Trojan Horse Clicker NEED HELP!

Computing.Net > Forums > Security and Virus > Trojan Horse Clicker NEED HELP!

Computer Problems? Computing.Net has over 1,000,000 posts about all things technology related! Over 90% answered within 24 hours! Click here to start participating now! Also, be sure to check out the New User Guide.

Trojan Horse Clicker NEED HELP!

Name: bballboy2011
Date: November 8, 2008 at 11:20:10 Pacific
OS: Windows XP Home SP3
CPU/Ram: P4, 512MB RAM
Product: VGC-RB53

Comment:

Need help please, I have a Trojan Horse clicker, I can't see my desktop or the taskbar, Ive tried deleting it with AVG and spybuster but it didn't work I need help fast!

Sponsored Link

Ads by Google

Response Number 1

Name: jabuck
Date: November 8, 2008 at 12:00:12 Pacific

Reply:

Try booting into safe mode with networking then download and run the following scans.
. Please then reboot your computer in Safe Mode by doing the following :
Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, a menu with options should appear;
Select "Safe Mode with Networking", then press "Enter".
Choose your usual account.
Please download Malwarebytes' Anti-Malware from one of these sites:
MalwareBytes1
MalwareBytes2
1. Double Click mbam-setup.exe to install the application.
2. Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
3. If an update is found, it will download and install the latest version.
4. Once the program has loaded, select "Perform Quick Scan", then click Scan. The scan may take some time to finish,so please be patient.
5. When the scan is complete, click OK, then Show Results to view the results.
6. Make sure that everything found is checked, and click Remove Selected.
7. When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately.
8. The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
9. Copy&Paste the entire report in your next reply.

Please download and install the latest version of HijackThis v2.0.2:

Download the "HijackThis" Installer from this link:
Hijack This

1. Save " HJTInstall.exe" to your desktop.
2. Double click on HJTInstall.exe to run the program.
3. By default it will install to C:\Program Files\Trend Micro\HijackThis.
4. Accept the license agreement by clicking the "I Accept" button.
5.Click on the "Do a system scan and save a log file" button. It will scan and then ask you to save the log.
6. Click "Save log" to save the log file and then the log will open in Notepad.
7. Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
8. Paste the log in your next reply.
9. Do NOT have HijackThis fix anything yet! Most of what it finds will be harmless or even required.

Response Number 2

Name: yellowbelt
Date: November 8, 2008 at 13:23:44 Pacific

Reply:

Spybuster is listed as rogue spyware.
After your done with jabuck's post, download a-squared free, cwshredder and Spybot S&D and run a free online AV scan from F-secure, Trend Micro or Kaspersky.
Weaseling out of things is important to learn. It's what separates us from the animals ... except the weasel.
~Homer Simpson~

Response Number 3

Name: bballboy2011
Date: November 8, 2008 at 21:26:27 Pacific

Reply:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:26:13 PM, on 11/8/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Belkin\Belkin Wireless Network Utility\WLService.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Microsoft SQL Server\MSSQL$EMMSDE\Binn\sqlservr.exe
C:\Program Files\Belkin\Belkin Wireless Network Utility\WLanCfgG.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VzRs\VzRs.exe
C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\explorer.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Ventrilo\Ventrilo.exe
C:\Program Files\Game Cam\GameCam.exe
C:\Program Files\Xfire\xfire.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cus...
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?Lin...
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSou...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?Lin...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?Lin...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?Lin...
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?Lin...
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/cus...
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Common\Companion\Installs\cpn0\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: AT&&T Toolbar - {4E7BD74F-2B8D-469E-94BE-FD60BB9AAE29} - C:\PROGRA~1\ATTTOO~1\ATTTOO~1.DLL
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Megaupload Toolbar - {A057A204-BACC-4D26-C39E-35F1D2A32EC8} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O2 - BHO: MegaIEMn - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - C:\Program Files\Megaupload\Mega Manager\MegaIEMn.dll
O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Common\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: AT&&T Toolbar - {4E7BD74F-2B8D-469E-94BE-FD60BB9AAE29} - C:\PROGRA~1\ATTTOO~1\ATTTOO~1.DLL
O3 - Toolbar: Megaupload Toolbar - {A057A204-BACC-4D26-C39E-35F1D2A32EC8} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAudPropShortcut.exe
O4 - HKLM\..\Run: [VZRemoteCommander] C:\Program Files\Sony\VAIO Zone Remote Commander\AvRmtCtr.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb06.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [SsAAD.exe] C:\PROGRA~1\sony\SONICS~1\SsAAD.exe
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.exe C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AT&T Yahoo! Dial Connection Manager] C:\Program Files\SBC Yahoo!\Connection Manager\ConnectionManager.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\PROGRA~1\Symantec\osCheck.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.exe C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.exe
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.exe
O4 - HKLM\..\Run: [IPInSightLAN 01] "C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe" -l
O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe"
O4 - HKLM\..\Run: [YOP] C:\PROGRA~1\Yahoo!\YOP\yop.exe /autostart
O4 - HKLM\..\Run: [YBrowser] C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [VAIO Update 2] "C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe" /Stationary
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [SalaatTime] C:\Program Files\Salaat Time\SalaatTime.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" -quiet
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [Performance Center] C:\Program Files\Ascentive\Performance Center\ApcMain.exe -m
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - Startup: AnyTime.lnk = C:\Program Files\AnyTime Deluxe\ISI Launcher.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - Extra context menu item: Transfer by Image Converter 2 - C:\Program Files\Sony\Image Converter 2\menu.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll
O9 - Extra button: AT&T Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople
O16 - DPF: {01010E00-5E80-11D8-9E86-0007E96C65AE} (SupportSoft SmartIssue) - http://www.symantec.com/techsupp/as...
O16 - DPF: {01012101-5E80-11D8-9E86-0007E96C65AE} (SupportSoft Script Runner Class) - http://www.symantec.com/techsupp/as...
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?lin...
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/as...
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
O16 - DPF: {50647AB5-18FD-4142-82B0-5852478DD0D5} (Keynote Connector Launcher 2) - http://webeffective.keynote.com/app...
O16 - DPF: {58172624-85DD-4482-9E64-02ADCA637E96} - http://www.shizmoo.com/activex/web6...
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windows...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} - http://atv.disney.go.com/global/dow...
O16 - DPF: {B1E2B96C-12FE-45E2-BEF1-44A219113CDD} (SABScanProcesses Class) - http://www.superadblocker.com/activ...
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} - http://www.symantec.com/techsupp/as...
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo.com/ocx/us/yexp...
O17 - HKLM\System\CCS\Services\Tcpip\..\{1BA68631-585D-4957-89B0-E77B1905C016}: NameServer = 216.104.64.5,216.104.72.5
O17 - HKLM\System\CCS\Services\Tcpip\..\{6F47FDE6-A57D-4D3C-A848-28ED3339C4D6}: NameServer = 192.168.0.1,192.168.2.1
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O21 - SSODL: Sysutdll - {073FFECE-BECE-4FE8-96A3-B7BA260FE22C} - C:\WINDOWS\system32\webennet.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Belkin 54g Wireless USB Network Adapter (Belkin 54g Wireless USB Network Adapter Service) - Unknown owner - C:\Program Files\Belkin\Belkin Wireless Network Utility\WLService.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Image Converter video recording monitor for VAIO Entertainment - Sony Corporation - C:\Program Files\Sony\Image Converter 2\IcVzMon.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\PROGRA~1\Symantec\isPwdSvc.exe
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: VAIO Entertainment Aggregation and Control Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VzRs\VzRs.exe
O23 - Service: VAIO Entertainment Task Scheduler - Sony Corporation - C:\Program Files\Sony\vaio entertainment\VzTaskScheduler.exe
O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe
O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe
O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe
O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
O23 - Service: VAIO Entertainment File Import Service (VzFw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.exe
--
End of file - 18017 bytes

Response Number 4

Name: bballboy2011
Date: November 8, 2008 at 23:12:47 Pacific

Reply:

thanks very much if someone can tell me what to fix

Malwarebytes' Anti-Malware 1.30
Database version: 1373
Windows 5.1.2600 Service Pack 3
11/8/2008 11:10:42 PM
mbam-log-2008-11-08 (23-10-42).txt
Scan type: Quick Scan
Objects scanned: 75146
Time elapsed: 11 minute(s), 45 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 4
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea1-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Performance Center (Rogue.PCSpeedScan) -> Quarantined and deleted successfully.
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)

Response Number 5

Name: jabuck
Date: November 9, 2008 at 10:44:40 Pacific

Reply:

It appears that you have two antivirus programs installed, AVG and Nortons. It appears that AVG is running and Nortons is turned off. If you have decided to use AVG you need to uninstall Nortons as the two programs will conflict an cause you problems. Go to start> control panel> add/remove programs click Norns and follow the directions to uninstall it.
Run Hijack This, close all windows and browsers except Hijack This, place a check tot eh left of the following items and press "fix checked":
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cus...
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/cus...

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
Exit Hijack This
Post a new Hijack This log once you uninstall Nortons and remove the suggested items with Hijack This.

trojan horse clicker record monitor at&t yahoo software center download	trojan horse clicker threat detected trojan horse clicker need help deleting a trojan on my xp
See More

Response Number 6

Name: bballboy2011
Date: November 10, 2008 at 15:46:20 Pacific

Reply:

After running hijack and uninstalling norton the following registry files would not be deleted
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
Im still having the problem when turning on my computer the taskbar and icons load on the desktop but about 30 seconds later they disappear, i go to task manager and manually launch explorer.exe and seems to work after that even though there is already an explorer.exe open heres my hijack log after, thanks for all your help so far
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:44:02 PM, on 11/10/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Belkin\Belkin Wireless Network Utility\WLService.exe
C:\Program Files\Belkin\Belkin Wireless Network Utility\WLanCfgG.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Microsoft SQL Server\MSSQL$EMMSDE\Binn\sqlservr.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
C:\Program Files\Sony\VAIO Zone Remote Commander\AvRmtCtr.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\PROGRA~1\sony\SONICS~1\SsAAD.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\SBC Yahoo!\Connection Manager\ConnectionManager.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\WINDOWS\system32\RUNDLL32.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\SOUNDMAN.exe
C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Program Files\Salaat Time\SalaatTime.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VzRs\VzRs.exe
C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
C:\WINDOWS\explorer.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZSTC06.exe
C:\Program Files\Steam\Steam.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Xfire\xfire.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?Lin...
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSou...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?Lin...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?Lin...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?Lin...
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?Lin...
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Common\Companion\Installs\cpn0\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: AT&&T Toolbar - {4E7BD74F-2B8D-469E-94BE-FD60BB9AAE29} - C:\PROGRA~1\ATTTOO~1\ATTTOO~1.DLL
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Megaupload Toolbar - {A057A204-BACC-4D26-C39E-35F1D2A32EC8} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O2 - BHO: MegaIEMn - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - C:\Program Files\Megaupload\Mega Manager\MegaIEMn.dll
O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Common\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: AT&&T Toolbar - {4E7BD74F-2B8D-469E-94BE-FD60BB9AAE29} - C:\PROGRA~1\ATTTOO~1\ATTTOO~1.DLL
O3 - Toolbar: Megaupload Toolbar - {A057A204-BACC-4D26-C39E-35F1D2A32EC8} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAudPropShortcut.exe
O4 - HKLM\..\Run: [VZRemoteCommander] C:\Program Files\Sony\VAIO Zone Remote Commander\AvRmtCtr.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb06.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [SsAAD.exe] C:\PROGRA~1\sony\SONICS~1\SsAAD.exe
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.exe C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AT&T Yahoo! Dial Connection Manager] C:\Program Files\SBC Yahoo!\Connection Manager\ConnectionManager.exe
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.exe C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.exe
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.exe
O4 - HKLM\..\Run: [IPInSightLAN 01] "C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe" -l
O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe"
O4 - HKLM\..\Run: [YOP] C:\PROGRA~1\Yahoo!\YOP\yop.exe /autostart
O4 - HKLM\..\Run: [YBrowser] C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [VAIO Update 2] "C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe" /Stationary
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [SalaatTime] C:\Program Files\Salaat Time\SalaatTime.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKUS\S-1-5-21-924670367-321305601-2495770623-1007\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background (User '?')
O4 - HKUS\S-1-5-21-924670367-321305601-2495770623-1007\..\Run: [Yahoo! Pager] C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe -quiet (User '?')
O4 - HKUS\S-1-5-21-924670367-321305601-2495770623-1007\..\Run: [SalaatTime] C:\Program Files\Salaat Time\SalaatTime.exe (User '?')
O4 - HKUS\S-1-5-21-924670367-321305601-2495770623-1007\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User '?')
O4 - HKUS\S-1-5-21-924670367-321305601-2495770623-1007\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User '?')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - Extra context menu item: Transfer by Image Converter 2 - C:\Program Files\Sony\Image Converter 2\menu.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll
O9 - Extra button: AT&T Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople
O16 - DPF: {01010E00-5E80-11D8-9E86-0007E96C65AE} (SupportSoft SmartIssue) - http://www.symantec.com/techsupp/as...
O16 - DPF: {01012101-5E80-11D8-9E86-0007E96C65AE} (SupportSoft Script Runner Class) - http://www.symantec.com/techsupp/as...
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?lin...
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/as...
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
O16 - DPF: {50647AB5-18FD-4142-82B0-5852478DD0D5} (Keynote Connector Launcher 2) - http://webeffective.keynote.com/app...
O16 - DPF: {58172624-85DD-4482-9E64-02ADCA637E96} - http://www.shizmoo.com/activex/web6...
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windows...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} - http://atv.disney.go.com/global/dow...
O16 - DPF: {B1E2B96C-12FE-45E2-BEF1-44A219113CDD} (SABScanProcesses Class) - http://www.superadblocker.com/activ...
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} - http://www.symantec.com/techsupp/as...
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo.com/ocx/us/yexp...
O17 - HKLM\System\CCS\Services\Tcpip\..\{1BA68631-585D-4957-89B0-E77B1905C016}: NameServer = 216.104.64.5,216.104.72.5
O17 - HKLM\System\CCS\Services\Tcpip\..\{6F47FDE6-A57D-4D3C-A848-28ED3339C4D6}: NameServer = 192.168.0.1,192.168.2.1
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: avgrsstx.dll
O21 - SSODL: Sysutdll - {073FFECE-BECE-4FE8-96A3-B7BA260FE22C} - C:\WINDOWS\system32\webennet.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Belkin 54g Wireless USB Network Adapter (Belkin 54g Wireless USB Network Adapter Service) - Unknown owner - C:\Program Files\Belkin\Belkin Wireless Network Utility\WLService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Image Converter video recording monitor for VAIO Entertainment - Sony Corporation - C:\Program Files\Sony\Image Converter 2\IcVzMon.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: VAIO Entertainment Aggregation and Control Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VzRs\VzRs.exe
O23 - Service: VAIO Entertainment Task Scheduler - Sony Corporation - C:\Program Files\Sony\vaio entertainment\VzTaskScheduler.exe
O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe
O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe
O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe
O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
O23 - Service: VAIO Entertainment File Import Service (VzFw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.exe
--
End of file - 18039 bytes

Response Number 7

Name: jabuck
Date: November 10, 2008 at 16:48:57 Pacific

Reply:

Please download ComboFix to the desktop from one of the following links:
Link1
Link 2
Link 3
Combofix is a powerful tool so follow the instructions exactly or you could damage your computer.
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with Combofix and remove some of its embedded files which may cause "unpredictable results".
Click on This Link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
In your case to run Combofix do the following:
1. Go offline turn off your AVG antivirus, Ad-Aware, and any other antispyware that you may have.
2. Run Combofix and save its log.
3. Restart the computer to get the antivirus running again but leave the antispyware programs off until we get the computer cleaned.
4. Post the Combofix log.

Remember to re-enable the protection again afterwards before connecting to the Internet.

Double-click combofix.exe
Follow the prompts.
(Don't click on the window while the program is running or move the mouse, it will cause your system to hang.)
Please post the log it produces.

Response Number 8

Name: bballboy2011
Date: November 10, 2008 at 18:00:01 Pacific

Reply:

can i just do this in safe mode so my antiviruses are already disabled?

Response Number 9

Name: bballboy2011
Date: November 10, 2008 at 18:57:57 Pacific

Reply:

heres the log
ComboFix 08-11-09.04 - MAHMOOD 2008-11-10 18:38:52.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.211 [GMT -8:00]
Running from: c:\documents and settings\MAHMOOD.EC29D2D7ECFE48B.001\Desktop\Media\BitTorrent\ComboFix.exe
* Created a new restore point
[COLOR=RED][B]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/B][/COLOR]
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\bold.log
c:\windows\Downloaded Program Files\setup.inf
c:\windows\IE4 Error Log.txt
c:\windows\setup.exe
.
((((((((((((((((((((((((( Files Created from 2008-10-11 to 2008-11-11 )))))))))))))))))))))))))))))))
.
2008-11-10 16:26 . 2008-11-10 16:26 <DIR> d-------- c:\documents and settings\MAHMOOD.EC29D2D7ECFE48B.001\Application Data\skypePM
2008-11-09 16:45 . 2008-11-09 16:45 <DIR> d-------- c:\documents and settings\cscontrol\Application Data\skypePM
2008-11-09 16:45 . 2008-11-09 16:45 56 --ah----- c:\windows\system32\ezsidmv.dat
2008-11-09 16:43 . 2008-11-09 20:35 <DIR> d-------- c:\documents and settings\cscontrol\Application Data\Skype
2008-11-09 16:42 . 2008-11-09 16:42 <DIR> d-------- c:\program files\Skype
2008-11-09 16:42 . 2008-11-09 16:42 <DIR> d-------- c:\program files\Common Files\Skype
2008-11-08 19:51 . 2008-11-08 19:51 <DIR> d-------- c:\documents and settings\MAHMOOD.EC29D2D7ECFE48B.001\Application Data\Malwarebytes
2008-11-07 22:16 . 2008-11-08 08:43 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-11-07 22:16 . 2008-11-07 22:16 <DIR> d-------- c:\documents and settings\cscontrol\Application Data\Malwarebytes
2008-11-07 22:16 . 2008-11-07 22:16 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2008-11-07 22:16 . 2008-10-22 16:28 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-11-07 22:16 . 2008-10-22 16:28 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-11-07 21:08 . 2008-07-18 21:09 325,832 --a------ c:\windows\system32\wucltui.dll
2008-11-07 21:08 . 2008-07-18 21:07 270,880 --a------ c:\windows\system32\mucltui.dll
2008-11-07 21:08 . 2008-07-18 21:07 210,976 --a------ c:\windows\system32\muweb.dll
2008-11-07 21:08 . 2008-07-18 21:09 205,000 --a------ c:\windows\system32\wuweb.dll
2008-11-07 21:08 . 2008-10-16 14:09 43,544 --a------ c:\windows\system32\wups2.dll
2008-11-07 21:08 . 2008-10-16 14:08 34,328 --a------ c:\windows\system32\wups.dll
2008-11-07 21:08 . 2008-10-16 14:08 34,328 --a--c--- c:\windows\system32\dllcache\wups.dll
2008-11-07 21:07 . 2008-07-18 21:09 1,811,656 --a------ c:\windows\system32\wuaueng.dll
2008-11-07 21:07 . 2008-07-18 21:09 563,912 --a------ c:\windows\system32\wuapi.dll
2008-11-07 21:07 . 2008-07-18 21:09 215,752 --a------ c:\windows\system32\wuaucpl.cpl
2008-11-07 21:07 . 2008-07-18 21:10 94,920 --a------ c:\windows\system32\cdm.dll
2008-11-07 21:07 . 2008-07-18 21:10 53,448 --a------ c:\windows\system32\wuauclt.exe
2008-11-07 20:35 . 2008-11-07 20:35 <DIR> d-------- c:\program files\Trend Micro
2008-11-07 17:56 . 2008-11-07 17:56 <DIR> d-------- c:\program files\Visual Networks
2008-11-06 17:17 . 2008-11-06 17:17 578,560 --a--c--- c:\windows\system32\dllcache\user32.dll
2008-11-06 17:13 . 2008-11-06 17:13 <DIR> d-------- c:\windows\ERUNT
2008-11-06 17:05 . 2008-11-06 19:50 <DIR> d-------- C:\SDFix
2008-11-02 09:00 . 2008-11-03 09:02 <DIR> d-------- c:\documents and settings\NetworkService\Application Data\AVGTOOLBAR
2008-11-02 05:18 . 2008-11-08 14:35 <DIR> d-------- c:\documents and settings\MAHMOOD.EC29D2D7ECFE48B.001\Application Data\AVGTOOLBAR
2008-11-02 03:13 . 2008-11-08 20:00 <DIR> d-------- c:\documents and settings\LocalService\Application Data\MEGAUPLOADTOOLBAR
2008-11-02 03:13 . 2008-11-02 03:13 <DIR> d-------- c:\documents and settings\LocalService\Application Data\EmailNotifier
2008-11-02 03:13 . 2008-11-02 03:18 <DIR> d-------- c:\documents and settings\LocalService\Application Data\AVGTOOLBAR
2008-11-02 03:13 . 2008-11-02 04:08 <DIR> d-------- c:\documents and settings\LocalService\Application Data\ATTTOOLBAR
2008-11-01 23:22 . 2008-11-10 08:56 <DIR> d-------- c:\windows\system32\drivers\Avg
2008-11-01 23:22 . 2008-11-06 19:50 <DIR> d-------- c:\documents and settings\cscontrol\Application Data\AVGTOOLBAR
2008-11-01 23:22 . 2008-11-01 23:22 97,928 --a------ c:\windows\system32\drivers\avgldx86.sys
2008-11-01 23:22 . 2008-11-01 23:22 76,040 --a------ c:\windows\system32\drivers\avgtdix.sys
2008-11-01 23:22 . 2008-11-01 23:22 10,520 --a------ c:\windows\system32\avgrsstx.dll
2008-11-01 23:06 . 2008-11-01 23:06 <DIR> d-------- c:\program files\Lavasoft
2008-11-01 23:06 . 2008-11-01 23:09 <DIR> d-------- c:\documents and settings\All Users\Application Data\Lavasoft
2008-11-01 21:01 . 2008-11-08 20:05 <DIR> d-------- c:\documents and settings\NetworkService\Application Data\MEGAUPLOADTOOLBAR
2008-11-01 21:01 . 2008-11-01 23:21 <DIR> d-------- c:\documents and settings\NetworkService\Application Data\EmailNotifier
2008-11-01 21:00 . 2008-11-02 14:02 <DIR> d-------- c:\documents and settings\NetworkService\Application Data\ATTTOOLBAR
2008-10-29 17:24 . 2008-10-29 17:24 42,320 --a------ c:\windows\system32\xfcodec.dll
2008-10-28 21:02 . 2007-11-14 14:18 553 --a------ c:\windows\USetup.iss
2008-10-28 21:00 . 2008-09-30 15:38 2,168,320 --a------ c:\windows\MicCal.exe
2008-10-28 21:00 . 2007-11-20 17:15 1,826,816 --a------ c:\windows\SkyTel.exe
2008-10-28 21:00 . 2008-08-05 19:10 1,684,736 --a------ c:\windows\system32\drivers\Ambfilt.sys
2008-10-28 21:00 . 2006-01-04 14:41 1,389,056 --a------ c:\windows\system32\drivers\Monfilt.sys
2008-10-28 21:00 . 2008-09-19 16:48 1,200,128 --a------ c:\windows\RtlUpd.exe
2008-10-28 21:00 . 2008-03-13 13:52 266,240 --a------ c:\windows\system32\RTSndMgr.CPL
2008-10-28 20:59 . 2008-08-25 15:17 528,384 --a------ c:\windows\RtlExUpd.dll
2008-10-28 20:59 . 2008-10-28 20:59 319,488 --a------ c:\windows\HideWin.exe
2008-10-28 20:42 . 2008-10-28 20:42 <DIR> d-------- c:\program files\Uniblue
2008-10-28 20:42 . 2008-10-28 20:42 <DIR> d-------- c:\documents and settings\MAHMOOD.EC29D2D7ECFE48B.001\Application Data\Uniblue
2008-10-28 20:42 . 2008-10-28 20:46 <DIR> d-------- c:\documents and settings\All Users\Application Data\DriverScanner
2008-10-28 20:41 . 2008-10-28 20:42 <DIR> d--h-c--- c:\documents and settings\All Users\Application Data\{D5ABFFAD-D592-4F98-B02B-587125B4801F}
2008-10-23 21:21 . 2008-10-15 08:34 337,408 -----c--- c:\windows\system32\dllcache\netapi32.dll
2008-10-22 21:19 . 2008-10-22 21:19 <DIR> d-------- C:\Xfire
2008-10-15 07:42 . 2008-09-08 02:41 333,824 -----c--- c:\windows\system32\dllcache\srv.sys
2008-10-15 07:41 . 2008-08-14 02:11 2,189,184 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe
2008-10-15 07:41 . 2008-08-14 02:09 2,145,280 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe
2008-10-15 07:41 . 2008-08-14 01:33 2,066,048 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe
2008-10-15 07:41 . 2008-08-14 01:33 2,023,936 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe
2008-10-15 07:41 . 2008-09-15 04:12 1,846,400 -----c--- c:\windows\system32\dllcache\win32k.sys
2008-10-12 14:25 . 2008-10-12 14:26 <DIR> d-------- c:\program files\iTunes
2008-10-12 14:25 . 2008-10-12 14:26 <DIR> d-------- c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-11 02:35 --------- d-----w c:\documents and settings\MAHMOOD.EC29D2D7ECFE48B.001\Application Data\Xfire
2008-11-11 02:31 --------- d-----w c:\documents and settings\MAHMOOD.EC29D2D7ECFE48B.001\Application Data\Skype
2008-11-11 02:07 --------- d-----w c:\program files\Common Files\Symantec Shared
2008-11-11 02:07 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec
2008-11-11 01:52 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2008-11-11 01:39 --------- d-----w c:\program files\EA GAMES
2008-11-11 00:36 --------- d-----w c:\program files\Steam
2008-11-10 15:26 --------- d-----w c:\program files\StudySmart Demo 4.0
2008-11-10 04:35 --------- d-----w c:\documents and settings\cscontrol\Application Data\Xfire
2008-11-10 00:42 --------- d-----w c:\documents and settings\All Users\Application Data\Skype
2008-11-09 23:38 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2008-11-09 19:07 --------- d-----w c:\program files\Yahoo!
2008-11-09 19:07 --------- d-----w c:\program files\Common Files\Scanner
2008-11-09 04:16 --------- d-----w c:\documents and settings\All Users\Application Data\ATTToolbar
2008-11-08 22:35 --------- d-----w c:\documents and settings\MAHMOOD.EC29D2D7ECFE48B.001\Application Data\MEGAUPLOADTOOLBAR
2008-11-08 01:57 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-08 01:57 --------- d-----w c:\documents and settings\All Users\Application Data\Visual Networks
2008-11-08 01:50 --------- d-----w c:\documents and settings\cscontrol\Application Data\LimeWire
2008-11-07 03:50 --------- d-----w c:\program files\Xfire
2008-11-07 03:50 --------- d-----w c:\documents and settings\MAHMOOD.EC29D2D7ECFE48B.001\Application Data\mIRC
2008-11-07 03:32 --------- d-----w c:\documents and settings\cscontrol\Application Data\MegauploadToolbar
2008-11-02 07:22 --------- d-----w c:\documents and settings\All Users\Application Data\Avg8
2008-11-02 06:19 --------- d-----w c:\documents and settings\cscontrol\Application Data\mIRC
2008-10-30 01:24 --------- d-----w c:\documents and settings\MAHMOOD.EC29D2D7ECFE48B.001\Application Data\LimeWire
2008-10-29 05:00 --------- d-----w c:\program files\Realtek
2008-10-14 01:26 4,879,360 ----a-w c:\windows\system32\drivers\RtkHDAud.sys
2008-10-12 22:25 --------- d-----w c:\program files\iPod
2008-10-12 21:13 23 ----a-w c:\documents and settings\MAHMOOD.EC29D2D7ECFE48B.001\jagex_runescape_preferences.dat
2008-10-09 21:54 17,021,440 ----a-w c:\windows\RTHDCPL.exe
2008-10-01 20:01 32,000 ----a-w c:\windows\system32\drivers\usbaapl.sys
2008-09-18 22:55 --------- d-----w c:\program files\LimeWire
2008-09-18 22:26 --------- d-----w c:\program files\QuickTime
2008-09-18 22:25 --------- d-----w c:\program files\Common Files\Apple
2008-09-15 12:12 1,846,400 ----a-w c:\windows\system32\win32k.sys
2008-09-05 22:54 348,160 ----a-w c:\windows\system32\msvcr71.dll
2008-08-26 07:24 826,368 ----a-w c:\windows\system32\wininet.dll
2008-08-19 20:26 77,824 ----a-w c:\windows\SOUNDMAN.exe
2008-08-14 10:09 2,145,280 ----a-w c:\windows\system32\ntoskrnl.exe
2008-08-14 09:33 2,023,936 ----a-w c:\windows\system32\ntkrnlpa.exe
2008-08-04 02:45 23 ----a-w c:\documents and settings\cscontrol\jagex_runescape_preferences.dat
2007-06-06 15:35 87,992 ----a-w c:\documents and settings\MAHMOOD.EC29D2D7ECFE48B.001\Application Data\GDIPFONTCACHEV1.DAT
2007-05-20 19:51 118 ----a-w c:\documents and settings\MAHMOOD.EC29D2D7ECFE48B.001\Application Data\MTC-savedfolder.dat
2007-05-09 19:01 56,912 ----a-w c:\documents and settings\MAHMOOD.EC29D2D7ECFE48B.001\g2mdlhlpx.exe
2007-03-12 06:02 6,072 -c--a-w c:\documents and settings\All Users\Application Data\ypinfo.bin
2005-10-12 05:54 221,184 ----a-w c:\documents and settings\MAHMOOD.EC29D2D7ECFE48B.001\ctapshr.dll
2006-10-12 03:09 94,208 --sha-w c:\windows\system32\SalaatTime.dll
2008-06-16 01:10 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008061520080616\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A057A204-BACC-4D26-C39E-35F1D2A32EC8}]
2008-08-04 12:44 1947080 --a------ c:\progra~1\MEGAUP~1\MEGAUP~1.DLL
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{A057A204-BACC-4D26-C39E-35F1D2A32EC8}"= "c:\progra~1\MEGAUP~1\MEGAUP~1.DLL" [2008-08-04 1947080]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{A057A204-BACC-4D26-C39E-35F1D2A32EC8}"= "c:\progra~1\MEGAUP~1\MEGAUP~1.DLL" [2008-08-04 1947080]
[HKEY_CLASSES_ROOT\clsid\{a057a204-bacc-4d26-c39e-35f1d2a32ec8}]
[HKEY_CLASSES_ROOT\megauploadtoolbar.MEGAUPLOADTOOLBAR]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SalaatTime"="c:\program files\Salaat Time\SalaatTime.exe" [2007-08-26 13443072]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-13 1695232]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-04-01 486856]
"AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 120\axcmd.exe" [2008-03-20 217544]
"Aim6"="c:\program files\AIM6\aim6.exe" [2008-08-06 50472]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-06-06 155648]
"VZRemoteCommander"="c:\program files\Sony\VAIO Zone Remote Commander\AvRmtCtr.exe" [2005-01-31 192512]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb06.exe" [2002-07-11 188416]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-16 49152]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-06-06 118784]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-03-22 339968]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2006-11-21 842584]
"SsAAD.exe"="c:\progra~1\sony\SONICS~1\SsAAD.exe" [2005-01-24 81920]
"BJCFD"="c:\program files\BroadJump\Client Foundation\CFD.exe" [2002-09-10 368706]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-08-02 13570048]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"AT&T Yahoo! Dial Connection Manager"="c:\program files\SBC Yahoo!\Connection Manager\ConnectionManager.exe" [2007-05-11 1158248]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-08-02 86016]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-09-05 185896]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-09-03 111936]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2008-11-01 1234712]
"IPInSightLAN 01"="c:\program files\Visual Networks\Visual IP InSight\SBC\IPClient.exe" [2003-06-11 380928]
"IPInSightMonitor 01"="c:\program files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe" [2003-06-11 122880]
"YOP"="c:\progra~1\Yahoo!\YOP\yop.exe" [2007-10-26 509224]
"YBrowser"="c:\progra~1\Yahoo!\browser\ybrwicon.exe" [2006-07-21 129536]
"VAIO Update 2"="c:\program files\Sony\VAIO Update 2\VAIOUpdt.exe" [2005-01-14 151552]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-09-06 413696]
"MSConfig"="c:\windows\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2008-04-13 169984]
"High Definition Audio Property Page Shortcut"="HDAudPropShortcut.exe" [2004-08-12 c:\windows\system32\Hdaudpropshortcut.exe]
"AGRSMMSG"="AGRSMMSG.exe" [2004-10-08 c:\windows\AGRSMMSG.exe]
"nwiz"="nwiz.exe" [2008-08-02 c:\windows\system32\nwiz.exe]
"SoundMan"="SOUNDMAN.EXE" [2008-08-19 c:\windows\SOUNDMAN.EXE]
"AlcWzrd"="ALCWZRD.EXE" [2008-06-19 c:\windows\ALCWZRD.EXE]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-04 258048]
HP Image Zone Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-04 53248]
Service Manager.lnk - c:\program files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2002-12-17 74308]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoViewOnDrive"= 0 (0x0)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"Sysutdll"= {073FFECE-BECE-4FE8-96A3-B7BA260FE22C} - c:\windows\system32\webennet.dll [2007-04-16 1044480]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.dvsd"= c:\progra~1\COMMON~1\SONYSH~1\VideoLib\sonydv.dll
"VIDC.XFR1"= xfcodec.dll
[HKLM\~\startupfolder\C:^Documents and Settings^cscontrol^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
path=c:\documents and settings\cscontrol\Start Menu\Programs\Startup\LimeWire On Startup.lnk
backup=c:\windows\pss\LimeWire On Startup.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^MAHMOOD.EC29D2D7ECFE48B.001^Start Menu^Programs^Startup^Xfire.lnk]
path=c:\documents and settings\MAHMOOD.EC29D2D7ECFE48B.001\Start Menu\Programs\Startup\Xfire.lnk
backup=c:\windows\pss\Xfire.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
--a------ 2008-08-06 07:21 50472 c:\program files\AIM6\aim6.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent]
--a------ 2008-07-17 15:43 587568 c:\program files\BitTorrent\bittorrent.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2008-10-01 17:57 289576 c:\program files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-09-06 14:09 413696 c:\program files\QuickTime\QTTask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SalaatTime]
--------- 2007-08-26 01:38 13443072 c:\program files\Salaat Time\SalaatTime.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Symantec Core LC"=2 (0x2)
"avg8wd"=2 (0x2)
"avg8emc"=2 (0x2)
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Yahoo!\\browser\\ybrowser.exe"=
"c:\\Program Files\\QuickTime\\QuickTimePlayer.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Program Files\\Microsoft Games\\Halo\\halo.exe"=
"c:\\Program Files\\Xfire\\xfire.exe"=
"c:\\WINDOWS\\system32\\fxsclnt.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"192:TCP"= 192:TCP:Halo Trial
"14361:TCP"= 14361:TCP:BitComet 14361 TCP
"14361:UDP"= 14361:UDP:BitComet 14361 UDP
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2008-11-01 97928]
R2 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\Drivers\avgtdix.sys [2008-11-01 76040]
R2 Belkin 54g Wireless USB Network Adapter Service;Belkin 54g Wireless USB Network Adapter;c:\program files\Belkin\Belkin Wireless Network Utility\WLService.exe [2004-03-29 49152]
R2 NwSapAgent;SAP Agent;c:\windows\system32\svchost.exe [2008-04-13 14336]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2007-01-04 24652]
S2 MSSQL$EMMSDE;MSSQL$EMMSDE;c:\program files\Microsoft SQL Server\MSSQL$EMMSDE\Binn\sqlservr.exe [2002-12-17 7520337]
S2 MSSQL$VAIO_VEDB;MSSQL$VAIO_VEDB;c:\program files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe [2002-12-17 7520337]
S3 bkn50USB;Belkin 54Mbps Wireless USB Network Adapter;c:\windows\system32\DRIVERS\rt2500usb.sys [2004-07-16 140416]
S3 Image Converter video recording monitor for VAIO Entertainment;Image Converter video recording monitor for VAIO Entertainment;c:\program files\Sony\Image Converter 2\IcVzMon.exe [2005-02-14 32768]
S3 mamotou;mamotou;c:\windows\system32\DRIVERS\mamotou.sys [2005-11-07 49399]
S3 MaRdPnp;MaRdPnp;c:\windows\system32\DRIVERS\MaRdP2K.sys [2005-08-17 49867]
S3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\ScreamingBAudio.sys [ ]
S3 SQLAgent$EMMSDE;SQLAgent$EMMSDE;c:\program files\Microsoft SQL Server\MSSQL$EMMSDE\Binn\sqlagent.exe [2002-12-17 311872]
S3 SQLAgent$VAIO_VEDB;SQLAgent$VAIO_VEDB;c:\program files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlagent.exe [2002-12-17 311872]
S4 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-11-01 875288]
S4 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-11-01 231704]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5e4b5960-fd42-11dc-a034-00132097ffdc}]
\Shell\AutoRun\command - J:\LaunchU3.exe -a
*Newly Created Service* - APPLE_MOBILE_DEVICE
*Newly Created Service* - PROCEXP90
.
Contents of the 'Scheduled Tasks' folder
2008-10-08 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
2008-11-09 c:\windows\Tasks\At1.job
- c:\windows\system32\wNuO1H6y.exe []
2008-11-10 c:\windows\Tasks\At10.job
- c:\windows\system32\wNuO1H6y.exe []
2008-11-10 c:\windows\Tasks\At11.job
- c:\windows\system32\wNuO1H6y.exe []
2008-11-10 c:\windows\Tasks\At12.job
- c:\windows\system32\wNuO1H6y.exe []
2008-11-10 c:\windows\Tasks\At13.job
- c:\windows\system32\wNuO1H6y.exe []
2008-11-10 c:\windows\Tasks\At14.job
- c:\windows\system32\wNuO1H6y.exe []
2008-11-10 c:\windows\Tasks\At15.job
- c:\windows\system32\wNuO1H6y.exe []
2008-11-10 c:\windows\Tasks\At16.job
- c:\windows\system32\wNuO1H6y.exe []
2008-11-11 c:\windows\Tasks\At17.job
- c:\windows\system32\wNuO1H6y.exe []
2008-11-11 c:\windows\Tasks\At18.job
- c:\windows\system32\wNuO1H6y.exe []
2008-11-11 c:\windows\Tasks\At19.job
- c:\windows\system32\wNuO1H6y.exe []
2008-11-09 c:\windows\Tasks\At2.job
- c:\windows\system32\wNuO1H6y.exe []
2008-11-10 c:\windows\Tasks\At20.job
- c:\windows\system32\wNuO1H6y.exe []
2008-11-10 c:\windows\Tasks\At21.job
- c:\windows\system32\wNuO1H6y.exe []
2008-11-10 c:\windows\Tasks\At22.job
- c:\windows\system32\wNuO1H6y.exe []
2008-11-09 c:\windows\Tasks\At23.job
- c:\windows\system32\wNuO1H6y.exe []
2008-11-10 c:\windows\Tasks\At24.job
- c:\windows\system32\wNuO1H6y.exe []
2008-11-09 c:\windows\Tasks\At25.job
- c:\windows\system32\2uvWeXN3.exe []
2008-11-09 c:\windows\Tasks\At26.job
- c:\windows\system32\2uvWeXN3.exe []
2008-11-09 c:\windows\Tasks\At27.job
- c:\windows\system32\2uvWeXN3.exe []
2008-11-09 c:\windows\Tasks\At28.job
- c:\windows\system32\2uvWeXN3.exe []
2008-11-09 c:\windows\Tasks\At29.job
- c:\windows\system32\2uvWeXN3.exe []
2008-11-09 c:\windows\Tasks\At3.job
- c:\windows\system32\wNuO1H6y.exe []
2008-11-09 c:\windows\Tasks\At30.job
- c:\windows\system32\2uvWeXN3.exe []
2008-11-09 c:\windows\Tasks\At31.job
- c:\windows\system32\2uvWeXN3.exe []
2008-11-09 c:\windows\Tasks\At32.job
- c:\windows\system32\2uvWeXN3.exe []
2008-11-10 c:\windows\Tasks\At33.job
- c:\windows\system32\2uvWeXN3.exe []
2008-11-10 c:\windows\Tasks\At34.job
- c:\windows\system32\2uvWeXN3.exe []
2008-11-10 c:\windows\Tasks\At35.job
- c:\windows\system32\2uvWeXN3.exe []
2008-11-10 c:\windows\Tasks\At36.job
- c:\windows\system32\2uvWeXN3.exe []
2008-11-10 c:\windows\Tasks\At37.job
- c:\windows\system32\2uvWeXN3.exe []
2008-11-10 c:\windows\Tasks\At38.job
- c:\windows\system32\2uvWeXN3.exe []
2008-11-10 c:\windows\Tasks\At39.job
- c:\windows\system32\2uvWeXN3.exe []
2008-11-09 c:\windows\Tasks\At4.job
- c:\windows\system32\wNuO1H6y.exe []
2008-11-10 c:\windows\Tasks\At40.job
- c:\windows\system32\2uvWeXN3.exe []
2008-11-11 c:\windows\Tasks\At41.job
- c:\windows\system32\2uvWeXN3.exe []
2008-11-11 c:\windows\Tasks\At42.job
- c:\windows\system32\2uvWeXN3.exe []
2008-11-11 c:\windows\Tasks\At43.job
- c:\windows\system32\2uvWeXN3.exe []
2008-11-10 c:\windows\Tasks\At44.job
- c:\windows\system32\2uvWeXN3.exe []
2008-11-10 c:\windows\Tasks\At45.job
- c:\windows\system32\2uvWeXN3.exe []
2008-11-10 c:\windows\Tasks\At46.job
- c:\windows\system32\2uvWeXN3.exe []
2008-11-09 c:\windows\Tasks\At47.job
- c:\windows\system32\2uvWeXN3.exe []
2008-11-10 c:\windows\Tasks\At48.job
- c:\windows\system32\2uvWeXN3.exe []
2008-11-09 c:\windows\Tasks\At5.job
- c:\windows\system32\wNuO1H6y.exe []
2008-11-09 c:\windows\Tasks\At6.job
- c:\windows\system32\wNuO1H6y.exe []
2008-11-09 c:\windows\Tasks\At7.job
- c:\windows\system32\wNuO1H6y.exe []
2008-11-09 c:\windows\Tasks\At8.job
- c:\windows\system32\wNuO1H6y.exe []
2008-11-10 c:\windows\Tasks\At9.job
- c:\windows\system32\wNuO1H6y.exe []
.
- - - - ORPHANS REMOVED - - - -
HKCU-Run-WorldTime2006 - (no file)
MSConfigStartUp-Google Update - c:\documents and settings\cscontrol\Local Settings\Application Data\Google\Update\GoogleUpdate.exe

.
------- Supplementary Scan -------
.
FireFox -: Profile - c:\documents and settings\MAHMOOD.EC29D2D7ECFE48B.001\Application Data\Mozilla\Firefox\Profiles\q1omzwv0.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.yahoo.com/
FF -: plugin - c:\program files\DivX\DivX Content Uploader\npUpload.dll
FF -: plugin - c:\program files\DNA\plugins\npbtdna.dll
FF -: plugin - c:\program files\iTunes\Mozilla Plugins\npitunes.dll
FF -: plugin - c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
FF -: plugin - c:\program files\Mozilla Firefox\plugins\npmozax.dll
FF -: plugin - c:\program files\Mozilla Firefox\plugins\npsabffx.dll
FF -: plugin - c:\program files\Mozilla Firefox\plugins\npunagi2.dll
FF -: plugin - c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF -: plugin - c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
FF -: plugin - c:\windows\system32\SuperAdBlocker.com\npsabffx.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-10 18:42:41
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-11-10 18:46:39
ComboFix-quarantined-files.txt 2008-11-11 02:46:14
Pre-Run: 116,649,914,368 bytes free
Post-Run: 117,547,077,632 bytes free
405 --- E O F --- 2008-10-24 10:01:26

Response Number 10

Name: jabuck
Date: November 10, 2008 at 19:20:59 Pacific

Reply:

Open Notepad and copy/paste everything between the X"s into it and make sure the first word (such as KILLALL, Or File, etc.) is at the very top of the page.
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
KILLALL::
File::
c:\windows\system32\webennet.dll
c:\windows\Tasks\At1.job
c:\windows\Tasks\At10.job
c:\windows\Tasks\At11.job
c:\windows\Tasks\At12.job
c:\windows\Tasks\At13.job
c:\windows\Tasks\At14.job
c:\windows\Tasks\At15.job
c:\windows\Tasks\At16.job
c:\windows\Tasks\At18.job
c:\windows\Tasks\At17.job
c:\windows\Tasks\At19.job
c:\windows\Tasks\At2.job
c:\windows\Tasks\At20.job
c:\windows\Tasks\At21.job
c:\windows\Tasks\At22.job
c:\windows\Tasks\At23.job
c:\windows\Tasks\At24.job
c:\windows\Tasks\At25.job
c:\windows\Tasks\At26.job
c:\windows\Tasks\At27.job
c:\windows\Tasks\At28.job
c:\windows\Tasks\At29.job
c:\windows\Tasks\At3.job
c:\windows\Tasks\At30.job
c:\windows\Tasks\At31.job
c:\windows\Tasks\At32.job
c:\windows\Tasks\At33.job
c:\windows\Tasks\At34.job
c:\windows\Tasks\At35.job
c:\windows\Tasks\At36.job
c:\windows\Tasks\At37.job
c:\windows\Tasks\At38.job
c:\windows\Tasks\At39.job
c:\windows\Tasks\At4.job
c:\windows\Tasks\At40.job
c:\windows\Tasks\At41.job
c:\windows\Tasks\At42.job
c:\windows\Tasks\At43.job
c:\windows\Tasks\At44.job
c:\windows\Tasks\At45.job
c:\windows\Tasks\At46.job
c:\windows\Tasks\At47.job
c:\windows\Tasks\At48.job
c:\windows\system32\2uvWeXN3.exe
c:\windows\Tasks\At5.job
c:\windows\system32\wNuO1H6y.exe
c:\windows\Tasks\At6.job
c:\windows\Tasks\At7.job
c:\windows\Tasks\At8.job
c:\windows\Tasks\At9.job
Driver::
Sysutdll
Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"Sysutdll"=-

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Go to File on the top bar and choose" Save As", Change the "Save As Type" to All Files, Name it CFScript.txt then save it to your desktop.
Then drag/drop the CFScript.txt onto ComboFix.exe (the red symbol on your desktop) if combofix does not auto start click "run".
Post a new Combofix log following the previous directions.

Response Number 11

Name: bballboy2011
Date: November 10, 2008 at 21:32:25 Pacific

Reply:

ty so much for all your help
ComboFix 08-11-10.01 - MAHMOOD 2008-11-10 21:07:33.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.167 [GMT -8:00]
Running from: c:\documents and settings\MAHMOOD.EC29D2D7ECFE48B.001\Desktop\Media\BitTorrent\ComboFix.exe
Command switches used :: c:\documents and settings\MAHMOOD.EC29D2D7ECFE48B.001\Desktop\CFScript.txt
* Created a new restore point
[COLOR=RED][B]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/B][/COLOR]
FILE ::
c:\windows\system32\2uvWeXN3.exe
c:\windows\system32\webennet.dll
c:\windows\system32\wNuO1H6y.exe
c:\windows\Tasks\At1.job
c:\windows\Tasks\At10.job
c:\windows\Tasks\At11.job
c:\windows\Tasks\At12.job
c:\windows\Tasks\At13.job
c:\windows\Tasks\At14.job
c:\windows\Tasks\At15.job
c:\windows\Tasks\At16.job
c:\windows\Tasks\At17.job
c:\windows\Tasks\At18.job
c:\windows\Tasks\At19.job
c:\windows\Tasks\At2.job
c:\windows\Tasks\At20.job
c:\windows\Tasks\At21.job
c:\windows\Tasks\At22.job
c:\windows\Tasks\At23.job
c:\windows\Tasks\At24.job
c:\windows\Tasks\At25.job
c:\windows\Tasks\At26.job
c:\windows\Tasks\At27.job
c:\windows\Tasks\At28.job
c:\windows\Tasks\At29.job
c:\windows\Tasks\At3.job
c:\windows\Tasks\At30.job
c:\windows\Tasks\At31.job
c:\windows\Tasks\At32.job
c:\windows\Tasks\At33.job
c:\windows\Tasks\At34.job
c:\windows\Tasks\At35.job
c:\windows\Tasks\At36.job
c:\windows\Tasks\At37.job
c:\windows\Tasks\At38.job
c:\windows\Tasks\At39.job
c:\windows\Tasks\At4.job
c:\windows\Tasks\At40.job
c:\windows\Tasks\At41.job
c:\windows\Tasks\At42.job
c:\windows\Tasks\At43.job
c:\windows\Tasks\At44.job
c:\windows\Tasks\At45.job
c:\windows\Tasks\At46.job
c:\windows\Tasks\At47.job
c:\windows\Tasks\At48.job
c:\windows\Tasks\At5.job
c:\windows\Tasks\At6.job
c:\windows\Tasks\At7.job
c:\windows\Tasks\At8.job
c:\windows\Tasks\At9.job
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\webennet.dll
c:\windows\Tasks\At1.job
c:\windows\Tasks\At10.job
c:\windows\Tasks\At11.job
c:\windows\Tasks\At12.job
c:\windows\Tasks\At13.job
c:\windows\Tasks\At14.job
c:\windows\Tasks\At15.job
c:\windows\Tasks\At16.job
c:\windows\Tasks\At17.job
c:\windows\Tasks\At18.job
c:\windows\Tasks\At19.job
c:\windows\Tasks\At2.job
c:\windows\Tasks\At20.job
c:\windows\Tasks\At21.job
c:\windows\Tasks\At22.job
c:\windows\Tasks\At23.job
c:\windows\Tasks\At24.job
c:\windows\Tasks\At25.job
c:\windows\Tasks\At26.job
c:\windows\Tasks\At27.job
c:\windows\Tasks\At28.job
c:\windows\Tasks\At29.job
c:\windows\Tasks\At3.job
c:\windows\Tasks\At30.job
c:\windows\Tasks\At31.job
c:\windows\Tasks\At32.job
c:\windows\Tasks\At33.job
c:\windows\Tasks\At34.job
c:\windows\Tasks\At35.job
c:\windows\Tasks\At36.job
c:\windows\Tasks\At37.job
c:\windows\Tasks\At38.job
c:\windows\Tasks\At39.job
c:\windows\Tasks\At4.job
c:\windows\Tasks\At40.job
c:\windows\Tasks\At41.job
c:\windows\Tasks\At42.job
c:\windows\Tasks\At43.job
c:\windows\Tasks\At44.job
c:\windows\Tasks\At45.job
c:\windows\Tasks\At46.job
c:\windows\Tasks\At47.job
c:\windows\Tasks\At48.job
c:\windows\Tasks\At5.job
c:\windows\Tasks\At6.job
c:\windows\Tasks\At7.job
c:\windows\Tasks\At8.job
c:\windows\Tasks\At9.job
.
((((((((((((((((((((((((( Files Created from 2008-10-11 to 2008-11-11 )))))))))))))))))))))))))))))))
.
2008-11-10 16:26 . 2008-11-10 16:26 <DIR> d-------- c:\documents and settings\MAHMOOD.EC29D2D7ECFE48B.001\Application Data\skypePM
2008-11-09 16:45 . 2008-11-09 16:45 <DIR> d-------- c:\documents and settings\cscontrol\Application Data\skypePM
2008-11-09 16:45 . 2008-11-09 16:45 56 --ah----- c:\windows\system32\ezsidmv.dat
2008-11-09 16:43 . 2008-11-09 20:35 <DIR> d-------- c:\documents and settings\cscontrol\Application Data\Skype
2008-11-09 16:42 . 2008-11-09 16:42 <DIR> d-------- c:\program files\Skype
2008-11-09 16:42 . 2008-11-09 16:42 <DIR> d-------- c:\program files\Common Files\Skype
2008-11-08 19:51 . 2008-11-08 19:51 <DIR> d-------- c:\documents and settings\MAHMOOD.EC29D2D7ECFE48B.001\Application Data\Malwarebytes
2008-11-07 22:16 . 2008-11-08 08:43 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-11-07 22:16 . 2008-11-07 22:16 <DIR> d-------- c:\documents and settings\cscontrol\Application Data\Malwarebytes
2008-11-07 22:16 . 2008-11-07 22:16 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2008-11-07 22:16 . 2008-10-22 16:28 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-11-07 22:16 . 2008-10-22 16:28 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-11-07 21:08 . 2008-07-18 21:09 325,832 --a------ c:\windows\system32\wucltui.dll
2008-11-07 21:08 . 2008-07-18 21:07 270,880 --a------ c:\windows\system32\mucltui.dll
2008-11-07 21:08 . 2008-07-18 21:07 210,976 --a------ c:\windows\system32\muweb.dll
2008-11-07 21:08 . 2008-07-18 21:09 205,000 --a------ c:\windows\system32\wuweb.dll
2008-11-07 21:08 . 2008-10-16 14:09 43,544 --a------ c:\windows\system32\wups2.dll
2008-11-07 21:08 . 2008-10-16 14:08 34,328 --a------ c:\windows\system32\wups.dll
2008-11-07 21:08 . 2008-10-16 14:08 34,328 --a--c--- c:\windows\system32\dllcache\wups.dll
2008-11-07 21:07 . 2008-07-18 21:09 1,811,656 --a------ c:\windows\system32\wuaueng.dll
2008-11-07 21:07 . 2008-07-18 21:09 563,912 --a------ c:\windows\system32\wuapi.dll
2008-11-07 21:07 . 2008-07-18 21:09 215,752 --a------ c:\windows\system32\wuaucpl.cpl
2008-11-07 21:07 . 2008-07-18 21:10 94,920 --a------ c:\windows\system32\cdm.dll
2008-11-07 21:07 . 2008-07-18 21:10 53,448 --a------ c:\windows\system32\wuauclt.exe
2008-11-07 20:35 . 2008-11-07 20:35 <DIR> d-------- c:\program files\Trend Micro
2008-11-07 17:56 . 2008-11-07 17:56 <DIR> d-------- c:\program files\Visual Networks
2008-11-06 17:17 . 2008-11-06 17:17 578,560 --a--c--- c:\windows\system32\dllcache\user32.dll
2008-11-06 17:13 . 2008-11-06 17:13 <DIR> d-------- c:\windows\ERUNT
2008-11-06 17:05 . 2008-11-06 19:50 <DIR> d-------- C:\SDFix
2008-11-02 09:00 . 2008-11-03 09:02 <DIR> d-------- c:\documents and settings\NetworkService\Application Data\AVGTOOLBAR
2008-11-02 05:18 . 2008-11-08 14:35 <DIR> d-------- c:\documents and settings\MAHMOOD.EC29D2D7ECFE48B.001\Application Data\AVGTOOLBAR
2008-11-02 03:13 . 2008-11-08 20:00 <DIR> d-------- c:\documents and settings\LocalService\Application Data\MEGAUPLOADTOOLBAR
2008-11-02 03:13 . 2008-11-02 03:13 <DIR> d-------- c:\documents and settings\LocalService\Application Data\EmailNotifier
2008-11-02 03:13 . 2008-11-02 03:18 <DIR> d-------- c:\documents and settings\LocalService\Application Data\AVGTOOLBAR
2008-11-02 03:13 . 2008-11-02 04:08 <DIR> d-------- c:\documents and settings\LocalService\Application Data\ATTTOOLBAR
2008-11-01 23:22 . 2008-11-10 08:56 <DIR> d-------- c:\windows\system32\drivers\Avg
2008-11-01 23:22 . 2008-11-06 19:50 <DIR> d-------- c:\documents and settings\cscontrol\Application Data\AVGTOOLBAR
2008-11-01 23:22 . 2008-11-01 23:22 97,928 --a------ c:\windows\system32\drivers\avgldx86.sys
2008-11-01 23:22 . 2008-11-01 23:22 76,040 --a------ c:\windows\system32\drivers\avgtdix.sys
2008-11-01 23:22 . 2008-11-01 23:22 10,520 --a------ c:\windows\system32\avgrsstx.dll
2008-11-01 23:06 . 2008-11-01 23:06 <DIR> d-------- c:\program files\Lavasoft
2008-11-01 23:06 . 2008-11-01 23:09 <DIR> d-------- c:\documents and settings\All Users\Application Data\Lavasoft
2008-11-01 21:01 . 2008-11-08 20:05 <DIR> d-------- c:\documents and settings\NetworkService\Application Data\MEGAUPLOADTOOLBAR
2008-11-01 21:01 . 2008-11-01 23:21 <DIR> d-------- c:\documents and settings\NetworkService\Application Data\EmailNotifier
2008-11-01 21:00 . 2008-11-02 14:02 <DIR> d-------- c:\documents and settings\NetworkService\Application Data\ATTTOOLBAR
2008-10-29 17:24 . 2008-10-29 17:24 42,320 --a------ c:\windows\system32\xfcodec.dll
2008-10-28 21:02 . 2007-11-14 14:18 553 --a------ c:\windows\USetup.iss
2008-10-28 21:00 . 2008-09-30 15:38 2,168,320 --a------ c:\windows\MicCal.exe
2008-10-28 21:00 . 2007-11-20 17:15 1,826,816 --a------ c:\windows\SkyTel.exe
2008-10-28 21:00 . 2008-08-05 19:10 1,684,736 --a------ c:\windows\system32\drivers\Ambfilt.sys
2008-10-28 21:00 . 2006-01-04 14:41 1,389,056 --a------ c:\windows\system32\drivers\Monfilt.sys
2008-10-28 21:00 . 2008-09-19 16:48 1,200,128 --a------ c:\windows\RtlUpd.exe
2008-10-28 21:00 . 2008-03-13 13:52 266,240 --a------ c:\windows\system32\RTSndMgr.CPL
2008-10-28 20:59 . 2008-08-25 15:17 528,384 --a------ c:\windows\RtlExUpd.dll
2008-10-28 20:59 . 2008-10-28 20:59 319,488 --a------ c:\windows\HideWin.exe
2008-10-28 20:42 . 2008-10-28 20:42 <DIR> d-------- c:\program files\Uniblue
2008-10-28 20:42 . 2008-10-28 20:42 <DIR> d-------- c:\documents and settings\MAHMOOD.EC29D2D7ECFE48B.001\Application Data\Uniblue
2008-10-28 20:42 . 2008-10-28 20:46 <DIR> d-------- c:\documents and settings\All Users\Application Data\DriverScanner
2008-10-28 20:41 . 2008-10-28 20:42 <DIR> d--h-c--- c:\documents and settings\All Users\Application Data\{D5ABFFAD-D592-4F98-B02B-587125B4801F}
2008-10-23 21:21 . 2008-10-15 08:34 337,408 -----c--- c:\windows\system32\dllcache\netapi32.dll
2008-10-22 21:19 . 2008-10-22 21:19 <DIR> d-------- C:\Xfire
2008-10-15 07:42 . 2008-09-08 02:41 333,824 -----c--- c:\windows\system32\dllcache\srv.sys
2008-10-15 07:41 . 2008-08-14 02:11 2,189,184 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe
2008-10-15 07:41 . 2008-08-14 02:09 2,145,280 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe
2008-10-15 07:41 . 2008-08-14 01:33 2,066,048 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe
2008-10-15 07:41 . 2008-08-14 01:33 2,023,936 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe
2008-10-15 07:41 . 2008-09-15 04:12 1,846,400 -----c--- c:\windows\system32\dllcache\win32k.sys
2008-10-12 14:25 . 2008-10-12 14:26 <DIR> d-------- c:\program files\iTunes
2008-10-12 14:25 . 2008-10-12 14:26 <DIR> d-------- c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-11 05:02 --------- d-----w c:\documents and settings\MAHMOOD.EC29D2D7ECFE48B.001\Application Data\Xfire
2008-11-11 03:23 --------- d-----w c:\program files\Steam
2008-11-11 03:05 --------- d-----w c:\documents and settings\All Users\Application Data\Visual Networks
2008-11-11 02:31 --------- d-----w c:\documents and settings\MAHMOOD.EC29D2D7ECFE48B.001\Application Data\Skype
2008-11-11 02:07 --------- d-----w c:\program files\Common Files\Symantec Shared
2008-11-11 02:07 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec
2008-11-11 01:52 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2008-11-11 01:39 --------- d-----w c:\program files\EA GAMES
2008-11-10 15:26 --------- d-----w c:\program files\StudySmart Demo 4.0
2008-11-10 04:35 --------- d-----w c:\documents and settings\cscontrol\Application Data\Xfire
2008-11-10 00:42 --------- d-----w c:\documents and settings\All Users\Application Data\Skype
2008-11-09 23:38 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2008-11-09 19:07 --------- d-----w c:\program files\Yahoo!
2008-11-09 19:07 --------- d-----w c:\program files\Common Files\Scanner
2008-11-09 04:16 --------- d-----w c:\documents and settings\All Users\Application Data\ATTToolbar
2008-11-08 22:35 --------- d-----w c:\documents and settings\MAHMOOD.EC29D2D7ECFE48B.001\Application Data\MEGAUPLOADTOOLBAR
2008-11-08 01:57 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-08 01:50 --------- d-----w c:\documents and settings\cscontrol\Application Data\LimeWire
2008-11-07 03:50 --------- d-----w c:\program files\Xfire
2008-11-07 03:50 --------- d-----w c:\documents and settings\MAHMOOD.EC29D2D7ECFE48B.001\Application Data\mIRC
2008-11-07 03:32 --------- d-----w c:\documents and settings\cscontrol\Application Data\MegauploadToolbar
2008-11-02 07:22 --------- d-----w c:\documents and settings\All Users\Application Data\Avg8
2008-11-02 06:19 --------- d-----w c:\documents and settings\cscontrol\Application Data\mIRC
2008-10-30 01:24 --------- d-----w c:\documents and settings\MAHMOOD.EC29D2D7ECFE48B.001\Application Data\LimeWire
2008-10-29 05:00 --------- d-----w c:\program files\Realtek
2008-10-14 01:26 4,879,360 ----a-w c:\windows\system32\drivers\RtkHDAud.sys
2008-10-12 22:25 --------- d-----w c:\program files\iPod
2008-10-12 21:13 23 ----a-w c:\documents and settings\MAHMOOD.EC29D2D7ECFE48B.001\jagex_runescape_preferences.dat
2008-10-09 21:54 17,021,440 ----a-w c:\windows\RTHDCPL.exe
2008-10-01 20:01 32,000 ----a-w c:\windows\system32\drivers\usbaapl.sys
2008-09-18 22:55 --------- d-----w c:\program files\LimeWire
2008-09-18 22:26 --------- d-----w c:\program files\QuickTime
2008-09-18 22:25 --------- d-----w c:\program files\Common Files\Apple
2008-08-19 20:26 77,824 ----a-w c:\windows\SOUNDMAN.exe
2008-08-04 02:45 23 ----a-w c:\documents and settings\cscontrol\jagex_runescape_preferences.dat
2007-06-06 15:35 87,992 ----a-w c:\documents and settings\MAHMOOD.EC29D2D7ECFE48B.001\Application Data\GDIPFONTCACHEV1.DAT
2007-05-20 19:51 118 ----a-w c:\documents and settings\MAHMOOD.EC29D2D7ECFE48B.001\Application Data\MTC-savedfolder.dat
2007-05-09 19:01 56,912 ----a-w c:\documents and settings\MAHMOOD.EC29D2D7ECFE48B.001\g2mdlhlpx.exe
2007-03-12 06:02 6,072 -c--a-w c:\documents and settings\All Users\Application Data\ypinfo.bin
2005-10-12 05:54 221,184 ----a-w c:\documents and settings\MAHMOOD.EC29D2D7ECFE48B.001\ctapshr.dll
2006-10-12 03:09 94,208 --sha-w c:\windows\system32\SalaatTime.dll
2008-06-16 01:10 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008061520080616\index.dat
.
((((((((((((((((((((((((((((( snapshot@2008-11-10_18.45.35.93 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-04-14 00:11:56 552,490 ---ha-w c:\windows\system32\keripapi\kbduwico.dll
+ 2008-04-14 00:11:56 554,008 ---ha-w c:\windows\system32\keripapi\kbduwico.dll
+ 2008-11-11 05:13:18 16,384 ----atw c:\windows\temp\Perflib_Perfdata_214.dat
+ 2008-11-11 05:13:19 16,384 ----atw c:\windows\temp\Perflib_Perfdata_290.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A057A204-BACC-4D26-C39E-35F1D2A32EC8}]
2008-08-04 12:44 1947080 --a------ c:\progra~1\MEGAUP~1\MEGAUP~1.DLL
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{A057A204-BACC-4D26-C39E-35F1D2A32EC8}"= "c:\progra~1\MEGAUP~1\MEGAUP~1.DLL" [2008-08-04 1947080]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{A057A204-BACC-4D26-C39E-35F1D2A32EC8}"= "c:\progra~1\MEGAUP~1\MEGAUP~1.DLL" [2008-08-04 1947080]
[HKEY_CLASSES_ROOT\clsid\{a057a204-bacc-4d26-c39e-35f1d2a32ec8}]
[HKEY_CLASSES_ROOT\megauploadtoolbar.MEGAUPLOADTOOLBAR]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SalaatTime"="c:\program files\Salaat Time\SalaatTime.exe" [2007-08-26 13443072]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-13 1695232]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-04-01 486856]
"AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 120\axcmd.exe" [2008-03-20 217544]
"Aim6"="c:\program files\AIM6\aim6.exe" [2008-08-06 50472]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-06-06 155648]
"VZRemoteCommander"="c:\program files\Sony\VAIO Zone Remote Commander\AvRmtCtr.exe" [2005-01-31 192512]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb06.exe" [2002-07-11 188416]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-06-06 118784]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-03-22 339968]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2006-11-21 842584]
"SsAAD.exe"="c:\progra~1\sony\SONICS~1\SsAAD.exe" [2005-01-24 81920]
"BJCFD"="c:\program files\BroadJump\Client Foundation\CFD.exe" [2002-09-10 368706]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-08-02 13570048]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"AT&T Yahoo! Dial Connection Manager"="c:\program files\SBC Yahoo!\Connection Manager\ConnectionManager.exe" [2007-05-11 1158248]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-08-02 86016]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-09-05 185896]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-09-03 111936]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2008-11-01 1234712]
"YOP"="c:\progra~1\Yahoo!\YOP\yop.exe" [2007-10-26 509224]
"YBrowser"="c:\progra~1\Yahoo!\browser\ybrwicon.exe" [2006-07-21 129536]
"VAIO Update 2"="c:\program files\Sony\VAIO Update 2\VAIOUpdt.exe" [2005-01-14 151552]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-09-06 413696]
"High Definition Audio Property Page Shortcut"="HDAudPropShortcut.exe" [2004-08-12 c:\windows\system32\Hdaudpropshortcut.exe]
"AGRSMMSG"="AGRSMMSG.exe" [2004-10-08 c:\windows\AGRSMMSG.exe]
"nwiz"="nwiz.exe" [2008-08-02 c:\windows\system32\nwiz.exe]
"SoundMan"="SOUNDMAN.EXE" [2008-08-19 c:\windows\SOUNDMAN.EXE]
"AlcWzrd"="ALCWZRD.EXE" [2008-06-19 c:\windows\ALCWZRD.EXE]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-04 258048]
HP Image Zone Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-04 53248]
Service Manager.lnk - c:\program files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2002-12-17 74308]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoViewOnDrive"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.dvsd"= c:\progra~1\COMMON~1\SONYSH~1\VideoLib\sonydv.dll
"VIDC.XFR1"= xfcodec.dll
[HKLM\~\startupfolder\C:^Documents and Settings^cscontrol^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
path=c:\documents and settings\cscontrol\Start Menu\Programs\Startup\LimeWire On Startup.lnk
backup=c:\windows\pss\LimeWire On Startup.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^MAHMOOD.EC29D2D7ECFE48B.001^Start Menu^Programs^Startup^Xfire.lnk]
path=c:\documents and settings\MAHMOOD.EC29D2D7ECFE48B.001\Start Menu\Programs\Startup\Xfire.lnk
backup=c:\windows\pss\Xfire.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
--a------ 2008-08-06 07:21 50472 c:\program files\AIM6\aim6.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent]
--a------ 2008-07-17 15:43 587568 c:\program files\BitTorrent\bittorrent.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2008-10-01 17:57 289576 c:\program files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-09-06 14:09 413696 c:\program files\QuickTime\QTTask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SalaatTime]
--------- 2007-08-26 01:38 13443072 c:\program files\Salaat Time\SalaatTime.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Symantec Core LC"=2 (0x2)
"avg8wd"=2 (0x2)
"avg8emc"=2 (0x2)
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Yahoo!\\browser\\ybrowser.exe"=
"c:\\Program Files\\QuickTime\\QuickTimePlayer.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Program Files\\Microsoft Games\\Halo\\halo.exe"=
"c:\\Program Files\\Xfire\\xfire.exe"=
"c:\\WINDOWS\\system32\\fxsclnt.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"192:TCP"= 192:TCP:Halo Trial
"14361:TCP"= 14361:TCP:BitComet 14361 TCP
"14361:UDP"= 14361:UDP:BitComet 14361 UDP
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2008-11-01 97928]
R2 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\Drivers\avgtdix.sys [2008-11-01 76040]
R2 Belkin 54g Wireless USB Network Adapter Service;Belkin 54g Wireless USB Network Adapter;c:\program files\Belkin\Belkin Wireless Network Utility\WLService.exe [2004-03-29 49152]
R2 MSSQL$EMMSDE;MSSQL$EMMSDE;c:\program files\Microsoft SQL Server\MSSQL$EMMSDE\Binn\sqlservr.exe [2002-12-17 7520337]
R2 MSSQL$VAIO_VEDB;MSSQL$VAIO_VEDB;c:\program files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe [2002-12-17 7520337]
R2 NwSapAgent;SAP Agent;c:\windows\system32\svchost.exe [2008-04-13 14336]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2007-01-04 24652]
S3 bkn50USB;Belkin 54Mbps Wireless USB Network Adapter;c:\windows\system32\DRIVERS\rt2500usb.sys [2004-07-16 140416]
S3 Image Converter video recording monitor for VAIO Entertainment;Image Converter video recording monitor for VAIO Entertainment;c:\program files\Sony\Image Converter 2\IcVzMon.exe [2005-02-14 32768]
S3 mamotou;mamotou;c:\windows\system32\DRIVERS\mamotou.sys [2005-11-07 49399]
S3 MaRdPnp;MaRdPnp;c:\windows\system32\DRIVERS\MaRdP2K.sys [2005-08-17 49867]
S3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\ScreamingBAudio.sys [ ]
S3 SQLAgent$EMMSDE;SQLAgent$EMMSDE;c:\program files\Microsoft SQL Server\MSSQL$EMMSDE\Binn\sqlagent.exe [2002-12-17 311872]
S3 SQLAgent$VAIO_VEDB;SQLAgent$VAIO_VEDB;c:\program files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlagent.exe [2002-12-17 311872]
S4 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-11-01 875288]
S4 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-11-01 231704]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5e4b5960-fd42-11dc-a034-00132097ffdc}]
\Shell\AutoRun\command - J:\LaunchU3.exe -a
.
Contents of the 'Scheduled Tasks' folder
2008-10-08 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
.
- - - - ORPHANS REMOVED - - - -
HKLM-Run-HP Software Update - c:\program files\HP\HP Software Update\HPWuSchd2.exe
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-10 21:18:32
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: c:\windows\explorer.exe
-> ?:\windows\System32\CSCDLL.dll
.
r Running Proce
.
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Belkin\Belkin Wireless Network Utility\WLanCfgG.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\PnkBstrA.exe
c:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
c:\program files\Viewpoint\Viewpoint Manager\ViewMgr.exe
c:\windows\system32\wscntfy.exe
c:\program files\Common Files\Sony Shared\VAIO Entertainment\VzRs\VzRs.exe
c:\windows\system32\rundll32.exe
c:\program files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
c:\progra~1\Yahoo!\browser\ycommon.exe
c:\program files\HP\Digital Imaging\bin\hpqgalry.exe
c:\windows\system32\msiexec.exe
c:\program files\AVG\AVG8\avgrsx.exe
c:\program files\AVG\AVG8\avgrsx.exe
.
**************************************************************************
.
Completion time: 2008-11-10 21:28:55 - machine was rebooted
ComboFix-quarantined-files.txt 2008-11-11 05:28:50
ComboFix2.txt 2008-11-11 02:46:40
Pre-Run: 118,361,063,424 bytes free
Post-Run: 118,352,834,560 bytes free
412 --- E O F --- 2008-10-24 10:01:26

Response Number 12

Name: jabuck
Date: November 11, 2008 at 15:19:30 Pacific

Reply:

Empty the restore folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok.

Download ATF Cleaner from this link:
http://www.majorgeeks.com/ATF_Cleaner_d4949.html
Run ATF-Cleaner
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
Please run Esets online scanner from this link:
ESET
1. Note: You will need to use Internet explorer for this scan
2. Tick the box next to YES, I accept the Terms of Use.
3. Click Start
4. When asked, allow the activex control to install
5. Click Start
6. Make sure that the option Remove found threats is unticked ( Iwant to see what is found first), and the option Scan unwanted applications is checked
7. Click Scan
8. Wait for the scan to finish
9. Use notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
10. Copy and paste that log in your next reply.

Sponsored Link

Ads by Google

recycled virus

please help 9 trojanhorse...

Post Locked

This post is quite old and has been locked from receiving new replies. Please create a new posting instead.

Go to Security and Virus Forum Home

Sponsored links

Ads by Google

Results for: Trojan Horse Clicker NEED HELP!

Trojan Horse Clicker.FMQ

Summary

www.computing.net/answers/security/trojan-horse-clickerfmq/21244.html

Trojan Horse Clicker

Summary

www.computing.net/answers/security/trojan-horse-clicker/19367.html

Multiple Trojan Horse Agent2.LEA. Help!

Summary

www.computing.net/answers/security/multiple-trojan-horse-agent2lea-help/26624.html

From the Geek Dictionary
religion - A set of beliefs that all human affairs are preordained and controlled by s...

Ask a Question!

Weekly Poll
What do you think of the new preview of Chrome OS?

Poll Finishes In 6 Days.
Discuss in The Lounge
Poll History

Recent Posts
Links won't open

cut question

Imaging with easy restore

Thin client question

Cant re-install XP after a major crash

All Awaiting Reply

Tom's News
Woman Tracks Down Club Attacker on Facebook

Geolocation Functions Come to Twitter

New Craigslist Trend: Trade Sex for Rent?

Law Firm Investigates MS Over Xbox Live Bans

Amazon Charges $25 for Palm Pixi and $80 for Pre

More Tom's Guide News

Data Recovery

Manufacturer List | About Us | Advertising Info | Contact Us
The information on Computing.Net is the opinions of its users. Such opinions may not be accurate and they are to be used at your own risk. Computing.Net cannot verify the validity of the statements made on this site. Computing.Net and Computing.Net LLC hereby disclaim all responsibility and liability for the content of Computing.Net and its accuracy.
PLEASE READ THE FULL DISCLAIMER AND LEGAL TERMS BY CLICKING HERE