Hello, I would really appreciate any help that you all might be able to offer. I've been working on this winlogon issue for 2 weeks and I'm about to pull my hair out. For some reason I thought it would be a smart idea to download software from LimeWire. HA!! Turns out I downloaded more trojans than I can count. I thought Norton had found it all, but I wanted to double check by running SpyBot, AdAware, Solo, PC Tools, Spyware Terminator, and Spy Sweeper. All of those programs found different items to get rid of but I'm still having a problem. My system slows dramatically on occasion (Usually when PC Tools finds something it can't clean). When I check processes, it shows winlogon at about 26-28. I don't know if this is related but PC Tools always finds a problem with WINDOWS\system32\awtqp.dll. It can never quarantine it and when I try to find it myself, it's not there (I showed hidden files). I would be happy to provide my Hijack This log.

Go to start> control panel> add/remove programs and uninstall this program if found: Limewire Please download VundoFix.exe to your C:\. Double-click VundoFix.exe to run it. Click the Scan for Vundo button. Once it's done scanning, click the Remove Vundo button. You will receive a prompt asking if you want to remove the files, click YES Once you click yes, your desktop will go blank as it starts removing Vundo. When completed, it will prompt that it will shutdown your computer, click OK. Turn your computer back on. Note: It is possible that VundoFix encountered a file it could not remove. In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button." when VundoFix appears at reboot. Post the log located at C:Vundofix.txt. Post your Hijack This log. Please download ComboFix to the desktop from this link: http://download.bleepingcomputer.com/sUBs/ComboFix.exe Double-click combofix.exe Follow the prompts. (Don't click on the window while the program is running, it may cause your system to hang.) Please post the log it produces.

First, thank you so much for your very quick response. I really appreciate your help more than you know. Here are the VundoFix and Hijack This logs you requested. I'm going to run Combo Fix right now. I'll post it as soon as it's done. --------- VundoFix V6.3.19 Checking Java version... Java version is 1.4.2.5 Old versions of java are exploitable and should be removed. Java version is 1.4.2.6 Old versions of java are exploitable and should be removed. Java version is 1.5.0.2 Old versions of java are exploitable and should be removed. Java version is 1.5.0.4 Old versions of java are exploitable and should be removed. Java version is 1.5.0.6 Old versions of java are exploitable and should be removed. Java version is 1.5.0.7 Old versions of java are exploitable and should be removed. Java version is 1.5.0.11 Scan started at 2:16:32 PM 4/6/2007 Listing files found while scanning.... C:\WINDOWS\system32\awtqp.dll C:\WINDOWS\system32\fccyxvt.dll C:\WINDOWS\system32\hggdeee.dll C:\WINDOWS\system32\ijkmp.tmp C:\WINDOWS\system32\khffggh.dll C:\WINDOWS\system32\ljjifdb.dll C:\WINDOWS\system32\pmkji.dll C:\WINDOWS\system32\pqtwa.bak1 C:\WINDOWS\system32\pqtwa.bak2 C:\WINDOWS\system32\pqtwa.ini C:\WINDOWS\system32\pqtwa.ini2 C:\WINDOWS\system32\rqrronn.dll Beginning removal... Attempting to delete C:\WINDOWS\system32\awtqp.dll C:\WINDOWS\system32\awtqp.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\fccyxvt.dll C:\WINDOWS\system32\fccyxvt.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\hggdeee.dll C:\WINDOWS\system32\hggdeee.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\ijkmp.tmp C:\WINDOWS\system32\ijkmp.tmp Has been deleted! Attempting to delete C:\WINDOWS\system32\khffggh.dll C:\WINDOWS\system32\khffggh.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\ljjifdb.dll C:\WINDOWS\system32\ljjifdb.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\pmkji.dll C:\WINDOWS\system32\pmkji.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\pqtwa.bak1 C:\WINDOWS\system32\pqtwa.bak1 Has been deleted! Attempting to delete C:\WINDOWS\system32\pqtwa.bak2 C:\WINDOWS\system32\pqtwa.bak2 Has been deleted! Attempting to delete C:\WINDOWS\system32\pqtwa.ini C:\WINDOWS\system32\pqtwa.ini Has been deleted! Attempting to delete C:\WINDOWS\system32\pqtwa.ini2 C:\WINDOWS\system32\pqtwa.ini2 Has been deleted! Attempting to delete C:\WINDOWS\system32\rqrronn.dll C:\WINDOWS\system32\rqrronn.dll Has been deleted! Performing Repairs to the registry. Done! ----------- Logfile of HijackThis v1.99.1 Scan saved at 04:27, on 07-04-06 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16414) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\CTsvcCDA.exe C:\Program Files\NavNT\defwatch.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe C:\Program Files\NavNT\rtvscan.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\PC Tools AntiVirus\PCTAVSvc.exe C:\Program Files\Spyware Doctor\sdhelp.exe C:\Program Files\Spyware Terminator\sp_rsser.exe c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wdfmgr.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\WINDOWS\Explorer.exe C:\Program Files\NavNT\vptray.exe C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe C:\WINDOWS\system32\RunDLL32.exe C:\WINDOWS\system32\MsgSys.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\System32\alg.exe C:\Documents and Settings\Kimberly\My Documents\Unzipped\hijackthis[1]\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?Lin... R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?Lin... R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?Lin... R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?Lin... O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {198239A7-257C-495A-B363-7AF2239EFD4F} - C:\WINDOWS\system32\awtqp.dll (file missing) O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll O2 - BHO: (no name) - {70A5CF26-C5AB-4B4F-81BE-380CA621AABB} - (no file) O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll O3 - Toolbar: Internet Research Scout - {75A0D830-27F2-416B-82F7-CB67D0F0611B} - C:\PROGRA~1\INTERN~2\nnotes.dll O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [vptray] "C:\Program Files\NavNT\vptray.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe" O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [Dale Locks Trust Wipe] "C:\Documents and Settings\All Users\Application Data\soap multi dale locks\PlanHtm.exe" O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKLM\..\Run: [SoloSchedule] C:\SRNMIC~1\SOLOCFG.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [NvMediaCenter] "RunDLL32.exe" NvMCTray.dll,NvTaskbarInit O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Save with Internet Research Scout - C:\Program Files\Internet Research Scout\nnotes.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll O9 - Extra button: Internet Research Scout - {AFEFA0A9-F33C-425C-9C00-553FF5C97E01} - C:\PROGRA~1\INTERN~2\nnotes.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: (no name) - {B48798CE-A2E0-4918-BC00-0F72FBA708E2} - C:\WINDOWS\System32\shdocvw.dll (HKCU) O10 - Unknown file in Winsock LSP: c:\program files\common files\pc tools\lsp\pctlsp.dll O10 - Unknown file in Winsock LSP: c:\program files\common files\pc tools\lsp\pctlsp.dll O10 - Unknown file in Winsock LSP: c:\program files\common files\pc tools\lsp\pctlsp.dll O10 - Unknown file in Winsock LSP: c:\program files\common files\pc tools\lsp\pctlsp.dll O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?lin... O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.c... O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microso... O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - http://download.zonelabs.com/bin/pr... O16 - DPF: {8EDAD21C-3584-4E66-A8AB-EB0E5584767D} (Toolbar Reg Sniff Activate) - http://toolbar.google.com/data/Goog... O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v1... O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real.com/gameconsol... O16 - DPF: {BAE1D8DF-0B35-47E3-A1E7-EEB3FF2ECD19} (CPlayFirstddfotgControl Object) - http://www.playfirst.com/play/game/... O16 - DPF: {C4DD6732-1E82-4AE7-BD94-180331B84082} (DeltaCVX Control) - http://www.mathxl.com/applets/delta... O20 - Winlogon Notify: cbxwwtt - cbxwwtt.dll (file missing) O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: SQL Server (MSSMLBIZ) (MSSQL$MSSMLBIZ) - Unknown owner - c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sMSSMLBIZ (file missing) O23 - Service: PC Tools AntiVirus Engine (PCTAVSvc) - PC Tools Research Pty Ltd - C:\Program Files\PC Tools AntiVirus\PCTAVSvc.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe Thanks again!

ComboFix log: [code] 04-08-29 16:07 723 --a--c--- C:\Qoobox\Quarantine\Program Files\INSTALL.LOG.vir 07-03-25 20:02 251 --a------ C:\Qoobox\Quarantine\INSTALL.LOG.vir 07-04-06 04:38 1176 --a------ C:\Qoobox\Quarantine\Registry_backups\LEGACY_MCHINJDRV.reg.cf 07-04-06 04:38 958 --a------ C:\Qoobox\Quarantine\Registry_backups\LEGACY_WINDOWS_OVERLAY_COMPONENTS.reg.cf Folder PATH listing Volume serial number is 1CA2-ED95 C:\QOOBOX \---Quarantine | INSTALL.LOG.vir | +---Program Files | INSTALL.LOG.vir | \---Registry_backups LEGACY_MCHINJDRV.reg.cf LEGACY_WINDOWS_OVERLAY_COMPONENTS.reg.cf [/code]

Please Download NoLop to your desktop from one of the links below... http://www.spywareedge.net/nolop/NoLop.exe First close any other programs you have running as this will require a reboot Double click NoLop.exe to run it Now click the button labelled "Search and Destroy" <<your computer will now be scanned for infected files>> When scanning is finished you will be prompted to reboot only if infected, Click OK Now click the "REBOOT" Button. A Message should popup from NoLop. If not, double click the program again and it will finish. Run Hijack This from normal mode, close all windows and browsers except Hijack This, place a check to the left of the following items and press "fix checked": R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank O2 - BHO: (no name) - {198239A7-257C-495A-B363-7AF2239EFD4F} - C:\WINDOWS\system32\awtqp.dll (file missing) O2 - BHO: (no name) - {70A5CF26-C5AB-4B4F-81BE-380CA621AABB} - (no file) O20 - Winlogon Notify: cbxwwtt - cbxwwtt.dll (file missing) Exit Hijack This. Post the combofix log requested in response #1 and a new Hijack This log please.

Oops, sorry! I gave you the wrong ComboFix log before. I've included the correct one this time. I followed your instructions for NoLop and Hijack This. The HJ log is included here as well. ------- "Kimberly" - 07-04-06 4:31:57 Service Pack 2 ComboFix 07-04-05 - Running from: "C:\Documents and Settings\Kimberly\Desktop" (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\Program Files\install.log C:\install.log ((((((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) -------\LEGACY_MCHINJDRV -------\LEGACY_WINDOWS_OVERLAY_COMPONENTS ((((((((((((((((((((((((((((((( Files Created from 2007-03-06 to 2007-04-06 )))))))))))))))))))))))))))))))))) 2007-04-06 14:16 <DIR> d-------- C:\VundoFix Backups 2007-04-06 12:53 46 --a------ C:\AUTOEXEC.BAT 2007-04-06 12:53 <DIR> d-------- C:\SRN Micro 2007-04-06 11:09 22,528 --a------ C:\WINDOWS\system32\drivers\AVHook.sys 2007-04-06 11:09 15,872 --a------ C:\WINDOWS\system32\drivers\AVRec.sys 2007-04-06 11:09 15,360 --a------ C:\WINDOWS\system32\drivers\AVFilter.sys 2007-04-06 11:09 <DIR> d-------- C:\Program Files\PC Tools AntiVirus 2007-04-06 11:09 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\PC Tools 2007-04-04 12:20 <DIR> d-------- C:\Program Files\Common Files\PC Tools 2007-04-04 10:48 135,936 --a------ C:\WINDOWS\system32\drivers\sp_rsdrv2.sys 2007-04-04 10:43 <DIR> d-------- C:\Program Files\Spyware Terminator 2007-04-04 10:43 <DIR> d-------- C:\DOCUME~1\Kimberly\APPLIC~1\Spyware Terminator 2007-04-04 10:43 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spyware Terminator 2007-04-04 10:35 <DIR> d-------- C:\Program Files\Abexo 2007-04-04 10:31 <DIR> d-------- C:\Program Files\Free Window Registry Repair 2007-04-04 10:18 164 --a------ C:\install.dat 2007-04-01 23:50 <DIR> d-------- C:\Program Files\RectAceCash 2007-04-01 23:50 <DIR> d-------- C:\DOCUME~1\Kimberly\APPLIC~1\RectAceCash 2007-04-01 23:50 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\soap multi dale locks 2007-04-01 23:48 <DIR> d-------- C:\DOCUME~1\Kimberly\APPLIC~1\.wyzo 2007-03-29 17:38 <DIR> d-------- C:\Program Files\Prison Tycoon 2007-03-29 00:39 <DIR> d-------- C:\DOCUME~1\Kimberly\.artofillusion 2007-03-28 23:44 <DIR> d-------- C:\Program Files\ArtOfIllusion 2007-03-28 16:49 <DIR> d-------- C:\Program Files\EwisoftWeb 2007-03-28 16:34 <DIR> d-------- C:\DOCUME~1\Kimberly\APPLIC~1\Nvu 2007-03-26 22:59 <DIR> d-------- C:\Program Files\MSXML 6.0 2007-03-26 18:09 <DIR> d-------- C:\Program Files\PHP 2007-03-26 17:55 <DIR> d-------- C:\zenCart 2007-03-23 17:58 <DIR> d-------- C:\Program Files\QuickTime Alternative 2007-03-23 17:58 <DIR> d-------- C:\Program Files\Media Player Classic 2007-03-23 17:57 157,696 --a------ C:\WINDOWS\system32\unrar.dll 2007-03-22 21:40 <DIR> d-------- C:\WINDOWS\network diagnostic 2007-03-22 17:04 <DIR> d-------- C:\712f0979ed143b37b9d7 2007-03-22 15:38 <DIR> d-------- C:\Program Files\Blender Foundation 2007-03-22 15:08 <DIR> d-------- C:\Program Files\Serif 2007-03-21 21:55 <DIR> d-------- C:\Program Files\Internet Research Scout 2007-03-21 21:00 <DIR> d-------- C:\Program Files\Microsoft Small Business 2007-03-21 20:54 <DIR> d-------- C:\Program Files\Microsoft SQL Server 2007-03-21 20:49 <DIR> d-------- C:\Program Files\Microsoft.NET 2007-03-19 11:40 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\TERMINAL Studio 2007-03-14 13:43 <DIR> d-------- C:\Program Files\BitTorrent 2007-03-14 12:36 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\WildTangent 2007-03-14 11:38 <DIR> d-------- C:\Program Files\Brain Booster 2007-03-13 13:47 <DIR> d-------- C:\DOCUME~1\Kimberly\APPLIC~1\Jamdat 2007-03-13 13:04 <DIR> d-------- C:\Program Files\Mind Machine 2007-03-13 12:48 <DIR> d-------- C:\Program Files\Runic 2007-03-13 10:32 <DIR> d-------- C:\Program Files\Fizzball 2007-03-13 10:02 <DIR> d-------- C:\Program Files\Cinema Tycoon Gold 2007-03-13 09:36 <DIR> d-------- C:\Program Files\BFG 2007-03-09 13:51 <DIR> d-------- C:\DOCUME~1\Kimberly\Shared 2007-03-09 13:51 <DIR> d-------- C:\DOCUME~1\Kimberly\Incomplete 2007-03-09 13:34 <DIR> d-------- C:\DOCUME~1\Kimberly\.limewire 2007-03-09 11:05 <DIR> d-------- C:\Program Files\ReflexiveArcade 2007-03-09 11:04 <DIR> d-------- C:\Program Files\Dragons 7 2007-03-08 13:52 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Enkord 2007-03-08 11:26 <DIR> d-------- C:\DOCUME~1\Kimberly\APPLIC~1\WinRAR 2007-03-06 21:59 <DIR> d--h----- C:\DOCUME~1\Kimberly\APPLIC~1\Move Networks (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-04-06 04:21 288 --a------ C:\WINDOWS\system32\dvcstatebkp-{00000002-00000000-0000000b-00001102-00000002-80661102}.dat 2007-04-06 04:21 288 --a------ C:\WINDOWS\system32\dvcstate-{00000002-00000000-0000000b-00001102-00000002-80661102}.dat 2007-04-04 12:24 -------- d-------- C:\DOCUME~1\Kimberly\APPLIC~1\pc tools 2007-04-02 19:53 -------- d--h----- C:\Program Files\installshield installation information 2007-03-28 23:41 -------- d-------- C:\Program Files\java 2007-03-28 22:19 -------- d-------- C:\Program Files\ubi soft 2007-03-28 22:17 -------- d-------- C:\Program Files\microids 2007-03-28 22:16 -------- d-------- C:\Program Files\syberia 2007-03-28 22:12 -------- d-------- C:\Program Files\google 2007-03-23 17:57 -------- d-------- C:\Program Files\quicktime 2007-03-23 09:58 44904 --a--c--- C:\DOCUME~1\Kimberly\APPLIC~1\gdipfontcachev1.dat 2007-03-14 15:23 -------- d-------- C:\Program Files\Common Files\sysgedata 2007-03-14 14:43 -------- d-------- C:\DOCUME~1\Kimberly\APPLIC~1\bittorrent 2007-03-08 11:36 577536 --a------ C:\WINDOWS\system32\user32.dll 2007-03-08 11:36 40960 --------- C:\WINDOWS\system32\mf3216.dll 2007-03-08 11:36 281600 --a------ C:\WINDOWS\system32\gdi32.dll 2007-03-08 09:47 1843584 --------- C:\WINDOWS\system32\win32k.sys 2007-03-05 12:23 -------- d-------- C:\DOCUME~1\Kimberly\APPLIC~1\ctxm 2007-03-04 19:46 -------- d-------- C:\DOCUME~1\Kimberly\APPLIC~1\playfirst 2007-03-04 15:34 36 --a------ C:\WINDOWS\popcinfo.dat 2007-03-04 12:51 -------- d-------- C:\DOCUME~1\Kimberly\APPLIC~1\gaijin ent 2007-03-01 18:03 -------- d-------- C:\Program Files\wildtangent 2007-03-01 09:16 4212 --ah----- C:\WINDOWS\system32\zllictbl.dat 2007-02-10 05:29 67952 --a------ C:\WINDOWS\system32\sqlctr90.dll 2007-02-10 05:29 2234224 --a------ C:\WINDOWS\system32\sqlncli.dll 2007-01-08 19:01 17408 --a------ C:\WINDOWS\system32\corpol.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe" "swg"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\1.2.1128.5462\\GoogleToolbarNotifier.exe" "NvMediaCenter"="\"RunDLL32.exe\" NvMCTray.dll,NvTaskbarInit" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "NvCplDaemon"="\"RUNDLL32.EXE\" C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup" "vptray"="\"C:\\Program Files\\NavNT\\vptray.exe\"" "SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_11\\bin\\jusched.exe\"" "Zone Labs Client"="\"C:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe\"" "Dale Locks Trust Wipe"="\"C:\\Documents and Settings\\All Users\\Application Data\\soap multi dale locks\\PlanHtm.exe\"" "MSConfig"="C:\\WINDOWS\\PCHealth\\HelpCtr\\Binaries\\MSConfig.exe /auto" "SoloSchedule"="C:\\SRNMIC~1\\SOLOCFG.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe" "Spyware Doctor"="\"C:\\Program Files\\Spyware Doctor\\swdoctor.exe\" /Q" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] "path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\Adobe Reader Speed Launch.lnk" "backup"="C:\\WINDOWS\\pss\\Adobe Reader Speed Launch.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\Adobe\\ACROBA~3.0\\Reader\\READER~1.exe " "item"="Adobe Reader Speed Launch" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk] "path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\Microsoft Office.lnk" "backup"="C:\\WINDOWS\\pss\\Microsoft Office.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\MICROS~3\\Office10\\OSA.exe -b -l" "item"="Microsoft Office" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Kimberly^Start Menu^Programs^Startup^PowerReg Scheduler.exe] "path"="C:\\Documents and Settings\\Kimberly\\Start Menu\\Programs\\Startup\\PowerReg Scheduler.exe" "backup"="C:\\WINDOWS\\pss\\PowerReg Scheduler.exeStartup" "location"="Startup" "command"="C:\\Documents and Settings\\Kimberly\\Start Menu\\Programs\\Startup\\PowerReg Scheduler.exe" "item"="PowerReg Scheduler" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCTAVApp] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="PCTAV" "hkey"="HKLM" "command"="\"C:\\Program Files\\PC Tools AntiVirus\\PCTAV.exe\" /MONITORSCAN" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="qttask" "hkey"="HKLM" "command"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpywareTerminator] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="SpywareTerminatorShield" "hkey"="HKLM" "command"="\"C:\\Program Files\\Spyware Terminator\\SpywareTerminatorShield.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB}"="Microsoft AntiMalware ShellExecuteHook" "{70A5CF26-C5AB-4B4F-81BE-380CA621AABB}"="" [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "Spyware Doctor"="\"C:\\Program Files\\Spyware Doctor\\swdoctor.exe\" /Q" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "DisableTaskMgr"=dword:00000000 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "NoColorChoice"=dword:00000000 "NoSizeChoice"=dword:00000000 "NoDispScrSavPage"=dword:00000000 "NoDispCPL"=dword:00000000 "NoVisualStyleChoice"=dword:00000000 "NoDispSettingsPage"=dword:00000000 "NoDispAppearancePage"=dword:00000000 "NoDispBackgroundPage"=dword:00000000 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoActiveDesktopChanges"=dword:00000000 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoSaveSettings"=dword:00000000 "NoThemesTab"=dword:00000000 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\run] [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0] Source REG_SZ http://cognitivedistortion.com/img/... HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cbxwwtt [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa Authentication Packages REG_MULTI_SZ msv1_0\0\0 Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0 Notification Packages REG_MULTI_SZ scecli\0\0 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 HTTPFilter REG_MULTI_SZ HTTPFilter\0\0 DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0 [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\E] Shell\readme\command notepad readme.txt [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\J] Shell\AutoRun\command J:\SafeGuard\Windows\SafeGuard20.exe [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{079acfa4-e7ed-11d8-ab7d-806d6172696f}] Shell\AutoRun\command E:\Launch.exe [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{76b6c050-62e6-11db-b045-00e06fa0d6c7}] Shell\AutoRun\command J:\SafeGuard\Windows\SafeGuard20.exe Contents of the 'Scheduled Tasks' folder C:\WINDOWS\tasks\AF326ED69339E86A.job C:\WINDOWS\tasks\MP Scheduled Scan.job ******************************************************************** catchme 0.2 W2K/XP/Vista - userland rootkit detector by Gmer, 17 October 2006 http://www.gmer.net scanning hidden processes ... scanning hidden services ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 ******************************************************************** Completion time: 07-04-06 4:41:56 C:\ComboFix-quarantined-files.txt ... 07-04-06 04:41 ------------ Logfile of HijackThis v1.99.1 Scan saved at 5:16:10 AM, on 4/6/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16414) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\CTsvcCDA.exe C:\Program Files\NavNT\defwatch.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe C:\Program Files\NavNT\rtvscan.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\PC Tools AntiVirus\PCTAVSvc.exe C:\Program Files\Spyware Doctor\sdhelp.exe C:\Program Files\Spyware Terminator\sp_rsser.exe c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.exe C:\WINDOWS\system32\wdfmgr.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\WINDOWS\system32\MsgSys.exe C:\Program Files\NavNT\vptray.exe C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe C:\WINDOWS\system32\RunDLL32.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\System32\alg.exe C:\Documents and Settings\Kimberly\My Documents\Unzipped\hijackthis[1]\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?Lin... R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?Lin... R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?Lin... O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll O3 - Toolbar: Internet Research Scout - {75A0D830-27F2-416B-82F7-CB67D0F0611B} - C:\PROGRA~1\INTERN~2\nnotes.dll O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [vptray] "C:\Program Files\NavNT\vptray.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe" O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [Dale Locks Trust Wipe] "C:\Documents and Settings\All Users\Application Data\soap multi dale locks\PlanHtm.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [NvMediaCenter] "RunDLL32.exe" NvMCTray.dll,NvTaskbarInit O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Save with Internet Research Scout - C:\Program Files\Internet Research Scout\nnotes.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll O9 - Extra button: Internet Research Scout - {AFEFA0A9-F33C-425C-9C00-553FF5C97E01} - C:\PROGRA~1\INTERN~2\nnotes.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: (no name) - {B48798CE-A2E0-4918-BC00-0F72FBA708E2} - C:\WINDOWS\System32\shdocvw.dll (HKCU) O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?lin... O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.c... O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microso... O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - http://download.zonelabs.com/bin/pr... O16 - DPF: {8EDAD21C-3584-4E66-A8AB-EB0E5584767D} (Toolbar Reg Sniff Activate) - http://toolbar.google.com/data/Goog... O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v1... O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real.com/gameconsol... O16 - DPF: {BAE1D8DF-0B35-47E3-A1E7-EEB3FF2ECD19} (CPlayFirstddfotgControl Object) - http://www.playfirst.com/play/game/... O16 - DPF: {C4DD6732-1E82-4AE7-BD94-180331B84082} (DeltaCVX Control) - http://www.mathxl.com/applets/delta... O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: SQL Server (MSSMLBIZ) (MSSQL$MSSMLBIZ) - Unknown owner - c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sMSSMLBIZ (file missing) O23 - Service: PC Tools AntiVirus Engine (PCTAVSvc) - PC Tools Research Pty Ltd - C:\Program Files\PC Tools AntiVirus\PCTAVSvc.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe ----------- Thanks

Once you you have completed the task in response #4 do the following. Go to start> control panel> add/remove programs> and un install these programs: SpywareTerminator ( It is on the rogue list) LimeWire (unless you have the newest version it has spyware in it). Next set msconfig to normal mode. You java is out of date and should be updted as soon as possible. Download the latest version of http://java.sun.com/javase/downloads/index.jsp Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications". Click the "Download" button to the right. Check the box that says: "Accept License Agreement". The page will refresh. Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop. Close any programs you may have running - especially your web browser. Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java. Check any item with Java Runtime Environment (JRE or J2SE) in the name. It should have the "coffee cup" icon next to it. Click the Remove or Change/Remove button. Repeat as many times as necessary to remove each Java versions. Reboot your computer once all Java components are removed . Then from your desktop double-click on jre-1_6_0-windowsi586-p.exe to install the newest version. Post a new Hijack This log.