[wufreak]

I went to a website to try and find out how to get my serial code for a game that I had lost. When I downloaded it's search software, I started getting a ton of pop ups. I've run adaware and the spyware with cox high speed internet. I've gone into the registry and I thought I got everything it listed that it could not get rid of. The website in my topic keeps opening as my homepage despite me changing the home page. Here is my hijackthis log.


Logfile of HijackThis v1.99.1
Scan saved at 11:45:56 AM, on 8/19/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Cox\Applications\app\SysSvcNt.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Common Files\Command Software\dvpapi.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Creative\ShareDLL\CtNotify.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\DIGStream\digstream.exe
C:\Program Files\ESPNRunTime\DIGServices.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\NVATray.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIADA.EXE
C:\Program Files\Creative\ShareDLL\Mediadet.exe
C:\WINDOWS\system32\7369dd0e.exe
C:\WINDOWS\thiselt.exe
C:\WINDOWS\ms04989634485.exe
C:\WINDOWS\Duce6.exe
C:\Program Files\Common Files\{1ABD13B3-0446-1033-0514-030401040001}\Update.exe
C:\WINDOWS\system32\SKS~1\chkdsk.exe
C:\Program Files\Belkin\Nostromo\nost_LM.exe
C:\Program Files\Cox\Applications\app\Console.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mim.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\MMDiag.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\LimeWire\LimeWire.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmjb.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
F:\Debug stuff\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.c...//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.c...rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.c...//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.c...//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
R3 - URLSearchHook: (no name) - {E0D49B03-2DE1-701B-C48F-06222AFE7EE0} - C:\WINDOWS\system32\fyqw.dll (file missing)
F2 - REG:system.ini: UserInit=userinit.exe
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Cox Popup Blocker - {2C0A5F28-48D8-408B-9172-9C6121025BCE} - C:\Program Files\Cox\Applications\App\PopupBHO01.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [TCASUTIEXE] TCAUDIAG.exe -off
O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [CTStartup] C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~2\mimboot.exe
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exe
O4 - HKLM\..\Run: [DIGServices] C:\Program Files\ESPNRunTime\DIGServices.exe /brand=ESPN /priority=0 /poll=24
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NVIDIA nForce APU1 Utilities] NVATray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [EPSON Stylus CX4800 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIADA.EXE /P26 "EPSON Stylus CX4800 Series" /O6 "USB001" /M "Stylus CX4800"
O4 - HKLM\..\Run: [nifse] f:\program files\nifsemaj\csrss.exe
O4 - HKLM\..\Run: [7369dd0e.exe] C:\WINDOWS\system32\7369dd0e.exe
O4 - HKLM\..\Run: [pop06apelt] C:\WINDOWS\thiselt.exe
O4 - HKLM\..\Run: [vkq16a50] RUNDLL32.EXE w03e05ce.dll,n 00316a4d0000000203e05ce
O4 - HKLM\..\Run: [ms04989634485] C:\WINDOWS\ms04989634485.exe
O4 - HKLM\..\Run: [TheMonitor] C:\WINDOWS\Duce6.exe
O4 - HKLM\..\Run: [ESP] C:\Program Files\Cox\Applications\app\start.exe
O4 - HKLM\..\Run: [adstart] "iexplore.exe" "-embedding [url="http://iesettingsupdate""]http://iesettingsupdate"[/url]
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKCU\..\Run: [Clm] C:\WINDOWS\System32\r?ndll32.exe
O4 - HKCU\..\Run: [Registry Cleaner] "C:\Program Files\Registry Cleaner Trial\regclean.exe" -startminimize
O4 - HKCU\..\Run: [nifse] f:\program files\nifsemaj\csrss.exe
O4 - HKCU\..\Run: [7369dd0e.exe] C:\Documents and Settings\James Finlay\Local Settings\Application Data\7369dd0e.exe
O4 - HKCU\..\Run: [Esos] "C:\WINDOWS\system32\SKS~1\chkdsk.exe" -vt yazr
O4 - HKCU\..\Run: [ziuo] C:\PROGRA~1\COMMON~1\ziuo\ziuom.exe
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O4 - Global Startup: Loadout Manager.lnk = C:\Program Files\Belkin\Nostromo\nost_LM.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {4ABF810A-F11D-4169-9D5F-7D274F2270A1} - (no file)
O9 - Extra 'Tools' menuitem: Java - {4ABF810A-F11D-4169-9D5F-7D274F2270A1} - (no file)
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.elitemediagroup.net
O15 - Trusted Zone: http://locator.cdn.imageservr.com
O15 - Trusted Zone: http://toolbar.imageshack.us
O15 - Trusted Zone: *.media-motor.net
O15 - Trusted Zone: *.mmohsix.com
O15 - Trusted Zone: http://scanner.sysprotect.com
O15 - Trusted Zone: http://*.systemdoctor.com
O15 - Trusted Zone: http://www.winantivirus.com
O15 - Trusted Zone: http://www.winantiviruspro.com
O15 - Trusted Zone: http://download.cdn.winsoftware.com
O15 - Trusted IP range: http://202.67.220.225
O15 - Trusted IP range: http://59.148.220.121
O15 - Trusted IP range: http://62.4.84.53
O15 - Trusted IP range: http://82.98.235.58
O15 - Trusted IP range: http://85.12.25.90
O16 - DPF: Yahoo! Blackjack - http://download.game...nts/y/jt0_x.cab
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://support.cox.c...oad/tgctlcm.cab
O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} (MetaStreamCtl Class) - https://components.v...T_ViewPoint.htm
O16 - DPF: {220FE57E-1624-3F66-F5BE-49AE717BC8FB} - http://209.8.161.54/1/rdgUS1022.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akama...meInstaller.exe
O16 - DPF: {8A0DCBDB-6E20-489C-9041-C1E8A0352E75} - http://awbeta.net-nu.../FIX/WinATS.cab
O16 - DPF: {9BFC2253-B9D9-477E-9488-CA450232620D} (BinAg1 Class) - https://fastconnectk...flowActiveX.CAB
O16 - DPF: {AD684060-16D6-40C3-AF27-53956783430D} - http://www.xpehbam.biz/exploit.exe
O16 - DPF: {AD688740-5246-40C3-1111-53959999940D} - http://xpehbam.biz/a/load.exe
O16 - DPF: {B3872502-F9FD-4E96-93FF-0D37298F0689} (SOESysInfo Control) - http://everquest2.st.../soesysinfo.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn...ro.cab34246.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/z...s/heartbeat.cab
O16 - DPF: {ED28050F-D713-43BA-A376-DCC5C35407D5} (MsnMusicAx Class) - https://music.msn.co...snmusax2330.cab
O21 - SSODL: incestuously - {03413bf7-e34c-445b-bfc0-a2b127255871} - C:\WINDOWS\system32\urroxtl.dll (file missing)
O23 - Service: Cox High Speed Internet Security Suite System Service (AuthSysSvc) - Authentium, Inc. - C:\Program Files\Cox\Applications\app\SysSvcNt.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - C:\Program Files\Common Files\Command Software\dvpapi.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: System Idle Service (sysidleserv) - Unknown owner - c:\windows\system32\adprot.exe (file missing)

Thank you very much for looking at this.

[Advertisements]

Hi and welcome to GeeksToGo! My name is Sam and I will be helping you.

Please download ComboFix and save it to your desktop.
Double click combofix.exe and follow the prompts.
When it's done running it will produce a log for you. Please post that log in your next reply.

Important Note - Do not mouseclick combofix's window whilst it's running. That may cause it to stall.

[Buckeye_Sam]

Hi and welcome to GeeksToGo! My name is Sam and I will be helping you.

Please download ComboFix and save it to your desktop.
Double click combofix.exe and follow the prompts.
When it's done running it will produce a log for you. Please post that log in your next reply.

Important Note - Do not mouseclick combofix's window whilst it's running. That may cause it to stall.

[wufreak]

Thank you for your time Sam. Here is the log from combofix.


James Finlay - 06-08-20 18:33:27.73
ComboFix 06.08.18 - Running from: C:\Documents and Settings\James Finlay\Desktop

((((((((((((((((((((((((((((((((((((((((((((( Qoologic's Log )))))))))))))))))))))))))))))))))))))))))))))))))))


* * * PRE-RUN - Filepaths from Locate * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *


2006-08-19 20:13 2 --a------ C:\WINDOWS\SYSTEM32\wtssu.exe
2006-08-16 07:45 158843 --a------ C:\WINDOWS\SYSTEM32\snfhh.dll
2006-08-15 21:39 573492 ---hs---- C:\WINDOWS\SYSTEM32\ssqrr.dll
2006-08-15 21:31 40973 ---hs---- C:\WINDOWS\SYSTEM32\yayaxuu.dll
2006-08-14 17:52 78848 --a------ C:\WINDOWS\SYSTEM32\nsd5A.dll
2006-07-30 12:04 82432 --a------ C:\WINDOWS\SYSTEM32\msxml4r.dll
2006-07-30 12:04 77312 --a------ C:\WINDOWS\SYSTEM32\DWSPY36.dll
2006-07-30 12:04 63488 --a------ C:\WINDOWS\SYSTEM32\FlexBag.dll
2006-07-30 12:04 63008 --a------ C:\WINDOWS\SYSTEM32\wscapi.dll
2006-07-30 12:04 331776 --a------ C:\WINDOWS\SYSTEM32\IMDBvb.dll
2006-07-30 12:04 200704 --a------ C:\WINDOWS\SYSTEM32\dwSock6.dll
2006-07-30 12:04 137216 --a------ C:\WINDOWS\SYSTEM32\dwspy32.dll
2006-07-30 12:04 1233920 --a------ C:\WINDOWS\SYSTEM32\msxml4.dll
2006-07-21 01:24 72704 --a------ C:\WINDOWS\SYSTEM32\hlink.dll
2006-06-05 14:51 61712 -ra------ C:\WINDOWS\SYSTEM32\avmontr.dll
2006-06-01 17:22 888832 --a------ C:\WINDOWS\SYSTEM32\nvmobls.dll
2006-06-01 17:22 81920 --a------ C:\WINDOWS\SYSTEM32\nvwddi.dll
2006-06-01 17:22 7618560 --a------ C:\WINDOWS\SYSTEM32\nvcpl.dll
2006-06-01 17:22 581632 --a------ C:\WINDOWS\SYSTEM32\nvhwvid.dll
2006-06-01 17:22 5652480 --a------ C:\WINDOWS\SYSTEM32\nvdisps.dll
2006-06-01 17:22 5632000 --a------ C:\WINDOWS\SYSTEM32\nvoglnt.dll
2006-06-01 17:22 466944 --a------ C:\WINDOWS\SYSTEM32\nvshell.dll
2006-06-01 17:22 35840 --a------ C:\WINDOWS\SYSTEM32\nvcod.dll
2006-06-01 17:22 3100672 --a------ C:\WINDOWS\SYSTEM32\nvgames.dll
2006-06-01 17:22 2924544 --a------ C:\WINDOWS\SYSTEM32\nvvitvs.dll
2006-06-01 17:22 229376 --a------ C:\WINDOWS\SYSTEM32\nvmccs.dll
2006-06-01 17:22 196608 --a------ C:\WINDOWS\SYSTEM32\nvapi.dll
2006-06-01 17:22 188416 --a------ C:\WINDOWS\SYSTEM32\nvmccss.dll
2006-06-01 17:22 1740800 --a------ C:\WINDOWS\SYSTEM32\nvwssr.dll
2006-06-01 17:22 1466368 --a------ C:\WINDOWS\SYSTEM32\nview.dll
2006-06-01 17:22 1257472 --a------ C:\WINDOWS\SYSTEM32\nvwss.dll
2006-06-01 17:22 1019904 --a------ C:\WINDOWS\SYSTEM32\nvwimg.dll


* * * POST-RUN - Files in the Quarantine folder * * * * * * * * * * * * * * * * * * * * * * * * *



DO NOT DELETE ANY FILES FROM THIS DIRECTORY UNLESS INSTRUCTED TO


(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\Duce6.exe
C:\WINDOWS\thiselt.exe
C:\WINDOWS\system32\ixt0.dll
C:\WINDOWS\system32\ixt1.dll
C:\WINDOWS\system32\ixt2.dll
C:\Documents and Settings\LocalService\Application Data\NetMon
C:\Program Files\Inetget2
C:\WINDOWS\system32\components
C:\WINDOWS\system32\ixt2.dll
C:\Program Files\Common Files\{1ABD13B3-0446-1033-0514-030401040001}
~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

Folders Quarantined:

C:\QooBox\Purity\WINDOWS\SYSTEM32\SKS~1
C:\QooBox\Purity\WINDOWS\SYSTEM32\SKS~1\SKS~1
C:\QooBox\Purity\WINDOWS\SYSTEM32\SKS~1\chkdsk.exe
C:\QooBox\Purity\Program Files\SSTEM~1
C:\QooBox\Purity\Program Files\Common Files\STEM~1
C:\QooBox\Purity\Program Files\SSTEM~1\m?iexec.exe
C:\QooBox\Purity\Documents and Settings\James Finlay\My Documents\MBOLS~1


((((((((((((((((((((((((((((((( Files Created from 2006-07-20 to 2006-08-20 ))))))))))))))))))))))))))))))))))


2006-08-20 16:23 32,573 C:\WINDOWS\system32\adrot-uninst.exe
2006-08-19 22:07 967 C:\WINDOWS\ScUnin.pif
2006-08-19 22:07 94,208 C:\WINDOWS\ScUnin.exe
2006-08-19 20:13 2 C:\WINDOWS\system32\wtssu.exe
2006-08-19 20:13 139,264 C:\WINDOWS\system32\rqxv.dll
2006-08-19 13:22 0 C:\WINDOWS\system32\rrqss.ini2
2006-08-18 11:35 20,992 C:\WINDOWS\system32\ixt2.dll
2006-08-17 21:17 13,844 C:\WINDOWS\system32\mwtgftbb.exe
2006-08-17 20:59 13,844 C:\WINDOWS\system32\illuwokn.exe
2006-08-17 11:44 13,844 C:\WINDOWS\system32\opmvbjtj.exe
2006-08-17 07:58 13,844 C:\WINDOWS\system32\hrwkrfyf.exe
2006-08-17 06:18 12,820 C:\WINDOWS\system32\wcaifpcu.exe
2006-08-17 06:18 12,308 C:\WINDOWS\system32\gchgvkad.exe
2006-08-16 23:16 12,820 C:\WINDOWS\system32\hjvtxuox.exe
2006-08-16 23:16 12,308 C:\WINDOWS\system32\jmdhntdt.exe
2006-08-16 22:51 12,820 C:\WINDOWS\system32\jncnpugb.exe
2006-08-16 22:51 12,308 C:\WINDOWS\system32\ddpfxppy.exe
2006-08-16 21:40 12,820 C:\WINDOWS\system32\nyfqliiq.exe
2006-08-16 21:40 12,308 C:\WINDOWS\system32\pwnuwndd.exe
2006-08-16 21:40 1,023,099 C:\WINDOWS\system32\rrqss.bak2
2006-08-16 14:55 102,400 C:\WINDOWS\system32\MSHTMPGR.DLL
2006-08-16 07:18 214,748 C:\WINDOWS\Setup90.exe
2006-08-16 07:18 2,560 C:\WINDOWS\ac3_0002.exe
2006-08-16 07:18 115,157 C:\WINDOWS\Justin.exe
2006-08-16 07:18 1,167 C:\WINDOWS\system32\vkq16a50.sys
2006-08-15 21:39 653,806 C:\WINDOWS\system32\rrqss.bak1
2006-08-15 21:39 573,492 C:\WINDOWS\system32\ssqrr.dll
2006-08-15 21:31 40,973 C:\WINDOWS\system32\yayaxuu.dll
2006-08-15 21:31 18,944 C:\WINDOWS\system32\winrge32.dll
2006-08-15 21:31 13,312 C:\WINDOWS\system32\7369dd0e.exe
2006-08-14 17:52 78,848 C:\WINDOWS\system32\nsd5A.dll
2006-08-14 12:52 2,859 C:\WINDOWS\system32\rgml.dll
2006-08-11 09:05 155,648 C:\WINDOWS\sys02859896344.exe
2006-08-09 03:59 58,880 C:\WINDOWS\system32\adrotate.dll
2006-07-30 12:13 189,984 C:\WINDOWS\system32\grfilter.dll
2006-07-30 12:07 103,968 C:\WINDOWS\system32\authcrypt.dll
2006-07-30 12:04 82,432 C:\WINDOWS\system32\msxml4r.dll
2006-07-30 12:04 77,312 C:\WINDOWS\system32\DWSPY36.dll
2006-07-30 12:04 63,488 C:\WINDOWS\system32\FlexBag.dll
2006-07-30 12:04 63,008 C:\WINDOWS\system32\wscapi.dll
2006-07-30 12:04 456,536 C:\WINDOWS\system32\XceedZip.dll
2006-07-30 12:04 405,504 C:\WINDOWS\system32\ExComboBox.dll
2006-07-30 12:04 40,960 C:\WINDOWS\system32\dwBkThrd.dll
2006-07-30 12:04 331,776 C:\WINDOWS\system32\IMDBvb.dll
2006-07-30 12:04 221,184 C:\WINDOWS\system32\DartSock.dll
2006-07-30 12:04 22,528 C:\WINDOWS\system32\SockIntf.dll
2006-07-30 12:04 200,704 C:\WINDOWS\system32\dwSock6.dll
2006-07-30 12:04 137,216 C:\WINDOWS\system32\dwspy32.dll
2006-07-30 12:04 122,880 C:\WINDOWS\system32\dwspyvb6.dll
2006-07-30 12:04 103,424 C:\WINDOWS\system32\sgRegExp.dll
2006-07-30 12:04 1,233,920 C:\WINDOWS\system32\msxml4.dll
2006-07-27 20:55 81,920 C:\WINDOWS\system32\MSTRC32.DLL
2006-07-27 20:55 372,736 C:\WINDOWS\system32\IJL11.DLL
2006-07-27 20:55 36,864 C:\WINDOWS\system32\msmidfsrm.exe


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2006-08-20 18:41 1023099 ---hs---- C:\WINDOWS\SYSTEM32\rrqss.bak2
2006-08-20 16:23 32573 --a------ C:\WINDOWS\SYSTEM32\adrot-uninst.exe
2006-08-19 22:08 967 --a------ C:\WINDOWS\ScUnin.pif
2006-08-19 22:08 94208 --a------ C:\WINDOWS\ScUnin.exe
2006-08-19 20:13 2 --a------ C:\WINDOWS\SYSTEM32\wtssu.exe
2006-08-19 14:02 155648 --a------ C:\WINDOWS\sys02859896344.exe
2006-08-19 00:58 -------- d-------- C:\Program Files\Common Files\Java
2006-08-18 11:35 20992 --a------ C:\WINDOWS\SYSTEM32\ixt2.dll
2006-08-17 21:17 13844 --a------ C:\WINDOWS\SYSTEM32\mwtgftbb.exe
2006-08-17 20:59 13844 --a------ C:\WINDOWS\SYSTEM32\illuwokn.exe
2006-08-17 11:44 13844 --a------ C:\WINDOWS\SYSTEM32\opmvbjtj.exe
2006-08-17 09:41 1167 --a------ C:\WINDOWS\SYSTEM32\vkq16a50.sys
2006-08-17 07:58 13844 --a------ C:\WINDOWS\SYSTEM32\hrwkrfyf.exe
2006-08-17 06:18 12820 --a------ C:\WINDOWS\SYSTEM32\wcaifpcu.exe
2006-08-17 06:18 12308 --a------ C:\WINDOWS\SYSTEM32\gchgvkad.exe
2006-08-16 23:16 12820 --a------ C:\WINDOWS\SYSTEM32\hjvtxuox.exe
2006-08-16 23:16 12308 --a------ C:\WINDOWS\SYSTEM32\jmdhntdt.exe
2006-08-16 22:51 12820 --a------ C:\WINDOWS\SYSTEM32\jncnpugb.exe
2006-08-16 22:51 12308 --a------ C:\WINDOWS\SYSTEM32\ddpfxppy.exe
2006-08-16 21:40 12820 --a------ C:\WINDOWS\SYSTEM32\nyfqliiq.exe
2006-08-16 21:40 12308 --a------ C:\WINDOWS\SYSTEM32\pwnuwndd.exe
2006-08-16 15:05 -------- d-------- C:\Program Files\Common Files\RuleSpace
2006-08-16 15:05 -------- d-------- C:\Program Files\Common Files\PestPatrol
2006-08-16 15:03 -------- d-------- C:\Program Files\Common Files\Command Software
2006-08-16 07:45 158843 --a------ C:\WINDOWS\SYSTEM32\snfhh.dll
2006-08-16 07:18 2560 --a------ C:\WINDOWS\ac3_0002.exe
2006-08-16 07:18 214748 --a------ C:\WINDOWS\Setup90.exe
2006-08-16 07:18 115157 --a------ C:\WINDOWS\Justin.exe
2006-08-16 06:16 2859 --a------ C:\WINDOWS\SYSTEM32\rgml.dll
2006-08-15 21:40 653806 ---hs---- C:\WINDOWS\SYSTEM32\rrqss.bak1
2006-08-15 21:39 573492 ---hs---- C:\WINDOWS\SYSTEM32\ssqrr.dll
2006-08-15 21:31 40973 ---hs---- C:\WINDOWS\SYSTEM32\yayaxuu.dll
2006-08-15 21:31 18944 --a------ C:\WINDOWS\SYSTEM32\winrge32.dll
2006-08-15 21:31 13312 --a------ C:\WINDOWS\SYSTEM32\7369dd0e.exe
2006-08-15 21:31 -------- d-------- C:\Program Files\Cowabanga
2006-08-14 17:52 78848 --a------ C:\WINDOWS\SYSTEM32\nsd5A.dll
2006-08-14 10:40 139264 --a------ C:\WINDOWS\SYSTEM32\rqxv.dll
2006-08-09 03:59 58880 --a------ C:\WINDOWS\SYSTEM32\adrotate.dll
2006-08-01 09:59 -------- d-------- C:\Documents and Settings\James Finlay\Application Data\EPSON
2006-07-30 12:13 189984 --a------ C:\WINDOWS\SYSTEM32\grfilter.dll
2006-07-30 12:07 103968 --a------ C:\WINDOWS\SYSTEM32\authcrypt.dll
2006-07-30 12:05 36352 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\GRTdiMon.sys
2006-07-30 12:05 16896 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\GRFilter.sys
2006-07-30 12:04 82432 --a------ C:\WINDOWS\SYSTEM32\msxml4r.dll
2006-07-30 12:04 77312 --a------ C:\WINDOWS\SYSTEM32\DWSPY36.dll
2006-07-30 12:04 63488 --a------ C:\WINDOWS\SYSTEM32\FlexBag.dll
2006-07-30 12:04 63008 --a------ C:\WINDOWS\SYSTEM32\wscapi.dll
2006-07-30 12:04 456536 --a------ C:\WINDOWS\SYSTEM32\XceedZip.dll
2006-07-30 12:04 40960 --a------ C:\WINDOWS\SYSTEM32\dwBkThrd.dll
2006-07-30 12:04 405504 --a------ C:\WINDOWS\SYSTEM32\ExComboBox.dll
2006-07-30 12:04 331776 --a------ C:\WINDOWS\SYSTEM32\IMDBvb.dll
2006-07-30 12:04 22528 --a------ C:\WINDOWS\SYSTEM32\SockIntf.dll
2006-07-30 12:04 221184 --a------ C:\WINDOWS\SYSTEM32\DartSock.dll
2006-07-30 12:04 200704 --a------ C:\WINDOWS\SYSTEM32\dwSock6.dll
2006-07-30 12:04 137216 --a------ C:\WINDOWS\SYSTEM32\dwspy32.dll
2006-07-30 12:04 1233920 --a------ C:\WINDOWS\SYSTEM32\msxml4.dll
2006-07-30 12:04 122880 --a------ C:\WINDOWS\SYSTEM32\dwspyvb6.dll
2006-07-30 12:04 103424 --a------ C:\WINDOWS\SYSTEM32\sgRegExp.dll
2006-07-30 12:04 102400 -ra------ C:\WINDOWS\SYSTEM32\MSHTMPGR.DLL
2006-07-27 06:24 679424 --a------ C:\WINDOWS\SYSTEM32\inetcomm.dll
2006-07-21 01:24 72704 --a------ C:\WINDOWS\SYSTEM32\hlink.dll
2006-07-20 16:02 -------- d-------- C:\Program Files\Dearborn
2006-07-19 11:25 -------- d-------- C:\Program Files\ArcSoft
2006-07-19 11:18 -------- d-------- C:\Program Files\epson
2006-07-18 20:42 -------- d-------- C:\Program Files\Google
2006-07-17 20:28 22768 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\usbsermpt.sys
2006-07-17 20:18 -------- d-------- C:\Program Files\Motorola Phone Tools
2006-07-01 14:32 -------- d-------- C:\Program Files\Java
2006-06-19 11:38 53248 --a------ C:\WINDOWS\uni_ehhhh.exe
2006-06-19 11:38 49152 --a------ C:\WINDOWS\uninst104.exe
2006-06-05 14:51 61712 -ra------ C:\WINDOWS\SYSTEM32\avmontr.dll
2006-06-01 19:09 208896 --a------ C:\WINDOWS\SYSTEM32\NVUNINST.EXE
2006-06-01 19:09 208896 --a------ C:\WINDOWS\SYSTEM32\nvudisp.exe
2006-06-01 19:09 208896 --a------ C:\WINDOWS\SYSTEM32\nvuaudio.exe
2006-06-01 17:22 888832 --a------ C:\WINDOWS\SYSTEM32\nvmobls.dll
2006-06-01 17:22 86016 --a------ C:\WINDOWS\SYSTEM32\nvmctray.dll
2006-06-01 17:22 81920 --a------ C:\WINDOWS\SYSTEM32\nvwddi.dll
2006-06-01 17:22 794624 --a------ C:\WINDOWS\SYSTEM32\nvcplui.exe
2006-06-01 17:22 7618560 --a------ C:\WINDOWS\SYSTEM32\nvcpl.dll
2006-06-01 17:22 581632 --a------ C:\WINDOWS\SYSTEM32\nvhwvid.dll
2006-06-01 17:22 5652480 --a------ C:\WINDOWS\SYSTEM32\nvdisps.dll
2006-06-01 17:22 5632000 --a------ C:\WINDOWS\SYSTEM32\nvoglnt.dll
2006-06-01 17:22 5246976 --a------ C:\WINDOWS\SYSTEM32\nvdispsr.dll
2006-06-01 17:22 466944 --a------ C:\WINDOWS\SYSTEM32\nvshell.dll
2006-06-01 17:22 462848 --a------ C:\WINDOWS\SYSTEM32\nvmccssr.dll
2006-06-01 17:22 4529408 --a------ C:\WINDOWS\SYSTEM32\nv4_disp.dll
2006-06-01 17:22 45056 --a------ C:\WINDOWS\SYSTEM32\nvmccsrs.dll
2006-06-01 17:22 442368 --a------ C:\WINDOWS\SYSTEM32\nvappbar.exe
2006-06-01 17:22 425984 --a------ C:\WINDOWS\SYSTEM32\keystone.exe
2006-06-01 17:22 35840 --a------ C:\WINDOWS\SYSTEM32\nvcodins.dll
2006-06-01 17:22 35840 --a------ C:\WINDOWS\SYSTEM32\nvcod.dll
2006-06-01 17:22 311296 --a------ C:\WINDOWS\SYSTEM32\nvexpbar.dll
2006-06-01 17:22 3100672 --a------ C:\WINDOWS\SYSTEM32\nvgames.dll
2006-06-01 17:22 2977792 --a------ C:\WINDOWS\SYSTEM32\nvvitvsr.dll
2006-06-01 17:22 2924544 --a------ C:\WINDOWS\SYSTEM32\nvvitvs.dll
2006-06-01 17:22 2916352 --a------ C:\WINDOWS\SYSTEM32\nvgamesr.dll
2006-06-01 17:22 286720 --a------ C:\WINDOWS\SYSTEM32\nvnt4cpl.dll
2006-06-01 17:22 2859008 --a------ C:\WINDOWS\SYSTEM32\nvmoblsr.dll
2006-06-01 17:22 229376 --a------ C:\WINDOWS\SYSTEM32\nvmccs.dll
2006-06-01 17:22 196608 --a------ C:\WINDOWS\SYSTEM32\nvapi.dll
2006-06-01 17:22 188416 --a------ C:\WINDOWS\SYSTEM32\nvmccss.dll
2006-06-01 17:22 1740800 --a------ C:\WINDOWS\SYSTEM32\nvwssr.dll
2006-06-01 17:22 1662976 --a------ C:\WINDOWS\SYSTEM32\nvwdmcpl.dll
2006-06-01 17:22 155715 --a------ C:\WINDOWS\SYSTEM32\nvsvc32.exe
2006-06-01 17:22 1519616 --a------ C:\WINDOWS\SYSTEM32\nwiz.exe
2006-06-01 17:22 147456 --a------ C:\WINDOWS\SYSTEM32\nvcolor.exe
2006-06-01 17:22 1466368 --a------ C:\WINDOWS\SYSTEM32\nview.dll
2006-06-01 17:22 1339392 --a------ C:\WINDOWS\SYSTEM32\nvdspsch.exe
2006-06-01 17:22 1257472 --a------ C:\WINDOWS\SYSTEM32\nvwss.dll
2006-06-01 17:22 1019904 --a------ C:\WINDOWS\SYSTEM32\nvwimg.dll
2006-06-01 17:22 1011712 --a------ C:\WINDOWS\SYSTEM32\nvcpluir.dll


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SystemTray"="SysTray.Exe"
"TCASUTIEXE"="TCAUDIAG.exe -off"
"WINDVDPatch"="CTHELPER.EXE"
"UpdReg"="C:\\WINDOWS\\UpdReg.EXE"
"CTStartup"="C:\\Program Files\\Creative\\Splash Screen\\CTEaxSpl.EXE /run"
"CTHelper"="CTHELPER.EXE"
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"MimBoot"="C:\\PROGRA~1\\MUSICM~1\\MUSICM~2\\mimboot.exe"
"type32"="\"C:\\Program Files\\Microsoft IntelliType Pro\\type32.exe\""
"IntelliPoint"="\"C:\\Program Files\\Microsoft IntelliPoint\\point32.exe\""
"DIGStream"="C:\\Program Files\\DIGStream\\digstream.exe"
"DIGServices"="C:\\Program Files\\ESPNRunTime\\DIGServices.exe /brand=ESPN /priority=0 /poll=24"
"iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"NVIDIA nForce APU1 Utilities"="NVATray.exe"
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
"EPSON Stylus CX4800 Series"="C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\E_FATIADA.EXE /P26 \"EPSON Stylus CX4800 Series\" /O6 \"USB001\" /M \"Stylus CX4800\""
"ESP"="C:\\Program Files\\Cox\\Applications\\app\\start.exe"
"NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit"
"nifse"="f:\\program files\\nifsemaj\\csrss.exe"
"adstart"="\"iexplore.exe\" \"-embedding [url="http://iesettingsupdate\"""]http://iesettingsupdate\""[/url]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Registry Cleaner"="\"C:\\Program Files\\Registry Cleaner Trial\\regclean.exe\" -startminimize"
"Esos"="\"C:\\WINDOWS\\system32\\SKS~1\\chkdsk.exe\" -vt yazr"
"nifse"="f:\\program files\\nifsemaj\\csrss.exe"
"Tjfa"="C:\\Program Files\\s?stem\\m?iexec.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
@=""
"NoDriveTypeAutoRun"=hex:5f,00,00,00
"NoCDBurning"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Runonce]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Runonce\CTStartup]
"CTStartup"="\"C:\\Program Files\\Creative\\Splash Screen\\CTEaxSpl.EXE\" /play"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000000
@=""
"CDRAutoRun"=hex:00,00,00,00

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"DisableTaskMgr"=dword:00000000

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="http://games.atari.c...y_games_bg.gif"
"SubscribedURL"="http://games.atari.c...y_games_bg.gif"
"FriendlyName"=""
"Flags"=dword:00000001
"Position"=hex:2c,00,00,00,00,00,00,00,01,00,00,00,80,02,00,00,df,01,00,00,e8,\
03,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:01,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,d2,03,00,00,78,01,00,00,08,07,00,00,08,07,\
00,00,01,00,00,40
"RestoredStateInfo"=hex:14,6d,33,02,41,c0,b4,74,50,bb,34,04,68,de,33,02,20,6d,\
33,02,c6,2b,00,00

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\1]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,00,01,00,00,00,00,00,00,00,04,00,00,00,04,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,a4,00,\
00,00,01,00,00,00

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000095
@=""
"CDRAutoRun"=hex:00,00,00,00

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000095
@=""
"CDRAutoRun"=hex:00,00,00,00

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\disabledrunkeys]
"LoadPowerProfile"="Rundll32.exe powrprof.dll,LoadCurrentPwrScheme"
"Disc Detector"="C:\\Program Files\\Creative\\ShareDLL\\CtNotify.exe"
"CTStartup"="C:\\PROGRAM FILES\\CREATIVE\\SPLASH SCREEN\\CTEaxSpl.EXE /run"
"Jet Detection"="C:\\Program Files\\Creative\\SBAudigy\\PROGRAM\\ADGJDet.exe"
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\SYSTEM32\\nvcpl.dll,NvStartup"
"nwiz"="nwiz.exe /install"
"TCASUTIEXE"="TCAUDIAG.EXE -off"
"OWCCardbusTray"="ocbtray.exe"
"QuickTime Task"="\"C:\\WINDOWS\\SYSTEM32\\qttask.exe\" -atboottime"
"winmain"="winmain.exe"
"IST Service"="C:\\Program Files\\ISTsvc\\istsvc.exe"
"ClrSchLoader"="\\Program Files\\ClearSearch\\Loader.exe"
"Bargains"="C:\\Program Files\\Bargain Buddy\\bin\\bargains.exe"

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ssqrr
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winrge32


Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\Tune-up Application Start.job

Completion time: Sun 08/20/2006 18:45:11.67
ComboFix.txt

[Buckeye_Sam]

Please download the Killbox by Option^Explicit.

Note: In the event you already have Killbox, this is a new version that I need you to download.

• Save it to your desktop.
• Please double-click Killbox.exe to run it.
• Select:
  • Delete on Reboot
  • then Click on the All Files button.
• Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):
  
  
  
  C:\WINDOWS\system32\adrot-uninst.exe
  C:\WINDOWS\ScUnin.pif
  C:\WINDOWS\ScUnin.exe
  C:\WINDOWS\system32\wtssu.exe
  C:\WINDOWS\system32\rqxv.dll
  C:\WINDOWS\system32\rrqss.ini2
  C:\WINDOWS\system32\ixt2.dll
  C:\WINDOWS\system32\mwtgftbb.exe
  C:\WINDOWS\system32\illuwokn.exe
  C:\WINDOWS\system32\opmvbjtj.exe
  C:\WINDOWS\system32\hrwkrfyf.exe
  C:\WINDOWS\system32\wcaifpcu.exe
  C:\WINDOWS\system32\gchgvkad.exe
  C:\WINDOWS\system32\hjvtxuox.exe
  C:\WINDOWS\system32\jmdhntdt.exe
  C:\WINDOWS\system32\jncnpugb.exe
  C:\WINDOWS\system32\ddpfxppy.exe
  C:\WINDOWS\system32\nyfqliiq.exe
  C:\WINDOWS\system32\pwnuwndd.exe
  C:\WINDOWS\system32\rrqss.bak2
  C:\WINDOWS\Setup90.exe
  C:\WINDOWS\ac3_0002.exe
  C:\WINDOWS\Justin.exe
  C:\WINDOWS\system32\vkq16a50.sys
  C:\WINDOWS\system32\rrqss.bak1
  C:\WINDOWS\system32\ssqrr.dll
  C:\WINDOWS\system32\yayaxuu.dll
  C:\WINDOWS\system32\winrge32.dll
  C:\WINDOWS\system32\7369dd0e.exe
  C:\WINDOWS\system32\nsd5A.dll
  C:\WINDOWS\system32\rgml.dll
  2C:\WINDOWS\sys02859896344.exe
  C:\WINDOWS\system32\adrotate.dll
  
  
  
  
  
• Return to Killbox, go to the File menu, and choose Paste from Clipboard.
  
• Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt. Click OK at any PendingFileRenameOperations prompt (and please let me know if you receive this message!).
  
  If your computer does not restart automatically, please restart it manually.
  
  
• After rebooting, open up Killbox again. Click File -> Logs -> Actions History Log
• Post this log in your next reply.

=============




Please download VundoFix.exe to your desktop.

• Double-click VundoFix.exe to run it.
• Click the Scan for Vundo button.
• Once it's done scanning, click the Remove Vundo button.
• You will receive a prompt asking if you want to remove the files, click YES
• Once you click yes, your desktop will go blank as it starts removing Vundo.
• When completed, it will prompt that it will reboot your computer, click OK.
• Please post the contents of C:\vundofix.txt and a new HiJackThis log in a reply to this thread.

Note: It is possible that VundoFix encountered a file it could not remove. In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button" when VundoFix appears upon rebooting.

[wufreak]

"If your computer does not restart automatically, please restart it manually." did not show up at all.

log from killbox:


Pocket Killbox version 2.0.0.648
Running on Windows XP as James Finlay(Administrator)
was started @ Monday, August 21, 2006, 8:55 PM

# 1 [Delete on Reboot]
Path = C:\WINDOWS\system32\adrot-uninst.exe


# 2 [Delete on Reboot]
Path = C:\WINDOWS\ScUnin.pif


# 3 [Delete on Reboot]
Path = C:\WINDOWS\ScUnin.exe


# 4 [Delete on Reboot]
Path = C:\WINDOWS\system32\wtssu.exe


# 5 [Delete on Reboot]
Path = C:\WINDOWS\system32\rqxv.dll


# 6 [Delete on Reboot]
Path = C:\WINDOWS\system32\rrqss.ini2


# 7 [Delete on Reboot]
Path = C:\WINDOWS\system32\ixt2.dll


# 8 [Delete on Reboot]
Path = C:\WINDOWS\system32\mwtgftbb.exe


# 9 [Delete on Reboot]
Path = C:\WINDOWS\system32\illuwokn.exe


# 10 [Delete on Reboot]
Path = C:\WINDOWS\system32\opmvbjtj.exe


# 11 [Delete on Reboot]
Path = C:\WINDOWS\system32\hrwkrfyf.exe


# 12 [Delete on Reboot]
Path = C:\WINDOWS\system32\wcaifpcu.exe


# 13 [Delete on Reboot]
Path = C:\WINDOWS\system32\gchgvkad.exe


# 14 [Delete on Reboot]
Path = C:\WINDOWS\system32\hjvtxuox.exe


# 15 [Delete on Reboot]
Path = C:\WINDOWS\system32\jmdhntdt.exe


# 16 [Delete on Reboot]
Path = C:\WINDOWS\system32\jncnpugb.exe


# 17 [Delete on Reboot]
Path = C:\WINDOWS\system32\ddpfxppy.exe


# 18 [Delete on Reboot]
Path = C:\WINDOWS\system32\nyfqliiq.exe


# 19 [Delete on Reboot]
Path = C:\WINDOWS\system32\pwnuwndd.exe


# 20 [Delete on Reboot]
Path = C:\WINDOWS\system32\rrqss.bak2


# 21 [Delete on Reboot]
Path = C:\WINDOWS\Setup90.exe


# 22 [Delete on Reboot]
Path = C:\WINDOWS\ac3_0002.exe


# 23 [Delete on Reboot]
Path = C:\WINDOWS\Justin.exe


# 24 [Delete on Reboot]
Path = C:\WINDOWS\system32\vkq16a50.sys


# 25 [Delete on Reboot]
Path = C:\WINDOWS\system32\rrqss.bak1


# 26 [Delete on Reboot]
Path = C:\WINDOWS\system32\ssqrr.dll


# 27 [Delete on Reboot]
Path = C:\WINDOWS\system32\yayaxuu.dll


# 28 [Delete on Reboot]
Path = C:\WINDOWS\system32\winrge32.dll


# 29 [Delete on Reboot]
Path = C:\WINDOWS\system32\7369dd0e.exe


# 30 [Delete on Reboot]
Path = C:\WINDOWS\system32\nsd5A.dll


# 31 [Delete on Reboot]
Path = C:\WINDOWS\system32\rgml.dll


# 32 [Delete on Reboot]
Path = C:\WINDOWS\system32\adrotate.dll


PendingFileRenameOperations Registry Data has been Removed by External Process! @ 8:58:12 PM
Killbox Closed(Exit) @ 8:58:55 PM
__________________________________________________

Pocket Killbox version 2.0.0.648
Running on Windows XP as James Finlay(Administrator)
was started @ Monday, August 21, 2006, 9:57 PM



log from vundofix:


VundoFix V6.1.2

Checking Java version...

Java version is 1.5.0.3

Java version is 1.5.0.6

Scan started at 9:10:54 PM 8/21/2006

Listing files found while scanning....

C:\WINDOWS\SYSTEM32\yayaxuu.dll
C:\WINDOWS\SYSTEM32\ssqrr.dll
C:\WINDOWS\SYSTEM32\rrqss.ini
C:\WINDOWS\SYSTEM32\rrqss.bak1
C:\WINDOWS\SYSTEM32\rrqss.bak2
C:\WINDOWS\SYSTEM32\rrqss.ini2
C:\WINDOWS\SYSTEM32\rrqss.tmp
C:\WINDOWS\SYSTEM32\jncnpugb.exe
C:\WINDOWS\SYSTEM32\nyfqliiq.exe
C:\WINDOWS\SYSTEM32\pwnuwndd.exe
C:\WINDOWS\SYSTEM32\jmdhntdt.exe
C:\WINDOWS\SYSTEM32\gchgvkad.exe
C:\WINDOWS\SYSTEM32\hjvtxuox.exe
C:\WINDOWS\SYSTEM32\ddpfxppy.exe
C:\WINDOWS\SYSTEM32\wcaifpcu.exe
C:\WINDOWS\SYSTEM32\hrwkrfyf.exe
C:\WINDOWS\SYSTEM32\opmvbjtj.exe
C:\WINDOWS\SYSTEM32\illuwokn.exe
C:\WINDOWS\SYSTEM32\mwtgftbb.exe

Beginning removal...

Attempting to delete C:\WINDOWS\SYSTEM32\yayaxuu.dll
C:\WINDOWS\SYSTEM32\yayaxuu.dll Has been deleted!

Attempting to delete C:\WINDOWS\SYSTEM32\ssqrr.dll
C:\WINDOWS\SYSTEM32\ssqrr.dll Could not be deleted.

Attempting to delete C:\WINDOWS\SYSTEM32\rrqss.ini
C:\WINDOWS\SYSTEM32\rrqss.ini Has been deleted!

Attempting to delete C:\WINDOWS\SYSTEM32\rrqss.bak1
C:\WINDOWS\SYSTEM32\rrqss.bak1 Has been deleted!

Attempting to delete C:\WINDOWS\SYSTEM32\rrqss.bak2
C:\WINDOWS\SYSTEM32\rrqss.bak2 Has been deleted!

Attempting to delete C:\WINDOWS\SYSTEM32\rrqss.ini2
C:\WINDOWS\SYSTEM32\rrqss.ini2 Has been deleted!

Attempting to delete C:\WINDOWS\SYSTEM32\rrqss.tmp
C:\WINDOWS\SYSTEM32\rrqss.tmp Has been deleted!

Attempting to delete C:\WINDOWS\SYSTEM32\jncnpugb.exe
C:\WINDOWS\SYSTEM32\jncnpugb.exe Has been deleted!

Attempting to delete C:\WINDOWS\SYSTEM32\nyfqliiq.exe
C:\WINDOWS\SYSTEM32\nyfqliiq.exe Has been deleted!

Attempting to delete C:\WINDOWS\SYSTEM32\pwnuwndd.exe
C:\WINDOWS\SYSTEM32\pwnuwndd.exe Has been deleted!

Attempting to delete C:\WINDOWS\SYSTEM32\jmdhntdt.exe
C:\WINDOWS\SYSTEM32\jmdhntdt.exe Has been deleted!

Attempting to delete C:\WINDOWS\SYSTEM32\gchgvkad.exe
C:\WINDOWS\SYSTEM32\gchgvkad.exe Has been deleted!

Attempting to delete C:\WINDOWS\SYSTEM32\hjvtxuox.exe
C:\WINDOWS\SYSTEM32\hjvtxuox.exe Has been deleted!

Attempting to delete C:\WINDOWS\SYSTEM32\ddpfxppy.exe
C:\WINDOWS\SYSTEM32\ddpfxppy.exe Has been deleted!

Attempting to delete C:\WINDOWS\SYSTEM32\wcaifpcu.exe
C:\WINDOWS\SYSTEM32\wcaifpcu.exe Has been deleted!

Attempting to delete C:\WINDOWS\SYSTEM32\hrwkrfyf.exe
C:\WINDOWS\SYSTEM32\hrwkrfyf.exe Has been deleted!

Attempting to delete C:\WINDOWS\SYSTEM32\opmvbjtj.exe
C:\WINDOWS\SYSTEM32\opmvbjtj.exe Has been deleted!

Attempting to delete C:\WINDOWS\SYSTEM32\illuwokn.exe
C:\WINDOWS\SYSTEM32\illuwokn.exe Has been deleted!

Attempting to delete C:\WINDOWS\SYSTEM32\mwtgftbb.exe
C:\WINDOWS\SYSTEM32\mwtgftbb.exe Has been deleted!

Performing Repairs to the registry.
Done!

VundoFix V6.1.2

Checking Java version...

Java version is 1.5.0.3

Java version is 1.5.0.6

Scan started at 9:26:49 PM 8/21/2006

Listing files found while scanning....

C:\WINDOWS\SYSTEM32\ssqrr.dll

Beginning removal...

Attempting to delete C:\WINDOWS\SYSTEM32\ssqrr.dll
C:\WINDOWS\SYSTEM32\ssqrr.dll Has been deleted!

Performing Repairs to the registry.
Done!


new hijackthis log:

Logfile of HijackThis v1.99.1
Scan saved at 10:00:01 PM, on 8/21/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\DIGStream\digstream.exe
C:\Program Files\ESPNRunTime\DIGServices.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\MUSICM~1\MUSICM~2\MMDiag.exe
C:\WINDOWS\system32\NVATray.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIADA.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mim.exe
C:\Program Files\Belkin\Nostromo\nost_LM.exe
C:\Program Files\Cox\Applications\app\SysSvcNt.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Cox\Applications\app\Console.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Common Files\Command Software\dvpapi.exe
C:\Program Files\Internet Explorer\iexplore.exe
F:\Debug stuff\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.c...//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.c...rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.c...//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.c...//www.yahoo.com
R3 - URLSearchHook: (no name) - {F61E8F7C-6FC8-3268-BD88-1653ED823FE7} - C:\WINDOWS\system32\rqxv.dll
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: AuthPopupBHO01.cBHO - {3C7195F6-D788-4D50-BA72-2EE212EDAC78} - C:\Program Files\Cox\Applications\App\PopupBHO01.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSL encrypt - {746455FE-D059-47e7-AF0E-140E03F5A447} - C:\WINDOWS\system32\nsh182.dll
O2 - BHO: (no name) - {873eb32d-ae1a-4183-89bd-45a77f761be4} - C:\WINDOWS\system32\ixt2.dll
O2 - BHO: Banner Rotator - {D117A61F-92C3-4450-A0C8-F425B14D4127} - C:\WINDOWS\system32\adrotate.dll
O2 - BHO: (no name) - {E0D49B03-2DE1-701B-C48F-06222AFE7EE0} - C:\WINDOWS\system32\fyqw.dll (file missing)
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: (no name) - {E9A33CC9-CC6C-4F93-A13D-AC3F81D4742E} - C:\WINDOWS\system32\ssqrr.dll (file missing)
O2 - BHO: (no name) - {F61E8F7C-6FC8-3268-BD88-1653ED823FE7} - C:\WINDOWS\system32\rqxv.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Cox Popup Blocker - {2C0A5F28-48D8-408B-9172-9C6121025BCE} - C:\Program Files\Cox\Applications\App\PopupBHO01.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [TCASUTIEXE] TCAUDIAG.exe -off
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [CTStartup] C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~2\mimboot.exe
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exe
O4 - HKLM\..\Run: [DIGServices] C:\Program Files\ESPNRunTime\DIGServices.exe /brand=ESPN /priority=0 /poll=24
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NVIDIA nForce APU1 Utilities] NVATray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [EPSON Stylus CX4800 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIADA.EXE /P26 "EPSON Stylus CX4800 Series" /O6 "USB001" /M "Stylus CX4800"
O4 - HKLM\..\Run: [ESP] C:\Program Files\Cox\Applications\app\start.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nifse] f:\program files\nifsemaj\csrss.exe
O4 - HKLM\..\Run: [adstart] "iexplore.exe" "-embedding [url="http://iesettingsupdate""]http://iesettingsupdate"[/url]
O4 - HKCU\..\Run: [Registry Cleaner] "C:\Program Files\Registry Cleaner Trial\regclean.exe" -startminimize
O4 - HKCU\..\Run: [Esos] "C:\WINDOWS\system32\SKS~1\chkdsk.exe" -vt yazr
O4 - HKCU\..\Run: [nifse] f:\program files\nifsemaj\csrss.exe
O4 - HKCU\..\Run: [Tjfa] C:\Program Files\s?stem\m?iexec.exe
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O4 - Global Startup: Loadout Manager.lnk = C:\Program Files\Belkin\Nostromo\nost_LM.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://support.cox.c...oad/tgctlcm.cab
O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} (MetaStreamCtl Class) - https://components.v...T_ViewPoint.htm
O16 - DPF: {220FE57E-1624-3F66-F5BE-49AE717BC8FB} - http://209.8.161.54/1/rdgUS1022.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn...ro.cab34246.cab
O16 - DPF: {ED28050F-D713-43BA-A376-DCC5C35407D5} (MsnMusicAx Class) - https://music.msn.co...snmusax2330.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: winrge32 - C:\WINDOWS\SYSTEM32\winrge32.dll
O23 - Service: Cox High Speed Internet Security Suite System Service (AuthSysSvc) - Authentium, Inc. - C:\Program Files\Cox\Applications\app\SysSvcNt.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - C:\Program Files\Common Files\Command Software\dvpapi.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: System Idle Service (sysidleserv) - Unknown owner - c:\windows\system32\adprot.exe (file missing)

[Buckeye_Sam]

You may want to print out these instructions as you will need to boot into safe mode for this part of the fix.
Please follow these steps:

• Please make sure that you can View Hidden Files
  • Click Start -> My Computer
  • Select Tools -> Folder options
  • Select the View tab and make sure that 'Show hidden files and folders' (or 'Show all files') is enabled.
  • Also make sure that 'Display the contents of system folders' is checked.
  • Make sure "Hide extensions for known file types" is unchecked
  • Make sure "Hide protected operating system files (recommended)" is unchecked
  • For more info on how to show hidden files click here.
  
  
  
• Run Hijackthis again, click scan, and Put a checkmark next to each of these. Then close all other windows--you should only see HijackThis on your Desktop--and click the Fix Checked button.
  
  
  R3 - URLSearchHook: (no name) - {F61E8F7C-6FC8-3268-BD88-1653ED823FE7} - C:\WINDOWS\system32\rqxv.dll
  R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
  O2 - BHO: SSL encrypt - {746455FE-D059-47e7-AF0E-140E03F5A447} - C:\WINDOWS\system32\nsh182.dll
  O2 - BHO: (no name) - {873eb32d-ae1a-4183-89bd-45a77f761be4} - C:\WINDOWS\system32\ixt2.dll
  O2 - BHO: Banner Rotator - {D117A61F-92C3-4450-A0C8-F425B14D4127} - C:\WINDOWS\system32\adrotate.dll
  O2 - BHO: (no name) - {E0D49B03-2DE1-701B-C48F-06222AFE7EE0} - C:\WINDOWS\system32\fyqw.dll (file missing)
  O2 - BHO: (no name) - {E9A33CC9-CC6C-4F93-A13D-AC3F81D4742E} - C:\WINDOWS\system32\ssqrr.dll (file missing)
  O2 - BHO: (no name) - {F61E8F7C-6FC8-3268-BD88-1653ED823FE7} - C:\WINDOWS\system32\rqxv.dll
  O4 - HKLM\..\Run: [nifse] f:\program files\nifsemaj\csrss.exe
  O4 - HKLM\..\Run: [adstart] "iexplore.exe" "-embedding http://iesettingsupdate"
  O4 - HKCU\..\Run: [Registry Cleaner] "C:\Program Files\Registry Cleaner Trial\regclean.exe" -startminimize
  O4 - HKCU\..\Run: [Esos] "C:\WINDOWS\system32\SKS~1\chkdsk.exe" -vt yazr
  O4 - HKCU\..\Run: [nifse] f:\program files\nifsemaj\csrss.exe
  O4 - HKCU\..\Run: [Tjfa] C:\Program Files\s?stem\m?iexec.exe
  O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
  O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
  O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
  O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} (MetaStreamCtl Class) - https://components.v...T_ViewPoint.htm
  O16 - DPF: {220FE57E-1624-3F66-F5BE-49AE717BC8FB} - http://209.8.161.54/1/rdgUS1022.exe
  O20 - Winlogon Notify: winrge32 - C:\WINDOWS\SYSTEM32\winrge32.dll
  O23 - Service: System Idle Service (sysidleserv) - Unknown owner - c:\windows\system32\adprot.exe (file missing)
  
  
  
  
• Please reboot your computer in SafeMode by doing the following:
  • Restart your computer
  • After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
  • Instead of Windows loading as normal, a menu should appear
  • Select the first option, to run Windows in Safe Mode.
  • If you have trouble getting into Safe mode go here for more info.
  
  
  
  
• Once in Safe mode, delete these files or directories (Do not be concerned if they do not exist):
  
  
  C:\WINDOWS\system32\nsh182.dll
  C:\WINDOWS\system32\ixt2.dll
  C:\WINDOWS\system32\adrotate.dll
  C:\WINDOWS\system32\rqxv.dll
  C:\WINDOWS\SYSTEM32\winrge32.dll
  f:\program files\nifsemaj\csrss.exe
  

Reboot your computer to go back to normal mode.
Please post a new hijackthis log and a new log from Combofix.

[wufreak]

Sorry for the delay. Here is the hijackthis log:


Logfile of HijackThis v1.99.1
Scan saved at 11:19:11 AM, on 8/24/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\DIGStream\digstream.exe
C:\Program Files\ESPNRunTime\DIGServices.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\NVATray.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIADA.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Belkin\Nostromo\nost_LM.exe
C:\PROGRA~1\MUSICM~1\MUSICM~2\MMDiag.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mim.exe
C:\Program Files\Cox\Applications\app\SysSvcNt.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Common Files\Command Software\dvpapi.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Internet Explorer\iexplore.exe
F:\Debug stuff\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.c...//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.c...rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.c...//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.c...//www.yahoo.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: AuthPopupBHO01.cBHO - {3C7195F6-D788-4D50-BA72-2EE212EDAC78} - C:\Program Files\Cox\Applications\App\PopupBHO01.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Cox Popup Blocker - {2C0A5F28-48D8-408B-9172-9C6121025BCE} - C:\Program Files\Cox\Applications\App\PopupBHO01.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [TCASUTIEXE] TCAUDIAG.exe -off
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [CTStartup] C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~2\mimboot.exe
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exe
O4 - HKLM\..\Run: [DIGServices] C:\Program Files\ESPNRunTime\DIGServices.exe /brand=ESPN /priority=0 /poll=24
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NVIDIA nForce APU1 Utilities] NVATray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [EPSON Stylus CX4800 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIADA.EXE /P26 "EPSON Stylus CX4800 Series" /O6 "USB001" /M "Stylus CX4800"
O4 - HKLM\..\Run: [ESP] C:\Program Files\Cox\Applications\app\start.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nifse] f:\program files\nifsemaj\csrss.exe
O4 - HKCU\..\Run: [nifse] f:\program files\nifsemaj\csrss.exe
O4 - Global Startup: Loadout Manager.lnk = C:\Program Files\Belkin\Nostromo\nost_LM.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://support.cox.c...oad/tgctlcm.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn...ro.cab34246.cab
O16 - DPF: {ED28050F-D713-43BA-A376-DCC5C35407D5} (MsnMusicAx Class) - https://music.msn.co...snmusax2330.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: winrge32 - C:\WINDOWS\SYSTEM32\winrge32.dll
O23 - Service: Cox High Speed Internet Security Suite System Service (AuthSysSvc) - Authentium, Inc. - C:\Program Files\Cox\Applications\app\SysSvcNt.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - C:\Program Files\Common Files\Command Software\dvpapi.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: System Idle Service (sysidleserv) - Unknown owner - c:\windows\system32\adprot.exe (file missing)




The combofix log:



James Finlay - 06-08-24 11:20:25.23
ComboFix 06.08.18 - Running from: C:\Documents and Settings\James Finlay\Desktop

(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

Folders Quarantined:

C:\QooBox\Purity\WINDOWS\SYSTEM32\SKS~1
C:\QooBox\Purity\WINDOWS\SYSTEM32\SKS~1\SKS~1
C:\QooBox\Purity\WINDOWS\SYSTEM32\SKS~1\chkdsk.exe
C:\QooBox\Purity\Program Files\SSTEM~1
C:\QooBox\Purity\Program Files\Common Files\STEM~1
C:\QooBox\Purity\Program Files\SSTEM~1\m?iexec.exe
C:\QooBox\Purity\Documents and Settings\James Finlay\My Documents\MBOLS~1


((((((((((((((((((((((((((((((( Files Created from 2006-07-24 to 2006-08-24 ))))))))))))))))))))))))))))))))))


2006-08-21 21:35 9,216 C:\WINDOWS\system32\VundoFixSVC.exe
2006-08-21 21:03 13,844 C:\WINDOWS\system32\lfpbdtxm.exe
2006-08-19 22:07 967 C:\WINDOWS\ScUnin.pif
2006-08-19 22:07 94,208 C:\WINDOWS\ScUnin.exe
2006-08-19 20:13 2 C:\WINDOWS\system32\wtssu.exe
2006-08-16 14:55 102,400 C:\WINDOWS\system32\MSHTMPGR.DLL
2006-08-16 07:18 214,748 C:\WINDOWS\Setup90.exe
2006-08-16 07:18 2,560 C:\WINDOWS\ac3_0002.exe
2006-08-16 07:18 115,157 C:\WINDOWS\Justin.exe
2006-08-16 07:18 1,167 C:\WINDOWS\system32\vkq16a50.sys
2006-08-15 21:31 18,944 C:\WINDOWS\system32\winrge32.dll
2006-08-15 21:31 13,312 C:\WINDOWS\system32\7369dd0e.exe
2006-08-14 17:52 78,848 C:\WINDOWS\system32\nsd5A.dll
2006-08-14 12:52 2,859 C:\WINDOWS\system32\rgml.dll
2006-08-11 09:05 155,648 C:\WINDOWS\sys02859896344.exe
2006-07-30 12:13 189,984 C:\WINDOWS\system32\grfilter.dll
2006-07-30 12:07 103,968 C:\WINDOWS\system32\authcrypt.dll
2006-07-30 12:04 82,432 C:\WINDOWS\system32\msxml4r.dll
2006-07-30 12:04 77,312 C:\WINDOWS\system32\DWSPY36.dll
2006-07-30 12:04 63,488 C:\WINDOWS\system32\FlexBag.dll
2006-07-30 12:04 63,008 C:\WINDOWS\system32\wscapi.dll
2006-07-30 12:04 456,536 C:\WINDOWS\system32\XceedZip.dll
2006-07-30 12:04 405,504 C:\WINDOWS\system32\ExComboBox.dll
2006-07-30 12:04 40,960 C:\WINDOWS\system32\dwBkThrd.dll
2006-07-30 12:04 331,776 C:\WINDOWS\system32\IMDBvb.dll
2006-07-30 12:04 221,184 C:\WINDOWS\system32\DartSock.dll
2006-07-30 12:04 22,528 C:\WINDOWS\system32\SockIntf.dll
2006-07-30 12:04 200,704 C:\WINDOWS\system32\dwSock6.dll
2006-07-30 12:04 137,216 C:\WINDOWS\system32\dwspy32.dll
2006-07-30 12:04 122,880 C:\WINDOWS\system32\dwspyvb6.dll
2006-07-30 12:04 103,424 C:\WINDOWS\system32\sgRegExp.dll
2006-07-30 12:04 1,233,920 C:\WINDOWS\system32\msxml4.dll
2006-07-27 20:55 81,920 C:\WINDOWS\system32\MSTRC32.DLL
2006-07-27 20:55 372,736 C:\WINDOWS\system32\IJL11.DLL
2006-07-27 20:55 36,864 C:\WINDOWS\system32\msmidfsrm.exe


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2006-08-21 21:35 9216 --a------ C:\WINDOWS\SYSTEM32\VundoFixSVC.exe
2006-08-21 21:03 13844 --a------ C:\WINDOWS\SYSTEM32\lfpbdtxm.exe
2006-08-19 22:08 967 --------- C:\WINDOWS\ScUnin.pif
2006-08-19 22:08 94208 --------- C:\WINDOWS\ScUnin.exe
2006-08-19 20:13 2 --------- C:\WINDOWS\SYSTEM32\wtssu.exe
2006-08-19 14:02 155648 --a------ C:\WINDOWS\sys02859896344.exe
2006-08-19 00:58 -------- d-------- C:\Program Files\Common Files\Java
2006-08-17 09:41 1167 --------- C:\WINDOWS\SYSTEM32\vkq16a50.sys
2006-08-16 15:05 -------- d-------- C:\Program Files\Common Files\RuleSpace
2006-08-16 15:05 -------- d-------- C:\Program Files\Common Files\PestPatrol
2006-08-16 15:03 -------- d-------- C:\Program Files\Common Files\Command Software
2006-08-16 07:45 158843 --a------ C:\WINDOWS\SYSTEM32\snfhh.dll
2006-08-16 07:18 2560 --------- C:\WINDOWS\ac3_0002.exe
2006-08-16 07:18 214748 --------- C:\WINDOWS\Setup90.exe
2006-08-16 07:18 115157 --------- C:\WINDOWS\Justin.exe
2006-08-16 06:16 2859 --------- C:\WINDOWS\SYSTEM32\rgml.dll
2006-08-15 21:31 18944 --a------ C:\WINDOWS\SYSTEM32\winrge32.dll
2006-08-15 21:31 13312 --------- C:\WINDOWS\SYSTEM32\7369dd0e.exe
2006-08-15 21:31 -------- d-------- C:\Program Files\Cowabanga
2006-08-14 17:52 78848 --------- C:\WINDOWS\SYSTEM32\nsd5A.dll
2006-08-01 09:59 -------- d-------- C:\Documents and Settings\James Finlay\Application Data\EPSON
2006-07-30 12:13 189984 --a------ C:\WINDOWS\SYSTEM32\grfilter.dll
2006-07-30 12:07 103968 --a------ C:\WINDOWS\SYSTEM32\authcrypt.dll
2006-07-30 12:05 36352 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\GRTdiMon.sys
2006-07-30 12:05 16896 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\GRFilter.sys
2006-07-30 12:04 82432 --a------ C:\WINDOWS\SYSTEM32\msxml4r.dll
2006-07-30 12:04 77312 --a------ C:\WINDOWS\SYSTEM32\DWSPY36.dll
2006-07-30 12:04 63488 --a------ C:\WINDOWS\SYSTEM32\FlexBag.dll
2006-07-30 12:04 63008 --a------ C:\WINDOWS\SYSTEM32\wscapi.dll
2006-07-30 12:04 456536 --a------ C:\WINDOWS\SYSTEM32\XceedZip.dll
2006-07-30 12:04 40960 --a------ C:\WINDOWS\SYSTEM32\dwBkThrd.dll
2006-07-30 12:04 405504 --a------ C:\WINDOWS\SYSTEM32\ExComboBox.dll
2006-07-30 12:04 331776 --a------ C:\WINDOWS\SYSTEM32\IMDBvb.dll
2006-07-30 12:04 22528 --a------ C:\WINDOWS\SYSTEM32\SockIntf.dll
2006-07-30 12:04 221184 --a------ C:\WINDOWS\SYSTEM32\DartSock.dll
2006-07-30 12:04 200704 --a------ C:\WINDOWS\SYSTEM32\dwSock6.dll
2006-07-30 12:04 137216 --a------ C:\WINDOWS\SYSTEM32\dwspy32.dll
2006-07-30 12:04 1233920 --a------ C:\WINDOWS\SYSTEM32\msxml4.dll
2006-07-30 12:04 122880 --a------ C:\WINDOWS\SYSTEM32\dwspyvb6.dll
2006-07-30 12:04 103424 --a------ C:\WINDOWS\SYSTEM32\sgRegExp.dll
2006-07-30 12:04 102400 -ra------ C:\WINDOWS\SYSTEM32\MSHTMPGR.DLL
2006-07-27 06:24 679424 --a------ C:\WINDOWS\SYSTEM32\inetcomm.dll
2006-07-21 01:24 72704 --a------ C:\WINDOWS\SYSTEM32\hlink.dll
2006-07-20 16:02 -------- d-------- C:\Program Files\Dearborn
2006-07-19 11:25 -------- d-------- C:\Program Files\ArcSoft
2006-07-19 11:18 -------- d-------- C:\Program Files\epson
2006-07-18 20:42 -------- d-------- C:\Program Files\Google
2006-07-17 20:28 22768 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\usbsermpt.sys
2006-07-17 20:18 -------- d-------- C:\Program Files\Motorola Phone Tools
2006-07-01 14:32 -------- d-------- C:\Program Files\Java
2006-06-19 11:38 53248 --a------ C:\WINDOWS\uni_ehhhh.exe
2006-06-19 11:38 49152 --a------ C:\WINDOWS\uninst104.exe
2006-06-05 14:51 61712 -ra------ C:\WINDOWS\SYSTEM32\avmontr.dll
2006-06-01 19:09 208896 --a------ C:\WINDOWS\SYSTEM32\NVUNINST.EXE
2006-06-01 19:09 208896 --a------ C:\WINDOWS\SYSTEM32\nvudisp.exe
2006-06-01 19:09 208896 --a------ C:\WINDOWS\SYSTEM32\nvuaudio.exe
2006-06-01 17:22 888832 --a------ C:\WINDOWS\SYSTEM32\nvmobls.dll
2006-06-01 17:22 86016 --a------ C:\WINDOWS\SYSTEM32\nvmctray.dll
2006-06-01 17:22 81920 --a------ C:\WINDOWS\SYSTEM32\nvwddi.dll
2006-06-01 17:22 794624 --a------ C:\WINDOWS\SYSTEM32\nvcplui.exe
2006-06-01 17:22 7618560 --a------ C:\WINDOWS\SYSTEM32\nvcpl.dll
2006-06-01 17:22 581632 --a------ C:\WINDOWS\SYSTEM32\nvhwvid.dll
2006-06-01 17:22 5652480 --a------ C:\WINDOWS\SYSTEM32\nvdisps.dll
2006-06-01 17:22 5632000 --a------ C:\WINDOWS\SYSTEM32\nvoglnt.dll
2006-06-01 17:22 5246976 --a------ C:\WINDOWS\SYSTEM32\nvdispsr.dll
2006-06-01 17:22 466944 --a------ C:\WINDOWS\SYSTEM32\nvshell.dll
2006-06-01 17:22 462848 --a------ C:\WINDOWS\SYSTEM32\nvmccssr.dll
2006-06-01 17:22 4529408 --a------ C:\WINDOWS\SYSTEM32\nv4_disp.dll
2006-06-01 17:22 45056 --a------ C:\WINDOWS\SYSTEM32\nvmccsrs.dll
2006-06-01 17:22 442368 --a------ C:\WINDOWS\SYSTEM32\nvappbar.exe
2006-06-01 17:22 425984 --a------ C:\WINDOWS\SYSTEM32\keystone.exe
2006-06-01 17:22 35840 --a------ C:\WINDOWS\SYSTEM32\nvcodins.dll
2006-06-01 17:22 35840 --a------ C:\WINDOWS\SYSTEM32\nvcod.dll
2006-06-01 17:22 311296 --a------ C:\WINDOWS\SYSTEM32\nvexpbar.dll
2006-06-01 17:22 3100672 --a------ C:\WINDOWS\SYSTEM32\nvgames.dll
2006-06-01 17:22 2977792 --a------ C:\WINDOWS\SYSTEM32\nvvitvsr.dll
2006-06-01 17:22 2924544 --a------ C:\WINDOWS\SYSTEM32\nvvitvs.dll
2006-06-01 17:22 2916352 --a------ C:\WINDOWS\SYSTEM32\nvgamesr.dll
2006-06-01 17:22 286720 --a------ C:\WINDOWS\SYSTEM32\nvnt4cpl.dll
2006-06-01 17:22 2859008 --a------ C:\WINDOWS\SYSTEM32\nvmoblsr.dll
2006-06-01 17:22 229376 --a------ C:\WINDOWS\SYSTEM32\nvmccs.dll
2006-06-01 17:22 196608 --a------ C:\WINDOWS\SYSTEM32\nvapi.dll
2006-06-01 17:22 188416 --a------ C:\WINDOWS\SYSTEM32\nvmccss.dll
2006-06-01 17:22 1740800 --a------ C:\WINDOWS\SYSTEM32\nvwssr.dll
2006-06-01 17:22 1662976 --a------ C:\WINDOWS\SYSTEM32\nvwdmcpl.dll
2006-06-01 17:22 155715 --a------ C:\WINDOWS\SYSTEM32\nvsvc32.exe
2006-06-01 17:22 1519616 --a------ C:\WINDOWS\SYSTEM32\nwiz.exe
2006-06-01 17:22 147456 --a------ C:\WINDOWS\SYSTEM32\nvcolor.exe
2006-06-01 17:22 1466368 --a------ C:\WINDOWS\SYSTEM32\nview.dll
2006-06-01 17:22 1339392 --a------ C:\WINDOWS\SYSTEM32\nvdspsch.exe
2006-06-01 17:22 1257472 --a------ C:\WINDOWS\SYSTEM32\nvwss.dll
2006-06-01 17:22 1019904 --a------ C:\WINDOWS\SYSTEM32\nvwimg.dll
2006-06-01 17:22 1011712 --a------ C:\WINDOWS\SYSTEM32\nvcpluir.dll


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SystemTray"="SysTray.Exe"
"TCASUTIEXE"="TCAUDIAG.exe -off"
"WINDVDPatch"="CTHELPER.EXE"
"UpdReg"="C:\\WINDOWS\\UpdReg.EXE"
"CTStartup"="C:\\Program Files\\Creative\\Splash Screen\\CTEaxSpl.EXE /run"
"CTHelper"="CTHELPER.EXE"
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"MimBoot"="C:\\PROGRA~1\\MUSICM~1\\MUSICM~2\\mimboot.exe"
"type32"="\"C:\\Program Files\\Microsoft IntelliType Pro\\type32.exe\""
"IntelliPoint"="\"C:\\Program Files\\Microsoft IntelliPoint\\point32.exe\""
"DIGStream"="C:\\Program Files\\DIGStream\\digstream.exe"
"DIGServices"="C:\\Program Files\\ESPNRunTime\\DIGServices.exe /brand=ESPN /priority=0 /poll=24"
"iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"NVIDIA nForce APU1 Utilities"="NVATray.exe"
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
"EPSON Stylus CX4800 Series"="C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\E_FATIADA.EXE /P26 \"EPSON Stylus CX4800 Series\" /O6 \"USB001\" /M \"Stylus CX4800\""
"ESP"="C:\\Program Files\\Cox\\Applications\\app\\start.exe"
"NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit"
"nifse"="f:\\program files\\nifsemaj\\csrss.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nifse"="f:\\program files\\nifsemaj\\csrss.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
@=""
"NoDriveTypeAutoRun"=hex:5f,00,00,00
"NoCDBurning"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Runonce]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Runonce\CTStartup]
"CTStartup"="\"C:\\Program Files\\Creative\\Splash Screen\\CTEaxSpl.EXE\" /play"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000000
@=""
"CDRAutoRun"=hex:00,00,00,00

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000000

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="http://games.atari.c...y_games_bg.gif"
"SubscribedURL"="http://games.atari.c...y_games_bg.gif"
"FriendlyName"=""
"Flags"=dword:00000001
"Position"=hex:2c,00,00,00,00,00,00,00,01,00,00,00,80,02,00,00,df,01,00,00,e8,\
03,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:01,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,d2,03,00,00,78,01,00,00,08,07,00,00,08,07,\
00,00,01,00,00,40
"RestoredStateInfo"=hex:14,6d,33,02,41,c0,b4,74,50,bb,34,04,68,de,33,02,20,6d,\
33,02,c6,2b,00,00

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\1]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,00,01,00,00,00,00,00,00,00,04,00,00,00,04,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,a4,00,\
00,00,01,00,00,00

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000095
@=""
"CDRAutoRun"=hex:00,00,00,00

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000095
@=""
"CDRAutoRun"=hex:00,00,00,00

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\disabledrunkeys]
"LoadPowerProfile"="Rundll32.exe powrprof.dll,LoadCurrentPwrScheme"
"Disc Detector"="C:\\Program Files\\Creative\\ShareDLL\\CtNotify.exe"
"CTStartup"="C:\\PROGRAM FILES\\CREATIVE\\SPLASH SCREEN\\CTEaxSpl.EXE /run"
"Jet Detection"="C:\\Program Files\\Creative\\SBAudigy\\PROGRAM\\ADGJDet.exe"
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\SYSTEM32\\nvcpl.dll,NvStartup"
"nwiz"="nwiz.exe /install"
"TCASUTIEXE"="TCAUDIAG.EXE -off"
"OWCCardbusTray"="ocbtray.exe"
"QuickTime Task"="\"C:\\WINDOWS\\SYSTEM32\\qttask.exe\" -atboottime"
"winmain"="winmain.exe"
"IST Service"="C:\\Program Files\\ISTsvc\\istsvc.exe"
"ClrSchLoader"="\\Program Files\\ClearSearch\\Loader.exe"
"Bargains"="C:\\Program Files\\Bargain Buddy\\bin\\bargains.exe"

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winrge32


Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\Tune-up Application Start.job

Completion time: Thu 08/24/2006 11:20:54.48
ComboFix2.txt
ComboFix.txt

[Buckeye_Sam]

We're in the home stretch after this step.


Open Notepad, and copy everything in the code box below and paste it into a new notepad file. Change the "Save As Type" to "All Files". Save it as fixme.reg on your Desktop. Make sure there is NO blank line above "REGEDIT4"!

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\disabledrunkeys]
"winmain"=-
"IST Service"=-
"ClrSchLoader"=-
"Bargains"=-

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nifse"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nifse"=-

Locate fixme.reg on your Desktop and double-click on it. When it asks if you want to merge with the registry, click YES.



Delete these files on reboot with Killbox just as you did before.


f:\program files\nifsemaj\csrss.exe
C:\WINDOWS\system32\lfpbdtxm.exe
C:\WINDOWS\ScUnin.pif
C:\WINDOWS\ScUnin.exe
C:\WINDOWS\system32\wtssu.exe
C:\WINDOWS\Setup90.exe
C:\WINDOWS\ac3_0002.exe
C:\WINDOWS\Justin.exe
C:\WINDOWS\system32\vkq16a50.sys
C:\WINDOWS\system32\winrge32.dll
C:\WINDOWS\system32\7369dd0e.exe
C:\WINDOWS\system32\nsd5A.dll
C:\WINDOWS\system32\rgml.dll
C:\WINDOWS\sys02859896344.exe
C:\WINDOWS\SYSTEM32\snfhh.dll
C:\WINDOWS\uni_ehhhh.exe
C:\WINDOWS\uninst104.exe


Delete this folder manually.

C:\Program Files\Cowabanga



Please download Ewido Anti-spyware and save that file to your desktop.
This is a 30 day trial of the program

• Once you have downloaded ewido anti-spyware, locate the icon on the desktop and double-click it to launch the set up program.
• Once the setup is complete you will need run Ewido and update the definition files.
• On the main screen select the icon "Update" then select the "Update now" link.
  • Next select the "Start Update" button, the update will start and a progress bar will show the updates being installed.
• Once the update has completed select the "Scanner" icon at the top of the screen, then select the "Settings" tab.
• Once in the Settings screen click on "Recommended actions" and then select "Quarantine".
• Under "Reports"
  • Select "Automatically generate report after every scan"
  • Un-Select "Only if threats were found"

Close Ewido anti-spyware, Do Not run a scan just yet, we will shortly.

• Reboot your computer into SafeMode. You can do this by restarting your computer and continually tapping the F8 key until a menu appears. Use your up arrow key to highlight SafeMode then hit enter.
• Clean out your Temporary Internet files
  • Quit Internet Explorer and quit any instances of Windows Explorer.
  • Click Start -> Control Panel and then double-click Internet Options.
  • On the General tab, click Delete Files under Temporary Internet Files.
  • In the Delete Files dialog box, tick the Delete all offline content check box , and then click OK.
  • On the General tab, click Delete Cookies under Temporary Internet Files, and then click OK.
  • Click on the Programs tab then click the Reset Web Settings button. Click Apply then OK.
  • Click OK.
  
  IMPORTANT: Close all windows and do not open any other windows or programs while Ewido is scanning, it may interfere with the scanning proccess:
  
  
• Lauch Ewido-anti-spyware by double-clicking the icon on your desktop.
• Select the "Scanner" icon at the top and then the "Scan" tab then click on "Complete System Scan".
• Ewido will now begin the scanning process, be patient this may take a little time.
  Once the scan is complete do the following:
• If you have any infections you will prompted, then select "Apply all actions"
• Next select the "Reports" icon at the top.
• Select the "Save report as" button in the lower left hand of the screen and save it to a text file on your system (make sure to remember where you saved that file, this is important).
• Close Ewido and reboot your system back into Normal Mode and post the results of the Ewido scan report along with a new Hijackthis log.

[wufreak]

Ewido wouldn't do a report at first, now it is:

---------------------------------------------------------
ewido anti-spyware - Scan Report
---------------------------------------------------------

+ Created at: 12:10:32 PM 8/31/2006

+ Scan result:



HKU\S-1-5-21-1957994488-117609710-839522115-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{052B12F7-86FA-4921-8482-26C42316B522} -> Adware.Generic : Cleaned with backup (quarantined).
HKU\S-1-5-21-1957994488-117609710-839522115-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{873EB32D-AE1A-4183-89BD-45A77F761BE4} -> Adware.Generic : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{26F90CCF-EA3F-4387-8C6B-7977A4B6FB87}\RP1141\A0322484.exe -> Adware.Look2Me : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{26F90CCF-EA3F-4387-8C6B-7977A4B6FB87}\RP1141\A0322485.ocx -> Adware.MediaMotor : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{26F90CCF-EA3F-4387-8C6B-7977A4B6FB87}\RP1141\A0322488.dll -> Adware.PurityScan : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{26F90CCF-EA3F-4387-8C6B-7977A4B6FB87}\RP1141\A0322489.exe -> Adware.PurityScan : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{26F90CCF-EA3F-4387-8C6B-7977A4B6FB87}\RP1141\A0322486.dll -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{26F90CCF-EA3F-4387-8C6B-7977A4B6FB87}\RP1141\A0322487.dll -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{26F90CCF-EA3F-4387-8C6B-7977A4B6FB87}\RP1141\A0322475.exe -> Downloader.Obfuscated.a : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{26F90CCF-EA3F-4387-8C6B-7977A4B6FB87}\RP1141\A0322476.exe -> Downloader.Obfuscated.a : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{26F90CCF-EA3F-4387-8C6B-7977A4B6FB87}\RP1141\A0322483.exe -> Downloader.PurityScan.da : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{26F90CCF-EA3F-4387-8C6B-7977A4B6FB87}\RP1141\A0322477.exe -> Downloader.Small.cyh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{26F90CCF-EA3F-4387-8C6B-7977A4B6FB87}\RP1141\A0322474.exe -> Downloader.TSUpdate.f : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{26F90CCF-EA3F-4387-8C6B-7977A4B6FB87}\RP1141\A0322473.exe -> Downloader.TSUpdate.l : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{26F90CCF-EA3F-4387-8C6B-7977A4B6FB87}\RP1141\A0322472.exe -> Downloader.TSUpdate.r : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{26F90CCF-EA3F-4387-8C6B-7977A4B6FB87}\RP1141\A0322482.exe -> Downloader.VB.akq : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{26F90CCF-EA3F-4387-8C6B-7977A4B6FB87}\RP1141\A0322478.dll -> Downloader.Zlob.agh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{26F90CCF-EA3F-4387-8C6B-7977A4B6FB87}\RP1141\A0322491.exe -> Not-A-Virus.Downloader.Win32.WinFixer.i : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{26F90CCF-EA3F-4387-8C6B-7977A4B6FB87}\RP1141\A0322492.exe -> Not-A-Virus.Downloader.Win32.WinFixer.i : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{26F90CCF-EA3F-4387-8C6B-7977A4B6FB87}\RP1141\A0322493.exe -> Not-A-Virus.Downloader.Win32.WinFixer.i : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{26F90CCF-EA3F-4387-8C6B-7977A4B6FB87}\RP1141\A0322494.exe -> Not-A-Virus.Downloader.Win32.WinFixer.i : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{26F90CCF-EA3F-4387-8C6B-7977A4B6FB87}\RP1141\A0322495.exe -> Not-A-Virus.Downloader.Win32.WinFixer.i : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{26F90CCF-EA3F-4387-8C6B-7977A4B6FB87}\RP1141\A0322496.exe -> Not-A-Virus.Downloader.Win32.WinFixer.i : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{26F90CCF-EA3F-4387-8C6B-7977A4B6FB87}\RP1141\A0322497.exe -> Not-A-Virus.Downloader.Win32.WinFixer.i : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{26F90CCF-EA3F-4387-8C6B-7977A4B6FB87}\RP1141\A0322498.exe -> Not-A-Virus.Downloader.Win32.WinFixer.i : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{26F90CCF-EA3F-4387-8C6B-7977A4B6FB87}\RP1141\A0322499.exe -> Not-A-Virus.Downloader.Win32.WinFixer.i : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{26F90CCF-EA3F-4387-8C6B-7977A4B6FB87}\RP1141\A0322500.exe -> Not-A-Virus.Downloader.Win32.WinFixer.i : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{26F90CCF-EA3F-4387-8C6B-7977A4B6FB87}\RP1141\A0322501.exe -> Not-A-Virus.Downloader.Win32.WinFixer.i : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{26F90CCF-EA3F-4387-8C6B-7977A4B6FB87}\RP1141\A0322502.exe -> Not-A-Virus.Downloader.Win32.WinFixer.i : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{26F90CCF-EA3F-4387-8C6B-7977A4B6FB87}\RP1141\A0322503.exe -> Not-A-Virus.Downloader.Win32.WinFixer.i : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{26F90CCF-EA3F-4387-8C6B-7977A4B6FB87}\RP1141\A0322504.exe -> Not-A-Virus.Downloader.Win32.WinFixer.i : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{26F90CCF-EA3F-4387-8C6B-7977A4B6FB87}\RP1141\A0322505.exe -> Not-A-Virus.Downloader.Win32.WinFixer.i : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{26F90CCF-EA3F-4387-8C6B-7977A4B6FB87}\RP1141\A0322506.exe -> Not-A-Virus.Downloader.Win32.WinFixer.i : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{26F90CCF-EA3F-4387-8C6B-7977A4B6FB87}\RP1141\A0322507.exe -> Not-A-Virus.Downloader.Win32.WinFixer.i : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{26F90CCF-EA3F-4387-8C6B-7977A4B6FB87}\RP1141\A0322508.exe -> Not-A-Virus.Downloader.Win32.WinFixer.i : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{26F90CCF-EA3F-4387-8C6B-7977A4B6FB87}\RP1141\A0322509.exe -> Not-A-Virus.Downloader.Win32.WinFixer.i : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{26F90CCF-EA3F-4387-8C6B-7977A4B6FB87}\RP1141\A0322510.exe -> Not-A-Virus.Downloader.Win32.WinFixer.i : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{26F90CCF-EA3F-4387-8C6B-7977A4B6FB87}\RP1141\A0322511.exe -> Not-A-Virus.Downloader.Win32.WinFixer.i : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{26F90CCF-EA3F-4387-8C6B-7977A4B6FB87}\RP1141\A0322512.exe -> Not-A-Virus.Downloader.Win32.WinFixer.i : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{26F90CCF-EA3F-4387-8C6B-7977A4B6FB87}\RP1141\A0322513.exe -> Not-A-Virus.Downloader.Win32.WinFixer.i : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{26F90CCF-EA3F-4387-8C6B-7977A4B6FB87}\RP1141\A0322514.exe -> Not-A-Virus.Downloader.Win32.WinFixer.i : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{26F90CCF-EA3F-4387-8C6B-7977A4B6FB87}\RP1141\A0322515.exe -> Not-A-Virus.Downloader.Win32.WinFixer.r : Cleaned with backup (quarantined).
C:\Documents and Settings\James Finlay\Cookies\james finlay@2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
C:\Documents and Settings\James Finlay\Cookies\james [email protected][1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
C:\Documents and Settings\James Finlay\Cookies\james finlay@adrevolver[3].txt -> TrackingCookie.Adrevolver : Cleaned with backup (quarantined).
C:\Documents and Settings\James Finlay\Cookies\james [email protected][1].txt -> TrackingCookie.Burstbeacon : Cleaned with backup (quarantined).
C:\Documents and Settings\James Finlay\Cookies\james finlay@burstnet[2].txt -> TrackingCookie.Burstnet : Cleaned with backup (quarantined).
C:\Documents and Settings\James Finlay\Cookies\james [email protected][1].txt -> TrackingCookie.Burstnet : Cleaned with backup (quarantined).
C:\Documents and Settings\James Finlay\Cookies\james finlay@casalemedia[1].txt -> TrackingCookie.Casalemedia : Cleaned with backup (quarantined).
C:\Documents and Settings\James Finlay\Cookies\james [email protected][2].txt -> TrackingCookie.Counted : Cleaned with backup (quarantined).
C:\Documents and Settings\James Finlay\Cookies\james finlay@fastclick[1].txt -> TrackingCookie.Fastclick : Cleaned with backup (quarantined).
C:\Documents and Settings\James Finlay\Cookies\james finlay@overture[1].txt -> TrackingCookie.Overture : Cleaned with backup (quarantined).
C:\Documents and Settings\James Finlay\Cookies\james [email protected][1].txt -> TrackingCookie.Overture : Cleaned with backup (quarantined).
C:\Documents and Settings\James Finlay\Cookies\james [email protected][1].txt -> TrackingCookie.Pointroll : Cleaned with backup (quarantined).
C:\Documents and Settings\James Finlay\Cookies\james finlay@questionmarket[2].txt -> TrackingCookie.Questionmarket : Cleaned with backup (quarantined).
C:\Documents and Settings\James Finlay\Cookies\james [email protected][1].txt -> TrackingCookie.Ru4 : Cleaned with backup (quarantined).
C:\Documents and Settings\James Finlay\Cookies\james [email protected][2].txt -> TrackingCookie.Specificclick : Cleaned with backup (quarantined).
C:\Documents and Settings\James Finlay\Cookies\james finlay@statcounter[1].txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined).
C:\Documents and Settings\James Finlay\Cookies\james [email protected][1].txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined).
C:\Documents and Settings\James Finlay\Cookies\james [email protected][1].txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined).
C:\Documents and Settings\James Finlay\Cookies\james finlay@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined).
C:\Documents and Settings\James Finlay\Cookies\james [email protected][1].txt -> TrackingCookie.Tracking101 : Cleaned with backup (quarantined).
C:\Documents and Settings\James Finlay\Cookies\james finlay@tradedoubler[2].txt -> TrackingCookie.Tradedoubler : Cleaned with backup (quarantined).
C:\Documents and Settings\James Finlay\Cookies\james finlay@trafficmp[2].txt -> TrackingCookie.Trafficmp : Cleaned with backup (quarantined).
C:\Documents and Settings\James Finlay\Cookies\james finlay@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Cleaned with backup (quarantined).
C:\Documents and Settings\James Finlay\Cookies\james [email protected][2].txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined).
C:\Documents and Settings\James Finlay\Cookies\james finlay@zedo[2].txt -> TrackingCookie.Zedo : Cleaned with backup (quarantined).
C:\!KillBox\winrge32.dll -> Trojan.Mezzia : Cleaned with backup (quarantined).
C:\!KillBox\winrge32.dll( 4) -> Trojan.Mezzia : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{26F90CCF-EA3F-4387-8C6B-7977A4B6FB87}\RP1141\A0322441.DLL -> Trojan.Mezzia : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{26F90CCF-EA3F-4387-8C6B-7977A4B6FB87}\RP1141\A0322481.exe -> Trojan.VB.tg : Cleaned with backup (quarantined).


::Report end



Hijackthis:

Logfile of HijackThis v1.99.1
Scan saved at 12:15:13 PM, on 8/31/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\WINDOWS\system32\NVATray.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Belkin\Nostromo\nost_LM.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mim.exe
C:\Program Files\Cox\Applications\app\SysSvcNt.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Common Files\Command Software\dvpapi.exe
F:\Debug stuff\ewido anti-spyware 4.0\guard.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\drwtsn32.exe
C:\WINDOWS\system32\drwtsn32.exe
C:\Program Files\Internet Explorer\iexplore.exe
F:\Debug stuff\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.c...rch/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.c...//www.yahoo.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: AuthPopupBHO01.cBHO - {3C7195F6-D788-4D50-BA72-2EE212EDAC78} - C:\Program Files\Cox\Applications\App\PopupBHO01.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Cox Popup Blocker - {2C0A5F28-48D8-408B-9172-9C6121025BCE} - C:\Program Files\Cox\Applications\App\PopupBHO01.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [TCASUTIEXE] TCAUDIAG.exe -off
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [CTStartup] C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~2\mimboot.exe
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exe
O4 - HKLM\..\Run: [DIGServices] C:\Program Files\ESPNRunTime\DIGServices.exe /brand=ESPN /priority=0 /poll=24
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NVIDIA nForce APU1 Utilities] NVATray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [EPSON Stylus CX4800 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIADA.EXE /P26 "EPSON Stylus CX4800 Series" /O6 "USB001" /M "Stylus CX4800"
O4 - HKLM\..\Run: [ESP] C:\Program Files\Cox\Applications\app\start.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nifse] f:\program files\nifsemaj\csrss.exe
O4 - HKLM\..\Run: [!ewido] "F:\Debug stuff\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKCU\..\Run: [nifse] f:\program files\nifsemaj\csrss.exe
O4 - Global Startup: Loadout Manager.lnk = C:\Program Files\Belkin\Nostromo\nost_LM.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://support.cox.c...oad/tgctlcm.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn...ro.cab34246.cab
O16 - DPF: {ED28050F-D713-43BA-A376-DCC5C35407D5} (MsnMusicAx Class) - https://music.msn.co...snmusax2330.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: winrge32 - winrge32.dll (file missing)
O23 - Service: Cox High Speed Internet Security Suite System Service (AuthSysSvc) - Authentium, Inc. - C:\Program Files\Cox\Applications\app\SysSvcNt.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - C:\Program Files\Common Files\Command Software\dvpapi.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - F:\Debug stuff\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: System Idle Service (sysidleserv) - Unknown owner - c:\windows\system32\adprot.exe (file missing)

[Buckeye_Sam]

Run Hijackthis again, click scan, and Put a checkmark next to each of the lines listed below. Then close all other windows--you should only see HijackThis on your Desktop--and click the Fix Checked button.

O4 - HKLM\..\Run: [nifse] f:\program files\nifsemaj\csrss.exe
O4 - HKCU\..\Run: [nifse] f:\program files\nifsemaj\csrss.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O20 - Winlogon Notify: winrge32 - winrge32.dll (file missing)
O23 - Service: System Idle Service (sysidleserv) - Unknown owner - c:\windows\system32\adprot.exe (file missing)


=========



Flush your system restore, this will delete any restore points that you have but it will also make sure that any malware hiding in system restore will be booted off.

Turn off System Restore:

• On the Desktop, right-click My Computer.
• Click Properties.
• Click the System Restore tab.
• Check Turn off System Restore.
• Click Apply, and then click OK.

Restart your computer, turn it back on and create a restore point.

Create a restore point:

• Click Start and point to All Programs.
• Mouse over Accessories, then System Tools, and select System Restore.
• In the System Restore wizard, select the box next the text labeled "Create a
  restore point" and click the Next button.
• Type a description for your new restore point. Something like "After
  cleanup". Click Create and you're done.

============


Update Java:

• Click Start -> Control Panel -> Add/Remove Programs
• Search in the list for all previous installed versions of Java. (J2SE Runtime Environment.... )
  
  It should have next icon next to it:
  Select it and click Remove.
• The current version of Java can be downloaded from http://java.sun.com/javase/downloads/index.jsp Scroll down the page to 'Java Runtime Environment (JRE) 5.0 Update 8' and press the 'Download' button. On the new web page, click the 'Accept License Agreement' button. Then select 'Windows Offline Installation, Multi-language' in the Windows Platform area just below the Accept button.

============


Please post a new hijackthis log.

[wufreak]

New Hijackthis log:



Logfile of HijackThis v1.99.1
Scan saved at 3:05:58 PM, on 8/31/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\ESPNRunTime\DIGServices.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\NVATray.exe
C:\PROGRA~1\MUSICM~1\MUSICM~2\MMDiag.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIADA.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Belkin\Nostromo\nost_LM.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mim.exe
C:\Program Files\Cox\Applications\app\Console.exe
C:\Program Files\Cox\Applications\app\SysSvcNt.exe
C:\WINDOWS\System32\CTsvcCDA.exe
F:\Debug stuff\ewido anti-spyware 4.0\guard.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Common Files\Command Software\dvpapi.exe
C:\Program Files\Internet Explorer\iexplore.exe
F:\Debug stuff\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.c...rch/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.c...//www.yahoo.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: AuthPopupBHO01.cBHO - {3C7195F6-D788-4D50-BA72-2EE212EDAC78} - C:\Program Files\Cox\Applications\App\PopupBHO01.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Cox Popup Blocker - {2C0A5F28-48D8-408B-9172-9C6121025BCE} - C:\Program Files\Cox\Applications\App\PopupBHO01.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [TCASUTIEXE] TCAUDIAG.exe -off
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [CTStartup] C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~2\mimboot.exe
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exe
O4 - HKLM\..\Run: [DIGServices] C:\Program Files\ESPNRunTime\DIGServices.exe /brand=ESPN /priority=0 /poll=24
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NVIDIA nForce APU1 Utilities] NVATray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [EPSON Stylus CX4800 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIADA.EXE /P26 "EPSON Stylus CX4800 Series" /O6 "USB001" /M "Stylus CX4800"
O4 - HKLM\..\Run: [ESP] C:\Program Files\Cox\Applications\app\start.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [!ewido] "F:\Debug stuff\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"
O4 - Global Startup: Loadout Manager.lnk = C:\Program Files\Belkin\Nostromo\nost_LM.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://support.cox.c...oad/tgctlcm.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn...ro.cab34246.cab
O16 - DPF: {ED28050F-D713-43BA-A376-DCC5C35407D5} (MsnMusicAx Class) - https://music.msn.co...snmusax2330.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Cox High Speed Internet Security Suite System Service (AuthSysSvc) - Authentium, Inc. - C:\Program Files\Cox\Applications\app\SysSvcNt.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - C:\Program Files\Common Files\Command Software\dvpapi.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - F:\Debug stuff\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: System Idle Service (sysidleserv) - Unknown owner - c:\windows\system32\adprot.exe (file missing)

[Buckeye_Sam]

Click Start > Run and type these commands hitting enter after each one:

sc stop sysidleserv

sc delete sysidleserv


Reboot and post one more hijackthis log.
Let me know of any problems that you are still having.

[wufreak]

new log:


Logfile of HijackThis v1.99.1
Scan saved at 9:24:16 AM, on 9/1/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\ESPNRunTime\DIGServices.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\NVATray.exe
C:\PROGRA~1\MUSICM~1\MUSICM~2\MMDiag.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIADA.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
C:\Program Files\Belkin\Nostromo\nost_LM.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mim.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Cox\Applications\app\Console.exe
C:\Program Files\Cox\Applications\app\SysSvcNt.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Common Files\Command Software\dvpapi.exe
F:\Debug stuff\ewido anti-spyware 4.0\guard.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Cox\Applications\app\WFRMailer.exe
F:\Debug stuff\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.c...rch/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.c...//www.yahoo.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: AuthPopupBHO01.cBHO - {3C7195F6-D788-4D50-BA72-2EE212EDAC78} - C:\Program Files\Cox\Applications\App\PopupBHO01.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Cox Popup Blocker - {2C0A5F28-48D8-408B-9172-9C6121025BCE} - C:\Program Files\Cox\Applications\App\PopupBHO01.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [TCASUTIEXE] TCAUDIAG.exe -off
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [CTStartup] C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~2\mimboot.exe
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exe
O4 - HKLM\..\Run: [DIGServices] C:\Program Files\ESPNRunTime\DIGServices.exe /brand=ESPN /priority=0 /poll=24
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NVIDIA nForce APU1 Utilities] NVATray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [EPSON Stylus CX4800 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIADA.EXE /P26 "EPSON Stylus CX4800 Series" /O6 "USB001" /M "Stylus CX4800"
O4 - HKLM\..\Run: [ESP] C:\Program Files\Cox\Applications\app\start.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [!ewido] "F:\Debug stuff\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"
O4 - Global Startup: Loadout Manager.lnk = C:\Program Files\Belkin\Nostromo\nost_LM.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://support.cox.c...oad/tgctlcm.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn...ro.cab34246.cab
O16 - DPF: {ED28050F-D713-43BA-A376-DCC5C35407D5} (MsnMusicAx Class) - https://music.msn.co...snmusax2330.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Cox High Speed Internet Security Suite System Service (AuthSysSvc) - Authentium, Inc. - C:\Program Files\Cox\Applications\app\SysSvcNt.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - C:\Program Files\Common Files\Command Software\dvpapi.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - F:\Debug stuff\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

[Buckeye_Sam]

Your log is clean!


Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

• Disable and Enable System Restore. - If you are using Windows ME or XP then you should disable and reenable system restore to make sure there are no infected files found in a restore point left over from what we have just cleaned.
  
  You can find instructions on how to enable and reenable system restore here:
  
  Managing Windows Millenium System Restore
  
  or
  
  Windows XP System Restore Guide
  
  Renable system restore with instructions from tutorial above
  
  
• Make your Internet Explorer more secure - This can be done by following these simple instructions:
  • From within Internet Explorer click on the Tools menu and then click on Options.
  • Click once on the Security tab
  • Click once on the Internet icon so it becomes highlighted.
  • Click once on the Custom Level button.
    
    • Change the Download signed ActiveX controls to Prompt
    • Change the Download unsigned ActiveX controls to Disable
    • Change the Initialize and script ActiveX controls not marked as safe to Disable
    • Change the Installation of desktop items to Prompt
    • Change the Launching programs and files in an IFRAME to Prompt
    • Change the Navigate sub-frames across different domains to Prompt
    • When all these settings have been made, click on the OK button.
    • If it prompts you as to whether or not you want to save the settings, press the Yes button.
  • Next press the Apply button and then the OK to exit the Internet Properties page.
• Use an AntiVirus Software - It is very important that your computer has an anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future.
  
  See this link for a listing of some online & their stand-alone antivirus programs:
  
  Virus, Spyware, and Malware Protection and Removal Resources
  
  
• Update your AntiVirus Software - It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
  
  
• Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is succeptible to being hacked and taken over. I am very serious about this and see it happen almost every day with my clients. Simply using a Firewall in its default configuration can lower your risk greatly.
  
  For a tutorial on Firewalls and a listing of some available ones see the link below:
  
  Understanding and Using Firewalls
  
  
• Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
  
  
• Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an antivirus software.
  
  A tutorial on installing & using this product can be found here:
  
  Using Spybot - Search & Destroy to remove Spyware , Malware, and Hijackers
  
  
• Install Ad-Aware - Install and download Ad-Aware. ou should also scan your computer with program on a regular basis just as you would an antivirus software in conjunction with Spybot.
  
  A tutorial on installing & using this product can be found here:
  
  Using Ad-aware to remove Spyware, Malware, & Hijackers from Your Computer
  
  
• Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.
  
  A tutorial on installing & using this product can be found here:
  
  Using SpywareBlaster to protect your computer from Spyware and Malware
  
  
• Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.

Follow this list and your potential for being infected again will reduce dramatically.

[wufreak]

Thank you so very, very much. I really appreciate the time you spent with me. You just won a constant donor Is there any way to give special recognition to you Sam?