[Orbbie]

Hello, miekiemoes assisted me with my last posting and cleaned my PC, however, before I had a chance to purchase Norton antivirus my partner infected my computer again when going on celebrity gossip sites. I have ran Combofix and that log is below along with a HJT log. Any assistance is greatly appreciated (particularly from miekiemoes). Thank you and my apologies to miekiemoes.

ComboFix 08-02.01.6 - Windows User 2008-02-07 23:56:35.10 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.1.1252.1.1033.18.76 [GMT -4:00]
Running from: C:\Documents and Settings\Windows User\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\awtqrrq.dll
C:\WINDOWS\system32\ddawu.dll
C:\WINDOWS\system32\wavnsxaa.dll
C:\Documents and Settings\Windows User\My Documents\DOBE~1
C:\WINDOWS\b151.exe
C:\WINDOWS\cookies.ini
C:\WINDOWS\mrofinu572.exe
C:\WINDOWS\system32\awtqrrq.dll
C:\WINDOWS\system32\bnnegjny.ini
C:\WINDOWS\system32\ddawu.dll
C:\WINDOWS\system32\lcflhokd.ini
C:\WINDOWS\system32\pac.txt
C:\WINDOWS\system32\qpapushn.dll
C:\WINDOWS\system32\uwadd.ini
C:\WINDOWS\system32\uwadd.ini2
C:\WINDOWS\system32\wavnsxaa.dll
C:\WINDOWS\system32\wavnsxaa.dllbox
C:\WINDOWS\system32\ynjgennb.dll
C:\WINDOWS\system32\ytvykxpb.dll

.
((((((((((((((((((((((((( Files Created from 2008-01-08 to 2008-02-08 )))))))))))))))))))))))))))))))
.

2008-02-06 05:18 . 2008-02-06 05:18 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Rabio
2008-02-05 20:57 . 2008-02-05 20:57 <DIR> d-------- C:\Program Files\Drmupgds
2008-02-05 20:53 . 2008-02-05 20:53 <DIR> d-------- C:\Temp\isgTi19
2008-02-01 20:17 . 2008-02-01 20:17 <DIR> d--h----- C:\WINDOWS\PIF
2008-02-01 19:51 . 2008-02-01 19:51 <DIR> d-------- C:\WINDOWS\system32\43444C4449494
2008-02-01 19:51 . 2007-12-14 08:40 120,832 --a------ C:\WINDOWS\system32\1F20282025252.exe
2008-02-01 17:52 . 2008-02-05 21:05 15,086 --a------ C:\WINDOWS\system32\FreePokerBonus.ico
2008-01-28 20:47 . 2008-01-28 20:47 <DIR> d---s---- C:\Documents and Settings\NetworkService\UserData
2008-01-28 20:45 . 2008-02-05 20:53 <DIR> d-------- C:\WINDOWS\system32\up5
2008-01-28 20:45 . 2008-01-28 20:45 <DIR> d-------- C:\WINDOWS\system32\nGpxx01
2008-01-28 20:45 . 2008-01-28 20:45 <DIR> d-------- C:\Temp\gTiis19
2008-01-28 20:45 . 2008-01-28 20:45 <DIR> d-------- C:\Temp\cXzz9
2008-01-24 19:37 . 2001-07-09 11:50 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe
2008-01-21 22:47 . 2002-08-29 01:05 245,920 --a------ C:\cmldr
2008-01-21 22:47 . 2005-11-24 12:19 194 --a------ C:\Boot.bak
2008-01-16 19:55 . 2008-01-16 19:55 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-01-15 18:35 . 2008-02-06 05:08 <DIR> d-------- C:\Temp

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-03 17:35 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-01-31 04:00 --------- d-----w C:\Program Files\PokerStars
2008-01-27 22:24 --------- d-----w C:\Program Files\Full Tilt Poker
2008-01-27 22:24 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-01-25 00:51 --------- d-----w C:\Program Files\SymNetDrv
2008-01-25 00:51 --------- d-----w C:\Program Files\QuickTime
2008-01-17 12:24 --------- d-----w C:\Program Files\PokerStars.NET
2007-12-10 02:58 --------- d-----w C:\Program Files\DIFX
2007-12-08 19:20 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kodak
2007-12-08 19:19 --------- d-----w C:\Program Files\Kodak
2007-12-08 19:17 --------- d-----w C:\Program Files\Common Files\Kodak
2007-11-26 03:43 245,408 ----a-w C:\WINDOWS\system32\unicows.dll
2007-08-02 13:43 282,624 ----a-w C:\Program Files\Common Files\hole4444.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{18E26C4C-27CF-4319-948C-33A33D8248B1}]
2007-08-02 09:43 282624 --a------ C:\Program Files\Common Files\hole4444.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Uniblue RegistryBooster 2"="C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster .exe" [ ]
"Pzq"="C:\Documents and Settings\Windows User\My Documents\A?pPatch\t?skmgr.exe" [ ]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2007-02-15 07:26 171448]
"Gfzvyvb"="C:\Program Files\??pPatch\?hkntfs.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"F9FA03FAFFFF020"="1F20282025252.exe" [2007-12-14 08:40 120832 C:\WINDOWS\system32\1F20282025252.exe]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-02-18 22:22 180269]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2007-02-15 07:26 171448]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Kodak EasyShare software.lnk - C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2007-06-21 22:56:14 282624]
KODAK Software Updater.lnk - C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe [2004-02-13 14:12:08 16423]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 16:05:56 65588]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\nvtztitn]
nvtztitn.dll


.
Contents of the 'Scheduled Tasks' folder
"2008-02-06 02:43:08 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-01-19 20:23:40 C:\WINDOWS\Tasks\EasyShare Registration Task.job"
- C:\WINDOWS\System32\rundll32.exelC:\DOCUME~1\ALLUSE~1\APPLIC~1\Kodak\EasyShareSetup\$REGIS~1\Registration_7.4.20.2.sxt _RegistrationOffer@16
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-08 00:06:53
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\System32\1F20282025252.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
.
**************************************************************************
.
Completion time: 2008-02-08 0:10:06 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-08 04:09:42
ComboFix2.txt 2008-02-06 09:17:34
ComboFix3.txt 2008-02-02 00:37:17
ComboFix4.txt 2008-01-29 02:27:07



Logfile of HijackThis v1.99.1
Scan saved at 12:11:01 AM, on 2/8/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\1F20282025252.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\HijackThis\crusty.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {18E26C4C-27CF-4319-948C-33A33D8248B1} - C:\Program Files\Common Files\hole4444.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [F9FA03FAFFFF020] 1F20282025252.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster .exe /S
O4 - HKCU\..\Run: [Pzq] "C:\Documents and Settings\Windows User\My Documents\A?pPatch\t?skmgr.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Gfzvyvb] "C:\Program Files\??pPatch\?hkntfs.exe"
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: KODAK Software Updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: *.amaena.com
O15 - Trusted Zone: *.avsystemcare.com
O15 - Trusted Zone: *.gomyhit.com
O15 - Trusted Zone: *.imageservr.com
O15 - Trusted Zone: *.imagesrvr.com
O15 - Trusted Zone: *.onerateld.com
O15 - Trusted Zone: *.safetydownload.com
O15 - Trusted Zone: *.storageguardsoft.com
O15 - Trusted Zone: *.trustedantivirus.com
O15 - Trusted Zone: *.virusschlacht.com
O15 - Trusted Zone: *.amaena.com (HKLM)
O15 - Trusted Zone: *.avsystemcare.com (HKLM)
O15 - Trusted Zone: *.gomyhit.com (HKLM)
O15 - Trusted Zone: *.imageservr.com (HKLM)
O15 - Trusted Zone: *.imagesrvr.com (HKLM)
O15 - Trusted Zone: *.onerateld.com (HKLM)
O15 - Trusted Zone: *.safetydownload.com (HKLM)
O15 - Trusted Zone: *.storageguardsoft.com (HKLM)
O15 - Trusted Zone: *.trustedantivirus.com (HKLM)
O15 - Trusted Zone: *.virusschlacht.com (HKLM)
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebo...toUploader3.cab
O20 - Winlogon Notify: nvtztitn - nvtztitn.dll (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe