, slow computer HELP!

Original Message

Name: InsanityPrawn
Date: January 24, 2008 at 00:20:22 Pacific
Subject: POS.tmp files, slow computer HELP!
OS: Win XP
CPU/Ram: #.00ghz, 1 gb RAM

Comment:

I have tons of POS.tmp files in My Documents and my C drive. My computer is really slow. HELP

Report Offensive Message For Removal

Response Number 1

Name: jabuck
Date: January 24, 2008 at 03:25:36 Pacific
Subject: POS.tmp files, slow computer HELP!

Reply: (edit)

Please download Atribune's VundoFix.exe from the followinf site to your desktop:
Vundofix.exe

Double-click VundoFix.exe to run it.
Click the Scan for Vundo button.
Once it's done scanning, click the Remove Vundo button.
You will receive a prompt asking if you want to remove the files,
click "yes".
Once you click yes, your desktop will go blank as it starts removing
Vundo.
When completed, it will prompt that it will reboot your computer,
click "ok".
Please download and install the latest version of HijackThis v2.0.2:

Download the "HijackThis" Installer from this link:
Hijack This

1. Save " HJTInstall.exe" to your desktop.
2. Double click on HJTInstall.exe to run the program.
3. By default it will install to C:\Program Files\Trend Micro\HijackThis.
4. Accept the license agreement by clicking the "I Accept" button.
5.Click on the "Do a system scan and save a log file" button. It will scan and then ask you to save the log.
6. Click "Save log" to save the log file and then the log will open in Notepad.
7. Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
8. Paste the log in your next reply.
9. Do NOT have HijackThis fix anything yet! Most of what it finds will be harmless or even required.

Report Offensive Follow Up For Removal

Response Number 2

Name: InsanityPrawn
Date: January 24, 2008 at 04:11:06 Pacific
Subject: POS.tmp files, slow computer HELP!

Reply: (edit)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:40:13 PM, on 24/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\QuickTime\QTTask .exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Ashampoo\Ashampoo AntiVirus\ashAvSrv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Ashampoo\Ashampoo AntiVirus\GuardGui.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Mickey\My Documents\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
F3 - REG:win.ini: load=C:\WINDOWS\system32\ddaya.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {5AE86891-0CCB-4C13-A250-231BCFB94FFC} - C:\WINDOWS\system32\ddaya.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: {fcc2c2f0-0389-c218-fa44-24f9ddc491ec} - {ce194cdd-9f42-44af-812c-98300f2c2ccf} - C:\WINDOWS\system32\junbyffr.dll (file missing)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [WinFast2KLoadDefault] rundll32.exe C:\WINDOWS\system32\wf2kcpl.dll,DllLoadDefaultSettings
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask .exe" -atboottime
O4 - HKLM\..\Run: [d83f366e] rundll32.exe "C:\WINDOWS\system32\scnujabb.dll",b
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?lin...
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (CDownloadCtrl Object) - http://www.fileplanet.com/fpdlmgr/c...
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.co...
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: cbxyvss - cbxyvss.dll (file missing)
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: avGuard Service (avGuard) - Unknown owner - C:\Program Files\Ashampoo\Ashampoo AntiVirus\ashAvSrv.exe
O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\bmvsrxtn.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
--
End of file - 5281 bytes

Report Offensive Follow Up For Removal

Response Number 3

Name: jabuck
Date: January 24, 2008 at 14:23:36 Pacific
Subject: POS.tmp files, slow computer HELP!

Reply: (edit)

Go to start> control panel> administrative tools> services> scroll down to "DomainService " and double click it. Click the blue drop down arrow to the far right of "startup type"> click disable> apply> ok.
Exit administrative tools.
Run Hijack This, close all windows and browsers except Hiajck This, place a check to the left of the following items and press "fix checked":
F3 - REG:win.ini: load=C:\WINDOWS\system32\ddaya.exe
O2 - BHO: (no name) - {5AE86891-0CCB-4C13-A250-231BCFB94FFC} - C:\WINDOWS\system32\ddaya.dll (file missing)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: {fcc2c2f0-0389-c218-fa44-24f9ddc491ec} - {ce194cdd-9f42-44af-812c-98300f2c2ccf} - C:\WINDOWS\system32\junbyffr.dll (file missing)
O4 - HKLM\..\Run: [d83f366e] rundll32.exe "C:\WINDOWS\system32\scnujabb.dll",b
O20 - Winlogon Notify: cbxyvss - cbxyvss.dll (file missing)
O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\bmvsrxtn.exe (file missing)
Exit Hijack This.
Please download ComboFix to the desktop from one of the following links:
Link1
Link 2
Link 3

Double-click combofix.exe
Follow the prompts.
(Don't click on the window while the program is running, it may cause your system to hang.)
Please post the log it produces.

Report Offensive Follow Up For Removal

Response Number 4

Name: InsanityPrawn
Date: January 24, 2008 at 16:07:58 Pacific
Subject: POS.tmp files, slow computer HELP!

Reply: (edit)

i couldn't get you the combofix log as it quit straight after it finished, all i know is it deleted all the pos.tmp files.
is there anything else i need to do?

Report Offensive Follow Up For Removal

Response Number 5

Name: jabuck
Date: January 24, 2008 at 16:51:00 Pacific
Subject: POS.tmp files, slow computer HELP!

Reply: (edit)

Most likely it did not delete all that needs to be removed from your computer.
Navigate to C:\Combofix.txt and see if a copy is there and post it if you find it.

Report Offensive Follow Up For Removal


Red X and POS Tmp files, Runs slow POS .tmp files HELP! HELP! Red X, pos.tmp files, Runs POS. tmp files in C drive, Red X ic pos.tmp files, red x on c:/	Virus with pos.tmp files pos.tmp files on my C: drive pos.tmp files and red x on my c:/ pos tmp files on c, red x,slow,dll pos.tmp files, red X, kernel errors

Response Number 6

Name: InsanityPrawn
Date: January 24, 2008 at 21:39:50 Pacific
Subject: POS.tmp files, slow computer HELP!

Reply: (edit)

all i could find was this
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
ComboFix 08-01-23.1B - Mickey 2008-01-25 10:24:52.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.629 [GMT 10.5:30]
Running from: C:\Documents and Settings\Mickey\My Documents\ComboFix.exe
[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

Report Offensive Follow Up For Removal

Response Number 7

Name: jabuck
Date: January 25, 2008 at 03:25:27 Pacific
Subject: POS.tmp files, slow computer HELP!

Reply: (edit)

Run Combofix again and see if it will save the log.
Combofix should never take more that 20 minutes including the reboot if malware is detected.
If it does, open task-manager > use the processes tab (press ctrl alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.

Report Offensive Follow Up For Removal

Response Number 8

Name: InsanityPrawn
Date: January 26, 2008 at 00:20:44 Pacific
Subject: POS.tmp files, slow computer HELP!

Reply: (edit)

it aint saving a log, same message as last time

Report Offensive Follow Up For Removal

Response Number 9

Name: jabuck
Date: January 26, 2008 at 12:46:40 Pacific
Subject: POS.tmp files, slow computer HELP!

Reply: (edit)

Must be corrupted somehow, lets unistall it and try again.
Go to start> run> type in combofix /u (note the space after combofix) then press ok.
Redownload combofix and run it again and see if it furnish a log.

Report Offensive Follow Up For Removal

Response Number 10

Name: InsanityPrawn
Date: January 26, 2008 at 17:22:43 Pacific
Subject: POS.tmp files, slow computer HELP!

Reply: (edit)

thats better, it must have been corrupted.
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
ComboFix 08-01-23.1C - Mickey 2008-01-27 11:46:25.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.598 [GMT 10.5:30]
Running from: C:\Documents and Settings\Mickey\My Documents\ComboFix.exe
* Created a new restore point
[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.
((((((((((((((((((((((((( Files Created from 2007-12-27 to 2008-01-27 )))))))))))))))))))))))))))))))
.
2008-01-27 11:45 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\Nircmd.exe
2008-01-27 10:59 . 2008-01-27 10:59 <DIR> d-------- C:\WINDOWS\LastGood
2008-01-24 19:37 . 2008-01-24 19:37 <DIR> d--h----- C:\WINDOWS\PIF
2008-01-24 17:03 . 2004-08-04 22:30 28,288 --a--c--- C:\WINDOWS\system32\dllcache\xjis.nls
2008-01-24 17:01 . 2004-08-04 22:30 13,463,552 --a--c--- C:\WINDOWS\system32\dllcache\hwxjpn.dll
2008-01-24 17:00 . 2004-08-04 22:30 1,677,824 --a--c--- C:\WINDOWS\system32\dllcache\chsbrkr.dll
2008-01-24 16:56 . 2008-01-24 16:56 749 -rah----- C:\WINDOWS\WindowsShell.Manifest
2008-01-24 16:56 . 2008-01-24 16:56 749 -rah----- C:\WINDOWS\system32\wuaucpl.cpl.manifest
2008-01-24 16:56 . 2008-01-24 16:56 749 -rah----- C:\WINDOWS\system32\sapi.cpl.manifest
2008-01-24 16:56 . 2008-01-24 16:56 749 -rah----- C:\WINDOWS\system32\ncpa.cpl.manifest
2008-01-24 16:56 . 2008-01-24 16:56 488 -rah----- C:\WINDOWS\system32\logonui.exe.manifest
2008-01-23 09:39 . 2008-01-23 09:49 <DIR> d-------- C:\Program Files\Eusing Free Registry Cleaner
2008-01-22 23:54 . 2008-01-23 09:47 475 --ahs---- C:\WINDOWS\system32\bbajuncs.ini
2008-01-22 20:30 . 2008-01-22 20:30 <DIR> d-------- C:\Program Files\Real Alternative
2008-01-21 21:36 . 2008-01-21 21:36 54 --a------ C:\WINDOWS\webdial.ini
2008-01-21 21:10 . 2008-01-24 17:28 <DIR> d-------- C:\Program Files\ITC
2008-01-21 19:58 . 2008-01-21 19:58 <DIR> d-------- C:\Program Files\Microsoft Silverlight
2008-01-17 23:30 . 2008-01-17 23:30 <DIR> d-------- C:\Program Files\A-Z
2008-01-17 23:30 . 2005-11-25 21:46 421,888 --a------ C:\WINDOWS\system32\RealMediaSplitter.ax
2008-01-17 22:30 . 2008-01-17 22:30 <DIR> d-------- C:\Program Files\Cucusoft
2008-01-17 22:30 . 2004-01-16 15:50 516,096 --a------ C:\WINDOWS\system32\CLVSD.ax
2008-01-17 22:30 . 2007-06-26 18:55 364,544 --a------ C:\WINDOWS\system32\cdg.dll
2008-01-17 22:30 . 2006-09-27 17:46 348,160 --a------ C:\WINDOWS\system32\cdga.dll
2008-01-17 22:30 . 2006-07-08 04:07 114,688 --a------ C:\WINDOWS\system32\PropListCtrl.ocx
2008-01-17 22:30 . 2006-07-17 21:42 14,909 --a------ C:\WINDOWS\system32\A_reg.reg
2008-01-17 20:14 . 2003-04-03 00:17 172,032 --a------ C:\WINDOWS\system32\ac3filter.ax
2008-01-17 19:17 . 2004-08-04 22:30 1,086,058 -ra------ C:\WINDOWS\SETAD.tmp
2008-01-17 19:17 . 2004-08-04 22:30 1,042,903 -ra------ C:\WINDOWS\SETAA.tmp
2008-01-17 19:17 . 2004-08-04 22:30 13,753 -ra------ C:\WINDOWS\SETB9.tmp
2008-01-17 16:41 . 2008-01-24 18:25 15,360 --a------ C:\WINDOWS\system32\ctfmon .exe
2008-01-17 16:40 . 2008-01-24 18:25 1,490,944 --a------ C:\WINDOWS\system32\WF2K .EXE
2008-01-17 16:40 . 2008-01-24 18:25 155,648 --a------ C:\WINDOWS\system32\NeroCheck .exe
2008-01-17 16:36 . 2008-01-17 16:36 <DIR> d-------- C:\Program Files\WinAVI Video Converter 9.0
2008-01-17 16:36 . 2008-01-17 16:36 <DIR> d-------- C:\Program Files\WinAVI MP4 Converter
2008-01-17 15:29 . 2008-01-17 16:37 <DIR> d-------- C:\Program Files\AC3Filter
2008-01-17 15:29 . 2007-08-18 18:24 380,928 --a------ C:\WINDOWS\system32\ac3filter.acm
2008-01-17 15:09 . 2008-01-17 15:09 61 --a------ C:\WINDOWS\wininit.ini
2008-01-17 14:37 . 2008-01-17 14:37 <DIR> d-------- C:\WINDOWS\WinAVI Video Converter 9.0
2008-01-16 22:33 . 2008-01-16 22:33 <DIR> d-------- C:\Program Files\iLuv
2008-01-16 22:33 . 2008-01-16 22:56 39,201 --a------ C:\iLuv.xml
2008-01-16 22:26 . 2008-01-16 22:26 <DIR> d-------- C:\Program Files\iPod
2008-01-16 19:23 . 2003-12-13 21:40 1,003,520 --a------ C:\WINDOWS\system32\ltmm_n.dll
2008-01-16 19:23 . 2004-01-25 17:49 303,104 --a------ C:\WINDOWS\system32\rmparser.dll
2008-01-16 19:23 . 2008-01-16 19:47 134 --a------ C:\avone.ini
2008-01-16 19:22 . 2008-01-16 19:46 107 --a------ C:\WINDOWS\system32\buyurl_rm.dat
2008-01-16 17:46 . 2008-01-16 19:19 <DIR> d-------- C:\Program Files\EO Video
2008-01-16 17:46 . 2008-01-16 17:45 724,992 --a------ C:\WINDOWS\iun6002.exe
2008-01-15 21:07 . 2008-01-15 21:07 <DIR> d-------- C:\Program Files\Microsoft.NET
2008-01-15 19:09 . 2008-01-15 19:09 <DIR> d-------- C:\Program Files\uTorrent
2008-01-14 20:18 . 2008-01-14 20:18 268 --ah----- C:\sqmdata00.sqm
2008-01-14 20:18 . 2008-01-14 20:18 244 --ah----- C:\sqmnoopt00.sqm
2008-01-10 15:36 . 2008-01-10 15:36 <DIR> d-------- C:\WINDOWS\.jagex_cache_32
2008-01-10 15:27 . 2008-01-10 15:27 90,112 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx
2008-01-10 15:27 . 2008-01-10 15:27 57,344 --a------ C:\WINDOWS\system32\QuickTime.qts
2008-01-10 10:24 . 2008-01-24 12:04 376,779 --a------ C:\WINDOWS\setupapi.old
2008-01-06 16:23 . 2008-01-06 16:23 <DIR> d-------- C:\Program Files\Stunt Playground
2008-01-03 10:52 . 2008-01-03 10:52 <DIR> d-------- C:\Program Files\Xpand Rally Xtreme
2008-01-02 01:35 . 2008-01-02 01:36 <DIR> d-------- C:\Program Files\DVD Decrypter
2008-01-02 01:20 . 2008-01-02 01:20 <DIR> d-------- C:\Program Files\DVDx 2.4
2008-01-01 23:56 . 2008-01-01 23:56 <DIR> d-------- C:\ConverterOutput
2008-01-01 23:55 . 2007-03-25 00:51 3,049,984 --a------ C:\WINDOWS\system32\libavcodec.dll
2008-01-01 23:55 . 2007-03-25 21:40 2,174,976 --a------ C:\WINDOWS\system32\ffdshow.ax
2008-01-01 23:55 . 2007-03-25 00:51 404,480 --a------ C:\WINDOWS\system32\libmplayer.dll
2008-01-01 23:55 . 2007-01-01 05:30 200,704 --a------ C:\WINDOWS\system32\TomsMoComp_ff.dll
2008-01-01 23:55 . 2007-03-25 00:51 114,688 --a------ C:\WINDOWS\system32\libmpeg2_ff.dll
2008-01-01 23:55 . 2004-09-10 13:50 34,820 --a------ C:\WINDOWS\system32\ffdshow.reg
2008-01-01 23:37 . 2008-01-02 00:23 <DIR> d-------- C:\Program Files\SlySoft
2008-01-01 23:25 . 2005-11-21 16:18 45,056 --a------ C:\WINDOWS\system32\WNASPI32.DLL
2008-01-01 23:25 . 2005-11-21 16:18 16,512 --a------ C:\WINDOWS\system32\drivers\ASPI32.SYS
2007-12-30 18:28 . 2008-01-21 18:46 <DIR> d-------- C:\Program Files\Microsoft Games
2007-12-30 18:15 . 2007-12-30 18:16 <DIR> d-------- C:\Disk Images
2007-12-30 18:08 . 2007-12-30 18:08 <DIR> d-------- C:\Program Files\PowerISO
2007-12-29 11:15 . 2007-12-29 11:18 139,264 --a------ C:\WINDOWS\War3Unin.exe
2007-12-29 11:15 . 2007-12-29 11:18 54,864 --a------ C:\WINDOWS\War3Unin.dat
2007-12-29 11:15 . 2007-12-29 11:18 2,829 --a------ C:\WINDOWS\War3Unin.pif
2007-12-29 11:14 . 2007-12-31 14:01 <DIR> d-------- C:\Program Files\Warcraft III
2007-12-28 20:26 . 2007-12-28 20:26 <DIR> d-------- C:\Program Files\tribes
2007-12-28 20:26 . 2007-12-28 20:26 <DIR> d-------- C:\Program Files\Sierra On-Line
2007-12-28 20:25 . 2007-12-28 20:27 223 --a------ C:\WINDOWS\Sierra.ini
2007-12-28 17:40 . 2007-12-28 17:45 <DIR> d-------- C:\Program Files\Diablo II
2007-12-27 23:41 . 2007-12-27 23:41 <DIR> d-------- C:\WINDOWS\Downloaded Installations
2007-12-27 23:41 . 2007-12-28 11:12 <DIR> d-------- C:\Program Files\D-Tools
2007-12-27 23:41 . 2003-12-27 20:42 137,216 --a------ C:\WINDOWS\system32\drivers\d344bus.sys
2007-12-27 23:41 . 2003-12-27 02:38 5,248 --a------ C:\WINDOWS\system32\drivers\d344prt.sys
2007-12-27 23:33 . 2007-12-27 23:45 70,656 --a------ C:\WINDOWS\ScUnin.exe
2007-12-27 23:33 . 2007-12-27 23:45 32,845 --a------ C:\WINDOWS\scunin.dat
2007-12-27 23:33 . 2007-12-27 23:45 967 --a------ C:\WINDOWS\ScUnin.pif
2007-12-27 23:32 . 2007-12-30 21:36 <DIR> d-------- C:\Program Files\Starcraft
2007-12-27 11:28 . 2007-12-28 02:43 <DIR> d-------- C:\Program Files\Dawn of War
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-26 10:36 --------- d-----w C:\Program Files\TrackMania Nations ESWC Special Edition
2008-01-26 08:42 --------- d-----w C:\Program Files\iTunes
2008-01-24 10:24 --------- d-----w C:\Program Files\QuickTime
2008-01-22 23:04 --------- d-----w C:\Program Files\Download Manager
2008-01-22 09:59 --------- d-----w C:\Program Files\Realplayer
2008-01-22 09:59 --------- d-----w C:\Program Files\Common Files\Real
2008-01-16 09:18 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-15 08:48 --------- d-----w C:\Program Files\BitComet
2008-01-01 14:44 --------- d-----w C:\Program Files\DivX
2008-01-01 14:28 4,681,459,712 ----a-w C:\Program Files\THE_SIMPSONS_MOVIE_SE_F9.ISO
2007-12-30 07:49 --------- d-----w C:\Program Files\Common Files\InstallShield
2007-12-25 07:12 --------- d-----w C:\Program Files\Red Kawa
2007-12-25 07:12 --------- d-----w C:\Program Files\AviSynth 2.5
2007-12-25 01:51 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2007-12-25 01:50 669,184 ----a-w C:\WINDOWS\system32\pbsvc.exe
2007-12-25 01:50 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
2007-12-25 01:50 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2007-12-25 01:38 --------- d-----w C:\Program Files\Electronic Arts
2007-12-24 23:23 --------- d-----w C:\Program Files\Common Files\Apple
2007-12-24 23:23 --------- d-----w C:\Program Files\Apple Software Update
2007-12-24 11:01 --------- d-----w C:\Program Files\Dexster
2007-12-14 23:35 --------- d-----w C:\Program Files\Irrational Games
2007-12-11 07:46 4,681,469,952 ----a-w C:\Program Files\DISTURBIA_AUS.ISO
2007-12-11 06:53 --------- d-----w C:\Program Files\DVD Shrink
2007-12-11 06:40 --------- d-----w C:\Program Files\Common Files\Ahead
2007-12-11 06:40 --------- d-----w C:\Program Files\Ahead
2007-12-07 09:56 --------- d-----w C:\Program Files\Skype
2007-12-07 09:56 --------- d-----w C:\Program Files\Common Files\Skype
2007-12-06 07:23 --------- d-----w C:\Program Files\NHN USA
2007-12-06 07:18 --------- d-----w C:\Program Files\Gunz
2007-12-04 01:33 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2007-12-04 01:33 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2007-12-04 01:33 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2007-12-04 01:33 682,496 ----a-w C:\WINDOWS\system32\DivX.dll
2007-11-29 22:30 9,464 ----a-w C:\WINDOWS\system32\drivers\cdralw2k.sys
2007-11-29 22:30 9,336 ----a-w C:\WINDOWS\system32\drivers\cdr4_xp.sys
2007-11-29 22:30 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2007-11-29 22:30 43,528 ----a-w C:\WINDOWS\system32\drivers\PxHelp20.sys
2007-11-29 22:30 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2007-11-29 22:30 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2007-11-29 22:30 129,784 ----a-w C:\WINDOWS\system32\pxafs.dll
2007-11-29 22:30 120,056 ----a-w C:\WINDOWS\system32\pxcpyi64.exe
2007-11-29 22:30 118,520 ----a-w C:\WINDOWS\system32\pxinsi64.exe
2007-11-29 22:30 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2007-11-29 22:28 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2007-11-29 22:28 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
2007-11-28 21:55 156,992 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2007-11-28 21:53 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
2007-11-28 21:53 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
2007-11-28 21:53 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
2007-11-28 21:53 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
2007-11-28 21:53 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
2007-11-28 21:53 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
2007-11-28 21:52 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2007-11-11 21:33 356,352 ----a-w C:\WINDOWS\system32\NVUNINST.EXE
2007-11-11 20:21 757,760 ----a-w C:\WINDOWS\system32\nvcplui.exe
2007-11-11 20:21 356,352 ----a-w C:\WINDOWS\system32\nvudisp.exe
2007-11-11 20:21 307,200 ----a-w C:\WINDOWS\system32\nvexpbar.dll
2007-11-11 20:21 1,089,536 ----a-w C:\WINDOWS\system32\nvcuda.dll
2007-11-10 03:32 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2007-10-30 18:42 3,590,656 ----a-w C:\WINDOWS\system32\SETC8.tmp
.
[code]
----a-w           213,936 2008-01-24 07:55:24  C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM                    .exe
----a-w         1,103,480 2008-01-22 23:00:21  C:\Program Files\Download Manager\DLM .exe
----a-w           579,072 2008-01-24 08:49:54  C:\Program Files\Grisoft\AVG7\avgcc .exe
----a-w           267,048 2008-01-24 07:55:29  C:\Program Files\iTunes\iTunesHelper .exe
----a-w           132,496 2008-01-24 07:55:26  C:\Program Files\Java\jre1.6.0_02\bin\jusched .exe
----a-w           385,024 2008-01-24 07:55:29  C:\Program Files\QuickTime\QTTask                       .exe
----a-w            15,360 2008-01-24 07:55:39  C:\WINDOWS\system32\ctfmon .exe
----a-w           155,648 2008-01-24 07:55:28  C:\WINDOWS\system32\NeroCheck .exe
----a-w         1,490,944 2008-01-24 07:55:24  C:\WINDOWS\system32\WF2K .EXE
[/code]

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 22:30 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-09-17 01:07 8491008]
"nwiz"="nwiz.exe" [2007-09-17 01:07 1626112 C:\WINDOWS\system32\nwiz.exe]
"WinFast2KLoadDefault"="C:\WINDOWS\system32\wf2kcpl.dll" [2005-09-16 15:35 616448]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask .exe" [2008-01-24 18:25 385024]
"SoundMan"="SOUNDMAN.EXE" [2004-02-13 19:27 62464 C:\WINDOWS\SOUNDMAN.EXE]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-09-17 01:07 81920]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-01-15 03:22 267048]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 22:30 15360]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-01-23 11:09 219136]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM]
--a------ 2008-01-24 18:25 213936 C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM .exe
R0 d344bus;d344bus;C:\WINDOWS\system32\DRIVERS\d344bus.sys [2003-12-27 20:42]
R0 d344prt;d344prt;C:\WINDOWS\system32\Drivers\d344prt.sys [2003-12-27 02:38]
R2 avGuard;avGuard Service;C:\Program Files\Ashampoo\Ashampoo AntiVirus\ashAvSrv.exe [2007-06-14 11:44]
R3 AshAvScan;AshAvScan;C:\WINDOWS\system32\DRIVERS\AshAvScan.sys [2007-03-02 11:04]
R4 WINFOXIO;WINFOXIO;C:\WINDOWS\system32\Drivers\WINFOXIO.SYS [2005-03-25 19:24]
S3 XDva032;XDva032;C:\WINDOWS\system32\XDva032.sys []
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
\Shell\AutoRun\command - D:\setup.exe
\Shell\directx\command - D:\DirectX\dxsetup.exe
\Shell\setup\command - D:\setup.exe
.
Contents of the 'Scheduled Tasks' folder
"2008-01-17 05:09:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-27 11:50:37
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-01-27 11:51:09
.
2008-01-27 00:29:55 --- E O F ---
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

Report Offensive Follow Up For Removal

Response Number 11

Name: jabuck
Date: January 26, 2008 at 18:34:36 Pacific
Subject: POS.tmp files, slow computer HELP!

Reply: (edit)

Open Notepad and copy/paste everything between the X"s into it and make sure "File::" is at the very top of the page.
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
File::
C:\WINDOWS\SETAD.tmp
C:\WINDOWS\SETAA.tmp
C:\WINDOWS\SETB9.tmp
C:\WINDOWS\system32\SETC8.tmp
C:\WINDOWS\system32\buyurl_rm.dat
RenV::
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM .exe
C:\Program Files\Download Manager\DLM .exe
C:\Program Files\Grisoft\AVG7\avgcc .exe
C:\Program Files\iTunes\iTunesHelper .exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched .exe
C:\Program Files\QuickTime\QTTask .exe
C:\WINDOWS\system32\ctfmon .exe
C:\WINDOWS\system32\NeroCheck .exe
C:\WINDOWS\system32\WF2K .EXE

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Go to File on the top bar and choose" Save As", Change the "Save As Type" to All Files, Name it CFScript.txt then save it to your desktop.
Then drag/drop the CFScript.txt onto ComboFix.exe (the red X on your desktop) if combofix does not auto start click "run".
Post a new Combofix log and a new Hijack This log please.
Please go to Virus Total and upload the following file for analysis:
C:\WINDOWS\system32\bbajuncs.ini
C:\WINDOWS\system32\webdial.ini

Post the results in your reply.

Report Offensive Follow Up For Removal

Response Number 12

Name: InsanityPrawn
Date: January 26, 2008 at 19:53:11 Pacific
Subject: POS.tmp files, slow computer HELP!

Reply: (edit)

Combo Fix Log
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
ComboFix 08-01-23.1C - Mickey 2008-01-27 13:12:06.5 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.593 [GMT 10.5:30]
Running from: C:\Documents and Settings\Mickey\My Documents\ComboFix.exe
Command switches used :: C:\Documents and Settings\Mickey\Desktop\CFScript.txt
* Created a new restore point
[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
FILE
C:\WINDOWS\SETAA.tmp
C:\WINDOWS\SETAD.tmp
C:\WINDOWS\SETB9.tmp
C:\WINDOWS\system32\buyurl_rm.dat
C:\WINDOWS\system32\SETC8.tmp
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\SETAA.tmp
C:\WINDOWS\SETAD.tmp
C:\WINDOWS\SETB9.tmp
C:\WINDOWS\system32\buyurl_rm.dat
C:\WINDOWS\system32\SETC8.tmp
.
((((((((((((((((((((((((( Files Created from 2007-12-27 to 2008-01-27 )))))))))))))))))))))))))))))))
.
2008-01-27 11:45 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\Nircmd.exe
2008-01-27 10:59 . 2008-01-27 10:59 <DIR> d-------- C:\WINDOWS\LastGood
2008-01-24 19:37 . 2008-01-24 19:37 <DIR> d--h----- C:\WINDOWS\PIF
2008-01-24 17:03 . 2004-08-04 22:30 28,288 --a--c--- C:\WINDOWS\system32\dllcache\xjis.nls
2008-01-24 17:01 . 2004-08-04 22:30 13,463,552 --a--c--- C:\WINDOWS\system32\dllcache\hwxjpn.dll
2008-01-24 17:00 . 2004-08-04 22:30 1,677,824 --a--c--- C:\WINDOWS\system32\dllcache\chsbrkr.dll
2008-01-24 16:56 . 2008-01-24 16:56 749 -rah----- C:\WINDOWS\WindowsShell.Manifest
2008-01-24 16:56 . 2008-01-24 16:56 749 -rah----- C:\WINDOWS\system32\wuaucpl.cpl.manifest
2008-01-24 16:56 . 2008-01-24 16:56 749 -rah----- C:\WINDOWS\system32\sapi.cpl.manifest
2008-01-24 16:56 . 2008-01-24 16:56 749 -rah----- C:\WINDOWS\system32\ncpa.cpl.manifest
2008-01-24 16:56 . 2008-01-24 16:56 488 -rah----- C:\WINDOWS\system32\logonui.exe.manifest
2008-01-23 09:39 . 2008-01-23 09:49 <DIR> d-------- C:\Program Files\Eusing Free Registry Cleaner
2008-01-22 23:54 . 2008-01-23 09:47 475 --ahs---- C:\WINDOWS\system32\bbajuncs.ini
2008-01-22 20:30 . 2008-01-22 20:30 <DIR> d-------- C:\Program Files\Real Alternative
2008-01-21 21:36 . 2008-01-21 21:36 54 --a------ C:\WINDOWS\webdial.ini
2008-01-21 21:10 . 2008-01-24 17:28 <DIR> d-------- C:\Program Files\ITC
2008-01-21 19:58 . 2008-01-21 19:58 <DIR> d-------- C:\Program Files\Microsoft Silverlight
2008-01-17 23:30 . 2008-01-17 23:30 <DIR> d-------- C:\Program Files\A-Z
2008-01-17 23:30 . 2005-11-25 21:46 421,888 --a------ C:\WINDOWS\system32\RealMediaSplitter.ax
2008-01-17 22:30 . 2008-01-17 22:30 <DIR> d-------- C:\Program Files\Cucusoft
2008-01-17 22:30 . 2004-01-16 15:50 516,096 --a------ C:\WINDOWS\system32\CLVSD.ax
2008-01-17 22:30 . 2007-06-26 18:55 364,544 --a------ C:\WINDOWS\system32\cdg.dll
2008-01-17 22:30 . 2006-09-27 17:46 348,160 --a------ C:\WINDOWS\system32\cdga.dll
2008-01-17 22:30 . 2006-07-08 04:07 114,688 --a------ C:\WINDOWS\system32\PropListCtrl.ocx
2008-01-17 22:30 . 2006-07-17 21:42 14,909 --a------ C:\WINDOWS\system32\A_reg.reg
2008-01-17 20:14 . 2003-04-03 00:17 172,032 --a------ C:\WINDOWS\system32\ac3filter.ax
2008-01-17 16:41 . 2008-01-24 18:25 15,360 --a--c--- C:\WINDOWS\system32\dllcache\ctfmon.exe
2008-01-17 16:41 . 2008-01-24 18:25 15,360 --a------ C:\WINDOWS\system32\ctfmon.exe
2008-01-17 16:40 . 2008-01-24 18:25 1,490,944 --a------ C:\WINDOWS\system32\WF2K.EXE
2008-01-17 16:40 . 2008-01-24 18:25 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe
2008-01-17 16:36 . 2008-01-17 16:36 <DIR> d-------- C:\Program Files\WinAVI Video Converter 9.0
2008-01-17 16:36 . 2008-01-17 16:36 <DIR> d-------- C:\Program Files\WinAVI MP4 Converter
2008-01-17 15:29 . 2008-01-17 16:37 <DIR> d-------- C:\Program Files\AC3Filter
2008-01-17 15:29 . 2007-08-18 18:24 380,928 --a------ C:\WINDOWS\system32\ac3filter.acm
2008-01-17 15:09 . 2008-01-17 15:09 61 --a------ C:\WINDOWS\wininit.ini
2008-01-17 14:37 . 2008-01-17 14:37 <DIR> d-------- C:\WINDOWS\WinAVI Video Converter 9.0
2008-01-16 22:33 . 2008-01-16 22:33 <DIR> d-------- C:\Program Files\iLuv
2008-01-16 22:33 . 2008-01-16 22:56 39,201 --a------ C:\iLuv.xml
2008-01-16 22:26 . 2008-01-16 22:26 <DIR> d-------- C:\Program Files\iPod
2008-01-16 19:23 . 2003-12-13 21:40 1,003,520 --a------ C:\WINDOWS\system32\ltmm_n.dll
2008-01-16 19:23 . 2004-01-25 17:49 303,104 --a------ C:\WINDOWS\system32\rmparser.dll
2008-01-16 19:23 . 2008-01-16 19:47 134 --a------ C:\avone.ini
2008-01-16 17:46 . 2008-01-16 19:19 <DIR> d-------- C:\Program Files\EO Video
2008-01-16 17:46 . 2008-01-16 17:45 724,992 --a------ C:\WINDOWS\iun6002.exe
2008-01-15 21:07 . 2008-01-15 21:07 <DIR> d-------- C:\Program Files\Microsoft.NET
2008-01-15 19:09 . 2008-01-15 19:09 <DIR> d-------- C:\Program Files\uTorrent
2008-01-14 20:18 . 2008-01-14 20:18 268 --ah----- C:\sqmdata00.sqm
2008-01-14 20:18 . 2008-01-14 20:18 244 --ah----- C:\sqmnoopt00.sqm
2008-01-10 15:36 . 2008-01-10 15:36 <DIR> d-------- C:\WINDOWS\.jagex_cache_32
2008-01-10 15:27 . 2008-01-10 15:27 90,112 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx
2008-01-10 15:27 . 2008-01-10 15:27 57,344 --a------ C:\WINDOWS\system32\QuickTime.qts
2008-01-10 10:24 . 2008-01-24 12:04 376,779 --a------ C:\WINDOWS\setupapi.old
2008-01-06 16:23 . 2008-01-06 16:23 <DIR> d-------- C:\Program Files\Stunt Playground
2008-01-03 10:52 . 2008-01-03 10:52 <DIR> d-------- C:\Program Files\Xpand Rally Xtreme
2008-01-02 01:35 . 2008-01-02 01:36 <DIR> d-------- C:\Program Files\DVD Decrypter
2008-01-02 01:20 . 2008-01-02 01:20 <DIR> d-------- C:\Program Files\DVDx 2.4
2008-01-01 23:56 . 2008-01-01 23:56 <DIR> d-------- C:\ConverterOutput
2008-01-01 23:55 . 2007-03-25 00:51 3,049,984 --a------ C:\WINDOWS\system32\libavcodec.dll
2008-01-01 23:55 . 2007-03-25 21:40 2,174,976 --a------ C:\WINDOWS\system32\ffdshow.ax
2008-01-01 23:55 . 2007-03-25 00:51 404,480 --a------ C:\WINDOWS\system32\libmplayer.dll
2008-01-01 23:55 . 2007-01-01 05:30 200,704 --a------ C:\WINDOWS\system32\TomsMoComp_ff.dll
2008-01-01 23:55 . 2007-03-25 00:51 114,688 --a------ C:\WINDOWS\system32\libmpeg2_ff.dll
2008-01-01 23:55 . 2004-09-10 13:50 34,820 --a------ C:\WINDOWS\system32\ffdshow.reg
2008-01-01 23:37 . 2008-01-02 00:23 <DIR> d-------- C:\Program Files\SlySoft
2008-01-01 23:25 . 2005-11-21 16:18 45,056 --a------ C:\WINDOWS\system32\WNASPI32.DLL
2008-01-01 23:25 . 2005-11-21 16:18 16,512 --a------ C:\WINDOWS\system32\drivers\ASPI32.SYS
2007-12-30 18:28 . 2008-01-21 18:46 <DIR> d-------- C:\Program Files\Microsoft Games
2007-12-30 18:15 . 2007-12-30 18:16 <DIR> d-------- C:\Disk Images
2007-12-30 18:08 . 2007-12-30 18:08 <DIR> d-------- C:\Program Files\PowerISO
2007-12-29 11:15 . 2007-12-29 11:18 139,264 --a------ C:\WINDOWS\War3Unin.exe
2007-12-29 11:15 . 2007-12-29 11:18 54,864 --a------ C:\WINDOWS\War3Unin.dat
2007-12-29 11:15 . 2007-12-29 11:18 2,829 --a------ C:\WINDOWS\War3Unin.pif
2007-12-29 11:14 . 2007-12-31 14:01 <DIR> d-------- C:\Program Files\Warcraft III
2007-12-28 20:26 . 2007-12-28 20:26 <DIR> d-------- C:\Program Files\tribes
2007-12-28 20:26 . 2007-12-28 20:26 <DIR> d-------- C:\Program Files\Sierra On-Line
2007-12-28 20:25 . 2007-12-28 20:27 223 --a------ C:\WINDOWS\Sierra.ini
2007-12-28 17:40 . 2007-12-28 17:45 <DIR> d-------- C:\Program Files\Diablo II
2007-12-27 23:41 . 2007-12-27 23:41 <DIR> d-------- C:\WINDOWS\Downloaded Installations
2007-12-27 23:41 . 2007-12-28 11:12 <DIR> d-------- C:\Program Files\D-Tools
2007-12-27 23:41 . 2003-12-27 20:42 137,216 --a------ C:\WINDOWS\system32\drivers\d344bus.sys
2007-12-27 23:41 . 2003-12-27 02:38 5,248 --a------ C:\WINDOWS\system32\drivers\d344prt.sys
2007-12-27 23:33 . 2007-12-27 23:45 70,656 --a------ C:\WINDOWS\ScUnin.exe
2007-12-27 23:33 . 2007-12-27 23:45 32,845 --a------ C:\WINDOWS\scunin.dat
2007-12-27 23:33 . 2007-12-27 23:45 967 --a------ C:\WINDOWS\ScUnin.pif
2007-12-27 23:32 . 2007-12-30 21:36 <DIR> d-------- C:\Program Files\Starcraft
2007-12-27 11:28 . 2007-12-28 02:43 <DIR> d-------- C:\Program Files\Dawn of War
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-27 02:42 --------- d-----w C:\Program Files\iTunes
2008-01-27 02:42 --------- d-----w C:\Program Files\Download Manager
2008-01-26 10:36 --------- d-----w C:\Program Files\TrackMania Nations ESWC Special Edition
2008-01-24 10:24 --------- d-----w C:\Program Files\QuickTime
2008-01-22 09:59 --------- d-----w C:\Program Files\Realplayer
2008-01-22 09:59 --------- d-----w C:\Program Files\Common Files\Real
2008-01-16 09:18 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-15 08:48 --------- d-----w C:\Program Files\BitComet
2008-01-01 14:44 --------- d-----w C:\Program Files\DivX
2008-01-01 14:28 4,681,459,712 ----a-w C:\Program Files\THE_SIMPSONS_MOVIE_SE_F9.ISO
2007-12-30 07:49 --------- d-----w C:\Program Files\Common Files\InstallShield
2007-12-25 07:12 --------- d-----w C:\Program Files\Red Kawa
2007-12-25 07:12 --------- d-----w C:\Program Files\AviSynth 2.5
2007-12-25 01:51 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2007-12-25 01:50 669,184 ----a-w C:\WINDOWS\system32\pbsvc.exe
2007-12-25 01:50 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
2007-12-25 01:50 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2007-12-25 01:38 --------- d-----w C:\Program Files\Electronic Arts
2007-12-24 23:23 --------- d-----w C:\Program Files\Common Files\Apple
2007-12-24 23:23 --------- d-----w C:\Program Files\Apple Software Update
2007-12-24 11:01 --------- d-----w C:\Program Files\Dexster
2007-12-14 23:35 --------- d-----w C:\Program Files\Irrational Games
2007-12-11 07:46 4,681,469,952 ----a-w C:\Program Files\DISTURBIA_AUS.ISO
2007-12-11 06:53 --------- d-----w C:\Program Files\DVD Shrink
2007-12-11 06:40 --------- d-----w C:\Program Files\Common Files\Ahead
2007-12-11 06:40 --------- d-----w C:\Program Files\Ahead
2007-12-07 09:56 --------- d-----w C:\Program Files\Skype
2007-12-07 09:56 --------- d-----w C:\Program Files\Common Files\Skype
2007-12-06 07:23 --------- d-----w C:\Program Files\NHN USA
2007-12-06 07:18 --------- d-----w C:\Program Files\Gunz
2007-12-04 01:33 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2007-12-04 01:33 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2007-12-04 01:33 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2007-12-04 01:33 682,496 ----a-w C:\WINDOWS\system32\DivX.dll
2007-11-29 22:30 9,464 ----a-w C:\WINDOWS\system32\drivers\cdralw2k.sys
2007-11-29 22:30 9,336 ----a-w C:\WINDOWS\system32\drivers\cdr4_xp.sys
2007-11-29 22:30 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2007-11-29 22:30 43,528 ----a-w C:\WINDOWS\system32\drivers\PxHelp20.sys
2007-11-29 22:30 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2007-11-29 22:30 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2007-11-29 22:30 129,784 ----a-w C:\WINDOWS\system32\pxafs.dll
2007-11-29 22:30 120,056 ----a-w C:\WINDOWS\system32\pxcpyi64.exe
2007-11-29 22:30 118,520 ----a-w C:\WINDOWS\system32\pxinsi64.exe
2007-11-29 22:30 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2007-11-29 22:28 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2007-11-29 22:28 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
2007-11-28 21:55 156,992 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2007-11-28 21:53 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
2007-11-28 21:53 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
2007-11-28 21:53 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
2007-11-28 21:53 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
2007-11-28 21:53 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
2007-11-28 21:53 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
2007-11-28 21:52 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2007-11-11 21:33 356,352 ----a-w C:\WINDOWS\system32\NVUNINST.EXE
2007-11-11 20:21 757,760 ----a-w C:\WINDOWS\system32\nvcplui.exe
2007-11-11 20:21 356,352 ----a-w C:\WINDOWS\system32\nvudisp.exe
2007-11-11 20:21 307,200 ----a-w C:\WINDOWS\system32\nvexpbar.dll
2007-11-11 20:21 1,089,536 ----a-w C:\WINDOWS\system32\nvcuda.dll
2007-11-10 03:32 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
.
[code]
----a-w           213,936 2008-01-24 07:55:24  C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM                    .exe
----a-w           385,024 2008-01-24 07:55:29  C:\Program Files\QuickTime\QTTask                       .exe
[/code]

((((((((((((((((((((((((((((( snapshot@2008-01-27_11.50.55.32 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-01-27 01:16:01 225,280 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000001\NTUSER.DAT
+ 2008-01-27 02:41:52 225,280 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000001\NTUSER.DAT
- 2008-01-27 01:16:01 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000002\UsrClass.dat
+ 2008-01-27 02:41:52 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000002\UsrClass.dat
- 2008-01-27 01:16:02 229,376 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000003\NTUSER.DAT
+ 2008-01-27 02:41:52 229,376 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000003\NTUSER.DAT
- 2008-01-27 01:16:02 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000004\UsrClass.dat
+ 2008-01-27 02:41:52 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000004\UsrClass.dat
- 2008-01-27 01:16:02 6,365,184 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000005\ntuser.dat
+ 2008-01-27 02:41:52 6,365,184 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000005\ntuser.dat
- 2008-01-27 01:16:02 290,816 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000006\UsrClass.dat
+ 2008-01-27 02:41:53 290,816 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000006\UsrClass.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-01-24 18:25 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-09-17 01:07 8491008]
"nwiz"="nwiz.exe" [2007-09-17 01:07 1626112 C:\WINDOWS\system32\nwiz.exe]
"WinFast2KLoadDefault"="C:\WINDOWS\system32\wf2kcpl.dll" [2005-09-16 15:35 616448]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask .exe" [2008-01-24 18:25 385024]
"SoundMan"="SOUNDMAN.EXE" [2004-02-13 19:27 62464 C:\WINDOWS\SOUNDMAN.EXE]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-09-17 01:07 81920]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-01-24 18:25 267048]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-01-24 18:25 15360]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-01-23 11:09 219136]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM]
--a------ 2008-01-24 18:25 213936 C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM .exe
R0 d344bus;d344bus;C:\WINDOWS\system32\DRIVERS\d344bus.sys [2003-12-27 20:42]
R0 d344prt;d344prt;C:\WINDOWS\system32\Drivers\d344prt.sys [2003-12-27 02:38]
R2 avGuard;avGuard Service;C:\Program Files\Ashampoo\Ashampoo AntiVirus\ashAvSrv.exe [2007-06-14 11:44]
R3 AshAvScan;AshAvScan;C:\WINDOWS\system32\DRIVERS\AshAvScan.sys [2007-03-02 11:04]
R4 WINFOXIO;WINFOXIO;C:\WINDOWS\system32\Drivers\WINFOXIO.SYS [2005-03-25 19:24]
S3 XDva032;XDva032;C:\WINDOWS\system32\XDva032.sys []
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
\Shell\AutoRun\command - D:\setup.exe
\Shell\directx\command - D:\DirectX\dxsetup.exe
\Shell\setup\command - D:\setup.exe
.
Contents of the 'Scheduled Tasks' folder
"2008-01-17 05:09:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-27 13:13:56
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-01-27 13:14:24
ComboFix-quarantined-files.txt 2008-01-27 02:44:22
ComboFix2.txt 2008-01-27 01:21:10
.
2008-01-27 00:29:55 --- E O F ---
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
HijackThis Log
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:48:34 PM, on 2008-01-27
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\QuickTime\QTTask .exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Ashampoo\Ashampoo AntiVirus\ashAvSrv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ashampoo\Ashampoo AntiVirus\GuardGui.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Mickey\My Documents\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [WinFast2KLoadDefault] rundll32.exe C:\WINDOWS\system32\wf2kcpl.dll,DllLoadDefaultSettings
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask .exe" -atboottime
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?lin...
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (CDownloadCtrl Object) - http://www.fileplanet.com/fpdlmgr/c...
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.co...
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: avGuard Service (avGuard) - Unknown owner - C:\Program Files\Ashampoo\Ashampoo AntiVirus\ashAvSrv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
--
End of file - 4721 bytes
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
I will post the results of the 2 files shortly

Report Offensive Follow Up For Removal

Response Number 13

Name: jabuck
Date: January 26, 2008 at 20:23:10 Pacific
Subject: POS.tmp files, slow computer HELP!

Reply: (edit)

I made an error on the location of the second file. It is at this location:
C:\WINDOWS\webdial.ini

Report Offensive Follow Up For Removal

Response Number 14

Name: InsanityPrawn
Date: January 26, 2008 at 22:47:59 Pacific
Subject: POS.tmp files, slow computer HELP!

Reply: (edit)

bbajuncs.ini results
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
File bbajuncs.ini received on 01.27.2008 04:48:49 (CET)
Antivirus Version Last Update Result
AhnLab-V3 2008.1.26.10 2008.01.25 -
AntiVir 7.6.0.53 2008.01.25 -
Authentium 4.93.8 2008.01.26 -
Avast 4.7.1098.0 2008.01.26 -
AVG 7.5.0.516 2008.01.26 -
BitDefender 7.2 2008.01.27 -
CAT-QuickHeal 9.00 2008.01.25 -
ClamAV 0.91.2 2008.01.27 -
DrWeb 4.44.0.09170 2008.01.26 -
eSafe 7.0.15.0 2008.01.16 -
eTrust-Vet 31.3.5486 2008.01.26 -
Ewido 4.0 2008.01.26 -
FileAdvisor 1 2008.01.27 -
Fortinet 3.14.0.0 2008.01.26 -
F-Prot 4.4.2.54 2008.01.26 -
F-Secure 6.70.13260.0 2008.01.26 -
Ikarus T3.1.1.20 2008.01.27 -
Kaspersky 7.0.0.125 2008.01.27 -
McAfee 5216 2008.01.26 -
Microsoft 1.3109 2008.01.27 -
NOD32v2 2824 2008.01.26 -
Norman 5.80.02 2008.01.24 -
Panda 9.0.0.4 2008.01.26 -
Prevx1 V2 2008.01.27 -
Rising 20.28.52.00 2008.01.26 -
Sophos 4.25.0 2008.01.26 -
Sunbelt 2.2.907.0 2008.01.25 -
Symantec 10 2008.01.27 -
TheHacker 6.2.9.199 2008.01.26 -
VBA32 3.12.2.5 2008.01.21 -
VirusBuster 4.3.26:9 2008.01.26 -
Webwasher-Gateway 6.6.2 2008.01.27 -
Additional information
File size: 475 bytes
MD5: 89166a130ed963df6d098700431ffad5
SHA1: 6dcf355fe2731f19a82fda16729c0a74f7476c54
PEiD: -
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
this is what appeared when i tried to upload the other file
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
0 bytes size received / Se ha recibido un archivo vacio
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

Report Offensive Follow Up For Removal

Response Number 15

Name: InsanityPrawn
Date: January 26, 2008 at 22:50:25 Pacific
Subject: POS.tmp files, slow computer HELP!

Reply: (edit)

oh ok, i'll do that second file. thats why it stuffed up.

Report Offensive Follow Up For Removal

Response Number 16

Name: InsanityPrawn
Date: January 26, 2008 at 23:29:49 Pacific
Subject: POS.tmp files, slow computer HELP!

Reply: (edit)

webdial.ini results
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
File webdial.ini received on 01.27.2008 07:51:03 (CET)
Antivirus Version Last Update Result
AhnLab-V3 2008.1.26.10 2008.01.25 -
AntiVir 7.6.0.53 2008.01.25 -
Authentium 4.93.8 2008.01.26 -
Avast 4.7.1098.0 2008.01.27 -
AVG 7.5.0.516 2008.01.26 -
BitDefender 7.2 2008.01.27 -
CAT-QuickHeal 9.00 2008.01.25 -
ClamAV 0.91.2 2008.01.27 -
DrWeb 4.44.0.09170 2008.01.26 -
eSafe 7.0.15.0 2008.01.16 -
eTrust-Vet 31.3.5486 2008.01.26 -
Ewido 4.0 2008.01.26 -
FileAdvisor 1 2008.01.27 -
Fortinet 3.14.0.0 2008.01.26 -
F-Prot 4.4.2.54 2008.01.26 -
F-Secure 6.70.13260.0 2008.01.26 -
Ikarus T3.1.1.20 2008.01.27 -
Kaspersky 7.0.0.125 2008.01.27 -
McAfee 5216 2008.01.26 -
Microsoft 1.3109 2008.01.27 -
NOD32v2 2824 2008.01.26 -
Norman 5.80.02 2008.01.24 -
Panda 9.0.0.4 2008.01.26 -
Prevx1 V2 2008.01.27 -
Rising 20.28.60.00 2008.01.27 -
Sophos 4.25.0 2008.01.27 -
Sunbelt 2.2.907.0 2008.01.25 -
Symantec 10 2008.01.27 -
TheHacker 6.2.9.199 2008.01.26 -
VBA32 3.12.2.5 2008.01.21 -
VirusBuster 4.3.26:9 2008.01.26 -
Webwasher-Gateway 6.6.2 2008.01.27 -
Additional information
File size: 54 bytes
MD5: 643917b5019c999de670106d71ea9ce0
SHA1: 743e9dedf6c1bba017f55ea4e48fd62751efc5b1
PEiD: -
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

Report Offensive Follow Up For Removal

Response Number 17

Name: jabuck
Date: January 27, 2008 at 06:20:41 Pacific
Subject: POS.tmp files, slow computer HELP!

Reply: (edit)

Empty the restore folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok.
Download ATF Cleaner from this link:
ATF Cleaner

Run ATF-Cleaner
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
Please run the BitDefender online scan this link:
Bitdefender Online Scanner

You will need to allow an active x install for the scan to run.
Leave the scanning options at default and press "click here to scan"
When finished scanning, click on "click here to export the scan report"
Save it to your desktop, at "file name" type in "bdscan" then click save.
Post a log in your reply.

Report Offensive Follow Up For Removal

Response Number 18

Name: jabuck
Date: January 27, 2008 at 08:06:23 Pacific
Subject: POS.tmp files, slow computer HELP!

Reply: (edit)

I think I see the virus but lets see if this scanner will remove.
Please run the BitDefender online scan this link:
Bitdefender Online Scanner

You will need to allow an active x install for the scan to run.
Leave the scanning options at default and press "click here to scan"
When finished scanning, click on "click here to export the scan report"
Save it to your desktop, at "file name" type in "bdscan" then click save.
Post a log in your reply.

Report Offensive Follow Up For Removal

Response Number 19

Name: jabuck
Date: January 27, 2008 at 08:16:43 Pacific
Subject: POS.tmp files, slow computer HELP!

Reply: (edit)

Response #18 was not intended for you, please disregard it.

Report Offensive Follow Up For Removal

Response Number 20

Name: InsanityPrawn
Date: January 27, 2008 at 17:31:44 Pacific
Subject: POS.tmp files, slow computer HELP!

Reply: (edit)

BitDefender Online Scanner

Scan report generated at: Mon, Jan 28, 2008 - 10:46:08

Scan path: C:\;D:\;E:\;F:\;G:\;

Statistics
Time

01:21:18
Files

349077
Folders

8085
Boot Sectors

2
Archives

1653
Packed Files

9332

Results
Identified Viruses

2
Infected Files

2
Suspect Files

0
Warnings

0
Disinfected

0
Deleted Files

2

Engines Info
Virus Definitions

977562
Engine build

AVCORE v1.0 (build 2422) (i386) (Sep 25 2007 08:26:36)
Scan plugins

16
Archive plugins

41
Unpack plugins

7
E-mail plugins

6
System plugins

5

Scan Settings
First Action

Disinfect
Second Action

Delete
Heuristics

Yes
Enable Warnings

Yes
Scanned Extensions

*;
Exclude Extensions

Scan Emails

Yes
Scan Archives

Yes
Scan Packed

Yes
Scan Files

Yes
Scan Boot

Yes

Scanned File

Status
C:\$VAULT$.AVG\01349953.FIL

Infected with: Trojan.Vundo.DVC
C:\$VAULT$.AVG\01349953.FIL

Disinfection failed
C:\$VAULT$.AVG\01349953.FIL

Deleted
C:\$VAULT$.AVG\09007531.FIL

Infected with: Trojan.Vundo.DVO
C:\$VAULT$.AVG\09007531.FIL

Disinfection failed
C:\$VAULT$.AVG\09007531.FIL

Deleted

Report Offensive Follow Up For Removal

Response Number 21

Name: jabuck
Date: January 27, 2008 at 17:53:08 Pacific
Subject: POS.tmp files, slow computer HELP!

Reply: (edit)

This should fix the red X.
Go to start> run> type in notepad > ok. Copy paste the following into notepad making [autorun] the very top line:
[autorun]
ICON=C:\WINDOWS\SYSTEM\SHELL32.DLL,8
Click "save as"> then using the drop down arrow on the far right of the "save in" window select Local Disk C: to be displayed in the "save in" window.
Next type "C:\autorun.inf" (you must use the quotes) in the file name window> click save.
Restart the computer.
How is the computer operating?

Report Offensive Follow Up For Removal

Response Number 22

Name: InsanityPrawn
Date: January 27, 2008 at 19:03:17 Pacific
Subject: POS.tmp files, slow computer HELP!

Reply: (edit)

my computer is running fine.

Report Offensive Follow Up For Removal

Response Number 23

Name: jabuck
Date: January 27, 2008 at 19:10:45 Pacific
Subject: POS.tmp files, slow computer HELP!

Reply: (edit)

You should consider adding "Spywareblaster" to your arsenol of antispyware tools, you can download it from this link Spywareblaster
Just download it,install it, and update it. Its free and runs in the background, so you don't actually run it, and re-writes malicious script before it can install on your computer. Look for updates weekly as there is no auto-update on the free version.
Glad we could help.

Report Offensive Follow Up For Removal

Response Number 24

Name: InsanityPrawn
Date: January 27, 2008 at 19:54:25 Pacific
Subject: POS.tmp files, slow computer HELP!

Reply: (edit)

ok, cheers. thanks for the help

Report Offensive Follow Up For Removal