registry key virus

dell inspiron 2650
September 21, 2006 at 16:30:16
Specs: xp pro, pent 4 512
i have a registry key that is picked up by most of my anyispyware programs, noadware and xoft spy pick it up. xoft spy says that its called ultimate defender, i've deleted this registry key many times but it keeps coming back, can someone help me get rid of it?


See More: registry key virus

Report •


#1
September 21, 2006 at 16:37:45
are you using the paid or trial versions of those softwares. If it's the trials, they are probably false positives to get you to buy their product.

Hopefully my advice will help you...Please post back with your results....thanks


Report •

#2
September 21, 2006 at 16:49:08
... moving right along

Appears to be more than just a single registry entry - here's the list

Seems to be a commercial product, and not one you'd want

Diplomacy is the art of saying 'Nice doggie!'... till you can find a rock


Report •

#3
September 21, 2006 at 17:12:41
Go to start> control panel> scroll down to and uninstall these programs if found as they are known rogue antispyware of the same family :ultimate defender

1stAntiVirus

KillSpy

SpyDeface

SpyContra

XSRemover

Next for some clean-up

Please download ATF-Cleaner to your desktop from this link
http://www.atribune.org/content/view/19/2/ We will need it later in safe mode

Download and install Ewido Security Suite We will need this later in safe mode

Be sure to update Ewido

Next, please reboot your computer in Safe Mode by doing the following :

Restart your computer

After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;

Instead of Windows loading as normal, a menu with options should appear;

Select the first option, to run Windows in Safe Mode, then press "Enter".

Choose your usual account.

Run ATF-Cleaner from safe mode.Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

In Safe Mode, run Ewido and click on the Scanner tab at the top. Click the "Settings" tab and then change the recommended action to Quarantine and click Automatically generate report after every scan. Click back to the "Scan" tab and then click on Complete System Scan. This scan can take quite a while to run, so be prepared.

Ewido will list any infections found on the left hand side. When the scan has finished, it will automatically set the recommended action. Click the Apply all actions button. Ewido will display "All actions have been applied" on the right hand side.

Click on "Save Report", then "Save Report As". This will create a text file. Make sure you know where to find this file again (like on the Desktop).

Post the Ewido report please.



Report •

Related Solutions

#4
September 21, 2006 at 21:38:02
i've done the scan in safe mode and saved the report, here it is


ewido anti-spyware - Scan Report


+ Created at: 11:31:46 PM 9/21/2006

+ Scan result:

C:\WINDOWS\system32\ixt2.dll -> Downloader.Zlob.all : No action taken.
C:\WINDOWS\system32\ixt3.dll -> Downloader.Zlob.all : No action taken.
C:\WINDOWS\system32\ixt4.dll -> Downloader.Zlob.all : No action taken.
C:\WINDOWS\system32\ixt5.dll -> Downloader.Zlob.all : No action taken.
C:\WINDOWS\system32\ixt6.dll -> Downloader.Zlob.all : No action taken.
:mozilla.83:C:\Documents and Settings\Daniel\Application Data\Mozilla\Firefox\Profiles\sy6rvf2k.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
:mozilla.52:C:\Documents and Settings\Daniel\Application Data\Mozilla\Firefox\Profiles\sy6rvf2k.default\cookies.txt -> TrackingCookie.Adbrite : No action taken.
:mozilla.53:C:\Documents and Settings\Daniel\Application Data\Mozilla\Firefox\Profiles\sy6rvf2k.default\cookies.txt -> TrackingCookie.Adbrite : No action taken.
:mozilla.51:C:\Documents and Settings\Daniel\Application Data\Mozilla\Firefox\Profiles\sy6rvf2k.default\cookies.txt -> TrackingCookie.Atdmt : No action taken.
:mozilla.54:C:\Documents and Settings\Daniel\Application Data\Mozilla\Firefox\Profiles\sy6rvf2k.default\cookies.txt -> TrackingCookie.Burstnet : No action taken.
:mozilla.56:C:\Documents and Settings\Daniel\Application Data\Mozilla\Firefox\Profiles\sy6rvf2k.default\cookies.txt -> TrackingCookie.Burstnet : No action taken.
:mozilla.59:C:\Documents and Settings\Daniel\Application Data\Mozilla\Firefox\Profiles\sy6rvf2k.default\cookies.txt -> TrackingCookie.Burstnet : No action taken.
:mozilla.27:C:\Documents and Settings\Daniel\Application Data\Mozilla\Firefox\Profiles\sy6rvf2k.default\cookies.txt -> TrackingCookie.Com : No action taken.
:mozilla.15:C:\Documents and Settings\Daniel\Application Data\Mozilla\Firefox\Profiles\sy6rvf2k.default\cookies.txt -> TrackingCookie.Doubleclick : No action taken.
:mozilla.38:C:\Documents and Settings\Daniel\Application Data\Mozilla\Firefox\Profiles\sy6rvf2k.default\cookies.txt -> TrackingCookie.Fastclick : No action taken.
:mozilla.39:C:\Documents and Settings\Daniel\Application Data\Mozilla\Firefox\Profiles\sy6rvf2k.default\cookies.txt -> TrackingCookie.Fastclick : No action taken.
:mozilla.40:C:\Documents and Settings\Daniel\Application Data\Mozilla\Firefox\Profiles\sy6rvf2k.default\cookies.txt -> TrackingCookie.Fastclick : No action taken.
:mozilla.41:C:\Documents and Settings\Daniel\Application Data\Mozilla\Firefox\Profiles\sy6rvf2k.default\cookies.txt -> TrackingCookie.Fastclick : No action taken.
:mozilla.44:C:\Documents and Settings\Daniel\Application Data\Mozilla\Firefox\Profiles\sy6rvf2k.default\cookies.txt -> TrackingCookie.Fastclick : No action taken.
:mozilla.45:C:\Documents and Settings\Daniel\Application Data\Mozilla\Firefox\Profiles\sy6rvf2k.default\cookies.txt -> TrackingCookie.Fastclick : No action taken.
:mozilla.20:C:\Documents and Settings\Daniel\Application Data\Mozilla\Firefox\Profiles\sy6rvf2k.default\cookies.txt -> TrackingCookie.Mediaplex : No action taken.
:mozilla.114:C:\Documents and Settings\Daniel\Application Data\Mozilla\Firefox\Profiles\sy6rvf2k.default\cookies.txt -> TrackingCookie.Reliablestats : No action taken.
:mozilla.115:C:\Documents and Settings\Daniel\Application Data\Mozilla\Firefox\Profiles\sy6rvf2k.default\cookies.txt -> TrackingCookie.Reliablestats : No action taken.
:mozilla.117:C:\Documents and Settings\Daniel\Application Data\Mozilla\Firefox\Profiles\sy6rvf2k.default\cookies.txt -> TrackingCookie.Reliablestats : No action taken.
:mozilla.118:C:\Documents and Settings\Daniel\Application Data\Mozilla\Firefox\Profiles\sy6rvf2k.default\cookies.txt -> TrackingCookie.Reliablestats : No action taken.
:mozilla.119:C:\Documents and Settings\Daniel\Application Data\Mozilla\Firefox\Profiles\sy6rvf2k.default\cookies.txt -> TrackingCookie.Reliablestats : No action taken.
:mozilla.16:C:\Documents and Settings\Daniel\Application Data\Mozilla\Firefox\Profiles\sy6rvf2k.default\cookies.txt -> TrackingCookie.Tribalfusion : No action taken.
:mozilla.17:C:\Documents and Settings\Daniel\Application Data\Mozilla\Firefox\Profiles\sy6rvf2k.default\cookies.txt -> TrackingCookie.Tribalfusion : No action taken.
:mozilla.18:C:\Documents and Settings\Daniel\Application Data\Mozilla\Firefox\Profiles\sy6rvf2k.default\cookies.txt -> TrackingCookie.Tribalfusion : No action taken.
:mozilla.55:C:\Documents and Settings\Daniel\Application Data\Mozilla\Firefox\Profiles\sy6rvf2k.default\cookies.txt -> TrackingCookie.Yieldmanager : No action taken.
:mozilla.57:C:\Documents and Settings\Daniel\Application Data\Mozilla\Firefox\Profiles\sy6rvf2k.default\cookies.txt -> TrackingCookie.Yieldmanager : No action taken.
:mozilla.58:C:\Documents and Settings\Daniel\Application Data\Mozilla\Firefox\Profiles\sy6rvf2k.default\cookies.txt -> TrackingCookie.Yieldmanager : No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run\\kernel32.dll -> Trojan.Small : No action taken.
HKU\S-1-5-21-2052111302-436374069-1957994488-1003\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\\kernel32.dll -> Trojan.Small : No action taken.


::Report end

also i've been having troubles with safe mode just recently. whenever i start it in safe mode, explorer.exe doesn't start up with the rest of the processes so my desktop doesn't appear. when i start it using the new task, the desktop only stays for a few seconds then dissapears again. can anyone help with this?


Report •

#5
September 22, 2006 at 03:50:47
You do have more problems other than ultimate defender.

Please download HJTsetup.exe from this link http://www.thespykiller.co.uk/files/HJTsetup.exe to your desktop.
Doubleclick on the HJTsetup.exe icon on your desktop.
By default it will install to C:\Program Files\Hijack This.
Continue to click "next" in the setup dialogue boxes until you get to the "Select Addition Tasks" dialogue.
Put a check by "Create a desktop icon" then click "Next" again.
Continue to follow the rest of the prompts from there.
At the final dialogue box click "Finish" and it will launch Hijack This.
Click on the "Do a system scan and save a logfile" button. It will scan and the log should open in notepad.
Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log and post it in this thread.

Do not fix anything yet unless you know what you are doing. This is a powerful tool that can crash the computer if used improperly.

Please download ATF-Cleaner to your desktop from this link
http://www.atribune.org/content/view/19/2/ We will need it later in safe mode

Download and install Ewido Security Suite We will need this later in safe mode

Be sure to update Ewido Please download SmitRemFix from this link http://siri.urz.free.fr/Fix/SmitfraudFix.zip Then extract the contents to your desktop.

Open the "SmitfraudFix" folder and double-click "smitfraudfix.cmd"
Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present).
Please copy/paste the content of that report into your next reply.

Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.

Do not run any other options in smitrem as they will damage your desktop if run on an uninfected computer.

Please post the Hijack This log and the SmitRem report.



Report •

#6
September 22, 2006 at 04:21:10
here is the hijack this log

Logfile of HijackThis v1.99.1
Scan saved at 6:16:10 AM, on 9/22/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~2\VPTray.exe
C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DVD X Studios\DVD X Utilities V2.1.1\DVDGhost\DVDGhost.EXE
C:\PROGRA~1\Ahead\NEROPH~1\data\Xtras\mssysmgr.exe
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
C:\Program Files\Belkin\Belkin 802.11g Wireless Card Configuration Utility\utility.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Hijackthis\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = dynhost.inetcam.com;register.inetcam.com;localhost
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O4 - HKLM\..\Run: [YBrowser] C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\Program Files\SBC Yahoo!\Connection Manager\IP InSight\IPMon32.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~2\VPTray.exe
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DVDXGhost] C:\Program Files\DVD X Studios\DVD X Utilities V2.1.1\DVDGhost\DVDGhost.EXE
O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] C:\PROGRA~1\Ahead\NEROPH~1\data\Xtras\mssysmgr.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Belkin 802.11g Wireless Card Utility.lnk = ?
O4 - Global Startup: Logitech Desktop Messenger Agent.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?lin...
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binar...
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo.com/ocx/us/yexp...
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE


and here is the smitfraud report

SmitFraudFix v2.97

Scan done at 6:18:19.25, Fri 09/22/2006
Run from C:\Documents and Settings\Daniel\Desktop\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
Fix ran in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

C:\WINDOWS\system32\ismini.exe FOUND !
C:\WINDOWS\system32\ixt?.dll FOUND !
C:\WINDOWS\system32\ixt??.dll FOUND !
C:\WINDOWS\system32\components\flx?.dll FOUND !
C:\WINDOWS\system32\components\flx??.dll FOUND !
C:\WINDOWS\system32\components\flx???.dll FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Daniel\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Start Menu


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Daniel\FAVORI~1


»»»»»»»»»»»»»»»»»»»»»»»» Desktop


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""


»»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32


»»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection


»»»»»»»»»»»»»»»»»»»»»»»» End



Report •

#7
September 22, 2006 at 14:47:11
Temporarily disable any of the following anti-spyware realtime protection programs that you may have of the fix will not work Temporarily Disable Realtime Protection

Next, please reboot your computer in Safe Mode by doing the following :

Restart your computer

After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;

Instead of Windows loading as normal, a menu with options should appear;

Select the first option, to run Windows in Safe Mode, then press "Enter".

Choose your usual account.

Run Hijack This from safe mode, close all windows except Hijack This, place a check to the left of the following items and press "fix checked":

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = dynhost.inetcam.com;register.inetcam.com;localhost

O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll

Exit Hijack This but remain in safe mode

Run ATF-Cleaner from safe mode.Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

From Safe Mode, open the "SmitfraudFix" folder again and double-click "smitfraudfix.cmd"
Select option #2 - Clean by typing 2 and press "Enter" to delete infected files.

You will be prompted : "Registry cleaning - Do you want to clean the registry ?"; answer "Yes" by typing " Y " and press "Enter" in order to remove the Desktop background and clean registry keys associated with the infection.

The tool will now check if "wininet.dll " is infected. You may be prompted to replace the infected file (if found); answer "Yes" by typing "Y" and press "Enter".

The tool may need to restart your computer to finish the cleaning process; if it doesn't, please restart it into Normal Windows.

A text file will appear onscreen, with results from the cleaning process; please copy/paste the content of that report into your next reply.
The report can also be found at the root of the system drive, usually at C:\rapport.txt

Reboot into normal mode.

Empty the restore folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok.

Reboot into safe mode

In Safe Mode, run Ewido and click on the Scanner tab at the top. Click the "Settings" tab and then change the recommended action to Quarantine and click Automatically generate report after every scan. Click back to the "Scan" tab and then click on Complete System Scan. This scan can take quite a while to run, so be prepared.

Ewido will list any infections found on the left hand side. When the scan has finished, it will automatically set the recommended action. Click the Apply all actions button. Ewido will display "All actions have been applied" on the right hand side.

Click on "Save Report", then "Save Report As". This will create a text file. Make sure you know where to find this file again (like on the Desktop). Then post the ewido scan please.


Report •

#8
September 22, 2006 at 17:13:12
here is the report from smitfraud

SmitFraudFix v2.97

Scan done at 17:51:38.92, Fri 09/22/2006
Run from C:\Documents and Settings\Daniel\Desktop\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
Fix ran in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

C:\WINDOWS\system32\ismini.exe Deleted
C:\WINDOWS\system32\ixt?.dll Deleted
C:\WINDOWS\system32\components\flx?.dll Deleted

»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» End

here is the one from ewido


ewido anti-spyware - Scan Report


+ Created at: 7:10:49 PM 9/22/2006

+ Scan result:

:mozilla.24:C:\Documents and Settings\Daniel\Application Data\Mozilla\Firefox\Profiles\sy6rvf2k.default\cookies.txt -> TrackingCookie.Adbrite : No action taken.
:mozilla.25:C:\Documents and Settings\Daniel\Application Data\Mozilla\Firefox\Profiles\sy6rvf2k.default\cookies.txt -> TrackingCookie.Adbrite : No action taken.
:mozilla.26:C:\Documents and Settings\Daniel\Application Data\Mozilla\Firefox\Profiles\sy6rvf2k.default\cookies.txt -> TrackingCookie.Doubleclick : No action taken.
:mozilla.23:C:\Documents and Settings\Daniel\Application Data\Mozilla\Firefox\Profiles\sy6rvf2k.default\cookies.txt -> TrackingCookie.Mediaplex : No action taken.
:mozilla.31:C:\Documents and Settings\Daniel\Application Data\Mozilla\Firefox\Profiles\sy6rvf2k.default\cookies.txt -> TrackingCookie.Reliablestats : No action taken.
:mozilla.32:C:\Documents and Settings\Daniel\Application Data\Mozilla\Firefox\Profiles\sy6rvf2k.default\cookies.txt -> TrackingCookie.Reliablestats : No action taken.
:mozilla.33:C:\Documents and Settings\Daniel\Application Data\Mozilla\Firefox\Profiles\sy6rvf2k.default\cookies.txt -> TrackingCookie.Reliablestats : No action taken.
:mozilla.35:C:\Documents and Settings\Daniel\Application Data\Mozilla\Firefox\Profiles\sy6rvf2k.default\cookies.txt -> TrackingCookie.Reliablestats : No action taken.
:mozilla.37:C:\Documents and Settings\Daniel\Application Data\Mozilla\Firefox\Profiles\sy6rvf2k.default\cookies.txt -> TrackingCookie.Reliablestats : No action taken.
:mozilla.27:C:\Documents and Settings\Daniel\Application Data\Mozilla\Firefox\Profiles\sy6rvf2k.default\cookies.txt -> TrackingCookie.Tribalfusion : No action taken.
:mozilla.28:C:\Documents and Settings\Daniel\Application Data\Mozilla\Firefox\Profiles\sy6rvf2k.default\cookies.txt -> TrackingCookie.Tribalfusion : No action taken.
:mozilla.29:C:\Documents and Settings\Daniel\Application Data\Mozilla\Firefox\Profiles\sy6rvf2k.default\cookies.txt -> TrackingCookie.Tribalfusion : No action taken.
:mozilla.30:C:\Documents and Settings\Daniel\Application Data\Mozilla\Firefox\Profiles\sy6rvf2k.default\cookies.txt -> TrackingCookie.Tribalfusion : No action taken.


::Report end



Report •

#9
September 22, 2006 at 20:25:25

Open notepad (Start Menu > Run > Type notepad and press "ok".

Copy and paste everything into notepad between the x's making regedit4 the top line.
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
REGEDIT4

[-HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run]

[HKU\S-1-5-21-2052111302-436374069-1957994488-1003\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]"kernel32.dll"=-


XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

Goto File on the top bar and choose Save As, Change the Save As Type to All Files, Name it Fix.reg then save it to your desktop.

Double click Fix.reg (or right click and choose Merge) and it will ask if you want to merge the contents into the registry, choose Yes and the reg entry should be removed.

Then let us know how you are running.


Report •

#10
September 23, 2006 at 01:57:03
everything seems to be working alright, i just had a internet explorer pop up for mysafetrip.com and winantiviruspro2006 just opened up in a new tab on my browser

Report •

#11
September 23, 2006 at 04:26:16
That is not good.

Please download ComboFix to the Desktop from this link:

http://download.bleepingcomputer.com/sUBs/combofix.exe

Double-click combofix.exe
Follow the prompts.
(Don't click on the window while the program is running, it may cause your system to hang.)

Please post the combofix.txt log


Report •

#12
September 23, 2006 at 07:35:36
here is the log

Daniel - 06-09-23 9:29:51.02 Service Pack 2
ComboFix 06.09.23.2 - Running from: "C:\Documents and Settings\Daniel\Desktop"

(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\WINDOWS\system32\components

~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

Folders Quarantined:

C:\QooBox\Purity\Documents and Settings\Daniel\Application Data\PPPATC~1
C:\QooBox\Purity\Documents and Settings\Daniel\Application Data\PPPATC~1\?ppPatch
C:\QooBox\Purity\Program Files\Common Files\ICROSO~1


((((((((((((((((((((((((((((((( Files Created from 2006-08-23 to 2006-09-23 ))))))))))))))))))))))))))))))))))

2006-09-22 17:51 53,248 --a------ C:\WINDOWS\system32\Process.exe
2006-09-22 17:51 40,960 --a------ C:\WINDOWS\system32\swsc.exe
2006-09-22 17:51 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2006-09-22 17:51 135,168 --a------ C:\WINDOWS\system32\swreg.exe
2006-09-19 22:58 94,208 --a------ C:\WINDOWS\system32\uhvjsul.dll
2006-09-14 19:06 838,965 ---hs---- C:\WINDOWS\system32\ttvyb.ini2
2006-09-13 17:09 915,004 ---hs---- C:\WINDOWS\system32\ttvyb.bak2
2006-09-12 17:07 930,015 --ahs---- C:\WINDOWS\system32\ttvyb.bak1
2006-09-12 17:07 577,588 --ahs---- C:\WINDOWS\system32\byvtt.dll
2006-09-09 10:53 421,888 C:\WINDOWSNero PhotoShow.scr
2006-09-09 10:53 38,912 --a------ C:\WINDOWS\system32\picn20.dll
2006-09-09 10:53 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll
2006-08-31 18:35 130,048 --a------ C:\WINDOWS\system32\SpoonUninstall.exe
2006-08-27 18:37 81,920 --a------ C:\WINDOWS\system32\DLLCPY32.dll
2006-08-27 18:37 65,536 --a------ C:\WINDOWS\system32\DLLPTL32.dll
2006-08-27 18:37 61,440 --a------ C:\WINDOWS\system32\DLLCDF32.dll
2006-08-27 18:37 57,344 --a------ C:\WINDOWS\system32\DLLTPO32.dll
2006-08-27 18:37 53,248 --a------ C:\WINDOWS\system32\DLLPRJ32.dll
2006-08-27 18:37 49,152 --a------ C:\WINDOWS\system32\DLLPRF32.dll
2006-08-27 18:37 49,152 --a------ C:\WINDOWS\system32\DLLIO32.dll
2006-08-27 18:37 45,056 --a------ C:\WINDOWS\system32\DLLIMG32.dll
2006-08-27 18:37 44,544 --a------ C:\WINDOWS\system32\msxml4a.dll
2006-08-27 18:37 401,408 --a------ C:\WINDOWS\system32\DLLAV32.dll
2006-08-27 18:37 40,960 --a------ C:\WINDOWS\system32\DLLRD32.dll
2006-08-27 18:37 36,864 --a------ C:\WINDOWS\system32\DLLPNT32.dll
2006-08-27 18:37 32,768 --a------ C:\WINDOWS\system32\STRING32.dll
2006-08-27 18:37 32,768 --a------ C:\WINDOWS\system32\DLLMSC32.dll
2006-08-27 18:37 32,768 --a------ C:\WINDOWS\system32\DLLISO32.dll
2006-08-27 18:37 32,768 --a------ C:\WINDOWS\system32\DLLDIR32.dll
2006-08-27 18:37 24,576 --a------ C:\WINDOWS\system32\TTIC32.dll
2006-08-27 18:37 24,576 --a------ C:\WINDOWS\system32\TTI32.dll
2006-08-27 18:37 24,576 --a------ C:\WINDOWS\system32\DLLIX.dll
2006-08-27 18:37 188,416 --a------ C:\WINDOWS\system32\DLLRES32.dll
2006-08-27 18:37 155,648 --a------ C:\WINDOWS\system32\DLLDEV32.dll
2006-08-27 18:37 143,360 --a------ C:\WINDOWS\system32\DLLDRV32.dll
2006-08-27 18:37 114,688 --a------ C:\WINDOWS\system32\DLLCDA32.dll
2006-08-27 18:16 420,240 --a------ C:\WINDOWS\system32\mpg4c32.dll
2006-08-27 18:14 85,504 --a------ C:\WINDOWS\system32\HtmlWH.dll
2006-08-27 18:14 1,089,536 --a------ C:\WINDOWS\system32\ROBOEX32.DLL
2006-08-27 18:13 475,136 --a------ C:\WINDOWS\system32\mgxoschk.dll

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2006-09-23 09:31 -------- d-------- C:\Program Files\Common Files
2006-09-23 09:28 -------- d-------- C:\Program Files\Mozilla Firefox
2006-09-23 04:02 -------- d-------- C:\Program Files\NoAdware4
2006-09-23 03:49 -------- d-------- C:\Program Files\ewido anti-spyware 4.0
2006-09-22 23:34 -------- d-------- C:\Program Files\Symantec AntiVirus
2006-09-22 17:50 -------- d-------- C:\Program Files\Hijackthis
2006-09-20 06:33 -------- d-------- C:\Documents and Settings\Daniel\Application Data\Lavasoft
2006-09-20 06:32 -------- d-------- C:\Program Files\Lavasoft
2006-09-17 12:41 -------- d-------- C:\Documents and Settings\Daniel\Application Data\Ahead
2006-09-17 11:02 -------- d-------- C:\Program Files\GRISOFT
2006-09-15 06:08 -------- d-------- C:\Program Files\XoftSpy
2006-09-11 21:13 -------- d-------- C:\Program Files\Adobe
2006-09-11 20:18 -------- d-------- C:\Program Files\Common Files\Adobe
2006-09-11 20:12 -------- d-------- C:\Documents and Settings\Daniel\Application Data\Adobe
2006-09-09 15:23 -------- d-------- C:\Documents and Settings\Daniel\Application Data\Snapfish
2006-09-09 10:53 -------- d-------- C:\Documents and Settings\Daniel\Application Data\Simple Star
2006-09-09 10:50 -------- d-------- C:\Program Files\Ahead
2006-09-09 10:38 -------- d-------- C:\Program Files\Nero
2006-09-09 10:38 -------- d-------- C:\Program Files\Common Files\Ahead
2006-09-08 18:54 -------- d-------- C:\Program Files\BitTorrent
2006-09-08 05:46 -------- d-------- C:\Program Files\Common Files\TI Shared
2006-09-08 05:44 -------- d--h----- C:\Program Files\InstallShield Installation Information
2006-09-08 05:44 -------- d-------- C:\Program Files\Vernier Software
2006-09-04 00:17 -------- d-------- C:\Program Files\MSN Messenger
2006-08-31 18:35 -------- d-------- C:\Program Files\Illustrate
2006-08-28 06:00 -------- d-------- C:\Documents and Settings\Daniel\Application Data\MAGIX
2006-08-27 18:37 -------- d-------- C:\Program Files\Common Files\MAGIX Shared
2006-08-25 23:42 -------- d-------- C:\Program Files\Java
2006-08-21 07:21 16896 --a------ C:\WINDOWS\system32\fltlib.dll
2006-08-21 04:14 23040 --a------ C:\WINDOWS\system32\fltmc.exe
2006-08-21 04:14 128896 --a------ C:\WINDOWS\system32\drivers\fltmgr.sys
2006-08-15 14:58 -------- d-------- C:\Documents and Settings\Daniel\Application Data\Microsoft Games
2006-08-13 04:34 -------- d-------- C:\Program Files\Common Files\Macromedia
2006-08-13 04:31 -------- d-------- C:\Program Files\Macromedia
2006-08-13 04:16 -------- d-------- C:\Documents and Settings\Daniel\Application Data\Macromedia
2006-08-08 21:11 -------- d-------- C:\Program Files\Internet Explorer
2006-07-30 05:36 -------- d-------- C:\Program Files\CloneDVD
2006-07-29 19:32 48936 --a------ C:\WINDOWS\system32\sirenacm.dll
2006-07-28 16:50 -------- d-------- C:\Program Files\WinRAR
2006-07-27 08:24 679424 --a------ C:\WINDOWS\system32\inetcomm.dll
2006-07-25 04:04 -------- d-------- C:\Documents and Settings\Daniel\Application Data\Registry Booster
2006-07-24 05:26 -------- d-------- C:\Program Files\mIRC
2006-07-24 03:00 -------- d-------- C:\Documents and Settings\Daniel\Application Data\CyberLink
2006-07-21 03:24 72704 --a------ C:\WINDOWS\system32\hlink.dll
2006-07-15 23:57 3082 --a------ C:\WINDOWS\system32\affv11300p2now.sys
2006-07-15 23:49 216731 --a------ C:\WINDOWS\MP3Producer Uninstaller.exe
2006-07-15 15:36 14 --a------ C:\WINDOWS\system32\systeminfo.dll
2006-07-15 15:28 14 --a------ C:\WINDOWS\system32\SysEngine2.SYS
2006-07-15 14:47 40 ---hs---- C:\Documents and Settings\Daniel\Application Data\.zreglib

(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Yahoo! Pager"="\"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe\" -quiet"
"AIM"="C:\\Program Files\\AIM\\aim.exe -cnetwait.odl"
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
"DVDXGhost"="C:\\Program Files\\DVD X Studios\\DVD X Utilities V2.1.1\\DVDGhost\\DVDGhost.EXE"
"PhotoShow Deluxe Media Manager"="C:\\PROGRA~1\\Ahead\\NEROPH~1\\data\\Xtras\\mssysmgr.exe"
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="\"C:\\Program Files\\Common Files\\Ahead\\lib\\NMBgMonitor.exe\""
"msnmsgr"="\"C:\\Program Files\\MSN Messenger\\MsnMsgr.Exe\" /background"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"YBrowser"="C:\\PROGRA~1\\Yahoo!\\browser\\ybrwicon.exe"
"IPInSightMonitor 01"="\"C:\\Program Files\\SBC Yahoo!\\Connection Manager\\IP InSight\\IPMon32.exe\""
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_08\\bin\\jusched.exe\""
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"type32"="\"C:\\Program Files\\Microsoft IntelliType Pro\\type32.exe\""
"IntelliPoint"="\"C:\\Program Files\\Microsoft IntelliPoint\\point32.exe\""
"Windows Defender"="\"C:\\Program Files\\Windows Defender\\MSASCui.exe\" -hide"
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"vptray"="C:\\PROGRA~1\\SYMANT~2\\VPTray.exe"
"CloneCDTray"="\"C:\\Program Files\\SlySoft\\CloneCD\\CloneCDTray.exe\" /s"
"VirtualCloneDrive"="\"C:\\Program Files\\Elaborate Bytes\\VirtualCloneDrive\\VCDDaemon.exe\" /s"
"iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"RemoteControl"="\"C:\\Program Files\\CyberLink\\PowerDVD\\PDVDServ.exe\""
"NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\shellexecutehooks]
"{569DAC0F-2791-46ab-8EFC-A54B77C04C20}"="Execute Hooker"
"{D3B3C51E-8D11-4667-85B9-0930F519BED7}"=""
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="ewido anti-spyware 4.0"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=hex:91,00,00,00

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]
"issearch.exe"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001
"DisableTaskMgr"=dword:00000000

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
"WPDShServiceObj"="{AAA288BA-9A4C-45B0-95D7-94D524869DB5}"

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\byvtt
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tuvsrpo
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winabs32
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winvvh32

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders
securityproviders REG_SZ msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll


Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\MP Scheduled Scan.job
C:\WINDOWS\tasks\XoftSpy.job

Completion time: Sat 09/23/2006 9:34:03.45
ComboFix.txt


Report •

#13
September 23, 2006 at 08:00:57
Download VundoFix.exe to C:\

Double-click VundoFix.exe to run it.
Click the Scan for Vundo button.
Once it's done scanning, click the Remove Vundo button.
In case it says that nothing was been found, Right click the list box (white box) in the main VundoFix window.
Select “Add More Files?” from the menu that comes up. This will open a new VundoFix window.
In the Window: copy and paste next in the first field:

C:\WINDOWS\system32\byvtt.dll

Click the “Add Files” button.
Click the "Close Window" button.
Click the Remove Vundo button.
You will receive a prompt asking if you want to remove the files, click YES
Once you click yes, your desktop will go blank as it starts removing Vundo.
When completed, it will prompt that it will shutdown your computer, click OK.
Turn your computer back on.

Note: It is possible that VundoFix encountered a file it could not remove.
In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button." when VundoFix appears at reboot.

Please post the contents of C:\vundofix.txt and a new combofix log.


Report •

#14
September 23, 2006 at 09:06:20
here is the vundofix


VundoFix V6.1.6

Checking Java version...

Java version is 1.5.0.6

Java version is 1.5.0.8

Scan started at 10:17:59 AM 9/23/2006

Listing files found while scanning....

C:\WINDOWS\system32\byvtt.dll
C:\WINDOWS\system32\ttvyb.ini
C:\WINDOWS\system32\ttvyb.bak1
C:\WINDOWS\system32\ttvyb.bak2
C:\WINDOWS\system32\ttvyb.ini2
C:\WINDOWS\system32\ttvyb.tmp

Beginning removal...

Attempting to delete C:\WINDOWS\system32\byvtt.dll
C:\WINDOWS\system32\byvtt.dll Could not be deleted.

Attempting to delete C:\WINDOWS\system32\ttvyb.ini
C:\WINDOWS\system32\ttvyb.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\ttvyb.bak1
C:\WINDOWS\system32\ttvyb.bak1 Has been deleted!

Attempting to delete C:\WINDOWS\system32\ttvyb.bak2
C:\WINDOWS\system32\ttvyb.bak2 Has been deleted!

Attempting to delete C:\WINDOWS\system32\ttvyb.ini2
C:\WINDOWS\system32\ttvyb.ini2 Has been deleted!

Attempting to delete C:\WINDOWS\system32\ttvyb.tmp
C:\WINDOWS\system32\ttvyb.tmp Has been deleted!

Performing Repairs to the registry.
Done!

VundoFix V6.1.6

Checking Java version...

Java version is 1.5.0.6

Java version is 1.5.0.8

Scan started at 10:43:29 AM 9/23/2006

Listing files found while scanning....

C:\WINDOWS\system32\byvtt.dll

Beginning removal...

Attempting to delete C:\WINDOWS\system32\byvtt.dll
C:\WINDOWS\system32\byvtt.dll Has been deleted!

Performing Repairs to the registry.
Done!


and here is the combofix

Daniel - 06-09-23 11:03:41.39 Service Pack 2
ComboFix 06.09.23.2 - Running from: "C:\Documents and Settings\Daniel\Desktop"

(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

Folders Quarantined:

C:\QooBox\Purity\Documents and Settings\Daniel\Application Data\PPPATC~1
C:\QooBox\Purity\Documents and Settings\Daniel\Application Data\PPPATC~1\?ppPatch
C:\QooBox\Purity\Program Files\Common Files\ICROSO~1


((((((((((((((((((((((((((((((( Files Created from 2006-08-23 to 2006-09-23 ))))))))))))))))))))))))))))))))))

2006-09-23 10:55 9,216 --a------ C:\WINDOWS\system32\VundoFixSVC.exe
2006-09-22 17:51 53,248 --a------ C:\WINDOWS\system32\Process.exe
2006-09-22 17:51 40,960 --a------ C:\WINDOWS\system32\swsc.exe
2006-09-22 17:51 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2006-09-22 17:51 135,168 --a------ C:\WINDOWS\system32\swreg.exe
2006-09-19 22:58 94,208 --a------ C:\WINDOWS\system32\uhvjsul.dll
2006-09-09 10:53 421,888 C:\WINDOWSNero PhotoShow.scr
2006-09-09 10:53 38,912 --a------ C:\WINDOWS\system32\picn20.dll
2006-09-09 10:53 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll
2006-08-31 18:35 130,048 --a------ C:\WINDOWS\system32\SpoonUninstall.exe
2006-08-27 18:37 81,920 --a------ C:\WINDOWS\system32\DLLCPY32.dll
2006-08-27 18:37 65,536 --a------ C:\WINDOWS\system32\DLLPTL32.dll
2006-08-27 18:37 61,440 --a------ C:\WINDOWS\system32\DLLCDF32.dll
2006-08-27 18:37 57,344 --a------ C:\WINDOWS\system32\DLLTPO32.dll
2006-08-27 18:37 53,248 --a------ C:\WINDOWS\system32\DLLPRJ32.dll
2006-08-27 18:37 49,152 --a------ C:\WINDOWS\system32\DLLPRF32.dll
2006-08-27 18:37 49,152 --a------ C:\WINDOWS\system32\DLLIO32.dll
2006-08-27 18:37 45,056 --a------ C:\WINDOWS\system32\DLLIMG32.dll
2006-08-27 18:37 44,544 --a------ C:\WINDOWS\system32\msxml4a.dll
2006-08-27 18:37 401,408 --a------ C:\WINDOWS\system32\DLLAV32.dll
2006-08-27 18:37 40,960 --a------ C:\WINDOWS\system32\DLLRD32.dll
2006-08-27 18:37 36,864 --a------ C:\WINDOWS\system32\DLLPNT32.dll
2006-08-27 18:37 32,768 --a------ C:\WINDOWS\system32\STRING32.dll
2006-08-27 18:37 32,768 --a------ C:\WINDOWS\system32\DLLMSC32.dll
2006-08-27 18:37 32,768 --a------ C:\WINDOWS\system32\DLLISO32.dll
2006-08-27 18:37 32,768 --a------ C:\WINDOWS\system32\DLLDIR32.dll
2006-08-27 18:37 24,576 --a------ C:\WINDOWS\system32\TTIC32.dll
2006-08-27 18:37 24,576 --a------ C:\WINDOWS\system32\TTI32.dll
2006-08-27 18:37 24,576 --a------ C:\WINDOWS\system32\DLLIX.dll
2006-08-27 18:37 188,416 --a------ C:\WINDOWS\system32\DLLRES32.dll
2006-08-27 18:37 155,648 --a------ C:\WINDOWS\system32\DLLDEV32.dll
2006-08-27 18:37 143,360 --a------ C:\WINDOWS\system32\DLLDRV32.dll
2006-08-27 18:37 114,688 --a------ C:\WINDOWS\system32\DLLCDA32.dll
2006-08-27 18:16 420,240 --a------ C:\WINDOWS\system32\mpg4c32.dll
2006-08-27 18:14 85,504 --a------ C:\WINDOWS\system32\HtmlWH.dll
2006-08-27 18:14 1,089,536 --a------ C:\WINDOWS\system32\ROBOEX32.DLL
2006-08-27 18:13 475,136 --a------ C:\WINDOWS\system32\mgxoschk.dll

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2006-09-23 11:03 -------- d-------- C:\Program Files\Mozilla Firefox
2006-09-23 11:01 -------- d-------- C:\Program Files\Symantec AntiVirus
2006-09-23 09:31 -------- d-------- C:\Program Files\Common Files
2006-09-23 04:02 -------- d-------- C:\Program Files\NoAdware4
2006-09-23 03:49 -------- d-------- C:\Program Files\ewido anti-spyware 4.0
2006-09-22 17:50 -------- d-------- C:\Program Files\Hijackthis
2006-09-20 06:33 -------- d-------- C:\Documents and Settings\Daniel\Application Data\Lavasoft
2006-09-20 06:32 -------- d-------- C:\Program Files\Lavasoft
2006-09-17 12:41 -------- d-------- C:\Documents and Settings\Daniel\Application Data\Ahead
2006-09-17 11:02 -------- d-------- C:\Program Files\GRISOFT
2006-09-15 06:08 -------- d-------- C:\Program Files\XoftSpy
2006-09-11 21:13 -------- d-------- C:\Program Files\Adobe
2006-09-11 20:18 -------- d-------- C:\Program Files\Common Files\Adobe
2006-09-11 20:12 -------- d-------- C:\Documents and Settings\Daniel\Application Data\Adobe
2006-09-09 15:23 -------- d-------- C:\Documents and Settings\Daniel\Application Data\Snapfish
2006-09-09 10:53 -------- d-------- C:\Documents and Settings\Daniel\Application Data\Simple Star
2006-09-09 10:50 -------- d-------- C:\Program Files\Ahead
2006-09-09 10:38 -------- d-------- C:\Program Files\Nero
2006-09-09 10:38 -------- d-------- C:\Program Files\Common Files\Ahead
2006-09-08 18:54 -------- d-------- C:\Program Files\BitTorrent
2006-09-08 05:46 -------- d-------- C:\Program Files\Common Files\TI Shared
2006-09-08 05:44 -------- d--h----- C:\Program Files\InstallShield Installation Information
2006-09-08 05:44 -------- d-------- C:\Program Files\Vernier Software
2006-09-04 00:17 -------- d-------- C:\Program Files\MSN Messenger
2006-08-31 18:35 -------- d-------- C:\Program Files\Illustrate
2006-08-28 06:00 -------- d-------- C:\Documents and Settings\Daniel\Application Data\MAGIX
2006-08-27 18:37 -------- d-------- C:\Program Files\Common Files\MAGIX Shared
2006-08-25 23:42 -------- d-------- C:\Program Files\Java
2006-08-21 07:21 16896 --a------ C:\WINDOWS\system32\fltlib.dll
2006-08-21 04:14 23040 --a------ C:\WINDOWS\system32\fltmc.exe
2006-08-21 04:14 128896 --a------ C:\WINDOWS\system32\drivers\fltmgr.sys
2006-08-15 14:58 -------- d-------- C:\Documents and Settings\Daniel\Application Data\Microsoft Games
2006-08-13 04:34 -------- d-------- C:\Program Files\Common Files\Macromedia
2006-08-13 04:31 -------- d-------- C:\Program Files\Macromedia
2006-08-13 04:16 -------- d-------- C:\Documents and Settings\Daniel\Application Data\Macromedia
2006-08-08 21:11 -------- d-------- C:\Program Files\Internet Explorer
2006-07-30 05:36 -------- d-------- C:\Program Files\CloneDVD
2006-07-29 19:32 48936 --a------ C:\WINDOWS\system32\sirenacm.dll
2006-07-28 16:50 -------- d-------- C:\Program Files\WinRAR
2006-07-27 08:24 679424 --a------ C:\WINDOWS\system32\inetcomm.dll
2006-07-25 04:04 -------- d-------- C:\Documents and Settings\Daniel\Application Data\Registry Booster
2006-07-24 05:26 -------- d-------- C:\Program Files\mIRC
2006-07-24 03:00 -------- d-------- C:\Documents and Settings\Daniel\Application Data\CyberLink
2006-07-21 03:24 72704 --a------ C:\WINDOWS\system32\hlink.dll
2006-07-15 23:57 3082 --a------ C:\WINDOWS\system32\affv11300p2now.sys
2006-07-15 23:49 216731 --a------ C:\WINDOWS\MP3Producer Uninstaller.exe
2006-07-15 15:36 14 --a------ C:\WINDOWS\system32\systeminfo.dll
2006-07-15 15:28 14 --a------ C:\WINDOWS\system32\SysEngine2.SYS
2006-07-15 14:47 40 ---hs---- C:\Documents and Settings\Daniel\Application Data\.zreglib

(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Yahoo! Pager"="\"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe\" -quiet"
"AIM"="C:\\Program Files\\AIM\\aim.exe -cnetwait.odl"
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
"DVDXGhost"="C:\\Program Files\\DVD X Studios\\DVD X Utilities V2.1.1\\DVDGhost\\DVDGhost.EXE"
"PhotoShow Deluxe Media Manager"="C:\\PROGRA~1\\Ahead\\NEROPH~1\\data\\Xtras\\mssysmgr.exe"
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="\"C:\\Program Files\\Common Files\\Ahead\\lib\\NMBgMonitor.exe\""
"msnmsgr"="\"C:\\Program Files\\MSN Messenger\\MsnMsgr.Exe\" /background"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"YBrowser"="C:\\PROGRA~1\\Yahoo!\\browser\\ybrwicon.exe"
"IPInSightMonitor 01"="\"C:\\Program Files\\SBC Yahoo!\\Connection Manager\\IP InSight\\IPMon32.exe\""
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_08\\bin\\jusched.exe\""
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"type32"="\"C:\\Program Files\\Microsoft IntelliType Pro\\type32.exe\""
"IntelliPoint"="\"C:\\Program Files\\Microsoft IntelliPoint\\point32.exe\""
"Windows Defender"="\"C:\\Program Files\\Windows Defender\\MSASCui.exe\" -hide"
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"vptray"="C:\\PROGRA~1\\SYMANT~2\\VPTray.exe"
"CloneCDTray"="\"C:\\Program Files\\SlySoft\\CloneCD\\CloneCDTray.exe\" /s"
"VirtualCloneDrive"="\"C:\\Program Files\\Elaborate Bytes\\VirtualCloneDrive\\VCDDaemon.exe\" /s"
"iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"RemoteControl"="\"C:\\Program Files\\CyberLink\\PowerDVD\\PDVDServ.exe\""
"NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\shellexecutehooks]
"{569DAC0F-2791-46ab-8EFC-A54B77C04C20}"="Execute Hooker"
"{D3B3C51E-8D11-4667-85B9-0930F519BED7}"=""
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="ewido anti-spyware 4.0"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=hex:91,00,00,00

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]
"issearch.exe"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001
"DisableTaskMgr"=dword:00000000

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
"WPDShServiceObj"="{AAA288BA-9A4C-45B0-95D7-94D524869DB5}"

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tuvsrpo
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winabs32
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winvvh32

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders
securityproviders REG_SZ msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll


Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\MP Scheduled Scan.job
C:\WINDOWS\tasks\XoftSpy.job

Completion time: Sat 09/23/2006 11:04:42.11
ComboFix.txt
ComboFix2.txt


Report •

#15
September 23, 2006 at 15:16:04
Open notepad (Start Menu > Run > Type notepad and press "ok".

Copy and paste everything into notepad between the x's making regedit4 the top line.
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
REGEDIT4

[-HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify]"tuvsrpo"=-

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify]"winabs32"=-

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify]"winvvh32"=-
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

Goto File on the top bar and choose Save As, Change the Save As Type to All Files, Name it Fix.reg then save it to your desktop.

Double click Fix.reg (or right click and choose Merge) and it will ask if you want to merge the contents into the registry, choose Yes and the reg entry should be removed.

Go to start > controlpanel > software > add/remove programs and uninstall next if present:

Oin
Yazzle by Oin
YazzleActiveX By OIN
Purityscan by Oin
Snowballwars by Oin
Cowabanga by OIN
or anything similar with Oin in it.

If OIN not listed, download and run this uninstaller OiUninstaller.exe

Reboot when done! Really important!

Post a new Hijack this log and a new combofix log.


Report •

#16
September 23, 2006 at 16:16:40
here is the hijack this log

Logfile of HijackThis v1.99.1
Scan saved at 6:09:26 PM, on 9/23/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~2\VPTray.exe
C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\AIM\aim.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DVD X Studios\DVD X Utilities V2.1.1\DVDGhost\DVDGhost.EXE
C:\PROGRA~1\Ahead\NEROPH~1\data\Xtras\mssysmgr.exe
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Belkin\Belkin 802.11g Wireless Card Configuration Utility\utility.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Hijackthis\HijackThis.exe
C:\Program Files\Mozilla Firefox\firefox.exe

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Adobe Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {B7672BAF-E9A3-49B6-86B2-C81719A18A4C} - C:\WINDOWS\system32\esdvyvtk.dll (file missing)
O2 - BHO: (no name) - {C6CC1ADD-DFA5-4A8F-9E2D-768DA173E88B} - C:\WINDOWS\system32\byvtt.dll (file missing)
O2 - BHO: (no name) - {D3B3C51E-8D11-4667-85B9-0930F519BED7} - C:\WINDOWS\system32\tuvsrpo.dll (file missing)
O4 - HKLM\..\Run: [YBrowser] C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\Program Files\SBC Yahoo!\Connection Manager\IP InSight\IPMon32.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~2\VPTray.exe
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DVDXGhost] C:\Program Files\DVD X Studios\DVD X Utilities V2.1.1\DVDGhost\DVDGhost.EXE
O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] C:\PROGRA~1\Ahead\NEROPH~1\data\Xtras\mssysmgr.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Belkin 802.11g Wireless Card Utility.lnk = ?
O4 - Global Startup: Logitech Desktop Messenger Agent.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?lin...
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binar...
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo.com/ocx/us/yexp...
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: tuvsrpo - tuvsrpo.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: winabs32 - winabs32.dll (file missing)
O20 - Winlogon Notify: winvvh32 - winvvh32.dll (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE

here is the combofix

Daniel - 06-09-23 18:10:38.20 Service Pack 2
ComboFix 06.09.23.2 - Running from: "C:\Documents and Settings\Daniel\Desktop"

(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

Folders Quarantined:

C:\QooBox\Purity\Documents and Settings\Daniel\Application Data\PPPATC~1
C:\QooBox\Purity\Documents and Settings\Daniel\Application Data\PPPATC~1\?ppPatch
C:\QooBox\Purity\Program Files\Common Files\ICROSO~1


((((((((((((((((((((((((((((((( Files Created from 2006-08-23 to 2006-09-23 ))))))))))))))))))))))))))))))))))

2006-09-23 10:55 9,216 --a------ C:\WINDOWS\system32\VundoFixSVC.exe
2006-09-22 17:51 53,248 --a------ C:\WINDOWS\system32\Process.exe
2006-09-22 17:51 40,960 --a------ C:\WINDOWS\system32\swsc.exe
2006-09-22 17:51 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2006-09-22 17:51 135,168 --a------ C:\WINDOWS\system32\swreg.exe
2006-09-19 22:58 94,208 --a------ C:\WINDOWS\system32\uhvjsul.dll
2006-09-09 10:53 421,888 C:\WINDOWSNero PhotoShow.scr
2006-09-09 10:53 38,912 --a------ C:\WINDOWS\system32\picn20.dll
2006-09-09 10:53 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll
2006-08-31 18:35 130,048 --a------ C:\WINDOWS\system32\SpoonUninstall.exe
2006-08-27 18:37 81,920 --a------ C:\WINDOWS\system32\DLLCPY32.dll
2006-08-27 18:37 65,536 --a------ C:\WINDOWS\system32\DLLPTL32.dll
2006-08-27 18:37 61,440 --a------ C:\WINDOWS\system32\DLLCDF32.dll
2006-08-27 18:37 57,344 --a------ C:\WINDOWS\system32\DLLTPO32.dll
2006-08-27 18:37 53,248 --a------ C:\WINDOWS\system32\DLLPRJ32.dll
2006-08-27 18:37 49,152 --a------ C:\WINDOWS\system32\DLLPRF32.dll
2006-08-27 18:37 49,152 --a------ C:\WINDOWS\system32\DLLIO32.dll
2006-08-27 18:37 45,056 --a------ C:\WINDOWS\system32\DLLIMG32.dll
2006-08-27 18:37 44,544 --a------ C:\WINDOWS\system32\msxml4a.dll
2006-08-27 18:37 401,408 --a------ C:\WINDOWS\system32\DLLAV32.dll
2006-08-27 18:37 40,960 --a------ C:\WINDOWS\system32\DLLRD32.dll
2006-08-27 18:37 36,864 --a------ C:\WINDOWS\system32\DLLPNT32.dll
2006-08-27 18:37 32,768 --a------ C:\WINDOWS\system32\STRING32.dll
2006-08-27 18:37 32,768 --a------ C:\WINDOWS\system32\DLLMSC32.dll
2006-08-27 18:37 32,768 --a------ C:\WINDOWS\system32\DLLISO32.dll
2006-08-27 18:37 32,768 --a------ C:\WINDOWS\system32\DLLDIR32.dll
2006-08-27 18:37 24,576 --a------ C:\WINDOWS\system32\TTIC32.dll
2006-08-27 18:37 24,576 --a------ C:\WINDOWS\system32\TTI32.dll
2006-08-27 18:37 24,576 --a------ C:\WINDOWS\system32\DLLIX.dll
2006-08-27 18:37 188,416 --a------ C:\WINDOWS\system32\DLLRES32.dll
2006-08-27 18:37 155,648 --a------ C:\WINDOWS\system32\DLLDEV32.dll
2006-08-27 18:37 143,360 --a------ C:\WINDOWS\system32\DLLDRV32.dll
2006-08-27 18:37 114,688 --a------ C:\WINDOWS\system32\DLLCDA32.dll
2006-08-27 18:16 420,240 --a------ C:\WINDOWS\system32\mpg4c32.dll
2006-08-27 18:14 85,504 --a------ C:\WINDOWS\system32\HtmlWH.dll
2006-08-27 18:14 1,089,536 --a------ C:\WINDOWS\system32\ROBOEX32.DLL
2006-08-27 18:13 475,136 --a------ C:\WINDOWS\system32\mgxoschk.dll

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2006-09-23 18:09 -------- d-------- C:\Program Files\Mozilla Firefox
2006-09-23 18:08 -------- d-------- C:\Program Files\Hijackthis
2006-09-23 18:05 -------- d-------- C:\Program Files\Symantec AntiVirus
2006-09-23 16:39 -------- d-------- C:\Documents and Settings\Daniel\Application Data\Lavasoft
2006-09-23 09:31 -------- d-------- C:\Program Files\Common Files
2006-09-23 04:02 -------- d-------- C:\Program Files\NoAdware4
2006-09-23 03:49 -------- d-------- C:\Program Files\ewido anti-spyware 4.0
2006-09-17 12:41 -------- d-------- C:\Documents and Settings\Daniel\Application Data\Ahead
2006-09-17 11:02 -------- d-------- C:\Program Files\GRISOFT
2006-09-15 06:08 -------- d-------- C:\Program Files\XoftSpy
2006-09-11 21:13 -------- d-------- C:\Program Files\Adobe
2006-09-11 20:18 -------- d-------- C:\Program Files\Common Files\Adobe
2006-09-11 20:12 -------- d-------- C:\Documents and Settings\Daniel\Application Data\Adobe
2006-09-09 15:23 -------- d-------- C:\Documents and Settings\Daniel\Application Data\Snapfish
2006-09-09 10:53 -------- d-------- C:\Documents and Settings\Daniel\Application Data\Simple Star
2006-09-09 10:50 -------- d-------- C:\Program Files\Ahead
2006-09-09 10:38 -------- d-------- C:\Program Files\Nero
2006-09-09 10:38 -------- d-------- C:\Program Files\Common Files\Ahead
2006-09-08 18:54 -------- d-------- C:\Program Files\BitTorrent
2006-09-08 05:46 -------- d-------- C:\Program Files\Common Files\TI Shared
2006-09-08 05:44 -------- d--h----- C:\Program Files\InstallShield Installation Information
2006-09-08 05:44 -------- d-------- C:\Program Files\Vernier Software
2006-09-04 00:17 -------- d-------- C:\Program Files\MSN Messenger
2006-08-31 18:35 -------- d-------- C:\Program Files\Illustrate
2006-08-28 06:00 -------- d-------- C:\Documents and Settings\Daniel\Application Data\MAGIX
2006-08-27 18:37 -------- d-------- C:\Program Files\Common Files\MAGIX Shared
2006-08-25 23:42 -------- d-------- C:\Program Files\Java
2006-08-21 07:21 16896 --a------ C:\WINDOWS\system32\fltlib.dll
2006-08-21 04:14 23040 --a------ C:\WINDOWS\system32\fltmc.exe
2006-08-21 04:14 128896 --a------ C:\WINDOWS\system32\drivers\fltmgr.sys
2006-08-15 14:58 -------- d-------- C:\Documents and Settings\Daniel\Application Data\Microsoft Games
2006-08-13 04:34 -------- d-------- C:\Program Files\Common Files\Macromedia
2006-08-13 04:31 -------- d-------- C:\Program Files\Macromedia
2006-08-13 04:16 -------- d-------- C:\Documents and Settings\Daniel\Application Data\Macromedia
2006-08-08 21:11 -------- d-------- C:\Program Files\Internet Explorer
2006-07-30 05:36 -------- d-------- C:\Program Files\CloneDVD
2006-07-29 19:32 48936 --a------ C:\WINDOWS\system32\sirenacm.dll
2006-07-28 16:50 -------- d-------- C:\Program Files\WinRAR
2006-07-27 08:24 679424 --a------ C:\WINDOWS\system32\inetcomm.dll
2006-07-25 04:04 -------- d-------- C:\Documents and Settings\Daniel\Application Data\Registry Booster
2006-07-24 05:26 -------- d-------- C:\Program Files\mIRC
2006-07-24 03:00 -------- d-------- C:\Documents and Settings\Daniel\Application Data\CyberLink
2006-07-21 03:24 72704 --a------ C:\WINDOWS\system32\hlink.dll
2006-07-15 23:57 3082 --a------ C:\WINDOWS\system32\affv11300p2now.sys
2006-07-15 23:49 216731 --a------ C:\WINDOWS\MP3Producer Uninstaller.exe
2006-07-15 15:36 14 --a------ C:\WINDOWS\system32\systeminfo.dll
2006-07-15 15:28 14 --a------ C:\WINDOWS\system32\SysEngine2.SYS
2006-07-15 14:47 40 ---hs---- C:\Documents and Settings\Daniel\Application Data\.zreglib

(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Yahoo! Pager"="\"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe\" -quiet"
"AIM"="C:\\Program Files\\AIM\\aim.exe -cnetwait.odl"
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
"DVDXGhost"="C:\\Program Files\\DVD X Studios\\DVD X Utilities V2.1.1\\DVDGhost\\DVDGhost.EXE"
"PhotoShow Deluxe Media Manager"="C:\\PROGRA~1\\Ahead\\NEROPH~1\\data\\Xtras\\mssysmgr.exe"
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="\"C:\\Program Files\\Common Files\\Ahead\\lib\\NMBgMonitor.exe\""
"msnmsgr"="\"C:\\Program Files\\MSN Messenger\\MsnMsgr.Exe\" /background"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"YBrowser"="C:\\PROGRA~1\\Yahoo!\\browser\\ybrwicon.exe"
"IPInSightMonitor 01"="\"C:\\Program Files\\SBC Yahoo!\\Connection Manager\\IP InSight\\IPMon32.exe\""
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_08\\bin\\jusched.exe\""
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"type32"="\"C:\\Program Files\\Microsoft IntelliType Pro\\type32.exe\""
"IntelliPoint"="\"C:\\Program Files\\Microsoft IntelliPoint\\point32.exe\""
"Windows Defender"="\"C:\\Program Files\\Windows Defender\\MSASCui.exe\" -hide"
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"vptray"="C:\\PROGRA~1\\SYMANT~2\\VPTray.exe"
"CloneCDTray"="\"C:\\Program Files\\SlySoft\\CloneCD\\CloneCDTray.exe\" /s"
"VirtualCloneDrive"="\"C:\\Program Files\\Elaborate Bytes\\VirtualCloneDrive\\VCDDaemon.exe\" /s"
"iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"RemoteControl"="\"C:\\Program Files\\CyberLink\\PowerDVD\\PDVDServ.exe\""
"NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\shellexecutehooks]
"{569DAC0F-2791-46ab-8EFC-A54B77C04C20}"="Execute Hooker"
"{D3B3C51E-8D11-4667-85B9-0930F519BED7}"=""
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="ewido anti-spyware 4.0"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=hex:91,00,00,00

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001
"DisableTaskMgr"=dword:00000000

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
"WPDShServiceObj"="{AAA288BA-9A4C-45B0-95D7-94D524869DB5}"

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tuvsrpo
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winabs32
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winvvh32

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders
securityproviders REG_SZ msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll


Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\MP Scheduled Scan.job
C:\WINDOWS\tasks\XoftSpy.job

Completion time: Sat 09/23/2006 18:11:37.40
ComboFix.txt
ComboFix2.txt
ComboFix3.txt


Report •

#17
September 23, 2006 at 16:59:50
Run Hijack This from normal mode, close all windows and browsers except Hijack This, place a check to the left of the following items and press "fix checked":

O2 - BHO: (no name) - {B7672BAF-E9A3-49B6-86B2-C81719A18A4C} - C:\WINDOWS\system32\esdvyvtk.dll (file missing)

O2 - BHO: (no name) - {C6CC1ADD-DFA5-4A8F-9E2D-768DA173E88B} - C:\WINDOWS\system32\byvtt.dll (file missing)

O2 - BHO: (no name) - {D3B3C51E-8D11-4667-85B9-0930F519BED7} - C:\WINDOWS\system32\tuvsrpo.dll (file missing)

O20 - Winlogon Notify: tuvsrpo - tuvsrpo.dll (file missing)

O20 - Winlogon Notify: winabs32 - winabs32.dll (file missing)

O20 - Winlogon Notify: winvvh32 - winvvh32.dll (file missing)

Exit Hijack This

Lets try removing the registry entries once again.

Open notepad (Start Menu > Run > Type notepad and press "ok".

Copy and paste everything into notepad between the x's making regedit4 the top line.
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
REGEDIT4

[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tuvsrpo]

[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winabs32]

[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winvvh32]

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

Goto File on the top bar and choose Save As, Change the Save As Type to All Files, Name it Fix.reg then save it to your desktop.

Double click Fix.reg (or right click and choose Merge) and it will ask if you want to merge the contents into the registry, choose Yes and the reg entry should be removed.

Post a new Hijack This log and let us know how you are runnning.


Report •

#18
September 23, 2006 at 17:11:05
here is the hijack this log

Logfile of HijackThis v1.99.1
Scan saved at 7:10:34 PM, on 9/23/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~2\VPTray.exe
C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\AIM\aim.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DVD X Studios\DVD X Utilities V2.1.1\DVDGhost\DVDGhost.EXE
C:\PROGRA~1\Ahead\NEROPH~1\data\Xtras\mssysmgr.exe
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Belkin\Belkin 802.11g Wireless Card Configuration Utility\utility.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Hijackthis\HijackThis.exe

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Adobe Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [YBrowser] C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\Program Files\SBC Yahoo!\Connection Manager\IP InSight\IPMon32.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~2\VPTray.exe
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DVDXGhost] C:\Program Files\DVD X Studios\DVD X Utilities V2.1.1\DVDGhost\DVDGhost.EXE
O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] C:\PROGRA~1\Ahead\NEROPH~1\data\Xtras\mssysmgr.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Belkin 802.11g Wireless Card Utility.lnk = ?
O4 - Global Startup: Logitech Desktop Messenger Agent.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?lin...
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binar...
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo.com/ocx/us/yexp...
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE

things seem to be running okay


Report •

#19
September 23, 2006 at 17:26:19
Your Hijack This log is clean.

If you don't already use this, you should add "Spywareblaster" to your arsenol of antispyware tools, just do a google search for spywareblaster, download it,install it, and update it. Its free and runs in the background, so you don't actually run it, and re-writes malicious script before it can install on your computer. Look for updates weekly as there is no auto-update on the free version.


Report •


Ask Question