i down loaded modem booster and run it now my internet keep's opening on it's own with cr** pages iv never seen. one is french i think and one about blog can some one help THANK'S WILDCHILD TIME STOP'S FOR NO ONE

We can run a few scans to check for viri/spyware. Please download SmitFraudFix from this link http://siri.urz.free.fr/Fix/Smitfra... Then extract the contents to your desktop. !!!! Only run option #1 as runing the other options on an uninfected computer will damage the desktop.!!!! Open the "SmitfraudFix" folder and double-click "smitfraudfix.cmd" Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present). Please copy/paste the content of that report into your next reply. Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user. Please download and install the latest version of HijackThis v2.0.2: Download the HijackThis Installer from this link: HijackThis 1. Save " HJTInstall.exe" to your desktop. 2. Double click on HJTInstall.exe to run the program. 3. By default it will install to C:\Program Files\Trend Micro\HijackThis. 4. Accept the license agreement by clicking the "I Accept" button. 5.Click on the "Do a system scan and save a log file" button. It will scan and then ask you to save the log. 6. Click "Save log" to save the log file and then the log will open in Notepad. 7. Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log. 8. Paste the log in your next reply. 9. Do NOT have HijackThis fix anything yet! Most of what it finds will be harmless or even required.

SmitFraudFix v2.240 Scan done at 7:03:39.45, 23/10/2007 Run from C:\Documents and Settings\Lee\Desktop\SmitfraudFix\SmitfraudFix OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in normal mode »»»»»»»»»»»»»»»»»»»»»»»» Process C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Virgin Broadband\PCguard\Fws.exe F:\Program Files\AlienGUIse\wbload.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe C:\WINDOWS\Explorer.exe C:\WINDOWS\runservice.exe F:\Program Files\3ds max\mentalray\satellite\raysat_3dsmax9_32server.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Raxco\PerfectDisk\PDAgent.exe f:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Raxco\PerfectDisk\PDEngine.exe C:\WINDOWS\system32\RUNDLL32.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\Program Files\Macrogaming\SweetIM\SweetIM.exe C:\WINDOWS\Logi_MwX.exe C:\WINDOWS\Mixer.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\WINDOWS\system32\System32i.exe C:\Program Files\Virgin Broadband\advisor\Broadbandadvisor.exe C:\Program Files\Virgin Broadband\PCguard\Rps.exe C:\Windows\system32\isys32.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\uTorrent\uTorrent.exe C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\PROGRA~1\INCRED~1\bin\IMApp.exe C:\Program Files\Virgin Broadband\advisor\BroadbandadvisorComHandler.exe C:\Program Files\Virgin Broadband\PCguard\rpsupdaterR.exe F:\Program Files\MSN Messenger\Device Manager\Messenger\YahooMessenger.exe F:\PROGRA~2\MSNMES~1\DEVICE~1\MESSEN~1\YServer.exe F:\Program Files\Common Files\firefox.exe C:\WINDOWS\system32\cmd.exe »»»»»»»»»»»»»»»»»»»»»»»» hosts »»»»»»»»»»»»»»»»»»»»»»»» C:\ »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32 »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Lee »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Lee\Application Data »»»»»»»»»»»»»»»»»»»»»»»» Start Menu »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Lee\FAVORI~1 »»»»»»»»»»»»»»»»»»»»»»»» Desktop »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="wbsys.dll" »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] »»»»»»»»»»»»»»»»»»»»»»»» Rustock »»»»»»»»»»»»»»»»»»»»»»»» DNS Description: NVIDIA nForce Networking Controller - Packet Scheduler Miniport DNS Server Search Order: 62.31.64.39 DNS Server Search Order: 62.31.112.39 DNS Server Search Order: 62.31.144.39 HKLM\SYSTEM\CCS\Services\Tcpip\..\{7B924B88-E971-4403-B864-83E080B5C026}: DhcpNameServer=62.31.64.39 62.31.112.39 62.31.144.39 HKLM\SYSTEM\CS1\Services\Tcpip\..\{7B924B88-E971-4403-B864-83E080B5C026}: DhcpNameServer=62.31.64.39 62.31.112.39 62.31.144.39 HKLM\SYSTEM\CS2\Services\Tcpip\..\{7B924B88-E971-4403-B864-83E080B5C026}: DhcpNameServer=62.31.64.39 62.31.112.39 62.31.144.39 HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=62.31.64.39 62.31.112.39 62.31.144.39 HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=62.31.64.39 62.31.112.39 62.31.144.39 HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=62.31.64.39 62.31.112.39 62.31.144.39 »»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection »»»»»»»»»»»»»»»»»»»»»»»» End THANK'S WILDCHILD TIME STOP'S FOR NO ONE

And the Hijack This log please.

Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 17:32:33, on 23/10/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Virgin Broadband\PCguard\Fws.exe F:\Program Files\AlienGUIse\wbload.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe C:\WINDOWS\Explorer.exe C:\WINDOWS\runservice.exe F:\Program Files\3ds max\mentalray\satellite\raysat_3dsmax9_32server.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Raxco\PerfectDisk\PDAgent.exe f:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Raxco\PerfectDisk\PDEngine.exe C:\WINDOWS\system32\RUNDLL32.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\Program Files\Macrogaming\SweetIM\SweetIM.exe C:\WINDOWS\Logi_MwX.exe C:\WINDOWS\Mixer.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\WINDOWS\system32\System32i.exe C:\Program Files\Virgin Broadband\advisor\Broadbandadvisor.exe C:\Program Files\Virgin Broadband\PCguard\Rps.exe C:\Windows\system32\isys32.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\uTorrent\uTorrent.exe C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\PROGRA~1\INCRED~1\bin\IMApp.exe C:\Program Files\Virgin Broadband\advisor\BroadbandadvisorComHandler.exe C:\Program Files\Virgin Broadband\PCguard\rpsupdaterR.exe F:\Program Files\MSN Messenger\Device Manager\Messenger\YahooMessenger.exe F:\PROGRA~2\MSNMES~1\DEVICE~1\MESSEN~1\YServer.exe F:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ebay.co.uk/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?Lin... R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?Lin... R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?Lin... R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?Lin... R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll O2 - BHO: Pop-Up Blocker BHO - {3C060EA2-E6A9-4E49-A530-D4657B8C449A} - C:\Program Files\Virgin Broadband\PCguard\pkR.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.exe C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.exe C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.exe O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [MSUpdater] System32i.exe O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup O4 - HKLM\..\Run: [QuickTime Task] "F:\Program Files\Adobe\quick time\QTTask.exe" -atboottime O4 - HKLM\..\Run: [Broadbandadvisor.exe] "C:\Program Files\Virgin Broadband\advisor\Broadbandadvisor.exe" /AUTORUN O4 - HKLM\..\Run: [PCguard] "C:\Program Files\Virgin Broadband\PCguard\Rps.exe" O4 - HKLM\..\Run: [-FreedomNeedsReboot] "C:\Program Files\Virgin Broadband\PCguard\ZkRunOnceR.exe" O4 - HKLM\..\Run: [MonAppli] C:\Windows\system32\isys32.exe O4 - HKLM\..\RunServices: [MSUpdater] System32i.exe O4 - HKLM\..\RunOnce: [IndexCleaner] "C:\Program Files\Virgin Broadband\PCguard\IdxClnR.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [IncrediMail] C:\PROGRA~1\INCRED~1\bin\IncMail.exe /c O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe" O4 - HKCU\..\Run: [AlcoholAutomount] "F:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount O4 - HKCU\..\RunOnce: [IndexCleaner] "C:\Program Files\Virgin Broadband\PCguard\IdxClnR.exe" O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.exe (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.exe (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.exe (User 'Default user') O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: http://toolbar.imageshack.us O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52... O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win... O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.co... O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic... O16 - DPF: {85D1F3B2-2A21-11D7-97B9-0010DC2A6243} (SecureLogin class) - http://secure2.comned.com/signuptem... O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Unknown owner - C:\Program Files\Bonjour\mDNSResponder.exe (file missing) O23 - Service: DvpApi (dvpapi) - Authentium, Inc. - C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINDOWS\runservice.exe O23 - Service: mental ray 3.5 Satellite (32-bit) (mi-raysat_3dsmax9_32) - Unknown owner - F:\Program Files\3ds max\mentalray\satellite\raysat_3dsmax9_32server.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDAgent.exe O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe O23 - Service: Virgin Broadband PCguard Update Service (RPSUpdaterR) - Virgin Media - C:\Program Files\Virgin Broadband\PCguard\rpsupdaterR.exe O23 - Service: PCguard Firewall (RP_FWS) - Virgin Media - C:\Program Files\Virgin Broadband\PCguard\Fws.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - f:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - Unknown owner - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe (file missing) O23 - Service: Ventrilo - Unknown owner - F:\program flie\ventrilo\ventrilo_svc.exe (file missing) -- End of file - 10776 bytes THANK'S WILDCHILD TIME STOP'S FOR NO ONE

Please download ComboFix to the desktop from this link: http://download.bleepingcomputer.com/sUBs/ComboFix.exe Double-click combofix.exe Follow the prompts. (Don't click on the window while the program is running, it may cause your system to hang.) Please post the log it produces.

ComboFix 07-10-23.1 - Lee 2007-10-24 7:07:15.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.785 [GMT 1:00] Running from: C:\Documents and Settings\Lee\My Documents\Downloads\ComboFix.exe . ((((((((((((((((((((((((( Files Created from 2007-09-24 to 2007-10-24 ))))))))))))))))))))))))))))))) . 2007-10-23 22:27 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-10-23 20:26 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2007-10-23 20:26 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-10-23 20:26 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-10-23 20:26 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2007-10-21 19:01 <DIR> d----c--- C:\My_new_mod 2007-10-21 19:01 <DIR> d----c--- C:\My_Mod 2007-10-20 15:32 <DIR> d-------- C:\Program Files\Raxco 2007-10-20 15:32 <DIR> d-------- C:\Program Files\Common Files\Scanner 2007-10-20 15:32 <DIR> d-------- C:\Program Files\Common Files\Authentium 2007-10-20 15:32 <DIR> d-------- C:\Program Files\CA 2007-10-20 15:32 55,296 --a------ C:\WINDOWS\system32\drivers\rp_skt32.sys 2007-10-20 15:32 48,384 --a------ C:\WINDOWS\system32\drivers\rp_pkt32.sys 2007-10-20 13:22 <DIR> d-------- C:\Program Files\THQ 2007-10-20 11:29 338,304 --a------ C:\WINDOWS\system32\_AxShlEx.dll 2007-10-18 19:01 <DIR> d-------- C:\Program Files\Common Files\Thraex Software 2007-10-18 19:01 171,540 --a------ C:\WINDOWS\Astrum InstallWizard 2 Uninstaller.exe 2007-10-18 18:00 65,024 --a------ C:\WINDOWS\IFinst26.exe 2007-10-14 23:31 <DIR> d----c--- C:\Documents and Settings\Lee\Application Data\uTorrent 2007-10-12 16:51 318,976 --a------ C:\WINDOWS\system32\Ucs32p.dll 2007-10-12 16:51 96,256 --a------ C:\WINDOWS\system32\Csp3osu.dll 2007-10-12 16:51 45,568 --a------ C:\WINDOWS\ScFBPPM3.DLL 2007-10-12 16:51 16,896 --a------ C:\WINDOWS\system32\Csp3utl.dll 2007-10-12 16:51 16,032 --a------ C:\WINDOWS\system32\drivers\ScFBPNT3.sys 2007-10-11 16:57 <DIR> d--hs---- C:\WINDOWS\ftpcache 2007-10-08 19:50 <DIR> d-------- C:\Program Files\ImageConverter Plus 2007-10-08 19:50 286,720 --a------ C:\WINDOWS\system32\cnvshell.dll 2007-10-08 19:35 269,312 --a------ C:\WINDOWS\system\devil.dll 2007-10-08 19:35 172,107 --a------ C:\WINDOWS\system\ddsconv.exe 2007-10-08 19:35 27,648 --a------ C:\WINDOWS\system\ilu.dll 2007-10-08 18:09 <DIR> d-------- C:\Program Files\skwas 2007-10-06 23:35 <DIR> d----c--- C:\Documents and Settings\Lee\Application Data\Oxin's style 2007-10-03 20:57 <DIR> d----c--- C:\Documents and Settings\Lee\Application Data\Nokia Multimedia Player 2007-10-03 19:50 <DIR> d-------- C:\Program Files\Common Files\PCSuite 2007-10-03 19:50 <DIR> d-------- C:\Program Files\Common Files\Nokia 2007-10-03 19:49 <DIR> d-------- C:\Program Files\Nokia 2007-10-03 19:49 137,216 --a------ C:\WINDOWS\system32\drivers\nmwcd.sys 2007-10-03 19:49 65,536 --a------ C:\WINDOWS\system32\nmwcdcocls.dll 2007-10-03 19:49 12,288 --a------ C:\WINDOWS\system32\drivers\nmwcdcm.sys 2007-10-03 19:49 12,288 --a------ C:\WINDOWS\system32\drivers\nmwcdcj.sys 2007-10-03 19:49 8,320 --a------ C:\WINDOWS\system32\drivers\nmwcdc.sys 2007-10-03 19:46 <DIR> d----c--- C:\Documents and Settings\Lee\Application Data\Ulead Systems 2007-10-03 19:44 <DIR> d-------- C:\Program Files\Windows Media Components 2007-10-03 19:43 <DIR> d-------- C:\Program Files\Ulead Systems 2007-10-03 19:43 <DIR> d-------- C:\Program Files\Common Files\Ulead Systems 2007-09-27 20:50 <DIR> d-------- C:\Program Files\DAEMON Tools 2007-09-27 20:46 685,816 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2007-09-27 20:27 <DIR> d----c--- C:\Documents and Settings\Lee\Application Data\DAEMON Tools Pro 2007-09-27 19:49 4 --a------ C:\WINDOWS\info147.sys 2007-09-25 22:34 <DIR> d-------- C:\Program Files\CBS Software 2007-09-25 22:20 <DIR> d----c--- C:\Documents and Settings\Lee\Application Data\InstallShield 2007-09-25 20:58 <DIR> d----c--- C:\Documents and Settings\Lee\Application Data\SlipStream 2007-09-25 20:58 86,016 --a------ C:\WINDOWS\system32\sliprt.dll 2007-09-24 22:02 1,144 --a------ C:\WINDOWS\mozver.dat 2007-09-24 22:00 <DIR> d----c--- C:\Documents and Settings\Lee\Application Data\Talkback 2007-09-24 21:59 0 --a------ C:\WINDOWS\nsreg.dat 2007-09-24 17:26 <DIR> d-------- C:\Program Files\PowerISO . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-10-23 20:02 --------- d-----w C:\Program Files\TuneUp Utilities 2007 2007-10-23 19:27 3,652 ----a-w C:\WINDOWS\system32\tmp.reg 2007-10-23 18:04 --------- d-----w C:\Program Files\SH3 Commander 2007-10-21 20:39 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-10-21 16:49 --------- dc----w C:\Documents and Settings\Lee\Application Data\Nokia 2007-10-20 14:31 --------- d-----w C:\Program Files\Virgin Broadband 2007-10-20 14:22 --------- dc----w C:\Documents and Settings\Lee\Application Data\Virgin Broadband 2007-10-20 10:38 --------- d-----w C:\Program Files\SH3 Unpacker 2007-10-20 10:38 --------- d-----w C:\Program Files\SH3 Mini Tweaker 2007-10-14 19:36 --------- d-----w C:\Program Files\Java 2007-10-06 21:53 --------- d-----w C:\Program Files\iPod 2007-10-03 18:43 --------- d-----w C:\Program Files\Common Files\InstallShield 2007-10-03 18:24 --------- d-----w C:\Program Files\ATITool 2007-09-25 20:15 --------- dc----w C:\Documents and Settings\Lee\Application Data\Hamachi 2007-09-25 20:15 --------- dc----w C:\Documents and Settings\Lee\Application Data\Apple Computer 2007-09-25 18:53 359,808 ----a-w C:\WINDOWS\system32\drivers\TCPIP.SYS.ORIGINAL 2007-09-25 18:53 359,808 ----a-w C:\WINDOWS\system32\drivers\TCPIP.SYS 2007-09-25 16:08 --------- d-----w C:\Program Files\Google 2007-09-21 18:12 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll 2007-09-21 18:12 --------- dc-h--r C:\Documents and Settings\Lee\Application Data\SecuROM 2007-09-18 17:05 --------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2 2007-09-17 18:06 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2007-09-17 17:48 --------- d-----w C:\Program Files\MSBuild 2007-09-17 17:48 --------- d-----w C:\Program Files\Microsoft Works 2007-09-17 17:46 --------- d-----w C:\Program Files\Microsoft.NET 2007-09-17 17:41 --------- d-----w C:\Program Files\Microsoft Visual Studio 8 2007-09-16 13:13 --------- dc----w C:\Documents and Settings\Lee\Application Data\Megaupload 2007-09-15 19:10 8 -c--a-w C:\Documents and Settings\Lee\Application Data\usb.dat.bin 2007-09-12 18:43 --------- d-----w C:\Program Files\Ethalone 2007-09-11 20:20 --------- dc----w C:\Documents and Settings\Lee\Application Data\Caphyon 2007-09-10 16:31 --------- d-----w C:\Program Files\Ubisoft 2007-09-09 14:49 --------- d-----w C:\Program Files\IncrediMail 2007-09-09 12:32 --------- dc----w C:\Documents and Settings\Lee\Application Data\U3 2007-09-02 13:11 --------- d-----w C:\Program Files\XviD 2007-08-31 19:42 --------- d-----w C:\Program Files\Logitech 2007-08-31 06:11 25,544 ----a-w C:\WINDOWS\system32\drivers\hamachi.sys 2007-08-31 06:10 --------- d-----w C:\Program Files\Hamachi 2007-08-28 21:51 --------- d-----w C:\Program Files\AVI Codec Pack 2007-08-28 21:37 --------- d-----w C:\Program Files\DivoCodec 2007-08-28 21:08 --------- dc----w C:\Documents and Settings\Lee\Application Data\Ahead 2007-08-26 18:09 --------- d-----w C:\Program Files\Yahoo! 2007-08-25 21:32 --------- d-----w C:\Program Files\Electronic Arts 2007-08-25 21:17 --------- d-----w C:\Program Files\C-Media 2007-08-25 20:01 --------- dc----w C:\Documents and Settings\Lee\Application Data\teamspeak2 2007-08-25 16:18 --------- d-----w C:\Program Files\Common Files\EasyInfo 2007-08-25 10:44 --------- dc----w C:\Documents and Settings\Lee\Application Data\Ventrilo 2007-08-23 21:06 4,810 ----a-w C:\WINDOWS\system32\ealregsnapshot1.reg 2007-08-01 18:30 21,840 ----a-w C:\WINDOWS\system32\SIntfNT.dll 2007-08-01 18:30 17,212 ----a-w C:\WINDOWS\system32\SIntf32.dll 2007-08-01 18:30 12,067 ----a-w C:\WINDOWS\system32\SIntf16.dll 2007-07-30 18:19 92,504 ----a-w C:\WINDOWS\system32\cdm.dll 2007-07-30 18:19 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll 2007-07-30 18:19 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe 2007-07-30 18:19 43,352 ----a-w C:\WINDOWS\system32\wups2.dll 2007-07-30 18:19 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll 2007-07-30 18:19 271,224 ----a-w C:\WINDOWS\system32\mucltui.dll 2007-07-30 18:19 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll 2007-07-30 18:19 1,712,984 ----a-w C:\WINDOWS\system32\wuaueng.dll 2007-07-30 18:18 33,624 ----a-w C:\WINDOWS\system32\wups.dll 2007-07-30 18:18 207,736 ----a-w C:\WINDOWS\system32\muweb.dll 2007-07-26 06:10 2,275,840 ----a-w C:\WINDOWS\system32\TUKernel.exe 2007-07-21 16:01:24 5 --sha-w C:\WINDOWS\system32\efddbadae_s.dll 2007-06-13 10:23:07 1,276,928 --sh--r C:\WINDOWS\system32\System32i.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-04-19 13:26] "nwiz"="nwiz.exe" [2007-04-19 13:26 C:\WINDOWS\system32\nwiz.exe] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-04-19 13:26] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11] "amd_dc_opt"="C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2006-11-17 16:49] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50] "SweetIM"="C:\Program Files\Macrogaming\SweetIM\SweetIM.exe" [2006-12-27 16:53] "Logitech Utility"="Logi_MwX.Exe" [2003-11-07 10:50 C:\WINDOWS\LOGI_MWX.EXE] "C-Media Mixer"="Mixer.exe" [2002-07-12 16:33 C:\WINDOWS\mixer.exe] "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47] "MSUpdater"="System32i.exe" [2007-06-13 11:23 C:\WINDOWS\system32\System32i.exe] "PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 15:10] "QuickTime Task"="F:\Program Files\Adobe\quick time\QTTask.exe" [2007-06-29 06:24] "Broadbandadvisor.exe"="C:\Program Files\Virgin Broadband\advisor\Broadbandadvisor.exe" [2007-08-07 18:49] "PCguard"="C:\Program Files\Virgin Broadband\PCguard\Rps.exe" [2007-09-05 14:10] "-FreedomNeedsReboot"="C:\Program Files\Virgin Broadband\PCguard\ZkRunOnceR.exe" [2007-09-05 14:10] "MonAppli"="C:\Windows\system32\isys32.exe" [2007-06-01 16:16] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 13:00] "IncrediMail"="C:\PROGRA~1\INCRED~1\bin\IncMail.exe" [2007-08-21 11:44] "uTorrent"="C:\Program Files\uTorrent\uTorrent.exe" [2007-09-09 17:06] "AlcoholAutomount"="F:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" [2007-10-20 11:29] "SpeedConnectStartUp"="" [] "TuneUp MemOptimizer"="C:\Program Files\TuneUp Utilities 2007\MemOptimizer.exe" [2007-04-26 21:50] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\runonce] "IndexCleaner"="C:\Program Files\Virgin Broadband\PCguard\IdxClnR.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce] "IndexCleaner"="C:\Program Files\Virgin Broadband\PCguard\IdxClnR.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices] "MSUpdater"=System32i.exe [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "Nokia.PCSync"=C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog C:\Documents and Settings\Lee\Start Menu\Programs\Startup\ OneNote 2007 Screen Clipper and Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.exe [2006-10-26 20:24:54] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WB] F:\Program Files\AlienGUIse\fastload.dll 2001-12-20 23:34 24576 F:\Program Files\AlienGUIse\fastload.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "appinit_dlls"=wbsys.dll [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" "SweetIM"=C:\Program Files\Macrogaming\SweetIM\SweetIM.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "PCSuiteTrayApplication"=C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup "iTunesHelper"="F:\Program Files\iTunesHelper.exe" "EPSON Stylus D78 Series"=C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBGE.exe /FU "C:\WINDOWS\TEMP\E_S7F.tmp" /EF "HKLM" R1 ATITool;ATITool Overclocking Utility;C:\WINDOWS\system32\DRIVERS\ATITool.sys R2 LicCtrlService;LicCtrl Service;C:\WINDOWS\runservice.exe R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe -k netsvcs S3 AmdLLD;AMD Low Level Device Driver;C:\WINDOWS\system32\DRIVERS\AmdLLD.sys S3 Radialpoint Security Services;Virgin Broadband PCguard;C:\WINDOWS\system32\dllhost.exe /Processid:{80098F68-1220-4F43-80A8-15C7395B8874} S3 TCCrystalCpuInfo;TCCrystalCpuInfo;\??\C:\DOCUME~1\Lee\LOCALS~1\Temp\TCCpuInfo.sys HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H] AutoRun\command - H:\autorun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\I] AutoRun\command - I:\Autorun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c82f731d-28d6-11dc-98ae-806d6172696f}] AutoRun\command - D:\setup.exe . Contents of the 'Scheduled Tasks' folder "2007-10-23 16:24:26 C:\WINDOWS\Tasks\1-Click Maintenance.job" . ************************************************************************** catchme 0.3.1232 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-24 07:11:59 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... ************************************************************************** . Completion time: 2007-10-24 7:13:11 C:\ComboFix2.txt ... 2007-10-24 06:54 . --- E O F --- THANK'S WILDCHILD TIME STOP'S FOR NO ONE