Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Win32:TratBHO [Trj] [RESOLVED]

Started by checkyoulater , Feb 10 2008 01:59 AM

This topic is locked

#1
checkyoulater

Posted 10 February 2008 - 01:59 AM

Member

Member
25 posts

i have been getting this annoying problem on both my laptop and PC now. I thought initially i could get it fixed by running vundofix but that didn't help.

the actual filenames of the files detected are always different but they all seem related to Win32:TratBHO [Trj]

so i installed hijackthis in the hopes someone here can help me remove this from my system. the laptop is more important for now so i'll post the hijackthis log here then when this is resolved i hope i can get the problem with the PC resolved too.

my laptop is running windows XP home and PC is at vista business, both have avast home edition installed

Logfile of HijackThis v1.99.1
Scan saved at 3:47:43 PM, on 2/10/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ATK0100\HControl.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Wireless Console 2\wcourier.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\ASUS\ATK Media\DMEDIA.EXE
C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe
C:\Program Files\ASUS\Splendid\ACMON.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\WINDOWS\system32\ACEngSvr.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\mrofinu1044.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Drmupgds\Drmupgds.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\WINDOWS\ATK0100\ATKOSD.exe
C:\Program Files\SetPoint\SetPoint.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1003A62D-C928-4285-B1AF-F93F1926CA49} - C:\WINDOWS\system32\awtss.dll (file missing)
O2 - BHO: (no name) - {35468C33-B904-4260-9B8C-FFB953B2A270} - C:\WINDOWS\system32\gebxwwt.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: (no name) - {AAB56341-3293-4F04-994F-A0FF133D69E0} - C:\WINDOWS\system32\jkkjh.dll (file missing)
O2 - BHO: (no name) - {F0DDEA88-C9E1-49E0-A92C-60252497858E} - C:\WINDOWS\system32\ssttq.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Wireless Console 2] C:\Program Files\Wireless Console 2\wcourier.exe
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Media\DMEDIA.EXE
O4 - HKLM\..\Run: [Power_Gear] C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe 1
O4 - HKLM\..\Run: [ACMON] C:\Program Files\ASUS\Splendid\ACMON.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [runner1] C:\WINDOWS\mrofinu1044.exe 61A847B5BBF72813329F3C466188719AB689201522886B092CBD44BD8689220221DD325762E902BC
9ED7286138F75F2F0C8D6E84A1EF7F506DCD610837F811E7C69D775A67
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Insider] C:\Program Files\Insider\Insider.exe
O4 - HKCU\..\Run: [Drmupgds] C:\Program Files\Drmupgds\Drmupgds.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Bluetooth Manager.lnk = ?
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\SetPoint\SetPoint.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

another thing i'm not sure if it's related but my web browsers keep opening up websites (mostly adware/spyware removal sites sometimes other netsearch engines)

#2
Rorschach112

Posted 10 February 2008 - 08:34 AM

Ralphie

Retired Staff
47,710 posts

Hello

Download ComboFix from one of the locations below, and save it to your Desktop.

Link 1
Link 2
Link 3

Double click combofix.exe and follow the prompts.
When finished, it shall produce a log for you. Post that log and a HiJackthis log in your next reply
Note: Do not mouseclick combofix's window while its running. That may cause it to stall

#3
checkyoulater

Posted 10 February 2008 - 11:59 AM

Member

Topic Starter
Member
25 posts

ComboFix 08-02.05.3 - jeree 2008-02-11 1:48:12.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.165 [GMT 8:00]
Running from: C:\Documents and Settings\jeree\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\inetget2
C:\Program Files\Insider
C:\Program Files\Temporary
C:\WINDOWS\b122.exe
C:\WINDOWS\b147.exe
C:\WINDOWS\mrofinu1044.exe
C:\WINDOWS\system32\gebxwwt.dll
C:\WINDOWS\system32\kmllm.ini
C:\WINDOWS\system32\kmllm.ini2
C:\WINDOWS\system32\mllmk.dll

.
((((((((((((((((((((((((( Files Created from 2008-01-10 to 2008-02-10 )))))))))))))))))))))))))))))))
.

2008-02-08 13:33 . 2008-02-10 15:41 <DIR> d-------- C:\VundoFix Backups
2008-02-07 22:20 . 2008-02-07 22:20 <DIR> d-------- C:\Program Files\Drmupgds
2008-02-06 22:44 . 2008-02-06 22:44 <DIR> d-------- C:\Documents and Settings\jeree\Application Data\ACD Systems
2008-01-30 23:37 . 2006-10-26 19:56 32,592 --a------ C:\WINDOWS\system32\msonpmon.dll
2008-01-30 22:53 . 2008-01-30 22:53 <DIR> d-------- C:\Program Files\MSBuild
2008-01-30 22:53 . 2008-01-30 22:53 <DIR> d-------- C:\Program Files\Microsoft Works
2008-01-30 22:39 . 2008-01-30 22:51 <DIR> d-------- C:\WINDOWS\SHELLNEW
2008-01-30 22:37 . 2008-01-30 23:39 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-01-30 22:35 . 2008-01-30 22:35 <DIR> dr-h----- C:\MSOCache
2008-01-30 22:07 . 2008-01-30 22:13 <DIR> d-------- C:\Documents and Settings\jeree\Arensus
2008-01-30 22:06 . 2008-01-30 22:06 <DIR> d-------- C:\Program Files\Arensus-1.1
2008-01-30 21:56 . 2008-01-30 21:56 <DIR> d-------- C:\Program Files\Super Collapse
2008-01-30 21:36 . 2008-02-05 20:14 <DIR> d-------- C:\Documents and Settings\jeree\Application Data\uTorrent
2008-01-30 21:22 . 2008-01-30 21:22 <DIR> d-------- C:\My Games
2008-01-30 21:22 . 2008-01-30 21:22 <DIR> d-------- C:\My Download Files
2008-01-30 21:21 . 2008-01-30 21:21 <DIR> d-------- C:\Program Files\Real
2008-01-30 21:21 . 2008-01-30 21:24 <DIR> d-------- C:\Program Files\Common Files\Real
2008-01-30 21:17 . 2008-01-30 21:31 37,473 --a------ C:\WINDOWS\system32\muzika.xm
2008-01-30 21:16 . 2008-01-30 21:26 <DIR> d-------- C:\Program Files\GameHouse
2008-01-30 21:14 . 2008-01-30 21:31 <DIR> d-------- C:\Program Files\PopCap Games
2008-01-30 21:14 . 2008-01-30 21:31 14 --a------ C:\WINDOWS\popcinfo.dat
2008-01-25 01:03 . 2008-01-25 01:03 <DIR> d-------- C:\Documents and Settings\benito\Application Data\ACD Systems
2008-01-25 01:01 . 2008-01-25 01:01 <DIR> d-------- C:\Program Files\Common Files\ACD Systems
2008-01-25 01:01 . 2008-01-25 01:01 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\ACD Systems
2008-01-25 01:00 . 2008-01-25 01:01 <DIR> d-------- C:\Program Files\ACD Systems
2008-01-21 20:30 . 2004-08-03 23:08 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys
2008-01-20 14:40 . 2007-09-24 23:31 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-01-20 14:39 . 2008-01-20 14:40 <DIR> d-------- C:\Program Files\Java
2008-01-20 14:31 . 2008-01-20 14:31 <DIR> d-------- C:\Program Files\Common Files\Java
2008-01-20 14:29 . 2008-01-20 14:29 0 --a------ C:\WINDOWS\mozver.dat
2008-01-13 21:21 . 2008-02-11 00:04 <DIR> d-------- C:\Documents and Settings\jeree\Application Data\skypePM
2008-01-13 21:20 . 2008-02-11 01:44 <DIR> d-------- C:\Documents and Settings\jeree\Application Data\Skype
2008-01-10 21:07 . 2001-08-17 21:59 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys
2008-01-10 21:06 . 2004-08-04 08:56 152,576 --a------ C:\WINDOWS\system32\irftp.exe
2008-01-10 21:06 . 2004-08-04 07:00 87,424 --a------ C:\WINDOWS\system32\drivers\irda.sys
2008-01-10 21:06 . 2004-08-04 06:59 57,472 --a------ C:\WINDOWS\system32\drivers\redbook.sys
2008-01-10 21:06 . 2006-03-12 12:28 48,128 --a------ C:\WINDOWS\system32\drivers\smcirda.sys
2008-01-10 21:06 . 2006-03-12 12:28 48,128 --a--c--- C:\WINDOWS\system32\dllcache\smcirda.sys
2008-01-10 21:06 . 2004-10-01 01:49 27,136 --a------ C:\WINDOWS\system32\irmon.dll
2008-01-10 21:06 . 2001-08-17 21:51 19,584 --a------ C:\WINDOWS\system32\drivers\rasirda.sys
2008-01-10 21:06 . 2004-08-04 08:56 8,192 --a------ C:\WINDOWS\system32\wshirda.dll
2008-01-10 21:06 . 2001-08-17 21:46 6,400 --a------ C:\WINDOWS\system32\drivers\enum1394.sys
2008-01-10 21:05 . 2004-08-04 00:56 74,240 --a------ C:\WINDOWS\system32\usbui.dll
2008-01-10 21:05 . 2004-08-04 00:56 74,240 --a--c--- C:\WINDOWS\system32\dllcache\usbui.dll
2008-01-10 21:05 . 2004-08-04 07:07 14,080 --a------ C:\WINDOWS\system32\drivers\CmBatt.sys
2008-01-10 21:05 . 2001-08-17 21:57 14,080 --a------ C:\WINDOWS\system32\drivers\battc.sys
2008-01-10 21:05 . 2001-08-17 21:58 9,344 --a------ C:\WINDOWS\system32\drivers\compbatt.sys
2008-01-10 21:04 . 2008-01-09 21:15 <DIR> dr------- C:\Documents and Settings\All Users\Documents
2008-01-10 21:03 . 2008-02-08 13:31 <DIR> d-------- C:\WINDOWS\system32\CatRoot2
2008-01-10 21:03 . 2008-01-10 06:40 <DIR> d-------- C:\WINDOWS\system32\CatRoot
2008-01-10 21:03 . 2004-08-04 20:00 1,086,058 -ra------ C:\WINDOWS\SET4.tmp
2008-01-10 21:03 . 2004-08-04 20:00 1,042,903 -ra------ C:\WINDOWS\SET3.tmp
2008-01-10 21:03 . 2008-01-10 05:17 1,040,267 --a------ C:\WINDOWS\setupapi.log.0.old
2008-01-10 21:02 . 2008-01-09 21:21 261 --a------ C:\WINDOWS\system32\$winnt$.inf
2008-01-10 08:12 . 2008-01-10 08:12 <DIR> d-------- C:\Documents and Settings\benito\Application Data\Microsoft Web Folders
2008-01-10 07:51 . 2008-01-10 07:52 <DIR> d-------- C:\OFFICE 2000
2008-01-10 07:18 . 2008-01-21 20:34 376 --a------ C:\WINDOWS\ODBC.INI
2008-01-10 07:09 . 2008-01-10 07:09 <DIR> d-------- C:\Program Files\uTorrent
2008-01-10 07:09 . 2008-01-10 07:10 <DIR> d-------- C:\Documents and Settings\benito\Application Data\uTorrent
2008-01-10 07:05 . 2008-01-10 07:05 <DIR> d-------- C:\WINDOWS\Downloaded Installations
2008-01-10 07:01 . 2005-07-29 23:12 2,977,792 --------- C:\WINDOWS\UNNMP.exe
2008-01-10 07:01 . 2006-05-22 22:05 49,858 --------- C:\WINDOWS\UNNMP.cfg
2008-01-10 07:00 . 2008-02-07 19:37 <DIR> d-------- C:\Program Files\Common Files\LightScribe
2008-01-10 06:59 . 2006-01-12 16:40 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe
2008-01-10 06:58 . 2008-01-10 06:58 <DIR> d-------- C:\Program Files\Common Files\Nero
2008-01-10 06:57 . 2005-12-09 22:02 3,051,520 --------- C:\WINDOWS\UNNeroVision.exe
2008-01-10 06:57 . 2006-05-22 22:05 174,154 --------- C:\WINDOWS\UNNeroVision.cfg
2008-01-10 06:57 . 2001-03-08 19:30 24,064 --------- C:\WINDOWS\system32\msxml3a.dll
2008-01-10 06:56 . 2008-01-10 06:56 <DIR> d-------- C:\Program Files\Common Files\Ahead
2008-01-10 06:56 . 2008-01-10 07:00 <DIR> d-------- C:\Program Files\Ahead
2008-01-10 06:56 . 2008-01-10 06:56 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Ahead
2008-01-10 06:56 . 2004-07-26 17:16 1,568,768 --------- C:\WINDOWS\system32\ImagX7.dll
2008-01-10 06:56 . 2004-07-26 17:16 476,320 --------- C:\WINDOWS\system32\ImagXpr7.dll
2008-01-10 06:56 . 2004-07-26 17:16 471,040 --------- C:\WINDOWS\system32\ImagXRA7.dll
2008-01-10 06:56 . 2004-07-09 09:43 364,544 --------- C:\WINDOWS\system32\TwnLib4.dll
2008-01-10 06:56 . 2004-07-26 17:16 262,144 --------- C:\WINDOWS\system32\ImagXR7.dll
2008-01-10 06:56 . 2000-06-26 11:45 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll
2008-01-10 06:56 . 2001-06-26 08:15 38,912 --------- C:\WINDOWS\system32\picn20.dll
2008-01-10 06:52 . 2008-01-10 06:52 <DIR> d-------- C:\Program Files\iTunes
2008-01-10 06:52 . 2008-01-10 06:52 <DIR> d-------- C:\Program Files\iPod
2008-01-10 06:52 . 2008-01-10 06:52 <DIR> d-------- C:\Documents and Settings\benito\Application Data\Apple Computer
2008-01-10 06:52 . 2008-02-11 01:54 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-01-10 06:52 . 2008-01-10 06:52 1,409 --a------ C:\WINDOWS\QTFont.for
2008-01-10 06:51 . 2008-01-10 06:51 <DIR> d-------- C:\Program Files\QuickTime
2008-01-10 06:51 . 2008-01-10 06:51 <DIR> d-------- C:\Program Files\Apple Software Update
2008-01-10 06:51 . 2008-01-10 06:52 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-01-10 06:50 . 2008-01-10 06:50 <DIR> d-------- C:\Program Files\Common Files\Apple
2008-01-10 06:50 . 2008-01-10 06:50 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple
2008-01-10 06:08 . 2008-01-10 06:08 <DIR> d-------- C:\Program Files\Windows Media Connect 2
2008-01-10 06:07 . 2008-01-10 06:07 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2008-01-10 06:07 . 2008-01-10 06:07 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF
2008-01-10 05:50 . 2007-10-11 07:55 6,065,664 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll
2008-01-10 05:50 . 2007-07-01 11:31 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat
2008-01-10 05:50 . 2007-07-01 11:36 991,232 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2008-01-10 05:50 . 2007-10-11 07:55 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll
2008-01-10 05:50 . 2007-10-11 07:55 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll
2008-01-10 05:50 . 2007-10-11 07:55 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll
2008-01-10 05:50 . 2007-10-11 07:55 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll
2008-01-10 05:50 . 2007-10-11 07:55 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2008-01-10 05:50 . 2007-10-10 18:59 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-30 13:25 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-09 23:06 --------- d-----w C:\Program Files\Common Files\Adobe
2008-01-09 15:35 --------- d-----w C:\Documents and Settings\benito\Application Data\Skype
2008-01-09 15:14 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
2008-01-09 15:14 --------- d-----w C:\Program Files\Google
2008-01-09 15:14 --------- d-----w C:\Documents and Settings\benito\Application Data\skypePM
2008-01-09 15:13 --------- d-----w C:\Program Files\Skype
2008-01-09 15:13 --------- d-----w C:\Program Files\Common Files\Skype
2008-01-09 15:13 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skype
2008-01-09 14:38 --------- d-----w C:\Program Files\Alwil Software
2008-01-09 14:09 --------- d-----w C:\Program Files\PowerForPhone
2008-01-09 14:03 606,848 ----a-w C:\WINDOWS\flashax.exe
2008-01-09 14:03 503,808 ----a-w C:\WINDOWS\Asus_A_Series_ScreenSaver.scr
2008-01-09 14:03 3,968,937 ----a-w C:\WINDOWS\A-series Demo.exe
2008-01-09 14:03 274,432 ----a-w C:\WINDOWS\ASUS A Series ScreenSaver Uninstaller.exe
2008-01-09 14:03 12,288 ----a-w C:\WINDOWS\impborl.dll
2008-01-09 14:02 --------- d-----w C:\Program Files\Asus
2008-01-09 13:58 21,419 ----a-w C:\WINDOWS\system32\drivers\AegisP.sys
2008-01-09 13:58 --------- d-----w C:\WINDOWS\system32\config\systemprofile\Application Data\Intel
2008-01-09 13:58 --------- d-----w C:\Documents and Settings\NetworkService\Application Data\Intel
2008-01-09 13:58 --------- d-----w C:\Documents and Settings\LocalService\Application Data\Intel
2008-01-09 13:58 --------- d-----w C:\Documents and Settings\Default User\Application Data\Intel
2008-01-09 13:58 --------- d-----w C:\Documents and Settings\benito\Application Data\Intel
2008-01-09 13:57 --------- d-----w C:\Program Files\Intel
2008-01-09 13:57 --------- d-----w C:\Documents and Settings\All Users\Application Data\Intel
2008-01-09 13:49 --------- d-----w C:\Program Files\Toshiba
2008-01-09 13:48 --------- d-----w C:\Program Files\Wireless Console 2
2008-01-09 13:44 --------- d-----w C:\Program Files\Synaptics
2008-01-09 13:44 --------- d-----w C:\Documents and Settings\benito\Application Data\Logitech
2008-01-09 13:43 --------- d-----w C:\Program Files\SetPoint
2008-01-09 13:43 --------- d-----w C:\Program Files\Common Files\Logitech
2008-01-09 13:41 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-01-09 13:40 --------- d-----w C:\Program Files\Motorola
2008-01-09 13:37 --------- d-----w C:\Program Files\Analog Devices
2008-01-09 13:19 --------- d-----w C:\Program Files\microsoft frontpage
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1003A62D-C928-4285-B1AF-F93F1926CA49}]
C:\WINDOWS\system32\awtss.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AAB56341-3293-4F04-994F-A0FF133D69E0}]
C:\WINDOWS\system32\jkkjh.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F0DDEA88-C9E1-49E0-A92C-60252497858E}]
C:\WINDOWS\system32\ssttq.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-12-07 15:08 21686568]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 20:00 15360]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2008-01-09 23:14 171448]
"Drmupgds"="C:\Program Files\Drmupgds\Drmupgds.exe" [2008-02-07 22:20 61440]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HControl"="C:\WINDOWS\ATK0100\HControl.exe" [2006-08-23 22:22 110592]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-07-20 20:58 7581696]
"nwiz"="nwiz.exe" [2006-07-20 20:58 1519616 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-07-20 20:58 86016]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-07 17:07 61952 C:\WINDOWS\system32\HdAShCut.exe]
"SMSERIAL"="C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe" [2006-08-07 13:11 573440]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2005-11-03 13:58 28160 C:\WINDOWS\KHALMNPR.Exe]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-10-21 14:26 761945]
"Wireless Console 2"="C:\Program Files\Wireless Console 2\wcourier.exe" [2005-10-17 17:09 987136]
"IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [2006-08-02 00:38 802816]
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2006-08-02 00:32 696320]
"ATKMEDIA"="C:\Program Files\ASUS\ATK Media\DMEDIA.EXE" [2006-05-16 16:29 53248]
"Power_Gear"="C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe" [2006-03-14 17:46 90112]
"ACMON"="C:\Program Files\ASUS\Splendid\ACMON.exe" [2006-05-30 10:28 811008]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 21:00 79224]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-12-11 10:56 286720]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-12-11 12:10 267048]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2006-01-12 16:40 155648]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 11:09 63712]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47 31016]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 04:44:06 29696]
Bluetooth Manager.lnk - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng1.exe [2006-05-24 14:16:14 49152]
Logitech SetPoint.lnk - C:\Program Files\SetPoint\SetPoint.exe [2008-01-09 21:43:50 532480]

*Newly Created Service* - HTTPFILTER
.
Contents of the 'Scheduled Tasks' folder
"2008-02-07 13:09:05 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-11 01:54:20
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\ATK0100\ATKOSD.exe
C:\WINDOWS\system32\ACEngSvr.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2008-02-11 1:56:19 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-10 17:56:15
.
2008-01-13 13:19:21 --- E O F ---

and the hijackthis logfile...

Logfile of HijackThis v1.99.1
Scan saved at 1:58:48 AM, on 2/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\ATK0100\HControl.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Wireless Console 2\wcourier.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\WINDOWS\ATK0100\ATKOSD.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\ASUS\ATK Media\DMEDIA.EXE
C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe
C:\Program Files\ASUS\Splendid\ACMON.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ACEngSvr.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Drmupgds\Drmupgds.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\SetPoint\SetPoint.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://85.17.166.174.....m/forums.html
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1003A62D-C928-4285-B1AF-F93F1926CA49} - C:\WINDOWS\system32\awtss.dll (file missing)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: (no name) - {AAB56341-3293-4F04-994F-A0FF133D69E0} - C:\WINDOWS\system32\jkkjh.dll (file missing)
O2 - BHO: (no name) - {F0DDEA88-C9E1-49E0-A92C-60252497858E} - C:\WINDOWS\system32\ssttq.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Wireless Console 2] C:\Program Files\Wireless Console 2\wcourier.exe
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Media\DMEDIA.EXE
O4 - HKLM\..\Run: [Power_Gear] C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe 1
O4 - HKLM\..\Run: [ACMON] C:\Program Files\ASUS\Splendid\ACMON.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Drmupgds] C:\Program Files\Drmupgds\Drmupgds.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Bluetooth Manager.lnk = ?
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\SetPoint\SetPoint.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

that's it...

#4
Rorschach112

Posted 10 February 2008 - 12:07 PM

Ralphie

Retired Staff
47,710 posts

Hello

1. Please re-open HiJackThis and choose do a system scan only. Check the boxes next to ONLY the entries listed below(if present):

O2 - BHO: (no name) - {1003A62D-C928-4285-B1AF-F93F1926CA49} - C:\WINDOWS\system32\awtss.dll (file missing)
O2 - BHO: (no name) - {AAB56341-3293-4F04-994F-A0FF133D69E0} - C:\WINDOWS\system32\jkkjh.dll (file missing)
O2 - BHO: (no name) - {F0DDEA88-C9E1-49E0-A92C-60252497858E} - C:\WINDOWS\system32\ssttq.dll (file missing)

2. Now close all windows other than HiJackThis, including browsers, so that nothing other than HijackThis is open, then click Fix Checked. A box will pop up asking you if you wish to fix the selected items. Please choose YES. Once it has fixed them, please exit/close HijackThis.

1. Close any open browsers.

2. Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\WINDOWS\SET4.tmp
C:\WINDOWS\SET3.tmp

Save this as CFScript.txt, in the same location as ComboFix.exe

Posted Image

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at "C:\ComboFix.txt"

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Download and scan with SUPERAntiSpyware Free for Home Users

Double-click SUPERAntiSpyware.exe and use the default settings for installation.
An icon will be created on your desktop. Double-click that icon to launch the program.
If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download and unzip them from here.)
Under "Configuration and Preferences", click the Preferences button.
Click the Scanning Control tab.
Under Scanner Options make sure the following are checked (leave all others unchecked):
- Close browsers before scanning.
- Scan for tracking cookies.
- Terminate memory threats before quarantining.
Click the "Close" button to leave the control center screen.
Back on the main screen, under "Scan for Harmful Software" click Scan your computer.
On the left, make sure you check C:\Fixed Drive.
On the right, under "Complete Scan", choose Perform Complete Scan.
Click "Next" to start the scan. Please be patient while it scans your computer.
After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".
Make sure everything has a checkmark next to it and click "Next".
A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
If asked if you want to reboot, click "Yes".
To retrieve the removal information after reboot, launch SUPERAntispyware again.
- Click Preferences, then click the Statistics/Logs tab.
- Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
- If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
- Please copy and paste the Scan Log results in your next reply.
Click Close to exit the program.

Reboot and post a new HijackThis log and tell me how your PC is running

#5
checkyoulater

Posted 10 February 2008 - 01:42 PM

Member

Topic Starter
Member
25 posts

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 02/11/2008 at 03:20 AM

Application Version : 3.9.1008

Core Rules Database Version : 3399
Trace Rules Database Version: 1391

Scan type : Complete Scan
Total Scan Time : 00:45:43

Memory items scanned : 556
Memory threats detected : 1
Registry items scanned : 5327
Registry threats detected : 2
File items scanned : 31617
File threats detected : 34

Adware.StarsDoor
C:\PROGRAM FILES\DRMUPGDS\DRMUPGDS.EXE
C:\PROGRAM FILES\DRMUPGDS\DRMUPGDS.EXE
[Drmupgds] C:\PROGRAM FILES\DRMUPGDS\DRMUPGDS.EXE
C:\WINDOWS\Prefetch\DRMUPGDS.EXE-04F55F5B.pf

Adware.Tracking Cookie
C:\Documents and Settings\jeree\Cookies\jeree@atdmt[2].txt
C:\Documents and Settings\jeree\Cookies\jeree@2o7[1].txt
C:\Documents and Settings\jeree\Cookies\jeree@doubleclick[1].txt
C:\Documents and Settings\benito\Cookies\benito@2o7[1].txt
C:\Documents and Settings\benito\Cookies\[email protected][2].txt
C:\Documents and Settings\benito\Cookies\benito@adbrite[1].txt
C:\Documents and Settings\benito\Cookies\benito@adinterax[2].txt
C:\Documents and Settings\benito\Cookies\[email protected][1].txt
C:\Documents and Settings\benito\Cookies\[email protected][2].txt
C:\Documents and Settings\benito\Cookies\benito@atdmt[1].txt
C:\Documents and Settings\benito\Cookies\benito@doubleclick[1].txt
C:\Documents and Settings\benito\Cookies\benito@mediaplex[1].txt
C:\Documents and Settings\benito\Cookies\[email protected][1].txt
C:\Documents and Settings\benito\Cookies\benito@realmedia[2].txt
C:\Documents and Settings\benito\Cookies\benito@revsci[2].txt
C:\Documents and Settings\benito\Cookies\benito@specificclick[2].txt
C:\Documents and Settings\benito\Cookies\benito@toplist[1].txt
C:\Documents and Settings\benito\Cookies\benito@zedo[1].txt

Adware.VXGame-Trace
HKU\S-1-5-21-790525478-1580436667-839522115-1005\Software\kernelexe

Trojan.Unknown Origin
C:\QOOBOX\QUARANTINE\C\WINDOWS\B147.EXE.VIR
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4A3F497E-1F09-4E34-BFF3-A9DBA699BB6B}\RP69\A0006624.EXE

Trojan.Downloader-Gen/MROFIN
C:\QOOBOX\QUARANTINE\C\WINDOWS\MROFINU1044.EXE.VIR
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4A3F497E-1F09-4E34-BFF3-A9DBA699BB6B}\RP64\A0006494.EXE

Trojan.Unclassifed/AffiliateBundle
C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\GEBXWWT.DLL.VIR
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4A3F497E-1F09-4E34-BFF3-A9DBA699BB6B}\RP69\A0006625.DLL
C:\VUNDOFIX BACKUPS\GEBXWWT.DLL.BAD

Trojan.Unclassified/17PHolmes-A
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4A3F497E-1F09-4E34-BFF3-A9DBA699BB6B}\RP61\A0005467.EXE

Trojan.Downloader-Gen/Bundle Installer
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4A3F497E-1F09-4E34-BFF3-A9DBA699BB6B}\RP64\A0006495.EXE

Trojan.Unclassified/KernInst
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4A3F497E-1F09-4E34-BFF3-A9DBA699BB6B}\RP64\A0006496.EXE

Adware.Vundo-Variant
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4A3F497E-1F09-4E34-BFF3-A9DBA699BB6B}\RP65\A0006512.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4A3F497E-1F09-4E34-BFF3-A9DBA699BB6B}\RP66\A0006541.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4A3F497E-1F09-4E34-BFF3-A9DBA699BB6B}\RP66\A0006560.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4A3F497E-1F09-4E34-BFF3-A9DBA699BB6B}\RP69\A0006626.DLL

here's the highjackthis log...

Logfile of HijackThis v1.99.1
Scan saved at 3:56:50 AM, on 2/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\ATK0100\HControl.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Wireless Console 2\wcourier.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\ASUS\ATK Media\DMEDIA.EXE
C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe
C:\Program Files\ASUS\Splendid\ACMON.exe
C:\WINDOWS\ATK0100\ATKOSD.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\ACEngSvr.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\SetPoint\SetPoint.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://85.17.166.174.....m/forums.html
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Wireless Console 2] C:\Program Files\Wireless Console 2\wcourier.exe
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Media\DMEDIA.EXE
O4 - HKLM\..\Run: [Power_Gear] C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe 1
O4 - HKLM\..\Run: [ACMON] C:\Program Files\ASUS\Splendid\ACMON.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Bluetooth Manager.lnk = ?
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\SetPoint\SetPoint.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

so far thelaptop hasn't given any warnings yet i really do hope this fixed it because my PC won't quite making noise at least the laptop seems quiet now

Edited by checkyoulater, 10 February 2008 - 01:59 PM.

#6
Rorschach112

Posted 10 February 2008 - 01:57 PM

Ralphie

Retired Staff
47,710 posts

Can you post the ComboFix log and a new HijackThis log

Also tell me how your PC is running

#7
checkyoulater

Posted 10 February 2008 - 02:03 PM

Member

Topic Starter
Member
25 posts

sorry i was excited on the previous post i forgot to include the new hijackthis log...it's there now (i edited the post) as well as saying that my laptop now seems to be very quiet no warning signs yet, oh please let it be cured

the combofix log? should i run that again?

#8
Rorschach112

Posted 10 February 2008 - 02:12 PM

Ralphie

Retired Staff
47,710 posts

No need, your logs are clean ! We need to do a few things

Now lets uninstall Combofix:

Click START then RUN
Now type Combofix /u in the runbox and click OK

The above procedure will do the following:

Delete ComboFix and its associated files and folders.
Delete VundoFix backups, if present
Delete the C:\Deckard folder, if present
Delete the C:_OtMoveIt folder, if present
Reset the clock settings.
Hide file extensions, if required.
Hide System/Hidden files, if required.
Reset System Restore.

You now need to update your Java and remove your older versions.

Please follow these steps to remove older version Java components.

* Click Start > Control Panel.
* Click Add/Remove Programs.
* Check any item with Java Runtime Environment (JRE) in the name.
* Click the Remove or Change/Remove button.

Download the latest version of Java Runtime Environment (JRE), and install it to your computer from
here

Your using an old version of Adobe Acrobat Reader, this can leave your pc open to vulnerabilities, you can update it here :
http://www.adobe.com.../readstep2.html

Below I have included a number of recommendations for how to protect your computer against malware infections.

* Keep Windows updated by regularly checking their website at :
http://windowsupdate.microsoft.com/
This will ensure your computer has always the latest security updates available installed on your computer.

* To reduce re-infection for malware in the future, I strongly recommend installing these free programs:
SpywareBlaster protects against bad ActiveX
IE-SPYAD puts over 5000 sites in your restricted zone so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all
Have a look at this tutorial for IE-Spyad here

* SpywareGuard offers realtime protection from spyware installation attempts.

Make Internet Explorer more secure

Click Start > Run
Type Inetcpl.cpl & click OK
Click on the Security tab
Click Reset all zones to default level
Make sure the Internet Zone is selected & Click Custom level
In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
Next Click OK, then Apply button and then OK to exit the Internet Properties page.

* MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.

* Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more
secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in pop up
blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from
Here

* Take a good look at the following suggestions for malware prevention by reading Tony Klein’s article 'How Did I Get Infected In The First Place'
Here

Thank you for your patience, and performing all of the procedures requested.

#9
checkyoulater

Posted 10 February 2008 - 02:22 PM

Member

Topic Starter
Member
25 posts

wow thanks you're a genius! i have a question though my PC is running windows vista (business) and is experiencing the same problem, should i create a new thread? or can i just post the hijackthis log for it here?

#10
Rorschach112

Posted 10 February 2008 - 02:23 PM

Ralphie

Retired Staff
47,710 posts

Do this for that computer

Please download Deckard's System Scanner (DSS) and save it to your Desktop.

Close all other windows before proceeding.
Double-click on dss.exe and follow the prompts.
If your anti-virus or firewall complains, please allow this script to run as it is not malicious.
When it has finished, dss will open two Notepads main.txt and extra.txt -- please copy (CTRL+A and then CTRL+C) and paste (CTRL+V) the contents of main.txt and extra.txt in your next reply.

Make sure you follow the steps in my previous post for the other computer though

#11
checkyoulater

Posted 10 February 2008 - 02:35 PM

Member

Topic Starter
Member
25 posts

by previous steps you mean to maintain a clean computer right?

yup i definitely will do that, this has never happened to me before, i'm pretty sure it wasn't me, probably someone decided to use my computer at home and i got all this mess....thanks for helping me out with my laptop....i'm still reading the suggestions and docs you recommended

i'll post the resuls of the DSS.exe file as soon as their done with my PC....the PC seems to be in a terrible state it's running slow and leaving it turned on i end up getting like 5-6 new websites opening all the time, i actually had to remove my desktop speakers because i got irritated with the constant warnings from avast

hopefully it'e fix-able...almost done

#12
checkyoulater

Posted 10 February 2008 - 02:37 PM

Member

Topic Starter
Member
25 posts

Deckard's System Scanner v20071014.68
Run by benito on 2008-02-11 04:30:12
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- Last 4 Restore Point(s) --
4: 2008-02-09 05:35:43 UTC - RP35 - Scheduled Checkpoint
3: 2008-02-08 06:50:02 UTC - RP34 - Windows Update
2: 2008-02-08 06:26:13 UTC - RP33 - Scheduled Checkpoint
1: 2008-02-07 12:01:11 UTC - RP32 - Scheduled Checkpoint

Backed up registry hives.
Performed disk cleanup.

Total Physical Memory: 1023 MiB (1024 MiB recommended).

-- HijackThis (run as benito.exe) ----------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:33:22 AM, on 2/11/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16575)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Windows\SOUNDMAN.EXE
C:\Windows\System32\rundll32.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Windows\mrofinu1044.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Internet Explorer\IEUser.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\explorer.exe
C:\Users\benito\Desktop\dss.exe
C:\Windows\system32\SearchFilterHost.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\benito.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.philmug.p...isplay.php?f=60
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\nnnklkk.dll,#1
O4 - HKLM\..\Run: [runner1] C:\Windows\mrofinu1044.exe 61A847B5BBF72813329F3C466188719AB689201522886B092CBD44BD8689220221DD3257
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKCU\..\Run: [MSServer] rundll32.exe C:\Users\benito\AppData\Local\Temp\ssttq.dll,#1
O4 - HKCU\..\Run: [cmds] rundll32.exe C:\Users\benito\AppData\Local\Temp\vtutt.dll,c
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~1\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

--
End of file - 5584 bytes

-- HijackThis Fixed Entries (C:\PROGRA~1\TRENDM~1\HIJACK~1\backups\) -----------

backup-20080202-121451-921 O1 - Hosts: ::1 localhost
backup-20080202-121718-253 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
backup-20080202-121718-283 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
backup-20080202-121718-493 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
backup-20080202-121718-520 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
backup-20080202-121718-678 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
backup-20080202-122825-300 O13 - Gopher Prefix:
backup-20080202-123005-165 O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
backup-20080202-123108-330 O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

-- File Associations -----------------------------------------------------------

All associations okay.

-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

All drivers whitelisted.

-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 Apple Mobile Device - "c:\program files\common files\apple\mobile device support\bin\applemobiledeviceservice.exe" <Not Verified; Apple, Inc.; Apple Mobile Device Service>
R2 Bonjour Service - "c:\program files\bonjour\mdnsresponder.exe" <Not Verified; Apple Inc.; Bonjour>

S3 FLEXnet Licensing Service - "c:\program files\common files\macrovision shared\flexnet publisher\fnplicensingservice.exe" <Not Verified; Macrovision Europe Ltd.; FLEXnet Publisher (32 bit)>

-- Device Manager: Disabled ----------------------------------------------------

No disabled devices found.

-- Scheduled Tasks -------------------------------------------------------------

2008-02-10 13:29:28 424 --ah----- C:\Windows\Tasks\User_Feed_Synchronization-{C3B6750F-69EC-4A83-ACAA-6641E8AD71D1}.job

-- Files created between 2008-01-11 and 2008-02-11 -----------------------------

2008-02-08 10:56:05 0 d-------- C:\VundoFix Backups
2008-02-02 12:10:26 0 d-------- C:\Program Files\Trend Micro
2008-01-28 22:13:06 32 --a------ C:\Users\All Users\ezsid.dat
2008-01-27 13:32:56 0 d-------- C:\Program Files\Microsoft Works
2008-01-27 13:26:43 0 d-------- C:\Program Files\Microsoft.NET
2008-01-27 13:21:07 0 d-------- C:\Program Files\Microsoft Visual Studio 8
2008-01-27 13:17:13 0 d-------- C:\Users\All Users\Microsoft Help
2008-01-27 13:16:19 0 dr-h----- C:\MSOCache
2008-01-27 01:06:32 36864 --a------ C:\Windows\mrofinu1044.exe
2008-01-27 01:06:05 38400 --a------ C:\Windows\system32\nnnklkk.dll
2008-01-26 23:12:12 0 d-------- C:\Users\All Users\FLEXnet
2008-01-26 22:53:09 0 d-------- C:\Program Files\Common Files\Macrovision Shared
2008-01-26 14:34:26 0 d-------- C:\Windows\WinRAR
2008-01-26 11:34:18 0 d-------- C:\Program Files\Java
2008-01-26 11:28:23 0 d-------- C:\Program Files\Common Files\Java
2008-01-24 16:23:45 0 d-------- C:\Program Files\WinSCP
2008-01-23 16:30:43 0 d-------- C:\Program Files\AviSynth 2.5
2008-01-23 16:30:35 0 d-------- C:\Program Files\Red Kawa
2008-01-22 14:05:27 0 d-------- C:\Windows\SoftwareDistribution
2008-01-22 14:02:47 0 d-------- C:\Windows\Debug
2008-01-22 14:02:46 0 d-------- C:\Windows\CSC
2008-01-22 13:57:08 0 d-------- C:\Windows\Prefetch
2008-01-22 13:55:45 0 d-------- C:\Windows\Panther
2008-01-22 11:53:10 0 d--hs---- C:\Boot
2008-01-22 11:31:07 0 d-------- C:\Windows.old
2008-01-22 06:11:34 0 d-------- C:\Users\All Users\Yahoo!
2008-01-22 06:11:18 0 d-------- C:\Users\All Users\NVIDIA
2008-01-22 02:12:05 0 d-------- C:\Windows\PCHEALTH
2008-01-22 02:03:40 0 d--hs--c- C:\Program Files\Common Files\WindowsLiveInstaller
2008-01-22 02:03:09 0 d-------- C:\Program Files\Windows Live
2008-01-22 02:02:39 0 d-------- C:\Users\All Users\WLInstaller
2008-01-22 01:59:46 0 d-------- C:\Program Files\Skype
2008-01-22 01:59:45 0 d-------- C:\Program Files\Common Files\Skype
2008-01-22 01:59:33 0 d-------- C:\Users\All Users\Skype
2008-01-22 01:47:29 0 d-------- C:\Windows\system32\Macromed
2008-01-22 01:44:34 0 d-------- C:\Program Files\Yahoo!
2008-01-22 01:33:53 0 d-------- C:\Program Files\Handbrake
2008-01-22 01:29:55 0 d-------- C:\Program Files\uTorrent
2008-01-22 01:29:07 0 d-------- C:\Program Files\Common Files\Adobe
2008-01-22 01:28:56 0 d-------- C:\Users\All Users\Adobe
2008-01-22 01:28:10 0 d-------- C:\Windows\Downloaded Installations
2008-01-21 23:41:23 0 d-------- C:\Program Files\iPod
2008-01-21 23:41:08 0 d-------- C:\Program Files\iTunes
2008-01-21 23:39:50 0 d-------- C:\Program Files\Bonjour
2008-01-21 23:38:46 0 d-------- C:\Program Files\QuickTime
2008-01-21 23:38:40 0 d-------- C:\Users\All Users\Apple Computer
2008-01-21 23:37:51 0 d-------- C:\Program Files\Apple Software Update
2008-01-21 23:36:32 0 d-------- C:\Program Files\Common Files\Apple
2008-01-21 23:36:28 0 d-------- C:\Users\All Users\Apple
2008-01-21 23:35:48 0 d--hs---- C:\Windows\Installer
2008-01-21 23:18:59 0 d-------- C:\Program Files\Alwil Software
2008-01-21 23:03:00 0 d-------- C:\Program Files\Combined Community Codec Pack
2008-01-21 22:17:40 0 dr------- C:\Users\benito\Searches
2008-01-21 22:17:00 0 dr------- C:\Users\benito\Contacts
2008-01-21 22:16:44 0 d--hs---- C:\Users\benito\Templates
2008-01-21 22:16:44 0 d--hs---- C:\Users\benito\Start Menu
2008-01-21 22:16:44 0 d--hs---- C:\Users\benito\SendTo
2008-01-21 22:16:44 0 d--hs---- C:\Users\benito\Recent
2008-01-21 22:16:44 0 d--hs---- C:\Users\benito\PrintHood
2008-01-21 22:16:44 0 d--hs---- C:\Users\benito\NetHood
2008-01-21 22:16:44 0 d--hs---- C:\Users\benito\My Documents
2008-01-21 22:16:44 0 d--hs---- C:\Users\benito\Local Settings
2008-01-21 22:16:44 0 d--hs---- C:\Users\benito\Cookies
2008-01-21 22:16:44 0 d--hs---- C:\Users\benito\Application Data
2008-01-21 22:16:40 0 dr------- C:\Users\benito\Videos
2008-01-21 22:16:40 0 dr------- C:\Users\benito\Saved Games
2008-01-21 22:16:40 0 dr------- C:\Users\benito\Pictures
2008-01-21 22:16:40 0 dr------- C:\Users\benito\Music
2008-01-21 22:16:40 0 dr------- C:\Users\benito\Links
2008-01-21 22:16:40 0 dr------- C:\Users\benito\Favorites
2008-01-21 22:16:40 0 dr------- C:\Users\benito\Downloads
2008-01-21 22:16:40 0 dr------- C:\Users\benito\Documents
2008-01-21 22:16:40 0 dr------- C:\Users\benito\Desktop
2008-01-21 22:16:40 0 d--h----- C:\Users\benito\AppData
2008-01-21 22:16:39 1310720 --ahs---- C:\Users\benito\ntuser.dat

-- Find3M Report ---------------------------------------------------------------

2008-02-08 10:57:06 0 d-------- C:\Users\benito\AppData\Roaming\uTorrent
2008-02-01 02:38:09 0 d-------- C:\Users\benito\AppData\Roaming\Media Player Classic
2008-01-29 02:27:34 0 d-------- C:\Users\benito\AppData\Roaming\Skype
2008-01-29 00:03:07 0 d-------- C:\Users\benito\AppData\Roaming\skypePM
2008-01-27 13:32:11 0 d-------- C:\Program Files\MSBuild
2008-01-27 13:30:39 0 d-------- C:\Program Files\Common Files
2008-01-26 23:20:19 0 d-------- C:\Users\benito\AppData\Roaming\Adobe
2008-01-25 00:51:55 0 d-------- C:\Users\benito\AppData\Roaming\Leadertech
2008-01-24 16:39:17 0 d-------- C:\Users\benito\AppData\Roaming\WinRAR
2008-01-22 16:54:03 0 d-------- C:\Users\benito\AppData\Roaming\Mozilla
2008-01-22 12:54:06 0 d-------- C:\Users\benito\AppData\Roaming\Apple Computer
2008-01-22 01:51:20 0 d-------- C:\Users\benito\AppData\Roaming\Macromedia
2008-01-21 23:16:12 174 --ahs---- C:\Program Files\desktop.ini
2008-01-21 23:11:03 0 d-------- C:\Program Files\Windows Calendar
2008-01-21 23:11:02 0 d-------- C:\Program Files\Windows Mail
2008-01-21 23:11:01 0 d-------- C:\Program Files\Windows Defender
2008-01-21 23:10:58 0 d-------- C:\Program Files\Windows Sidebar
2008-01-21 22:17:12 0 d-------- C:\Users\benito\AppData\Roaming\Identities

-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [01/21/2008 11:02 PM]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [12/04/2007 09:00 PM]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [01/10/2008 03:27 PM]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [01/15/2008 03:22 AM]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [03/09/2007 11:09 AM]
"SoundMan"="SOUNDMAN.EXE" [03/09/2007 04:28 PM C:\Windows\SOUNDMAN.EXE]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [09/12/2007 05:28 AM]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [09/12/2007 05:28 AM]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [09/12/2007 05:28 AM]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [09/25/2007 01:11 AM]
"MSServer"="C:\Windows\system32\nnnklkk.dll" [01/27/2008 01:06 AM]
"runner1"="C:\Windows\mrofinu1044.exe" [01/27/2008 01:06 AM]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [10/27/2006 12:47 AM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSServer"="C:\Users\benito\AppData\Local\Temp\ssttq.dll,#1" []
"cmds"="C:\Users\benito\AppData\Local\Temp\vtutt.dll,c" []

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"=2 (0x2)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{446624E1-B767-4443-AA6E-0F355CAFD21B}"= C:\Windows\system32\nnnklkk.dll [01/27/2008 01:06 AM 38400]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppInfo]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\KeyIso]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NTDS]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ProfSvc]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sacsvr]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SWPRV]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TabletInputService]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TBS]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TrustedInstaller]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\VDS]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgr.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgrx.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
@="Volume shadow copy"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}]
@="IEEE 1394 Bus host controllers"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}]
@="SBP2 IEEE 1394 Devices"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}]
@="SecurityDevices"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalService nsi lltdsvc SSDPSRV upnphost SCardSvr w32time EventSystem RemoteRegistry WinHttpAutoProxySvc lanmanworkstation TBS SLUINotify THREADORDER fdrespub netprofm fdphost wcncsvc QWAVE WebClient
LocalSystemNetworkRestricted hidserv UxSms WdiSystemHost Netman trkwks AudioEndpointBuilder WUDFSvc irmon sysmain IPBusEnum dot3svc PcaSvc CscService TabletInputService UmRdpService wlansvc WPDBusEnum EMDMgmt
LocalServiceNoNetwork PLA DPS BFE mpssvc
LocalServiceNetworkRestricted DHCP eventlog AudioSrv LmHosts wscsvc p2pimsvc PNRPSvc p2psvc PnrpAutoReg

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{038819f6-cae5-11dc-9849-001109dafb52}]
Auto\command- RECYCLER\S-1-5-21-1078073611-1993962763-839522115-1003\mmc32.EXE
AutoRun\command- C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RECYCLER\S-1-5-21-1078073611-1993962763-839522115-1003\mmc32.EXE
Browser\command- RECYCLER\S-1-5-21-1078073611-1993962763-839522115-1003\mmc32.EXE

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7d0477d1-c84f-11dc-88a9-001109dafb52}]
AutoRun\command- G:\RavMon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
C:\Windows\system32\unregmp2.exe /ShowWMP

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
%SystemRoot%\system32\unregmp2.exe /FirstLogon /Shortcuts /RegBrowsers /ResetMUI

-- End of Deckard's System Scanner: finished at 2008-02-11 04:35:15 ------------

Deckard's System Scanner v20071014.68
Extra logfile - please post this as an attachment with your post.
--------------------------------------------------------------------------------

-- System Information ----------------------------------------------------------

Microsoft® Windows Vista™ Business (build 6000)
Architecture: X86; Language: English

CPU 0: AMD Athlon™ 64 Processor 3000+
Percentage of Memory in Use: 48%
Physical Memory (total/avail): 1022.94 MiB / 525.75 MiB
Pagefile Memory (total/avail): 2301.29 MiB / 1517.91 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1930.53 MiB

A: is Removable (No Media)
C: is Fixed (NTFS) - 74.52 GiB total, 28.52 GiB free.
D: is Fixed (NTFS) - 74.53 GiB total, 8.93 GiB free.
E: is CDROM (No Media)
F: is CDROM (No Media)

\\.\PHYSICALDRIVE0 - ST380817AS ATA Device - 74.53 GiB - 1 partition
\PARTITION0 (bootable) - Installable File System - 74.52 GiB - C:

\\.\PHYSICALDRIVE1 - ST380817AS ATA Device - 74.53 GiB - 1 partition
\PARTITION0 - Installable File System - 74.53 GiB - D:

-- Security Center -------------------------------------------------------------

AUOptions is scheduled to auto-install.
Windows Internal Firewall is enabled.

AV: avast! antivirus 4.7.1098 [VPS 080209-0] v4.7.1098 (ALWIL Software)
AS: Windows Defender v1.1.1505.0 (Microsoft Corporation)

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

-- Environment Variables -------------------------------------------------------

ALLUSERSPROFILE=C:\ProgramData
APPDATA=C:\Users\benito\AppData\Roaming
CLASSPATH=.;C:\Program Files\QuickTime\QTSystem\QTJava.zip
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=MYROOM
ComSpec=C:\Windows\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Users\benito
LOCALAPPDATA=C:\Users\benito\AppData\Local
LOGONSERVER=\\MYROOM
NUMBER_OF_PROCESSORS=1
OS=Windows_NT
Path=C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Program Files\QuickTime\QTSystem\
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 15 Model 31 Stepping 0, AuthenticAMD
PROCESSOR_LEVEL=15
PROCESSOR_REVISION=1f00
ProgramData=C:\ProgramData
ProgramFiles=C:\Program Files
PROMPT=$P$G
PUBLIC=C:\Users\Public
QTJAVA=C:\Program Files\QuickTime\QTSystem\QTJava.zip
SystemDrive=C:
SystemRoot=C:\Windows
TEMP=C:\Users\benito\AppData\Local\Temp
TMP=C:\Users\benito\AppData\Local\Temp
USERDOMAIN=myROOM
USERNAME=benito
USERPROFILE=C:\Users\benito
windir=C:\Windows

-- User Profiles ---------------------------------------------------------------

benito

-- Add/Remove Programs ---------------------------------------------------------

µTorrent --> "C:\Program Files\uTorrent\uTorrent.exe" /UNINSTALL
Adobe Anchor Service CS3 --> MsiExec.exe /I{90176341-0A8B-4CCC-A78D-F862228A6B95}
Adobe Asset Services CS3 --> MsiExec.exe /I{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}
Adobe Bridge CS3 --> MsiExec.exe /I{9C9824D9-9000-4373-A6A5-D0E5D4831394}
Adobe Bridge Start Meeting --> MsiExec.exe /I{08B32819-6EEF-4057-AEDA-5AB681A36A23}
Adobe Camera Raw 4.0 --> MsiExec.exe /I{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}
Adobe CMaps --> MsiExec.exe /I{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}
Adobe Color - Photoshop Specific --> MsiExec.exe /I{A2D81E70-2A98-4A08-A628-94388B063C5E}
Adobe Color Common Settings --> MsiExec.exe /I{DADD7B8A-BCB0-44F5-967A-ECB6B4F2ECD9}
Adobe Color EU Extra Settings --> MsiExec.exe /I{51846830-E7B2-4218-8968-B77F0FF475B8}
Adobe Color JA Extra Settings --> MsiExec.exe /I{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}
Adobe Color NA Recommended Settings --> MsiExec.exe /I{95655ED4-7CA5-46DF-907F-7144877A32E5}
Adobe Default Language CS3 --> MsiExec.exe /I{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}
Adobe Device Central CS3 --> MsiExec.exe /I{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}
Adobe ExtendScript Toolkit 2 --> MsiExec.exe /I{C2D69781-F392-4118-A5A7-C7E9C38DBFC2}
Adobe Flash Player ActiveX --> C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player Plugin --> C:\Windows\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Fonts All --> MsiExec.exe /I{6ABE0BEE-D572-4FE8-B434-9E72A289431B}
Adobe Help Viewer CS3 --> MsiExec.exe /I{04AF207D-9A77-465A-8B76-991F6AB66245}
Adobe Linguistics CS3 --> MsiExec.exe /I{54793AA1-5001-42F4-ABB6-C364617C6078}
Adobe PDF Library Files --> MsiExec.exe /I{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}
Adobe Photoshop CS3 --> C:\Program Files\Common Files\Adobe\Installers\2ac78060bc5856b0c1cf873bb919b58\Setup.exe
Adobe Photoshop CS3 --> MsiExec.exe /I{0046FA01-C5B9-4985-BACB-398DC480FC05}
Adobe Setup --> MsiExec.exe /I{D1BB4446-AE9C-4256-9A7F-4D46604D2462}
Adobe Stock Photos CS3 --> MsiExec.exe /I{29E5EA97-5F74-4A57-B8B2-D4F169117183}
Adobe Type Support --> MsiExec.exe /I{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}
Adobe Update Manager CS3 --> MsiExec.exe /I{E69AE897-9E0B-485C-8552-7841F48D42D8}
Adobe Version Cue CS3 Client --> MsiExec.exe /I{D0DFF92A-492E-4C40-B862-A74A173C25C5}
Adobe WinSoft Linguistics Plugin --> MsiExec.exe /I{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}
Adobe XMP Panels CS3 --> MsiExec.exe /I{802771A9-A856-4A41-ACF7-1450E523C923}
Adobe® Photoshop® Album Starter Edition 3.2 --> MsiExec.exe /I{A654A805-41D9-40C7-AA46-4AF04F044D61}
Apple Mobile Device Support --> MsiExec.exe /I{D8AB8F0C-CEEB-4A29-8EF5-219B064813F4}
Apple Software Update --> MsiExec.exe /I{B74F042E-E1B9-4A5B-8D46-387BB172F0A4}
avast! Antivirus --> rundll32 C:\PROGRA~1\ALWILS~1\Avast4\Setup\setiface.dll,RunSetup
AviSynth 2.5 --> "C:\Program Files\AviSynth 2.5\Uninstall.exe"
Bonjour --> MsiExec.exe /I{47BF1BD6-DCAC-468F-A0AD-E5DECC2211C3}
Combined Community Codec Pack 2007-07-22 --> "C:\Program Files\Combined Community Codec Pack\unins000.exe"
Handbrake 2.4.1 --> C:\Program Files\Handbrake\uninst.exe
HijackThis 2.0.2 --> "C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
iTunes --> MsiExec.exe /I{B85C4D19-6CEB-48CF-BD98-C887AC8C6F94}
J2SE Runtime Environment 5.0 Update 12 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150120}
Java™ 6 Update 3 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160030}
Microsoft Office Access MUI (English) 2007 --> MsiExec.exe /X{90120000-0015-0409-0000-0000000FF1CE}
Microsoft Office Access Setup Metadata MUI (English) 2007 --> MsiExec.exe /X{90120000-0117-0409-0000-0000000FF1CE}
Microsoft Office Enterprise 2007 --> "C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall ENTERPRISE /dll OSETUP.DLL
Microsoft Office Enterprise 2007 --> MsiExec.exe /X{90120000-0030-0000-0000-0000000FF1CE}
Microsoft Office Excel MUI (English) 2007 --> MsiExec.exe /X{90120000-0016-0409-0000-0000000FF1CE}
Microsoft Office Groove MUI (English) 2007 --> MsiExec.exe /X{90120000-00BA-0409-0000-0000000FF1CE}
Microsoft Office Groove Setup Metadata MUI (English) 2007 --> MsiExec.exe /X{90120000-0114-0409-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (English) 2007 --> MsiExec.exe /X{90120000-0044-0409-0000-0000000FF1CE}
Microsoft Office OneNote MUI (English) 2007 --> MsiExec.exe /X{90120000-00A1-0409-0000-0000000FF1CE}
Microsoft Office Outlook MUI (English) 2007 --> MsiExec.exe /X{90120000-001A-0409-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (English) 2007 --> MsiExec.exe /X{90120000-0018-0409-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007 --> MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007 --> MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007 --> MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (English) 2007 --> MsiExec.exe /X{90120000-002C-0409-0000-0000000FF1CE}
Microsoft Office Publisher MUI (English) 2007 --> MsiExec.exe /X{90120000-0019-0409-0000-0000000FF1CE}
Microsoft Office Shared MUI (English) 2007 --> MsiExec.exe /X{90120000-006E-0409-0000-0000000FF1CE}
Microsoft Office Shared Setup Metadata MUI (English) 2007 --> MsiExec.exe /X{90120000-0115-0409-0000-0000000FF1CE}
Microsoft Office Word MUI (English) 2007 --> MsiExec.exe /X{90120000-001B-0409-0000-0000000FF1CE}
Mozilla Firefox (2.0.0.12) --> C:\Program Files\Mozilla Firefox\uninstall\helper.exe
NVIDIA Drivers --> C:\Windows\system32\NVUNINST.EXE UninstallGUI
PDF Settings --> MsiExec.exe /I{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5}
QuickTime --> MsiExec.exe /I{6EC874C2-F950-4B7E-A5B7-B1066D6B74AA}
Realtek AC'97 Audio --> Alcrmv.exe -r -m
Skype™ 3.6 --> MsiExec.exe /X{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}
Update for Outlook 2007 Junk Email Filter (kb943597) --> msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {A751F0DB-8476-4207-956E-20AEBBA4B1DA}
Videora iPhone Converter 3.07 --> C:\Program Files\Red Kawa\Video Converter 3\uninstaller.exe
Windows Live installer --> MsiExec.exe /X{A7E4ECCA-4A8E-4258-8EC8-2DCCF5B11320}
Windows Live Messenger --> MsiExec.exe /X{508CE775-4BA4-4748-82DF-FE28DA9F03B0}
Windows Live Sign-in Assistant --> MsiExec.exe /I{AFA4E5FD-ED70-4D92-99D0-162FD56DC986}
WinRAR --> "C:\Windows\WinRAR\uninstall.exe" "/U:C:\Program Files\WinRAR\Uninstall\uninstall.xml"
WinSCP 4.0.6 --> "C:\Program Files\WinSCP\unins000.exe"
Yahoo! Messenger --> C:\PROGRA~1\Yahoo!\MESSEN~1\UNWISE.EXE /U C:\PROGRA~1\Yahoo!\MESSEN~1\INSTALL.LOG

-- Application Event Log -------------------------------------------------------

Event Record #/Type1742 / Success
Event Submitted/Written: 02/10/2008 00:58:26 AM
Event ID/Source: 5617 / WinMgmt
Event Description:

Event Record #/Type1741 / Success
Event Submitted/Written: 02/10/2008 00:58:25 AM
Event ID/Source: 5615 / WinMgmt
Event Description:

Event Record #/Type1739 / Success
Event Submitted/Written: 02/10/2008 00:58:21 AM
Event ID/Source: 902 / Software Licensing Service
Event Description:
The Software Licensing service has started.

Event Record #/Type1730 / Warning
Event Submitted/Written: 02/09/2008 06:42:21 PM
Event ID/Source: 1530 / profsvc
Event Description:
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.

DETAIL -
1 user registry handles leaked from \Registry\User\S-1-5-21-3784900115-268296912-4214499356-1000_Classes:
Process 848 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3784900115-268296912-4214499356-1000_CLASSES

Event Record #/Type1729 / Warning
Event Submitted/Written: 02/09/2008 06:42:20 PM
Event ID/Source: 1530 / profsvc
Event Description:
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.

DETAIL -
1 user registry handles leaked from \Registry\User\S-1-5-21-3784900115-268296912-4214499356-1000:
Process 848 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3784900115-268296912-4214499356-1000

-- Security Event Log ----------------------------------------------------------

No Errors/Warnings found.

-- System Event Log ------------------------------------------------------------

Event Record #/Type21939 / Warning
Event Submitted/Written: 02/11/2008 00:58:25 AM
Event ID/Source: 36 / W32Time
Event Description:
The time service has not synchronized the system time for 86400 seconds because none of the time service providers provided a usable time stamp. The time service will not update the local system time until it is able to synchronize with a time source. If the local system is configured to act as a time server for clients, it will stop advertising as a time source to clients. The time service will continue to retry and sync time with its time sources. Check system event log for other W32time events for more details. Run 'w32tm /resync' to force an instant time synchronization.

Event Record #/Type20335 / Warning
Event Submitted/Written: 02/09/2008 01:48:40 PM
Event ID/Source: 3004 / WinDefend
Event Description:
%myROOM27 Real-Time Protection agent has detected changes. Microsoft recommends you analyze the software that made these changes for potential risks. You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer. Allow changes only if you trust the program or the software publisher. %myROOM27 can't undo changes that you allow.

For more information please see the following:
%myROOM275

Scan ID: {BC2C17A4-517D-48AE-BE63-0D12A7B5CE81}

User: myROOM\benito

Name: %myROOM271

ID: %myROOM272

Severity ID: %myROOM273

Category ID: %myROOM274

Path Found: %myROOM276

Alert Type: %myROOM278

Detection Type: 1.1.1505.02

Event Record #/Type20259 / Error
Event Submitted/Written: 02/09/2008 01:46:58 PM
Event ID/Source: 6008 / EventLog
Event Description:
The previous system shutdown at 1:45:30 PM on 2/9/2008 was unexpected.

Event Record #/Type20191 / Error
Event Submitted/Written: 02/09/2008 00:40:34 PM
Event ID/Source: 7022 / Service Control Manager
Event Description:
Windows Update

Event Record #/Type20109 / Warning
Event Submitted/Written: 02/09/2008 00:35:41 PM
Event ID/Source: 3004 / WinDefend
Event Description:
%myROOM27 Real-Time Protection agent has detected changes. Microsoft recommends you analyze the software that made these changes for potential risks. You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer. Allow changes only if you trust the program or the software publisher. %myROOM27 can't undo changes that you allow.

For more information please see the following:
%myROOM275

Scan ID: {2241DB57-EA4C-434E-B47A-05112FB3DD60}

User: myROOM\benito

Name: %myROOM271

ID: %myROOM272

Severity ID: %myROOM273

Category ID: %myROOM274

Path Found: %myROOM276

Alert Type: %myROOM278

Detection Type: 1.1.1505.02

-- End of Deckard's System Scanner: finished at 2008-02-11 04:35:15 ------------

#13
Rorschach112

Posted 10 February 2008 - 02:41 PM

Ralphie

Retired Staff
47,710 posts

Won't take long to fix this one, can get it done by today if you wish

1. Please re-open HiJackThis and choose do a system scan only. Check the boxes next to ONLY the entries listed below(if present):

O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\nnnklkk.dll,#1
O4 - HKLM\..\Run: [runner1] C:\Windows\mrofinu1044.exe 61A847B5BBF72813329F3C466188719AB689201522886B092CBD44BD8689220221DD3257
O4 - HKCU\..\Run: [MSServer] rundll32.exe C:\Users\benito\AppData\Local\Temp\ssttq.dll,#1
O4 - HKCU\..\Run: [cmds] rundll32.exe C:\Users\benito\AppData\Local\Temp\vtutt.dll,c

2. Now close all windows other than HiJackThis, including browsers, so that nothing other than HijackThis is open, then click Fix Checked. A box will pop up asking you if you wish to fix the selected items. Please choose YES. Once it has fixed them, please exit/close HijackThis.

Please download the OTMoveIt2 by OldTimer.

Save it to your desktop.
Please double-click OTMoveIt2.exe to run it.

Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

C:\Windows\mrofinu1044.exe
C:\Windows\system32\nnnklkk.dll
G:\RavMon.exe
C:\Users\benito\AppData\Local\Temp\ssttq.dll
C:\Users\benito\AppData\Local\Temp\vtutt.dll

Return to OTMoveIt2, right click in the "Paste List of Files/Folders to be Moved" window (under the light blue bar) and choose Paste.
Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
```
purity
```
Return to OTMoveIt2, right click in the "Paste List Of Files/Patterns To Search For and Move" window (under the yellow bar) and choose Paste.
Click the red Moveit! button.
Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
Close OTMoveIt2

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

Backup Your Registry with ERUNT

Please use the following link and scroll down to ERUNT and download it.
http://aumha.org/freeware/freeware.php
For version with the Installer:
Use the setup program to install ERUNT on your computer
For the zipped version:
Unzip all the files into a folder of your choice.

Click Erunt.exe to backup your registry to the folder of your choice.

Note: to restore your registry, go to the folder and start ERDNT.exe

Now we need to fix your problems by making a .reg file. Copy the code below into a Notepad file. Name the file as fix.reg, change the "Save as Type" to "All files" and save it on the desktop.

Windows Registry Editor Version 5.00

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7d0477d1-c84f-11dc-88a9-001109dafb52}]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{038819f6-cae5-11dc-9849-001109dafb52}]

Then double click on the fix.reg file, when it prompts to merge click "Yes".

Reboot and post a new DSS log

#14
checkyoulater

Posted 10 February 2008 - 02:41 PM

Member

Topic Starter
Member
25 posts

some points that may be of relevance i tried running hijackthis 2 days ago, and "fixed" some stuff which i thought weren't supposed to be there, and nothing really happened the files weren't there in the next log but i still had web pages opening and warnings popping up time and time again.

then after rebooting my PC i could no longer get hijackthis to work correctly an error pops up saying something stopped it from scanning all files completely...or something to that effect...i'm lost, and usually i'm not so dumbfounded when it comes to my computer, but malware has just gotten so good at hidding that i have completely lost control of it in my system

just thougt i'd let you know that..

#15
Rorschach112

Posted 10 February 2008 - 02:43 PM

Ralphie

Retired Staff
47,710 posts

Yeah I noticed you fixed some stuff

Do the above steps then do this

To restore the backups:

Open HiJackThis
Click on "View the list of Backups"
Place a check mark next to the following

backup-20080202-121451-921 O1 - Hosts: ::1 localhost
backup-20080202-121718-253 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
backup-20080202-121718-283 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
backup-20080202-121718-493 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
backup-20080202-121718-520 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
backup-20080202-121718-678 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
backup-20080202-122825-300 O13 - Gopher Prefix:
backup-20080202-123108-330 O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
Click Restore
Click Yes
Reboot your computer