[richt]

Hi All

I have a probem, first off computer takes about 10-15 mins to start up on windows xp and then after a bit i get the following message popping up every 5 mins

Windows security alert

windows has detected an internet attack attempt...

somebodys trying to affect you pc with spyware or other harmful virus.

This then asks me to download a program to sort out but it then just pops up some web address to purchase it from.

Also in the bottom right hand corner a red cross flashes telling me about another attack.

can someone please help me as the computer wont run at all.

I have listed my hijack log, extra.txt and main.txt from deckard

HIJACK

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:39:35, on 14/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Kontiki\KService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\krmdopsb.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = www.google.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.bearsh...ar.html?src=ssb
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarerefer...=...6Ojg5&lid=2
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.bearsh...ar.html?src=ssb
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer Provided by blueyonder
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: (no name) - {466AADAC-E21A-422D-958C-2B627A22E99A} - (no file)
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
O4 - HKLM\..\Run: [Workflow] D:\Workflow.exe
O4 - HKLM\..\Run: [4oD] "C:\Program Files\Kontiki\KHost.exe" -all
O4 - HKLM\..\Run: [10ac579d] rundll32.exe "C:\WINDOWS\system32\eneetfoa.dll",b
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKCU\..\Run: [fdntfgxm] C:\WINDOWS\system32\krmdopsb.exe
O4 - HKCU\..\Run: [kdx] C:\Program Files\Kontiki\KHost.exe -all
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [PC-Cleaner] "C:\Program Files\PC-Cleaner\PC-Cleaner.exe" hide
O4 - HKLM\..\Policies\Explorer\Run: [b6BT4NQEsK] C:\Documents and Settings\All Users\Application Data\qjcrohyr\ktkfmdql.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.liv...m/quickadd.aspx
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe
O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://www.bullbearings.co.uk
O16 - DPF: {2AF5BD25-90C5-4EEC-88C5-B44DC2905D8B} (DownloadManager Control) - http://dlm.tools.aka...vex-2.2.0.8.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.syma...bin/AvSniff.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg...l_v1-0-3-48.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by102fd.bay10...es/MsnPUpld.cab
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebo...toUploader3.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.safe...wlscbase969.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.syma...n/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1155651804203
O16 - DPF: {AF2E62B6-F9E1-4D4F-A10A-9DC8E6DCBCC0} - http://update.videoe...ggPublisher.exe
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zon...nt.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.m...ash/swflash.cab
O21 - SSODL: dsktbwfe - {A799B096-95D0-411E-A103-BBAB456493E0} - C:\WINDOWS\dsktbwfe.dll
O21 - SSODL: ogxtsepr - {5FC492A4-5CC8-4268-AD5B-DA96E64C4E55} - C:\WINDOWS\ogxtsepr.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: KService - Kontiki Inc. - C:\Program Files\Kontiki\KService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O24 - Desktop Component 0: Privacy Protection - file:///C:\WINDOWS\privacy_danger\index.htm

--
End of file - 12444 bytes

Deckard's System Scanner v20071014.68
Run by Richard on 2008-04-15 13:34:34
Computer is in Normal Mode.
--------------------------------------------------------------------------------

Total Physical Memory: 503 MiB (512 MiB recommended).
System Drive C: has 1.45 GiB (less than 15%) free.


-- HijackThis (run as Richard.exe) ---------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:34:59, on 15/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Kontiki\KService.exe
C:\Documents and Settings\All Users\Application Data\qjcrohyr\ktkfmdql.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\olyxedmj.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Documents and Settings\Richard.RICHARD\Desktop\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Richard.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarerefer...=...6Ojg5&lid=2
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.bearsh...ar.html?src=ssb
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.safenavwe...&...aid=1&pid=0
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: (no name) - {34A75400-077F-4E0E-BB38-B7F45BAEA819} - (no file)
O2 - BHO: (no name) - {3CAB59B4-55A3-4737-9FD5-B93C6430BF75} - C:\WINDOWS\system32\oswvtksp.dll
O2 - BHO: (no name) - {63E88EAE-0DDA-423A-84DA-249FFA401F9A} - C:\WINDOWS\system32\urqPiGVM.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O2 - BHO: (no name) - {C3E15DFE-D990-4C3F-9BE2-4CF4E3E007CE} - C:\WINDOWS\system32\byXPGXNf.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: (no name) - {466AADAC-E21A-422D-958C-2B627A22E99A} - (no file)
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
O4 - HKLM\..\Run: [Workflow] D:\Workflow.exe
O4 - HKLM\..\Run: [4oD] "C:\Program Files\Kontiki\KHost.exe" -all
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [10ac579d] rundll32.exe "C:\WINDOWS\system32\jsyoxiwe.dll",b
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [kdx] C:\Program Files\Kontiki\KHost.exe -all
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [cjqlmshf] C:\WINDOWS\system32\olyxedmj.exe
O4 - HKLM\..\Policies\Explorer\Run: [b6BT4NQEsK] C:\Documents and Settings\All Users\Application Data\qjcrohyr\ktkfmdql.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe
O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {2AF5BD25-90C5-4EEC-88C5-B44DC2905D8B} (DownloadManager Control) - http://dlm.tools.aka...vex-2.2.0.8.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.syma...bin/AvSniff.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg...l_v1-0-3-48.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by102fd.bay10...es/MsnPUpld.cab
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebo...toUploader3.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.safe...wlscbase969.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.syma...n/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1155651804203
O16 - DPF: {AF2E62B6-F9E1-4D4F-A10A-9DC8E6DCBCC0} - http://update.videoe...ggPublisher.exe
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zon...nt.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.m...ash/swflash.cab
O20 - Winlogon Notify: byXPGXNf - C:\WINDOWS\SYSTEM32\byXPGXNf.dll
O21 - SSODL: dsktbwfe - {263D7CED-2310-483A-8DD0-1AD3DDA7915D} - C:\WINDOWS\dsktbwfe.dll
O21 - SSODL: ogxtsepr - {7D700DEC-2E6C-41DF-8904-587DA3E6C0F1} - C:\WINDOWS\ogxtsepr.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: KService - Kontiki Inc. - C:\Program Files\Kontiki\KService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O24 - Desktop Component 0: Privacy Protection - file:///C:\WINDOWS\privacy_danger\index.htm

--
End of file - 13713 bytes


MAIN.TXT

-- Files created between 2008-03-15 and 2008-04-15 -----------------------------

2008-04-15 12:54:38 0 d-------- C:\Documents and Settings\Richard.RICHARD\Application Data\DivX
2008-04-15 12:54:02 0 d-------- C:\Documents and Settings\Richard.RICHARD\Application Data\Real
2008-04-15 12:26:01 4096 --a------ C:\WINDOWS\userconfig9x.dll
2008-04-15 12:26:01 4096 --a------ C:\WINDOWS\system32winlogonpc.exe
2008-04-15 12:26:01 4096 --a------ C:\WINDOWS\system32hoproxy.dll
2008-04-15 12:26:01 4096 --a------ C:\WINDOWS\FVProtect.exe
2008-04-15 12:26:00 4096 --a------ C:\WINDOWS\system32taack.exe
2008-04-15 12:26:00 4096 --a------ C:\WINDOWS\system32taack.dat
2008-04-15 12:26:00 4096 --a------ C:\WINDOWS\system32ssurf022.dll
2008-04-15 12:26:00 4096 --a------ C:\WINDOWS\system32sncntr.exe
2008-04-15 12:26:00 0 d-------- C:\WINDOWS\system32smp
2008-04-15 12:26:00 4096 --a------ C:\WINDOWS\system32psoft1.exe
2008-04-15 12:26:00 4096 --a------ C:\WINDOWS\system32psof1.exe
2008-04-15 12:26:00 4096 --a------ C:\WINDOWS\system32ps1.exe
2008-04-15 12:26:00 4096 --a------ C:\WINDOWS\system32netode.exe
2008-04-15 12:26:00 4096 --a------ C:\WINDOWS\system32mwin32.exe
2008-04-15 12:26:00 4096 --a------ C:\WINDOWS\system32msnbho.dll
2008-04-15 12:26:00 4096 --a------ C:\WINDOWS\system32medup020.dll
2008-04-15 12:26:00 4096 --a------ C:\WINDOWS\system32medup012.dll
2008-04-15 12:26:00 4096 --a------ C:\WINDOWS\system32hxiwlgpm.exe
2008-04-15 12:26:00 4096 --a------ C:\WINDOWS\system32hxiwlgpm.dat
2008-04-15 12:26:00 4096 --a------ C:\WINDOWS\system32bsva-egihsg52.exe
2008-04-15 12:26:00 4096 --a------ C:\WINDOWS\iTunesMusic.exe
2008-04-15 12:26:00 4096 --a------ C:\WINDOWS\a.bat
2008-04-15 12:26:00 0 d-------- C:\Documents and Settings\Richard.RICHARD\Desktopvirii
2008-04-15 12:25:59 4096 --a------ C:\WINDOWS\system32thun32.dll
2008-04-15 12:25:59 4096 --a------ C:\WINDOWS\system32thun.dll
2008-04-15 12:25:59 4096 --a------ C:\WINDOWS\system32temp#01.exe
2008-04-15 12:25:59 4096 --a------ C:\WINDOWS\system32ssvchost.exe
2008-04-15 12:25:59 4096 --a------ C:\WINDOWS\system32ssvchost.com
2008-04-15 12:25:59 4096 --a------ C:\WINDOWS\system32Rundl1.exe
2008-04-15 12:25:59 4096 --a------ C:\WINDOWS\system32regm64.dll
2008-04-15 12:25:59 4096 --a------ C:\WINDOWS\system32regc64.dll
2008-04-15 12:25:59 4096 --a------ C:\WINDOWS\system32mtr2.exe
2008-04-15 12:25:59 4096 --a------ C:\WINDOWS\system32msvchost.exe
2008-04-15 12:25:59 4096 --a------ C:\WINDOWS\system32msgp.exe
2008-04-15 12:25:59 4096 --a------ C:\WINDOWS\system32h@tkeysh@@k.dll
2008-04-15 12:25:59 4096 --a------ C:\WINDOWS\system32dpcproxy.exe
2008-04-15 12:25:59 4096 --a------ C:\Documents and Settings\Richard.RICHARD\DesktopFWebdEditor.exe
2008-04-15 12:25:59 4096 --a------ C:\Documents and Settings\Richard.RICHARD\Desktopfwebd.exe
2008-04-15 12:25:59 4096 --a------ C:\Documents and Settings\Richard.RICHARD\Desktopfilemanagerclient.exe
2008-04-15 12:25:58 4096 --a------ C:\WINDOWS\winsystem.exe
2008-04-15 12:25:58 4096 --a------ C:\WINDOWS\system32WINWGPX.EXE
2008-04-15 12:25:58 4096 --a------ C:\WINDOWS\system32winsystem.exe
2008-04-15 12:25:58 4096 --a------ C:\WINDOWS\system32vcatchpi.dll
2008-04-15 12:25:58 4096 --a------ C:\WINDOWS\system32vbsys2.dll
2008-04-15 12:25:58 4096 --a------ C:\WINDOWS\system32sysreq.exe
2008-04-15 12:25:58 4096 --a------ C:\WINDOWS\system32newsd32.exe
2008-04-15 12:25:58 4096 --a------ C:\WINDOWS\system32mssecu.exe
2008-04-15 12:25:58 4096 --a------ C:\WINDOWS\system32emesx.dll
2008-04-15 12:25:58 4096 --a------ C:\WINDOWS\system32bdn.com
2008-04-15 12:25:58 4096 --a------ C:\WINDOWS\system32awtoolb.dll
2008-04-15 12:25:58 4096 --a------ C:\WINDOWS\system32anticipator.dll
2008-04-15 12:25:58 4096 --a------ C:\WINDOWS\system32akttzn.exe
2008-04-15 12:25:58 4096 --a------ C:\WINDOWS\mssecu.exe
2008-04-15 12:25:58 4096 --a------ C:\WINDOWS\bdn.com
2008-04-15 12:25:30 110592 --a------ C:\WINDOWS\system32\olyxedmj.exe
2008-04-15 12:09:11 2212 --a------ C:\WINDOWS\system32\tmp.reg
2008-04-15 12:08:46 25600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-04-15 12:08:46 86528 --a------ C:\WINDOWS\system32\VACFix.exe <Not Verified; S!Ri.URZ; VACFix>
2008-04-15 12:08:46 82432 --a------ C:\WINDOWS\system32\IEDFix.exe <Not Verified; S!Ri.URZ; IEDFix>
2008-04-15 12:08:45 289144 --a------ C:\WINDOWS\system32\VCCLSID.exe <Not Verified; S!Ri; >
2008-04-15 12:08:45 288417 --a------ C:\WINDOWS\system32\SrchSTS.exe <Not Verified; S!Ri; SrchSTS>
2008-04-15 12:08:45 53248 --a------ C:\WINDOWS\system32\Process.exe <Not Verified; http://www.beyondlogic.org; Command Line Process Utility>
2008-04-15 12:08:45 51200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-04-15 11:48:46 0 d-------- C:\Documents and Settings\Richard.RICHARD\Application Data\Sun
2008-04-15 11:45:44 0 d-------- C:\WINDOWS\privacy_danger
2008-04-15 11:31:44 0 d-------- C:\Documents and Settings\Richard.RICHARD\Application Data\Macromedia
2008-04-15 11:27:54 0 d-------- C:\Documents and Settings\Richard.RICHARD\Complete
2008-04-15 11:27:20 0 d-------- C:\Documents and Settings\Richard.RICHARD\.limewire
2008-04-15 11:26:44 0 d-------- C:\Documents and Settings\Richard.RICHARD\Contacts
2008-04-15 11:26:28 0 d-------- C:\Documents and Settings\Richard.RICHARD\Phone Browser
2008-04-15 11:12:07 0 d-------- C:\Documents and Settings\Richard.RICHARD\Application Data\Google
2008-04-15 10:41:59 9195520 --a------ C:\Documents and Settings\Richard\ntuser.dat
2008-04-15 10:35:14 0 d-------- C:\Documents and Settings\Richard.RICHARD\Application Data\TmpRecentIcons
2008-04-15 10:29:16 0 dr-h----- C:\Documents and Settings\Richard.RICHARD\Recent
2008-04-15 10:29:16 0 d--h----- C:\Documents and Settings\Richard.RICHARD\PrintHood
2008-04-15 10:29:16 0 d--h----- C:\Documents and Settings\Richard.RICHARD\NetHood
2008-04-15 10:29:16 0 dr------- C:\Documents and Settings\Richard.RICHARD\My Documents
2008-04-15 10:29:16 0 d--h----- C:\Documents and Settings\Richard.RICHARD\Local Settings
2008-04-15 10:29:16 0 dr------- C:\Documents and Settings\Richard.RICHARD\Favorites
2008-04-15 10:29:16 0 d-------- C:\Documents and Settings\Richard.RICHARD\Desktop
2008-04-15 10:29:16 0 d--hs---- C:\Documents and Settings\Richard.RICHARD\Cookies
2008-04-15 10:29:16 0 dr-h----- C:\Documents and Settings\Richard.RICHARD\Application Data
2008-04-15 10:29:16 0 d-------- C:\Documents and Settings\Richard.RICHARD\Application Data\Identities
2008-04-15 10:29:15 0 d--h----- C:\Documents and Settings\Richard.RICHARD\Templates
2008-04-15 10:29:15 0 dr------- C:\Documents and Settings\Richard.RICHARD\Start Menu
2008-04-15 10:29:15 0 dr-h----- C:\Documents and Settings\Richard.RICHARD\SendTo
2008-04-15 10:29:15 1835008 --ah----- C:\Documents and Settings\Richard.RICHARD\NTUSER.DAT
2008-04-14 18:52:53 85056 --a------ C:\WINDOWS\system32\jsyoxiwe.dll
2008-04-14 18:49:46 53312 --a------ C:\WINDOWS\system32\oswvtksp.dll
2008-04-14 15:20:54 0 d-------- C:\Documents and Settings\Richard\Application Data\PC-Cleaner
2008-04-14 15:19:50 0 d-------- C:\Program Files\PC-Cleaner
2008-04-14 15:14:19 0 d-------- C:\Program Files\Trend Micro
2008-04-14 14:38:32 0 dr-h----- C:\Documents and Settings\Richard\Recent
2008-04-14 13:57:07 0 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-04-14 13:55:38 0 d-------- C:\Program Files\Yahoo!
2008-04-14 13:54:59 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-04-14 13:54:55 0 d-------- C:\Program Files\CCleaner
2008-04-14 13:25:06 0 d-------- C:\Documents and Settings\Richard\Application Data\Uniblue
2008-04-14 13:24:47 0 d-------- C:\Program Files\Uniblue
2008-04-13 21:10:05 0 d-------- C:\Documents and Settings\Richard\Application Data\DivX
2008-04-13 19:14:08 0 d-------- C:\Program Files\Norton Internet Security
2008-04-13 19:08:16 0 d-------- C:\Program Files\Symantec
2008-04-13 18:49:49 53312 --a------ C:\WINDOWS\system32\quduwjjt.dll
2008-04-13 18:44:36 0 d-------- C:\Program Files\Norton AntiVirus
2008-04-13 17:48:24 0 d-------- C:\Documents and Settings\Richard\Application Data\TmpRecentIcons
2008-04-13 17:43:32 0 d-------- C:\Program Files\winupdates
2008-04-13 17:43:13 0 d-------- C:\Program Files\ArcSoft
2008-04-13 16:49:47 0 d-------- C:\WINDOWS\privacy_danger(2)
2008-04-13 15:19:09 0 d-------- C:\Documents and Settings\All Users\Application Data\PC Tools
2008-04-13 15:13:44 0 d-------- C:\Program Files\Windows Sidebar
2008-04-13 04:17:26 176973 --ahs---- C:\WINDOWS\system32\MVGiPqru.ini2
2008-04-13 04:17:21 272384 --a------ C:\WINDOWS\system32\urqPiGVM.dll
2008-04-13 04:05:18 167936 --a------ C:\WINDOWS\ogxtsepr.dll
2008-04-13 04:05:18 217088 --a------ C:\WINDOWS\dsktbwfe.dll
2008-04-13 04:05:12 0 d-------- C:\Program Files\Inet Delivery
2008-04-13 04:05:10 0 d-------- C:\WINDOWS\mslagent
2008-04-13 04:05:10 0 d-------- C:\Program Files\akl
2008-04-13 04:04:50 90112 --a------ C:\WINDOWS\system32\krmdopsb.exe
2008-04-13 04:04:50 0 d-------- C:\Documents and Settings\All Users\Application Data\qjcrohyr
2008-04-13 04:04:26 37888 --a------ C:\WINDOWS\system32\byXPGXNf.dll
2008-04-13 00:33:34 0 d-------- C:\divx
2008-04-13 00:27:28 0 d-------- C:\Documents and Settings\Richard\Application Data\LG Electronics
2008-04-13 00:27:04 0 d-------- C:\Program Files\DivX
2008-04-12 22:30:14 0 d-------- C:\Program Files\LG Electronics
2008-04-03 13:46:38 0 d-------- C:\Documents and Settings\Richard\Application Data\Talkback
2008-04-03 13:01:48 0 d-------- C:\Program Files\Common Files\xing shared
2008-03-31 22:25:48 823296 --a------ C:\WINDOWS\system32\divx_xx0c.dll <Not Verified; DivX, Inc.; DivX®>
2008-03-31 22:25:48 823296 --a------ C:\WINDOWS\system32\divx_xx07.dll <Not Verified; DivX, Inc.; DivX®>
2008-03-31 22:25:46 802816 --a------ C:\WINDOWS\system32\divx_xx11.dll <Not Verified; DivX, Inc.; DivX?>
2008-03-31 22:25:46 831488 --a------ C:\WINDOWS\system32\divx_xx0a.dll
2008-03-31 22:25:46 682496 --a------ C:\WINDOWS\system32\DivX.dll <Not Verified; DivX, Inc.; DivX®>
2008-03-30 20:33:05 0 d-------- C:\Program Files\Optic Limited
2008-03-25 20:27:28 0 d-------- C:\Program Files\PartyGaming.Net
2008-03-22 00:17:05 0 d-------- C:\Program Files\BeloSoft
2008-03-21 21:30:08 3596288 --a------ C:\WINDOWS\system32\qt-dx331.dll
2008-03-21 21:28:54 196608 --a------ C:\WINDOWS\system32\dtu100.dll <Not Verified; DivX, Inc.; DivX, Inc. dtu100>
2008-03-21 21:28:54 81920 --a------ C:\WINDOWS\system32\dpl100.dll <Not Verified; DivX, Inc.; DivX, Inc. dpl100>
2008-03-21 21:28:20 12288 --a------ C:\WINDOWS\system32\DivXWMPExtType.dll


-- Find3M Report ---------------------------------------------------------------

2008-04-15 13:35:23 0 d-------- C:\Program Files\Common Files\Symantec Shared
2008-04-15 11:01:32 2508 --a------ C:\Documents and Settings\Richard.RICHARD\Application Data\$_hpcst$.hpc
2008-04-14 13:54:59 0 d-------- C:\Program Files\Common Files
2008-04-13 17:44:00 0 d-------- C:\Program Files\Java
2008-04-13 17:43:23 0 d-------- C:\Program Files\TomTom HOME 2
2008-04-13 17:43:12 0 d-------- C:\Program Files\FairUse Wizard 2
2008-04-13 17:42:30 0 d-------- C:\Program Files\Google
2008-04-13 15:28:41 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-04-03 13:01:42 0 d-------- C:\Program Files\Common Files\Real
2008-03-28 21:54:54 0 d-------- C:\Program Files\MSN Messenger
2008-03-28 21:54:50 0 d-------- C:\Program Files\Messenger Plus! Live
2008-03-05 19:06:11 0 d-------- C:\Program Files\Windows Live
2008-03-05 19:04:40 0 d--hs--c- C:\Program Files\Common Files\WindowsLiveInstaller
2008-02-25 18:18:28 0 d-------- C:\Program Files\TomTom DesktopSuite
2008-01-30 17:10:46 274432 --a------ C:\WINDOWS\system32\libcurl.dll


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{34A75400-077F-4E0E-BB38-B7F45BAEA819}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3CAB59B4-55A3-4737-9FD5-B93C6430BF75}]
14/04/2008 18:49 53312 --a------ C:\WINDOWS\system32\oswvtksp.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{63E88EAE-0DDA-423A-84DA-249FFA401F9A}]
13/04/2008 04:17 272384 --a------ C:\WINDOWS\system32\urqPiGVM.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C3E15DFE-D990-4C3F-9BE2-4CF4E3E007CE}]
13/04/2008 04:04 37888 --a------ C:\WINDOWS\system32\byXPGXNf.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Workflow"="D:\Workflow.exe" []
"4oD"="C:\Program Files\Kontiki\KHost.exe" [23/04/2007 12:23]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [03/09/2006 08:04]
"osCheck"="C:\Program Files\Norton Internet Security\osCheck.exe" [06/09/2006 02:22]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [29/01/2008 17:38]
"10ac579d"="C:\WINDOWS\system32\jsyoxiwe.dll" [14/04/2008 18:52]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [03/04/2008 13:01]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"kdx"="C:\Program Files\Kontiki\KHost.exe" [23/04/2007 12:23]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [21/05/2007 23:13]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [13/10/2004 17:24]
"cjqlmshf"="C:\WINDOWS\system32\olyxedmj.exe" [15/04/2008 12:25]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Nokia.PCSync"=C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"=1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\Run]
"b6BT4NQEsK"=C:\Documents and Settings\All Users\Application Data\qjcrohyr\ktkfmdql.exe

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
Source= file:///C:\WINDOWS\privacy_danger\index.htm
FriendlyName= Privacy Protection

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{C3E15DFE-D990-4C3F-9BE2-4CF4E3E007CE}"= C:\WINDOWS\system32\byXPGXNf.dll [13/04/2008 04:04 37888]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"dsktbwfe"= {263D7CED-2310-483A-8DD0-1AD3DDA7915D} - C:\WINDOWS\dsktbwfe.dll [13/04/2008 00:07 217088]
"ogxtsepr"= {7D700DEC-2E6C-41DF-8904-587DA3E6C0F1} - C:\WINDOWS\ogxtsepr.dll [13/04/2008 00:07 167936]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"System"="kdspz.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\byXPGXNf]
byXPGXNf.dll 13/04/2008 04:04 37888 C:\WINDOWS\system32\byXPGXNf.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\system32\urqPiGVM

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs BthServ
p2psvc p2psvc p2pimsvc p2pgasvc PNRPSvc

*Newly Created Service* - COMHOST

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44AA3114-D221-43EC-1C32-1EAC52A2014D}]
C:\WINDOWS\system32\msnvl.exe



-- End of Deckard's System Scanner: finished at 2008-04-15 13:36:19 ------------

EXTRA.TXT

Deckard's System Scanner v20071014.68
Extra logfile - please post this as an attachment with your post.
--------------------------------------------------------------------------------

-- System Information ----------------------------------------------------------

Microsoft Windows XP Home Edition (build 2600) SP 2.0
Architecture: X86; Language: English

CPU 0: Intel® Pentium® 4 CPU 2.80GHz
Percentage of Memory in Use: 62%
Physical Memory (total/avail): 502.98 MiB / 191.05 MiB
Pagefile Memory (total/avail): 845.83 MiB / 371.73 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1920.03 MiB

A: is Removable (No Media)
C: is Fixed (NTFS) - 37.31 GiB total, 5.94 GiB free.
D: is CDROM (No Media)

\\.\PHYSICALDRIVE0 - SAMSUNG SP0411N - 37.31 GiB - 1 partition
\PARTITION0 (bootable) - Installable File System - 37.31 GiB - C:



-- Security Center -------------------------------------------------------------

AUOptions is scheduled to auto-install.
Windows Internal Firewall is disabled.

FirstRunDisabled is set.

FW: Norton Internet Security v2007 (Symantec Corporation)
AV: Norton Internet Security v2007 (Symantec Corporation) Disabled

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\\Program Files\\Macromedia\\Dreamweaver MX 2004\\Dreamweaver.exe"="C:\\Program Files\\Macromedia\\Dreamweaver MX 2004\\Dreamweaver.exe:*:Enabled:Dreamweaver MX 2004"
"C:\\Documents and Settings\\Richard\\Local Settings\\Temp\\Temporary Directory 3 for S722.ZIP\\sin.exe"="C:\\Documents and Settings\\Richard\\Local Settings\\Temp\\Temporary Directory 3 for S722.ZIP\\sin.exe:*:Disabled:System Tray Aplet"
"C:\\Documents and Settings\\Richard\\Local Settings\\Temp\\Temporary Directory 8 for S722.ZIP\\sin.exe"="C:\\Documents and Settings\\Richard\\Local Settings\\Temp\\Temporary Directory 8 for S722.ZIP\\sin.exe:*:Disabled:System Tray Aplet"
"C:\\Program Files\\Global Star Software\\Airport Tycoon 3\\at3.exe"="C:\\Program Files\\Global Star Software\\Airport Tycoon 3\\at3.exe:*:Disabled:at3"
"C:\\Documents and Settings\\Richard\\Local Settings\\Temp\\Temporary Directory 1 for skream23.zip\\plisten.exe"="C:\\Documents and Settings\\Richard\\Local Settings\\Temp\\Temporary Directory 1 for skream23.zip\\plisten.exe:*:Disabled:plisten"
"C:\\WINDOWS\\system32\\sessmgr.exe"="C:\\WINDOWS\\system32\\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019"
"C:\\Documents and Settings\\Richard\\Local Settings\\Temp\\Temporary Directory 1 for ipmonitor.zip\\Port Monitor v.1.1.exe"="C:\\Documents and Settings\\Richard\\Local Settings\\Temp\\Temporary Directory 1 for ipmonitor.zip\\Port Monitor v.1.1.exe:*:Disabled:Internet Protection"
"C:\\Program Files\\Real\\RealPlayer\\realplay.exe"="C:\\Program Files\\Real\\RealPlayer\\realplay.exe:*:Disabled:RealPlayer"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Disabled:Windows Messenger"
"C:\\WINDOWS\\system32\\rtcshare.exe"="C:\\WINDOWS\\system32\\rtcshare.exe:*:Enabled:RTC App Sharing"
"C:\\Program Files\\NetMeeting\\conf.exe"="C:\\Program Files\\NetMeeting\\conf.exe:*:Disabled:Windows® NetMeeting®"
"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"="C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE:*:Enabled:Internet Explorer"
"C:\\Program Files\\Common Files\\PocketSoft\\RTPatch\\AutoRTP\\artpschd.exe"="C:\\Program Files\\Common Files\\PocketSoft\\RTPatch\\AutoRTP\\artpschd.exe:*:Enabled:artpschd"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Apache Group\\Apache2\\bin\\Apache.exe"="C:\\Program Files\\Apache Group\\Apache2\\bin\\Apache.exe:*:Enabled:Apache HTTP Server"
"C:\\Program Files\\uTorrent\\utorrent.exe"="C:\\Program Files\\uTorrent\\utorrent.exe:*:Enabled:µTorrent"
"C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"="C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe:*:Enabled:Remote Assistance - Windows Messenger and Voice"
"C:\\Program Files\\Ares\\Ares.exe"="C:\\Program Files\\Ares\\Ares.exe:*:Enabled:Ares"
"C:\\Program Files\\SopCast\\SopCast.exe"="C:\\Program Files\\SopCast\\SopCast.exe:*:Enabled:SopCast Main Application"
"C:\\Documents and Settings\\Richard\\Application Data\\SopCast\\adv\\SopAdver.exe"="C:\\Documents and Sett

Edited by richt, 15 April 2008 - 06:57 AM.

[Advertisements]

Welcome to GTG.

Go to http://www.bleepingc...to-use-combofix and follow the instructions on how to install the Recovery Console and run ComboFix. Go through all the steps until posting the log part. Post the combofix log here.

Run a new HijackThis scan and post the new log here.

[greyknight17]

Welcome to GTG.

Go to http://www.bleepingc...to-use-combofix and follow the instructions on how to install the Recovery Console and run ComboFix. Go through all the steps until posting the log part. Post the combofix log here.

Run a new HijackThis scan and post the new log here.

[richt]

Thank you so much for helping me

Here is the combo fix log, I dont think this is the log but its the only thing that popped up from combofix

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

Here is the new Hijackthis log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:36:45, on 16/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Kontiki\KService.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.safenavwe...&...aid=1&pid=0
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: (no name) - {466AADAC-E21A-422D-958C-2B627A22E99A} - (no file)
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Workflow] D:\Workflow.exe
O4 - HKLM\..\Run: [4oD] "C:\Program Files\Kontiki\KHost.exe" -all
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [10ac579d] rundll32.exe "C:\WINDOWS\system32\bqsiipqf.dll",b
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [kdx] C:\Program Files\Kontiki\KHost.exe -all
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe
O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {2AF5BD25-90C5-4EEC-88C5-B44DC2905D8B} (DownloadManager Control) - http://dlm.tools.aka...vex-2.2.0.8.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.syma...bin/AvSniff.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg...l_v1-0-3-48.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by102fd.bay10...es/MsnPUpld.cab
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebo...toUploader3.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitd...can8/oscan8.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.safe...wlscbase969.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.syma...n/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1155651804203
O16 - DPF: {AF2E62B6-F9E1-4D4F-A10A-9DC8E6DCBCC0} - http://update.videoe...ggPublisher.exe
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zon...nt.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.m...ash/swflash.cab
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: KService - Kontiki Inc. - C:\Program Files\Kontiki\KService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O24 - Desktop Component 0: Privacy Protection - file:///C:\WINDOWS\privacy_danger\index.htm

--
End of file - 11228 bytes

Edited by richt, 16 April 2008 - 10:42 AM.

[greyknight17]

Double click on the Combofix.exe tool on your desktop to run it. Follow the instructions on screen and post the log here when it's completed...

Post another new HijackThis log after the Combofix tool finished running.

[richt]

Thank you.

Here is the combo fix log

ComboFix 08-04-15.5 - Richard 2008-04-16 18:07:23.1 - NTFSx86
Running from: C:\Documents and Settings\Richard.RICHARD\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Richard.RICHARD\Desktopvirii
C:\Documents and Settings\Richard\Desktop\Error Cleaner.url
C:\Documents and Settings\Richard\Desktop\Privacy Protector.url
C:\Documents and Settings\Richard\Desktop\Spyware&Malware Protection.url
C:\Documents and Settings\Richard\Favorites\Error Cleaner.url
C:\Documents and Settings\Richard\Favorites\Privacy Protector.url
C:\Documents and Settings\Richard\Favorites\Spyware&Malware Protection.url
C:\Program Files\download plugin
C:\Program Files\Inet Delivery
C:\Program Files\Inet Delivery\inetdl.exe
C:\Program Files\PC-Cleaner
C:\Program Files\PC-Cleaner\com\pcsd.dll
C:\Program Files\PC-Cleaner\PC-Cleaner.db
C:\Program Files\PC-Cleaner\pccleaner.pkg
C:\Program Files\PC-Cleaner\program.info
C:\Program Files\winupdates
C:\WINDOWS\a.bat
C:\WINDOWS\base64.tmp
C:\WINDOWS\bdn.com
C:\WINDOWS\cookies.ini
C:\WINDOWS\FVProtect.exe
C:\WINDOWS\iTunesMusic.exe
C:\WINDOWS\mslagent
C:\WINDOWS\mslagent\2_mslagent.dll
C:\WINDOWS\mslagent\mslagent.exe
C:\WINDOWS\mslagent\uninstall.exe
C:\WINDOWS\mssecu.exe
C:\WINDOWS\system32\aofteene.ini
C:\WINDOWS\system32\ewixoysj.ini
C:\WINDOWS\system32\install.exe
C:\WINDOWS\system32\MVGiPqru.ini
C:\WINDOWS\system32\MVGiPqru.ini2
C:\WINDOWS\system32\NqBKkUvw.ini
C:\WINDOWS\system32\NqBKkUvw.ini2
C:\WINDOWS\system32\wvUkKBqN.dll
C:\WINDOWS\system32akttzn.exe
C:\WINDOWS\system32anticipator.dll
C:\WINDOWS\system32awtoolb.dll
C:\WINDOWS\system32bdn.com
C:\WINDOWS\system32bsva-egihsg52.exe
C:\WINDOWS\system32dpcproxy.exe
C:\WINDOWS\system32emesx.dll
C:\WINDOWS\system32h@tkeysh@@k.dll
C:\WINDOWS\system32hoproxy.dll
C:\WINDOWS\system32hxiwlgpm.dat
C:\WINDOWS\system32hxiwlgpm.exe
C:\WINDOWS\system32medup012.dll
C:\WINDOWS\system32medup020.dll
C:\WINDOWS\system32msgp.exe
C:\WINDOWS\system32msnbho.dll
C:\WINDOWS\system32mssecu.exe
C:\WINDOWS\system32msvchost.exe
C:\WINDOWS\system32mtr2.exe
C:\WINDOWS\system32mwin32.exe
C:\WINDOWS\system32netode.exe
C:\WINDOWS\system32newsd32.exe
C:\WINDOWS\system32ps1.exe
C:\WINDOWS\system32psof1.exe
C:\WINDOWS\system32psoft1.exe
C:\WINDOWS\system32regc64.dll
C:\WINDOWS\system32regm64.dll
C:\WINDOWS\system32Rundl1.exe
C:\WINDOWS\system32smp
C:\WINDOWS\system32smp\msrc.exe
C:\WINDOWS\system32sncntr.exe
C:\WINDOWS\system32ssurf022.dll
C:\WINDOWS\system32ssvchost.com
C:\WINDOWS\system32ssvchost.exe
C:\WINDOWS\system32sysreq.exe
C:\WINDOWS\system32taack.dat
C:\WINDOWS\system32taack.exe
C:\WINDOWS\system32temp#01.exe
C:\WINDOWS\system32thun.dll
C:\WINDOWS\system32thun32.dll
C:\WINDOWS\system32VBIEWER.OCX
C:\WINDOWS\system32vbsys2.dll
C:\WINDOWS\system32vcatchpi.dll
C:\WINDOWS\system32winlogonpc.exe
C:\WINDOWS\system32winsystem.exe
C:\WINDOWS\system32WINWGPX.EXE
C:\WINDOWS\userconfig9x.dll
C:\WINDOWS\Web\def.htm
C:\WINDOWS\winhelp.ini
C:\WINDOWS\winsystem.exe
C:\WINDOWS\zip1.tmp
C:\WINDOWS\zip2.tmp
C:\WINDOWS\zip3.tmp
C:\WINDOWS\zipped.tmp

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_6TO4
-------\Legacy_IPRIP
-------\Legacy_NPF
-------\Service_6to4
-------\Service_Iprip


((((((((((((((((((((((((( Files Created from 2008-03-16 to 2008-04-16 )))))))))))))))))))))))))))))))
.

2008-04-16 17:15 . 2008-04-16 17:15 <DIR> d-------- C:\Program Files\TVAnts
2008-04-16 17:14 . 2008-04-16 17:15 <DIR> d-------- C:\Program Files\Java
2008-04-16 17:14 . 2008-04-16 17:16 <DIR> d-------- C:\Program Files\FairUse Wizard 2
2008-04-16 17:14 . 2008-04-16 17:15 <DIR> d-------- C:\Program Files\DIGITAL COLOUR ATLAS 3.0
2008-04-16 17:08 . 2008-04-16 17:08 <DIR> d-------- C:\Program Files\RegCure
2008-04-16 12:36 . 2008-04-16 12:36 244 --ah----- C:\sqmnoopt00.sqm
2008-04-16 12:36 . 2008-04-16 12:36 232 --ah----- C:\sqmdata00.sqm
2008-04-16 00:10 . 2008-04-16 00:10 <DIR> d-------- C:\Documents and Settings\Richard.RICHARD\Application Data\Malwarebytes
2008-04-16 00:08 . 2008-04-16 00:08 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-04-16 00:06 . 2008-04-16 00:06 <DIR> d-------- C:\Program Files\Common Files\Download Manager
2008-04-15 23:30 . 2008-04-15 23:30 <DIR> d-------- C:\Program Files\Enigma Software Group
2008-04-15 20:16 . 2008-04-16 14:58 990 ---hs---- C:\WINDOWS\system32\fqpiisqb.ini
2008-04-15 20:14 . 2008-04-15 23:09 <DIR> d-------- C:\WINDOWS\BDOSCAN8
2008-04-15 14:42 . 2008-04-15 14:42 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\SUPERAntiSpyware.com
2008-04-15 14:26 . 2008-04-15 14:26 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-04-15 14:25 . 2008-04-16 18:08 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2008-04-15 14:25 . 2008-04-16 18:11 <DIR> d-------- C:\Documents and Settings\Richard.RICHARD\Application Data\SUPERAntiSpyware.com
2008-04-15 12:54 . 2008-04-15 12:54 <DIR> d-------- C:\Documents and Settings\Richard.RICHARD\Application Data\DivX
2008-04-15 12:09 . 2008-04-16 14:48 2,396 --a------ C:\WINDOWS\system32\tmp.reg
2008-04-15 12:08 . 2008-04-14 19:28 86,528 --a------ C:\WINDOWS\system32\VACFix.exe
2008-04-15 12:08 . 2008-04-12 13:49 82,432 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-04-15 11:27 . 2008-04-15 11:27 <DIR> d-------- C:\Documents and Settings\Richard.RICHARD\Complete
2008-04-15 11:27 . 2008-04-15 11:27 <DIR> d-------- C:\Documents and Settings\Richard.RICHARD\.limewire
2008-04-15 11:26 . 2008-04-15 11:26 <DIR> d-------- C:\Documents and Settings\Richard.RICHARD\Phone Browser
2008-04-15 11:26 . 2008-04-15 11:27 <DIR> d-------- C:\Documents and Settings\Richard.RICHARD\Contacts
2008-04-15 10:35 . 2008-04-15 10:35 <DIR> d-------- C:\Documents and Settings\Richard.RICHARD\Application Data\TmpRecentIcons
2008-04-15 10:29 . 2008-04-16 18:26 <DIR> d-------- C:\Documents and Settings\Richard.RICHARD
2008-04-14 15:57 . 2008-04-14 15:57 <DIR> d-------- C:\_OTMoveIt
2008-04-14 15:28 . 2008-04-14 15:28 <DIR> d-------- C:\Deckard
2008-04-14 15:20 . 2008-04-14 15:22 <DIR> d-------- C:\Documents and Settings\Richard\Application Data\PC-Cleaner
2008-04-14 15:14 . 2008-04-14 15:14 <DIR> d-------- C:\Program Files\Trend Micro
2008-04-14 13:57 . 2008-04-15 23:26 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-04-14 13:55 . 2008-04-14 13:55 <DIR> d-------- C:\Program Files\Yahoo!
2008-04-14 13:25 . 2008-04-14 13:25 <DIR> d-------- C:\Documents and Settings\Richard\Application Data\Uniblue
2008-04-13 21:10 . 2008-04-13 21:10 <DIR> d-------- C:\Documents and Settings\Richard\Application Data\DivX
2008-04-13 19:14 . 2008-04-13 19:52 <DIR> d-------- C:\Program Files\Norton Internet Security
2008-04-13 19:11 . 2008-04-13 19:41 123,952 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2008-04-13 19:11 . 2008-04-13 19:41 60,800 --a------ C:\WINDOWS\system32\S32EVNT1.DLL
2008-04-13 19:08 . 2008-04-13 19:41 <DIR> d-------- C:\Program Files\Symantec
2008-04-13 18:44 . 2008-04-13 18:44 <DIR> d-------- C:\Program Files\Norton AntiVirus
2008-04-13 17:48 . 2008-04-14 15:28 <DIR> d-------- C:\Documents and Settings\Richard\Application Data\TmpRecentIcons
2008-04-13 17:43 . 2008-04-13 17:43 <DIR> d-------- C:\Program Files\ArcSoft
2008-04-13 16:49 . 2008-04-13 17:42 <DIR> d-------- C:\WINDOWS\privacy_danger(2)
2008-04-13 15:19 . 2008-04-13 15:19 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\PC Tools
2008-04-13 15:13 . 2008-04-13 15:13 <DIR> d-------- C:\Program Files\Windows Sidebar
2008-04-13 14:13 . 2008-04-13 19:41 10,740 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2008-04-13 14:13 . 2008-04-13 19:41 805 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.INF
2008-04-13 04:04 . 2008-04-16 16:54 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\qjcrohyr
2008-04-13 00:33 . 2008-04-13 00:35 <DIR> d-------- C:\divx
2008-04-13 00:27 . 2008-04-13 00:32 <DIR> d-------- C:\Program Files\DivX
2008-04-13 00:27 . 2008-04-13 00:27 <DIR> d-------- C:\Documents and Settings\Richard\Application Data\LG Electronics
2008-04-12 23:36 . 2004-08-03 23:10 38,016 --a------ C:\WINDOWS\system32\drivers\bthmodem.sys
2008-04-12 23:36 . 2004-08-03 23:10 38,016 --a--c--- C:\WINDOWS\system32\dllcache\bthmodem.sys
2008-04-12 22:30 . 2008-04-12 22:30 <DIR> d-------- C:\Program Files\LG Electronics
2008-04-12 22:30 . 2007-07-11 10:45 21,632 --a------ C:\WINDOWS\system32\drivers\lgusbmodem.sys
2008-04-12 22:30 . 2007-07-11 15:51 19,840 --a------ C:\WINDOWS\system32\drivers\lgusbdiag.sys
2008-04-12 22:30 . 2007-07-11 10:40 12,416 --a------ C:\WINDOWS\system32\drivers\lgusbbus.sys
2008-04-03 13:46 . 2008-04-03 13:46 <DIR> d-------- C:\Documents and Settings\Richard\Application Data\Talkback
2008-04-03 13:01 . 2008-04-03 13:01 <DIR> d-------- C:\Program Files\Common Files\xing shared
2008-03-31 22:25 . 2008-03-31 22:25 831,488 --a------ C:\WINDOWS\system32\divx_xx0a.dll
2008-03-31 22:25 . 2008-03-31 22:25 823,296 --a------ C:\WINDOWS\system32\divx_xx0c.dll
2008-03-31 22:25 . 2008-03-31 22:25 823,296 --a------ C:\WINDOWS\system32\divx_xx07.dll
2008-03-31 22:25 . 2008-03-31 22:25 802,816 --a------ C:\WINDOWS\system32\divx_xx11.dll
2008-03-31 22:25 . 2008-03-31 22:25 682,496 --a------ C:\WINDOWS\system32\DivX.dll
2008-03-31 22:25 . 2008-03-31 22:25 161,096 --a------ C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-03-30 20:33 . 2008-04-06 16:34 <DIR> d-------- C:\Program Files\Optic Limited
2008-03-25 20:27 . 2008-03-28 15:56 <DIR> d-------- C:\Program Files\PartyGaming.Net
2008-03-24 20:45 . 2008-03-24 20:45 630,784 --a------ C:\WINDOWS\system32\divxdec.ax
2008-03-22 00:17 . 2008-03-22 00:17 <DIR> d-------- C:\Program Files\BeloSoft
2008-03-21 21:30 . 2008-03-21 21:30 3,596,288 --a------ C:\WINDOWS\system32\qt-dx331.dll
2008-03-21 21:30 . 2008-03-21 21:30 1,044,480 --a------ C:\WINDOWS\system32\libdivx.dll
2008-03-21 21:30 . 2008-03-21 21:30 524,288 --a------ C:\WINDOWS\system32\DivXsm.exe
2008-03-21 21:30 . 2008-03-21 21:30 200,704 --a------ C:\WINDOWS\system32\ssldivx.dll
2008-03-21 21:30 . 2008-03-21 21:30 4,816 --a------ C:\WINDOWS\system32\divxsm.tlb

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-16 17:26 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kontiki
2008-04-16 17:24 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-04-16 17:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-04-16 16:59 --------- d-----w C:\Program Files\Google
2008-04-16 12:48 --------- d-----w C:\Program Files\VirtualDJ
2008-04-16 11:31 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-04-15 22:26 --------- d-----w C:\Program Files\Lavasoft
2008-04-15 21:08 --------- d-----w C:\Program Files\Common Files\Oem Common
2008-04-13 16:43 --------- d-----w C:\Program Files\TomTom HOME 2
2008-04-13 14:28 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-03 12:01 --------- d-----w C:\Program Files\Common Files\Real
2008-03-28 20:54 --------- d-----w C:\Program Files\MSN Messenger
2008-03-28 20:54 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-03-12 19:51 --------- d-----w C:\Documents and Settings\Richard\Application Data\SopCast
2008-03-05 18:06 --------- d-----w C:\Program Files\Windows Live
2008-03-05 18:04 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-02-25 17:24 --------- d-----w C:\Documents and Settings\Richard\Application Data\TomTom
2008-02-25 17:24 --------- d-----w C:\Documents and Settings\All Users\Application Data\TomTom
2008-02-25 17:18 --------- d-----w C:\Program Files\TomTom DesktopSuite
2008-02-21 20:04 --------- d-----w C:\Documents and Settings\Richard\Application Data\TVU Networks
2008-02-21 20:04 --------- d-----w C:\Documents and Settings\All Users\Application Data\TVU Networks
2008-01-14 15:05 41,168 -c--a-w C:\Documents and Settings\Richard\Application Data\GDIPFONTCACHEV1.DAT
2007-03-08 15:54 77,456 -c--a-w C:\Documents and Settings\Richard\TB2Categories000.dat
2006-11-14 12:03 20 ---h--w C:\Documents and Settings\All Users\Application Data\PKP_DLec.DAT
2001-05-10 09:04 162,304 -c----w C:\Program Files\UNWISE.EXE
2007-10-09 14:47 1,031 --sh--w C:\WINDOWS\system\ws32ntfl.dat
2002-04-16 10:27 5 --sha-w C:\WINDOWS\system32\CdI5T.drv
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"kdx"="C:\Program Files\Kontiki\KHost.exe" [2007-04-23 12:23 1032640]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 12:34 5724184]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-04-16 12:40 68856]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 13:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Workflow"="D:\Workflow.exe" [ ]
"4oD"="C:\Program Files\Kontiki\KHost.exe" [2007-04-23 12:23 1032640]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-09-03 08:04 84640]
"osCheck"="C:\Program Files\Norton Internet Security\osCheck.exe" [2006-09-06 02:22 26248]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 17:38 583048]
"10ac579d"="C:\WINDOWS\system32\bqsiipqf.dll" [ ]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-04-03 13:01 185896]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 13:00 15360]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 10:17 1241088]

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
Source= file:///C:\WINDOWS\privacy_danger\index.htm
FriendlyName= Privacy Protection

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\Macromedia\\Dreamweaver MX 2004\\Dreamweaver.exe"=
"C:\\WINDOWS\\system32\\sessmgr.exe"=
"C:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"C:\\WINDOWS\\system32\\rtcshare.exe"=
"C:\\Program Files\\NetMeeting\\conf.exe"=
"C:\\Program Files\\Common Files\\PocketSoft\\RTPatch\\AutoRTP\\artpschd.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
"C:\\Program Files\\Ares\\Ares.exe"=
"C:\\Program Files\\Kontiki\\KService.exe"=
"C:\\Program Files\\Sports Interactive\\Football Manager 2008\\fm.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3587:TCP"= 3587:TCP:Windows Peer-to-Peer Grouping
"3540:UDP"= 3540:UDP:Peer Name Resolution Protocol (PNRP)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R3 AN983;ADMtek AN983/AN985/ADM951X 10/100Mbps Fast Ethernet Adapter;C:\WINDOWS\system32\DRIVERS\AN983.sys [2005-01-13 09:28]
S3 p2pgasvc;Peer Networking Group Authentication;C:\WINDOWS\system32\svchost.exe [2004-08-04 13:00]
S3 p2pimsvc;Peer Networking Identity Manager;C:\WINDOWS\system32\svchost.exe [2004-08-04 13:00]
S3 p2psvc;Peer Networking;C:\WINDOWS\system32\svchost.exe [2004-08-04 13:00]
S3 PNRPSvc;Peer Name Resolution Protocol;C:\WINDOWS\system32\svchost.exe [2004-08-04 13:00]
S3 ZxPacket;Zx Packet driver;C:\Documents and Settings\Richard\Desktop\ZxSniffer\ZxPacket.sys []

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc

*Newly Created Service* - COMHOST

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44AA3114-D221-43EC-1C32-1EAC52A2014D}]
C:\WINDOWS\system32\msnvl.exe
.
Contents of the 'Scheduled Tasks' folder
"2008-04-16 16:10:01 C:\WINDOWS\Tasks\HP Usg Daily.job"
- C:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\pexpress\hphped05.exe
"2008-04-14 02:34:56 C:\WINDOWS\Tasks\Norton Internet Security - Run Full System Scan - Richard.job"
- C:\PROGRA~1\NORTON~2\NORTON~1\Navw32.exeh/TASK:
"2008-04-16 17:28:35 C:\WINDOWS\Tasks\RegCure Program Check.job"
- C:\Program Files\RegCure\RegCure.exe
"2008-04-16 16:08:50 C:\WINDOWS\Tasks\RegCure.job"
- C:\Program Files\RegCure\RegCure.exe
.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-16 18:29:25
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Kontiki\KService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\wdfmgr.exe
.
**************************************************************************
.
Completion time: 2008-04-16 18:44:38 - machine was rebooted
ComboFix-quarantined-files.txt 2008-04-16 17:44:28

Pre-Run: 1,513,345,024 bytes free
Post-Run: 1,470,734,336 bytes free
.
2008-04-12 02:09:26 --- E O F ---


And the Hijack This Log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:45:32, on 16/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Kontiki\KService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.safenavwe...&...aid=1&pid=0
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: (no name) - {466AADAC-E21A-422D-958C-2B627A22E99A} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Workflow] D:\Workflow.exe
O4 - HKLM\..\Run: [4oD] "C:\Program Files\Kontiki\KHost.exe" -all
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [10ac579d] rundll32.exe "C:\WINDOWS\system32\bqsiipqf.dll",b
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [kdx] C:\Program Files\Kontiki\KHost.exe -all
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe
O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {2AF5BD25-90C5-4EEC-88C5-B44DC2905D8B} (DownloadManager Control) - http://dlm.tools.aka...vex-2.2.0.8.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.syma...bin/AvSniff.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg...l_v1-0-3-48.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by102fd.bay10...es/MsnPUpld.cab
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebo...toUploader3.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitd...can8/oscan8.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.safe...wlscbase969.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.syma...n/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1155651804203
O16 - DPF: {AF2E62B6-F9E1-4D4F-A10A-9DC8E6DCBCC0} - http://update.videoe...ggPublisher.exe
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zon...nt.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.m...ash/swflash.cab
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: KService - Kontiki Inc. - C:\Program Files\Kontiki\KService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O24 - Desktop Component 0: Privacy Protection - file:///C:\WINDOWS\privacy_danger\index.htm

--
End of file - 12198 bytes

[greyknight17]

Please print the below instructions or copy them to Notepad. Make sure to work through the fixes in the order mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes.

Uninstall the following via the Add/Remove Panel (Start->Settings->Control Panel->Add/Remove Programs) if found:

Kontiki
PC-Cleaner

Run a scan in HijackThis. Check each of the following if they still exist and hit 'Fix Checked' after you checked the last one:

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.safenavwe...&...aid=1&pid=0
O3 - Toolbar: (no name) - {466AADAC-E21A-422D-958C-2B627A22E99A} - (no file)
O23 - Service: KService - Kontiki Inc. - C:\Program Files\Kontiki\KService.exe

Open up your Notepad editor (Start->Run, type in notepad and click OK). Copy and paste the text into the quotebox below:

File::
C:\WINDOWS\system32\fqpiisqb.ini
C:\WINDOWS\system32\bqsiipqf.dll
C:\WINDOWS\system32\bqsiipqf.dll
C:\WINDOWS\system32\msnvl.exe

Folder::
C:\Documents and Settings\Richard\Application Data\PC-Cleaner
C:\Documents and Settings\Richard\Application Data\TmpRecentIcons
C:\WINDOWS\privacy_danger(2)
C:\Program Files\Kontiki\
C:\WINDOWS\privacy_danger\
C:\Documents and Settings\All Users\Application Data\qjcrohyr
C:\Documents and Settings\All Users\Application Data\Kontiki
C:\Program Files\Kontiki\

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"kdx"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"4oD"=-
"10ac579d"=-
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"FriendlyName"="My Current Home Page"
[-HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44AA3114-D221-43EC-1C32-1EAC52A2014D}]

Save this as CFScript.txt in the same location as the ComboFix.exe tool.
Drag the CFScript.txt into ComboFix.exe
Follow the prompts. When finished, it shall produce a log for you. Post that log in your next reply.

Note: Do not click on combofix's window while it's running. That may cause it to stall.

Post a new HijackThis log here also.

[richt]

log.txt

ComboFix 08-04-15.5 - Richard 2008-04-16 20:00:25.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.235 [GMT 1:00]
Running from: C:\Documents and Settings\Richard.RICHARD\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Richard.RICHARD\Desktop\CFScript.txt
* Created a new restore point

FILE ::
C:\WINDOWS\system32\bqsiipqf.dll
C:\WINDOWS\system32\fqpiisqb.ini
C:\WINDOWS\system32\msnvl.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\Kontiki\error.log
C:\Documents and Settings\All Users\Application Data\Kontiki\error2.log
C:\Documents and Settings\All Users\Application Data\Kontiki\zdata.db
C:\Documents and Settings\All Users\Application Data\qjcrohyr
C:\Documents and Settings\Richard\Application Data\PC-Cleaner
C:\Documents and Settings\Richard\Application Data\PC-Cleaner\log.dat
C:\Documents and Settings\Richard\Application Data\PC-Cleaner\settings.dat
C:\Documents and Settings\Richard\Application Data\TmpRecentIcons
C:\Documents and Settings\Richard\Application Data\TmpRecentIcons\HijackThis.lnk
C:\Documents and Settings\Richard\Application Data\TmpRecentIcons\PC-Cleaner.lnk
C:\Program Files\Kontiki\
C:\Program Files\Kontiki\\4od1\cache\4od.css
C:\Program Files\Kontiki\\4od1\cache\4od.gif
C:\Program Files\Kontiki\\4od1\cache\4od.js
C:\Program Files\Kontiki\\4od1\cache\4od.swf
C:\Program Files\Kontiki\\4od1\cache\4od_button.css
C:\Program Files\Kontiki\\4od1\cache\4od_event.js
C:\Program Files\Kontiki\\4od1\cache\4od_html_launch_offline.css
C:\Program Files\Kontiki\\4od1\cache\4od_html_launch_offline.js
C:\Program Files\Kontiki\\4od1\cache\4od_html_offline.css
C:\Program Files\Kontiki\\4od1\cache\4od_html_offline.js
C:\Program Files\Kontiki\\4od1\cache\4od_html_player_offline.css
C:\Program Files\Kontiki\\4od1\cache\4od_html_player_offline.js
C:\Program Files\Kontiki\\4od1\cache\4od_tooltip.css
C:\Program Files\Kontiki\\4od1\cache\4od_tooltip.js
C:\Program Files\Kontiki\\4od1\cache\4odmedium.swf
C:\Program Files\Kontiki\\4od1\cache\button_continue.png
C:\Program Files\Kontiki\\4od1\cache\button_delete_selected.png
C:\Program Files\Kontiki\\4od1\cache\button_launch_4oD.png
C:\Program Files\Kontiki\\4od1\cache\button_view_my_downloads.png
C:\Program Files\Kontiki\\4od1\cache\c4_background.jpg
C:\Program Files\Kontiki\\4od1\cache\c4_btn_dlg.gif
C:\Program Files\Kontiki\\4od1\cache\c4_button-close.gif
C:\Program Files\Kontiki\\4od1\cache\c4_button-continue.gif
C:\Program Files\Kontiki\\4od1\cache\c4_button-downloads.gif
C:\Program Files\Kontiki\\4od1\cache\c4_complete.html
C:\Program Files\Kontiki\\4od1\cache\c4_eventDefault.html
C:\Program Files\Kontiki\\4od1\cache\c4_grass.jpg
C:\Program Files\Kontiki\\4od1\cache\c4_home.html
C:\Program Files\Kontiki\\4od1\cache\c4_kdx.js
C:\Program Files\Kontiki\\4od1\cache\c4_kdx_init.js
C:\Program Files\Kontiki\\4od1\cache\c4_kdx_playing.js
C:\Program Files\Kontiki\\4od1\cache\c4_kdx_sweep.js
C:\Program Files\Kontiki\\4od1\cache\c4_kdx_util.js
C:\Program Files\Kontiki\\4od1\cache\c4_lowdiskspace.html
C:\Program Files\Kontiki\\4od1\cache\c4_menuTray.html
C:\Program Files\Kontiki\\4od1\cache\c4_offline.html
C:\Program Files\Kontiki\\4od1\cache\c4_popuplogo.gif
C:\Program Files\Kontiki\\4od1\cache\c4_profileTemplate.html
C:\Program Files\Kontiki\\4od1\cache\c4_script.js
C:\Program Files\Kontiki\\4od1\cache\c4_spacer.gif
C:\Program Files\Kontiki\\4od1\cache\c4_styles.css
C:\Program Files\Kontiki\\4od1\cache\c4_tray0.ico
C:\Program Files\Kontiki\\4od1\cache\c4_tray1.ico
C:\Program Files\Kontiki\\4od1\cache\c4_tray2.ico
C:\Program Files\Kontiki\\4od1\cache\c4player.html
C:\Program Files\Kontiki\\4od1\cache\c4player.js
C:\Program Files\Kontiki\\4od1\cache\config.xml
C:\Program Files\Kontiki\\4od1\cache\ie_6_4od.css
C:\Program Files\Kontiki\\4od1\cache\ie_6_4od_button.css
C:\Program Files\Kontiki\\4od1\cache\ie_6_4od_html_launch_offline.css
C:\Program Files\Kontiki\\4od1\cache\ie_6_4od_html_offline.css
C:\Program Files\Kontiki\\4od1\cache\ie_6_4od_html_player_offline.css
C:\Program Files\Kontiki\\4od1\cache\ie_6_4od_tooltip.css
C:\Program Files\Kontiki\\4od1\cache\ie_6_launch_list.gif
C:\Program Files\Kontiki\\4od1\cache\ie_7_4od.css
C:\Program Files\Kontiki\\4od1\cache\ie_7_4od_button.css
C:\Program Files\Kontiki\\4od1\cache\ie_7_4od_html_launch_offline.css
C:\Program Files\Kontiki\\4od1\cache\ie_7_4od_html_offline.css
C:\Program Files\Kontiki\\4od1\cache\ie_7_4od_html_player_offline.css
C:\Program Files\Kontiki\\4od1\cache\ie_7_4od_tooltip.css
C:\Program Files\Kontiki\\4od1\cache\launch.vod-body.headline.b.gif
C:\Program Files\Kontiki\\4od1\cache\launch.vod-body.headline.t.gif
C:\Program Files\Kontiki\\4od1\cache\launch_list.gif
C:\Program Files\Kontiki\\4od1\cache\launch_player.png
C:\Program Files\Kontiki\\4od1\cache\myDownloads.html
C:\Program Files\Kontiki\\4od1\cache\player.js
C:\Program Files\Kontiki\\4od1\cache\player_help.gif
C:\Program Files\Kontiki\\4od1\cache\player01.gif
C:\Program Files\Kontiki\\4od1\cache\player02.gif
C:\Program Files\Kontiki\\4od1\cache\player03.gif
C:\Program Files\Kontiki\\4od1\cache\png.gif
C:\Program Files\Kontiki\\4od1\cache\question_mark.gif
C:\Program Files\Kontiki\\4od1\cache\rating_g.gif
C:\Program Files\Kontiki\\4od1\cache\right_arrow.png
C:\Program Files\Kontiki\\4od1\cache\status_launch_player.png
C:\Program Files\Kontiki\\4od1\cache\status_pay_and_play.png
C:\Program Files\Kontiki\\4od1\cache\status_play.png
C:\Program Files\Kontiki\\4od1\cache\status_ready_to_play.png
C:\Program Files\Kontiki\\4od1\cache\tooltip_question_mark.gif
C:\Program Files\Kontiki\\4od1\cache\vod_body_arrow_b_d.gif
C:\Program Files\Kontiki\\4od1\cache\vod_body_arrow_b_d.png
C:\Program Files\Kontiki\\4od1\cache\vod_body_arrow_b_r.gif
C:\Program Files\Kontiki\\4od1\cache\vod_body_arrow_b_r.png
C:\Program Files\Kontiki\\4od1\cache\vod_body_device.gif
C:\Program Files\Kontiki\\4od1\cache\vod_body_headline_b.gif
C:\Program Files\Kontiki\\4od1\cache\vod_body_headline_t.gif
C:\Program Files\Kontiki\\4od1\cache\vod_head_4od_offline.gif
C:\Program Files\Kontiki\\4od1\cache\vod_head_arrow_b_d.gif
C:\Program Files\Kontiki\\4od1\cache\vod_head_arrow_g_r.gif
C:\Program Files\Kontiki\\4od1\cache\vod_head_my_downloads.gif
C:\Program Files\Kontiki\\4od1\cache\vod_neck_arrow_b_r.gif
C:\Program Files\Kontiki\\4od1\cache\vod_neck_arrow_w_d.gif
C:\Program Files\Kontiki\\4od1\cache\vod_neck_arrow_w_u.gif
C:\Program Files\Kontiki\\4od1\zprefs_db_netman.xml.read
C:\Program Files\Kontiki\\errorlog.cfg
C:\Program Files\Kontiki\\kdx.inf
C:\Program Files\Kontiki\\KHost.exe
C:\Program Files\Kontiki\\KService.exe
C:\WINDOWS\privacy_danger(2)
C:\WINDOWS\privacy_danger(2)\images(2)\danger.jpg
C:\WINDOWS\privacy_danger(2)\images(2)\spacer.gif
C:\WINDOWS\privacy_danger(2)\index.htm
C:\WINDOWS\system32\fqpiisqb.ini

.
((((((((((((((((((((((((( Files Created from 2008-03-16 to 2008-04-16 )))))))))))))))))))))))))))))))
.

2008-04-16 17:15 . 2008-04-16 17:15 <DIR> d-------- C:\Program Files\TVAnts
2008-04-16 17:14 . 2008-04-16 17:15 <DIR> d-------- C:\Program Files\Java
2008-04-16 17:14 . 2008-04-16 17:16 <DIR> d-------- C:\Program Files\FairUse Wizard 2
2008-04-16 17:14 . 2008-04-16 17:15 <DIR> d-------- C:\Program Files\DIGITAL COLOUR ATLAS 3.0
2008-04-16 12:36 . 2008-04-16 12:36 244 --ah----- C:\sqmnoopt00.sqm
2008-04-16 12:36 . 2008-04-16 12:36 232 --ah----- C:\sqmdata00.sqm
2008-04-16 00:10 . 2008-04-16 00:10 <DIR> d-------- C:\Documents and Settings\Richard.RICHARD\Application Data\Malwarebytes
2008-04-16 00:08 . 2008-04-16 00:08 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-04-16 00:06 . 2008-04-16 00:06 <DIR> d-------- C:\Program Files\Common Files\Download Manager
2008-04-15 23:30 . 2008-04-15 23:30 <DIR> d-------- C:\Program Files\Enigma Software Group
2008-04-15 20:14 . 2008-04-15 23:09 <DIR> d-------- C:\WINDOWS\BDOSCAN8
2008-04-15 14:42 . 2008-04-15 14:42 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\SUPERAntiSpyware.com
2008-04-15 14:26 . 2008-04-15 14:26 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-04-15 14:25 . 2008-04-16 18:08 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2008-04-15 14:25 . 2008-04-16 18:11 <DIR> d-------- C:\Documents and Settings\Richard.RICHARD\Application Data\SUPERAntiSpyware.com
2008-04-15 12:54 . 2008-04-15 12:54 <DIR> d-------- C:\Documents and Settings\Richard.RICHARD\Application Data\DivX
2008-04-15 12:09 . 2008-04-16 14:48 2,396 --a------ C:\WINDOWS\system32\tmp.reg
2008-04-15 12:08 . 2008-04-14 19:28 86,528 --a------ C:\WINDOWS\system32\VACFix.exe
2008-04-15 12:08 . 2008-04-12 13:49 82,432 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-04-15 11:27 . 2008-04-15 11:27 <DIR> d-------- C:\Documents and Settings\Richard.RICHARD\Complete
2008-04-15 11:27 . 2008-04-15 11:27 <DIR> d-------- C:\Documents and Settings\Richard.RICHARD\.limewire
2008-04-15 11:26 . 2008-04-15 11:26 <DIR> d-------- C:\Documents and Settings\Richard.RICHARD\Phone Browser
2008-04-15 11:26 . 2008-04-15 11:27 <DIR> d-------- C:\Documents and Settings\Richard.RICHARD\Contacts
2008-04-15 10:35 . 2008-04-15 10:35 <DIR> d-------- C:\Documents and Settings\Richard.RICHARD\Application Data\TmpRecentIcons
2008-04-15 10:29 . 2008-04-16 18:26 <DIR> d-------- C:\Documents and Settings\Richard.RICHARD
2008-04-14 15:57 . 2008-04-14 15:57 <DIR> d-------- C:\_OTMoveIt
2008-04-14 15:28 . 2008-04-14 15:28 <DIR> d-------- C:\Deckard
2008-04-14 15:14 . 2008-04-14 15:14 <DIR> d-------- C:\Program Files\Trend Micro
2008-04-14 13:57 . 2008-04-15 23:26 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-04-14 13:55 . 2008-04-14 13:55 <DIR> d-------- C:\Program Files\Yahoo!
2008-04-14 13:25 . 2008-04-14 13:25 <DIR> d-------- C:\Documents and Settings\Richard\Application Data\Uniblue
2008-04-13 21:10 . 2008-04-13 21:10 <DIR> d-------- C:\Documents and Settings\Richard\Application Data\DivX
2008-04-13 19:14 . 2008-04-13 19:52 <DIR> d-------- C:\Program Files\Norton Internet Security
2008-04-13 19:11 . 2008-04-13 19:41 123,952 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2008-04-13 19:11 . 2008-04-13 19:41 60,800 --a------ C:\WINDOWS\system32\S32EVNT1.DLL
2008-04-13 19:08 . 2008-04-13 19:41 <DIR> d-------- C:\Program Files\Symantec
2008-04-13 18:44 . 2008-04-13 18:44 <DIR> d-------- C:\Program Files\Norton AntiVirus
2008-04-13 17:43 . 2008-04-13 17:43 <DIR> d-------- C:\Program Files\ArcSoft
2008-04-13 15:19 . 2008-04-13 15:19 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\PC Tools
2008-04-13 15:13 . 2008-04-13 15:13 <DIR> d-------- C:\Program Files\Windows Sidebar
2008-04-13 14:13 . 2008-04-13 19:41 10,740 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2008-04-13 14:13 . 2008-04-13 19:41 805 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.INF
2008-04-13 00:33 . 2008-04-13 00:35 <DIR> d-------- C:\divx
2008-04-13 00:27 . 2008-04-13 00:32 <DIR> d-------- C:\Program Files\DivX
2008-04-13 00:27 . 2008-04-13 00:27 <DIR> d-------- C:\Documents and Settings\Richard\Application Data\LG Electronics
2008-04-12 23:36 . 2004-08-03 23:10 38,016 --a------ C:\WINDOWS\system32\drivers\bthmodem.sys
2008-04-12 23:36 . 2004-08-03 23:10 38,016 --a--c--- C:\WINDOWS\system32\dllcache\bthmodem.sys
2008-04-12 22:30 . 2008-04-12 22:30 <DIR> d-------- C:\Program Files\LG Electronics
2008-04-12 22:30 . 2007-07-11 10:45 21,632 --a------ C:\WINDOWS\system32\drivers\lgusbmodem.sys
2008-04-12 22:30 . 2007-07-11 15:51 19,840 --a------ C:\WINDOWS\system32\drivers\lgusbdiag.sys
2008-04-12 22:30 . 2007-07-11 10:40 12,416 --a------ C:\WINDOWS\system32\drivers\lgusbbus.sys
2008-04-03 13:46 . 2008-04-03 13:46 <DIR> d-------- C:\Documents and Settings\Richard\Application Data\Talkback
2008-04-03 13:01 . 2008-04-03 13:01 <DIR> d-------- C:\Program Files\Common Files\xing shared
2008-03-31 22:25 . 2008-03-31 22:25 831,488 --a------ C:\WINDOWS\system32\divx_xx0a.dll
2008-03-31 22:25 . 2008-03-31 22:25 823,296 --a------ C:\WINDOWS\system32\divx_xx0c.dll
2008-03-31 22:25 . 2008-03-31 22:25 823,296 --a------ C:\WINDOWS\system32\divx_xx07.dll
2008-03-31 22:25 . 2008-03-31 22:25 802,816 --a------ C:\WINDOWS\system32\divx_xx11.dll
2008-03-31 22:25 . 2008-03-31 22:25 682,496 --a------ C:\WINDOWS\system32\DivX.dll
2008-03-31 22:25 . 2008-03-31 22:25 161,096 --a------ C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-03-30 20:33 . 2008-04-06 16:34 <DIR> d-------- C:\Program Files\Optic Limited
2008-03-25 20:27 . 2008-03-28 15:56 <DIR> d-------- C:\Program Files\PartyGaming.Net
2008-03-24 20:45 . 2008-03-24 20:45 630,784 --a------ C:\WINDOWS\system32\divxdec.ax
2008-03-22 00:17 . 2008-03-22 00:17 <DIR> d-------- C:\Program Files\BeloSoft
2008-03-21 21:30 . 2008-03-21 21:30 3,596,288 --a------ C:\WINDOWS\system32\qt-dx331.dll
2008-03-21 21:30 . 2008-03-21 21:30 1,044,480 --a------ C:\WINDOWS\system32\libdivx.dll
2008-03-21 21:30 . 2008-03-21 21:30 524,288 --a------ C:\WINDOWS\system32\DivXsm.exe
2008-03-21 21:30 . 2008-03-21 21:30 200,704 --a------ C:\WINDOWS\system32\ssldivx.dll
2008-03-21 21:30 . 2008-03-21 21:30 4,816 --a------ C:\WINDOWS\system32\divxsm.tlb

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-16 18:46 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-04-16 18:10 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-04-16 16:59 --------- d-----w C:\Program Files\Google
2008-04-16 12:48 --------- d-----w C:\Program Files\VirtualDJ
2008-04-16 11:31 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-04-15 22:26 --------- d-----w C:\Program Files\Lavasoft
2008-04-15 21:08 --------- d-----w C:\Program Files\Common Files\Oem Common
2008-04-13 16:43 --------- d-----w C:\Program Files\TomTom HOME 2
2008-04-13 14:28 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-03 12:01 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll
2008-04-03 12:01 --------- d-----w C:\Program Files\Common Files\Real
2008-03-28 20:54 --------- d-----w C:\Program Files\MSN Messenger
2008-03-28 20:54 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-03-21 20:28 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2008-03-21 20:28 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
2008-03-21 20:28 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
2008-03-21 20:28 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
2008-03-21 20:28 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
2008-03-21 20:28 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
2008-03-21 20:28 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
2008-03-21 20:28 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
2008-03-21 20:28 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2008-03-19 09:40 1,845,888 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-12 19:51 --------- d-----w C:\Documents and Settings\Richard\Application Data\SopCast
2008-03-05 18:06 --------- d-----w C:\Program Files\Windows Live
2008-03-05 18:04 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-03-01 13:06 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-02-25 17:24 --------- d-----w C:\Documents and Settings\Richard\Application Data\TomTom
2008-02-25 17:24 --------- d-----w C:\Documents and Settings\All Users\Application Data\TomTom
2008-02-25 17:18 --------- d-----w C:\Program Files\TomTom DesktopSuite
2008-02-21 20:04 --------- d-----w C:\Documents and Settings\Richard\Application Data\TVU Networks
2008-02-21 20:04 --------- d-----w C:\Documents and Settings\All Users\Application Data\TVU Networks
2008-02-20 06:52 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-02-20 05:32 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
2008-01-30 16:10 274,432 ----a-w C:\WINDOWS\system32\libcurl.dll
2008-01-14 15:05 41,168 -c--a-w C:\Documents and Settings\Richard\Application Data\GDIPFONTCACHEV1.DAT
2007-03-08 15:54 77,456 -c--a-w C:\Documents and Settings\Richard\TB2Categories000.dat
2006-11-14 12:03 20 ---h--w C:\Documents and Settings\All Users\Application Data\PKP_DLec.DAT
2001-05-10 09:04 162,304 -c----w C:\Program Files\UNWISE.EXE
2007-10-09 14:47 1,031 --sh--w C:\WINDOWS\system\ws32ntfl.dat
2002-04-16 10:27 5 --sha-w C:\WINDOWS\system32\CdI5T.drv
.

((((((((((((((((((((((((((((( snapshot@2008-04-16_18.44.08.32 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-04-16 17:27:37 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-04-16 19:08:37 2,048 --s-a-w C:\WINDOWS\bootstat.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 12:34 5724184]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-04-16 12:40 68856]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 13:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Workflow"="D:\Workflow.exe" [ ]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-09-03 08:04 84640]
"osCheck"="C:\Program Files\Norton Internet Security\osCheck.exe" [2006-09-06 02:22 26248]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 17:38 583048]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-04-03 13:01 185896]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 13:00 15360]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 10:17 1241088]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\Macromedia\\Dreamweaver MX 2004\\Dreamweaver.exe"=
"C:\\WINDOWS\\system32\\sessmgr.exe"=
"C:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"C:\\WINDOWS\\system32\\rtcshare.exe"=
"C:\\Program Files\\NetMeeting\\conf.exe"=
"C:\\Program Files\\Common Files\\PocketSoft\\RTPatch\\AutoRTP\\artpschd.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
"C:\\Program Files\\Ares\\Ares.exe"=
"C:\\Program Files\\Sports Interactive\\Football Manager 2008\\fm.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3587:TCP"= 3587:TCP:Windows Peer-to-Peer Grouping
"3540:UDP"= 3540:UDP:Peer Name Resolution Protocol (PNRP)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R3 AN983;ADMtek AN983/AN985/ADM951X 10/100Mbps Fast Ethernet Adapter;C:\WINDOWS\system32\DRIVERS\AN983.sys [2005-01-13 09:28]
S3 ZxPacket;Zx Packet driver;C:\Documents and Settings\Richard\Desktop\ZxSniffer\ZxPacket.sys []

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc

*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder
"2008-04-16 16:10:01 C:\WINDOWS\Tasks\HP Usg Daily.job"
- C:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\pexpress\hphped05.exe
"2008-04-14 02:34:56 C:\WINDOWS\Tasks\Norton Internet Security - Run Full System Scan - Richard.job"
- C:\PROGRA~1\NORTON~2\NORTON~1\Navw32.exeh/TASK:
.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-16 20:11:07
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

C:\WINDOWS\explorer.exe [1800] 0x82A1C670

scanning hidden autostart entries ...

scanning hidden files ...


C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\lulock.dat 0 bytes
C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\tmp4a4d.tmp
C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\tmp6d66.tmp

scan completed successfully
hidden files: 3

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\wdfmgr.exe
.
**************************************************************************
.
Completion time: 2008-04-16 20:35:15 - machine was rebooted
ComboFix-quarantined-files.txt 2008-04-16 19:34:56
ComboFix2.txt 2008-04-16 17:44:39

Pre-Run: 1,466,437,632 bytes free
Post-Run: 1,512,046,592 bytes free
.
2008-04-12 02:09:26 --- E O F ---


hijack this log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:39:20, on 16/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.safenavwe...&...aid=1&pid=0
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: (no name) - {466AADAC-E21A-422D-958C-2B627A22E99A} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Workflow] D:\Workflow.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe
O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {2AF5BD25-90C5-4EEC-88C5-B44DC2905D8B} (DownloadManager Control) - http://dlm.tools.aka...vex-2.2.0.8.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.syma...bin/AvSniff.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg...l_v1-0-3-48.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by102fd.bay10...es/MsnPUpld.cab
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebo...toUploader3.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitd...can8/oscan8.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.safe...wlscbase969.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.syma...n/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1155651804203
O16 - DPF: {AF2E62B6-F9E1-4D4F-A10A-9DC8E6DCBCC0} - http://update.videoe...ggPublisher.exe
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zon...nt.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.m...ash/swflash.cab
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: KService - Unknown owner - C:\Program Files\Kontiki\KService.exe (file missing)
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O24 - Desktop Component 0: My Current Home Page - About:Home

--
End of file - 11846 bytes

[greyknight17]

Please print the below instructions or copy them to Notepad. Make sure to work through the fixes in the order mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes.

Run a scan in HijackThis. Check each of the following if they still exist and hit 'Fix Checked' after you checked the last one:

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.safenavwe...&...aid=1&pid=0
O3 - Toolbar: (no name) - {466AADAC-E21A-422D-958C-2B627A22E99A} - (no file)
O23 - Service: KService - Unknown owner - C:\Program Files\Kontiki\KService.exe (file missing)

Go into HijackThis->Config->Misc Tools->Delete an NT service and type in KService and hit OK.

Go to Start->Run and type in services.msc and hit OK. Then look for KService and double click on it. Click on the Stop button.

Restart and run a new HijackThis scan. Save the log file and post it here.

[richt]

I went through what u sed, step by step but when i got to

Go to Start->Run and type in services.msc and hit OK. Then look for KService and double click on it. Click on the Stop button.

I could not find Kservice, any idea y?

Here is the new log anyway


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:00:13, on 17/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Workflow] D:\Workflow.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe
O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {2AF5BD25-90C5-4EEC-88C5-B44DC2905D8B} (DownloadManager Control) - http://dlm.tools.aka...vex-2.2.0.8.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.syma...bin/AvSniff.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg...l_v1-0-3-48.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by102fd.bay10...es/MsnPUpld.cab
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebo...toUploader3.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitd...can8/oscan8.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.safe...wlscbase969.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.syma...n/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1155651804203
O16 - DPF: {AF2E62B6-F9E1-4D4F-A10A-9DC8E6DCBCC0} - http://update.videoe...ggPublisher.exe
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zon...nt.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.m...ash/swflash.cab
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O24 - Desktop Component 0: My Current Home Page - About:Home

--
End of file - 11754 bytes

[greyknight17]

HijackThis probably removed it

Good job. Your log is clean.

To help prevent future spyware infections, read the Anti-Spyware Tutorial and use the tools provided.

Are there any problems now? If none, go to Start->Run and type in Combofix /u to remove Combofix. You should be set to go.

[richt]

Thank you for all your help i have no pop up screens anymore.

My last concern is windows is taking about 6-7 mins to start, the 1st min just shows the desktop pic and 2-5 mins shows the taskbar and then then last 2 mins it shows everything including the desktop folders and this only happened when i caught the virus, I have done basic things to run it quicker such as remove progs, clean recycle bin and temp internet files and its still the same, any thoughts please.

Thank you once again.

[greyknight17]

Let's have a look at these logs:

Download Deckard's System Scanner at http://deckard.geekstogo.com/dss.exe or http://www.techsuppo...Deckard/dss.exe and save it to your desktop.

- Close all applications and windows.
- Double-click on DSS.exe to run it, and follow the prompts.
- When the scan is complete, two text files will open - Main.txt and Extra.txt

Post the main.txt (copy and paste it in your reply) and extra.txt (attach it in your next reply) from the C:\Deckard\System Scanner folder into your next reply.

Perform an online scan with Internet Explorer at Panda ActiveScan http://www.pandasoft.../activescan.htm

* Click on 'Scan your PC' button. There should be a popup - if you have a pop-up blocker, make sure it's not blocking it.
* Click 'Check Now' & a pop-up window will appear.
* Enter your Country, State and E-mail Address & click 'Scan Now' - begin downloading Panda's ActiveX controls (8 MB size).
* Begin the scan by selecting My Computer.
* If it finds any malware, it will offer you a report. Ignore any entry it finds (since it wants you to buy the program for removal) as we will address this later.
* Click on see report. Then click Save report.
* Post that log in your next reply.

[richt]

This might sound silly, but how do i close windows

[greyknight17]

If you have any folders or programs open right now, please close them

[richt]

There was no extra.txt file log produced when using deckards system checker, i even looked in the deckard folder as mention, it only gave me the main.txt, so here are the logs

main.txt

Deckard's System Scanner v20071014.68
Run by Richard on 2008-04-20 13:22:29
Computer is in Normal Mode.
--------------------------------------------------------------------------------

Total Physical Memory: 503 MiB (512 MiB recommended).
System Drive C: has 1.37 GiB (less than 15%) free.


-- HijackThis (run as Richard.exe) ---------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:22:31, on 20/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Documents and Settings\Richard.RICHARD\Desktop\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Richard.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [Workflow] D:\Workflow.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE /auto
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\RunOnce: [NoIE4StubProcessing] C:\WINDOWS\system32\reg.exe DELETE "HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components" /v "NoIE4StubProcessing" /f
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.liv...m/quickadd.aspx
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe
O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.appl...ex/qtplugin.cab
O16 - DPF: {2AF5BD25-90C5-4EEC-88C5-B44DC2905D8B} (DownloadManager Control) - http://dlm.tools.aka...vex-2.2.0.8.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.syma...bin/AvSniff.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg...l_v1-0-3-48.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by102fd.bay10...es/MsnPUpld.cab
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebo...toUploader3.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitd...can8/oscan8.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.safe...wlscbase969.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.syma...n/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1155651804203
O16 - DPF: {AF2E62B6-F9E1-4D4F-A10A-9DC8E6DCBCC0} - http://update.videoe...ggPublisher.exe
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zon...nt.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.m...ash/swflash.cab
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O24 - Desktop Component 0: My Current Home Page - About:Home

--
End of file - 13050 bytes

-- Files created between 2008-03-20 and 2008-04-20 -----------------------------

2008-04-18 20:10:31 0 d-------- C:\Documents and Settings\Default User\Application Data\Apple Computer
2008-04-18 19:27:44 0 d-------- C:\Program Files\Winamp
2008-04-18 19:27:44 0 d-------- C:\Documents and Settings\Richard.RICHARD\Application Data\Winamp
2008-04-18 14:49:08 0 d-------- C:\Documents and Settings\Richard.RICHARD\Application Data\Apple Computer
2008-04-18 14:47:23 0 d-------- C:\Program Files\iPod
2008-04-18 14:45:34 0 d-------- C:\Program Files\iTunes
2008-04-18 14:43:39 0 d-------- C:\Program Files\Bonjour
2008-04-18 14:39:55 0 d-------- C:\Program Files\Apple Software Update
2008-04-18 14:38:44 0 d-------- C:\Program Files\Common Files\Apple
2008-04-18 14:38:42 0 d-------- C:\Documents and Settings\All Users\Application Data\Apple
2008-04-18 12:52:36 0 d-------- C:\WINDOWS\LastGood
2008-04-18 12:43:53 0 d-------- C:\Documents and Settings\Richard.RICHARD\Application Data\Nokia
2008-04-18 12:27:02 0 d--h----- C:\Program Files\Zero G Registry
2008-04-18 12:27:02 0 d--h----- C:\Documents and Settings\Richard.RICHARD\InstallAnywhere
2008-04-17 19:47:40 0 d-------- C:\Program Files\Windows Live Toolbar
2008-04-17 19:47:36 0 d-------- C:\Program Files\Windows Live Favorites
2008-04-16 17:31:21 0 d-------- C:\cmdcons
2008-04-16 17:29:34 68096 --a------ C:\WINDOWS\zip.exe
2008-04-16 17:29:34 49152 --a------ C:\WINDOWS\VFind.exe
2008-04-16 17:29:34 212480 --a------ C:\WINDOWS\swxcacls.exe <Not Verified; SteelWerX; SteelWerX Extended Configurator ACLists>
2008-04-16 17:29:34 136704 --a------ C:\WINDOWS\swsc.exe <Not Verified; SteelWerX; SteelWerX Service Controller>
2008-04-16 17:29:34 161792 --a------ C:\WINDOWS\swreg.exe <Not Verified; SteelWerX; SteelWerX Registry Editor>
2008-04-16 17:29:34 98816 --a------ C:\WINDOWS\sed.exe
2008-04-16 17:29:34 80412 --a------ C:\WINDOWS\grep.exe
2008-04-16 17:29:34 73728 --a------ C:\WINDOWS\fdsv.exe <Not Verified; Smallfrogs Studio; >
2008-04-16 17:15:13 0 d-------- C:\Program Files\TVAnts
2008-04-16 17:14:58 0 d-------- C:\Program Files\DIGITAL COLOUR ATLAS 3.0
2008-04-16 17:14:55 0 d-------- C:\Program Files\Java
2008-04-16 17:14:48 0 d-------- C:\Program Files\FairUse Wizard 2
2008-04-16 00:10:01 0 d-------- C:\Documents and Settings\Richard.RICHARD\Application Data\Malwarebytes
2008-04-16 00:08:41 0 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-04-16 00:06:50 0 d-------- C:\Program Files\Common Files\Download Manager
2008-04-15 23:30:01 0 d-------- C:\Program Files\Enigma Software Group
2008-04-15 20:14:18 0 d-------- C:\WINDOWS\BDOSCAN8
2008-04-15 14:42:28 0 d-------- C:\Documents and Settings\Administrator\Application Data\SUPERAntiSpyware.com
2008-04-15 14:26:29 0 d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-04-15 14:25:45 0 d-------- C:\Program Files\SUPERAntiSpyware
2008-04-15 14:25:45 0 d-------- C:\Documents and Settings\Richard.RICHARD\Application Data\SUPERAntiSpyware.com
2008-04-15 12:54:38 0 d-------- C:\Documents and Settings\Richard.RICHARD\Application Data\DivX
2008-04-15 12:54:02 0 d-------- C:\Documents and Settings\Richard.RICHARD\Application Data\Real
2008-04-15 12:09:11 2396 --a------ C:\WINDOWS\system32\tmp.reg
2008-04-15 12:08:46 86528 --a------ C:\WINDOWS\system32\VACFix.exe <Not Verified; S!Ri.URZ; VACFix>
2008-04-15 12:08:46 82432 --a------ C:\WINDOWS\system32\IEDFix.exe <Not Verified; S!Ri.URZ; IEDFix>
2008-04-15 11:48:46 0 d-------- C:\Documents and Settings\Richard.RICHARD\Application Data\Sun
2008-04-15 11:31:44 0 d-------- C:\Documents and Settings\Richard.RICHARD\Application Data\Macromedia
2008-04-15 11:27:54 0 d-------- C:\Documents and Settings\Richard.RICHARD\Complete
2008-04-15 11:27:20 0 d-------- C:\Documents and Settings\Richard.RICHARD\.limewire
2008-04-15 11:26:44 0 d-------- C:\Documents and Settings\Richard.RICHARD\Contacts
2008-04-15 11:26:28 0 d-------- C:\Documents and Settings\Richard.RICHARD\Phone Browser
2008-04-15 11:12:07 0 d-------- C:\Documents and Settings\Richard.RICHARD\Application Data\Google
2008-04-15 10:41:59 9195520 --a------ C:\Documents and Settings\Richard\ntuser.dat
2008-04-15 10:35:14 0 d-------- C:\Documents and Settings\Richard.RICHARD\Application Data\TmpRecentIcons
2008-04-15 10:29:16 0 dr-h----- C:\Documents and Settings\Richard.RICHARD\Recent
2008-04-15 10:29:16 0 d--h----- C:\Documents and Settings\Richard.RICHARD\PrintHood
2008-04-15 10:29:16 0 d--h----- C:\Documents and Settings\Richard.RICHARD\NetHood
2008-04-15 10:29:16 0 dr------- C:\Documents and Settings\Richard.RICHARD\My Documents
2008-04-15 10:29:16 0 d--h----- C:\Documents and Settings\Richard.RICHARD\Local Settings
2008-04-15 10:29:16 0 dr------- C:\Documents and Settings\Richard.RICHARD\Favorites
2008-04-15 10:29:16 0 d-------- C:\Documents and Settings\Richard.RICHARD\Desktop
2008-04-15 10:29:16 0 d--hs---- C:\Documents and Settings\Richard.RICHARD\Cookies
2008-04-15 10:29:16 0 dr-h----- C:\Documents and Settings\Richard.RICHARD\Application Data
2008-04-15 10:29:16 0 d-------- C:\Documents and Settings\Richard.RICHARD\Application Data\Identities
2008-04-15 10:29:15 0 d--h----- C:\Documents and Settings\Richard.RICHARD\Templates
2008-04-15 10:29:15 0 dr------- C:\Documents and Settings\Richard.RICHARD\Start Menu
2008-04-15 10:29:15 0 dr-h----- C:\Documents and Settings\Richard.RICHARD\SendTo
2008-04-15 10:29:15 2097152 --ah----- C:\Documents and Settings\Richard.RICHARD\NTUSER.DAT
2008-04-14 15:14:19 0 d-------- C:\Program Files\Trend Micro
2008-04-14 14:38:32 0 dr-h----- C:\Documents and Settings\Richard\Recent
2008-04-14 13:57:07 0 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-04-14 13:55:38 0 d-------- C:\Program Files\Yahoo!
2008-04-14 13:25:06 0 d-------- C:\Documents and Settings\Richard\Application Data\Uniblue
2008-04-13 21:10:05 0 d-------- C:\Documents and Settings\Richard\Application Data\DivX
2008-04-13 19:14:08 0 d-------- C:\Program Files\Norton Internet Security
2008-04-13 19:08:16 0 d-------- C:\Program Files\Symantec
2008-04-13 18:44:36 0 d-------- C:\Program Files\Norton AntiVirus
2008-04-13 17:43:13 0 d-------- C:\Program Files\ArcSoft
2008-04-13 15:19:09 0 d-------- C:\Documents and Settings\All Users\Application Data\PC Tools
2008-04-13 15:13:44 0 d-------- C:\Program Files\Windows Sidebar
2008-04-13 00:33:34 0 d-------- C:\divx
2008-04-13 00:27:28 0 d-------- C:\Documents and Settings\Richard\Application Data\LG Electronics
2008-04-13 00:27:04 0 d-------- C:\Program Files\DivX
2008-04-12 22:30:14 0 d-------- C:\Program Files\LG Electronics
2008-04-03 13:46:38 0 d-------- C:\Documents and Settings\Richard\Application Data\Talkback
2008-03-31 22:25:48 823296 --a------ C:\WINDOWS\system32\divx_xx0c.dll <Not Verified; DivX, Inc.; DivX®>
2008-03-31 22:25:48 823296 --a------ C:\WINDOWS\system32\divx_xx07.dll <Not Verified; DivX, Inc.; DivX®>
2008-03-31 22:25:46 802816 --a------ C:\WINDOWS\system32\divx_xx11.dll <Not Verified; DivX, Inc.; DivX?>
2008-03-31 22:25:46 831488 --a------ C:\WINDOWS\system32\divx_xx0a.dll
2008-03-31 22:25:46 682496 --a------ C:\WINDOWS\system32\DivX.dll <Not Verified; DivX, Inc.; DivX®>
2008-03-30 20:33:05 0 d-------- C:\Program Files\Optic Limited
2008-03-25 20:27:28 0 d-------- C:\Program Files\PartyGaming.Net
2008-03-22 00:17:05 0 d-------- C:\Program Files\BeloSoft
2008-03-21 21:30:08 3596288 --a------ C:\WINDOWS\system32\qt-dx331.dll
2008-03-21 21:28:54 196608 --a------ C:\WINDOWS\system32\dtu100.dll <Not Verified; DivX, Inc.; DivX, Inc. dtu100>
2008-03-21 21:28:54 81920 --a------ C:\WINDOWS\system32\dpl100.dll <Not Verified; DivX, Inc.; DivX, Inc. dpl100>
2008-03-21 21:28:20 12288 --a------ C:\WINDOWS\system32\DivXWMPExtType.dll


-- Find3M Report ---------------------------------------------------------------

2008-04-19 20:50:13 0 d-------- C:\Program Files\Common Files\Symantec Shared
2008-04-18 14:42:52 0 d-------- C:\Program Files\QuickTime
2008-04-18 14:38:44 0 d-------- C:\Program Files\Common Files
2008-04-18 12:44:06 0 d-------- C:\Program Files\Nokia
2008-04-18 12:38:19 0 d-------- C:\Program Files\Real
2008-04-18 12:38:19 0 d-------- C:\Program Files\Common Files\Real
2008-04-16 17:59:49 0 d-------- C:\Program Files\Google
2008-04-16 13:48:59 0 d-------- C:\Program Files\VirtualDJ
2008-04-15 23:26:52 0 d-------- C:\Program Files\Lavasoft
2008-04-15 22:08:01 0 d-------- C:\Program Files\Common Files\Oem Common
2008-04-15 11:01:32 2508 --a------ C:\Documents and Settings\Richard.RICHARD\Application Data\$_hpcst$.hpc
2008-04-13 17:43:23 0 d-------- C:\Program Files\TomTom HOME 2
2008-04-13 15:28:41 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-03-28 21:54:54 0 d-------- C:\Program Files\MSN Messenger
2008-03-28 21:54:50 0 d-------- C:\Program Files\Messenger Plus! Live
2008-03-05 19:06:11 0 d-------- C:\Program Files\Windows Live
2008-03-05 19:04:40 0 d--hs--c- C:\Program Files\Common Files\WindowsLiveInstaller
2008-02-25 18:18:28 0 d-------- C:\Program Files\TomTom DesktopSuite
2008-01-30 17:10:46 274432 --a------ C:\WINDOWS\system32\libcurl.dll


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Workflow"="D:\Workflow.exe" []
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [03/09/2006 08:04]
"osCheck"="C:\Program Files\Norton Internet Security\osCheck.exe" [06/09/2006 02:22]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [29/01/2008 17:38]
"MSConfig"="C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.exe" [04/08/2004 13:00]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [18/04/2008 14:30]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [30/03/2008 10:36]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [01/04/2008 19:49]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [18/10/2007 12:34]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [04/08/2004 13:00]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [16/04/2008 12:40]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce]
"NoIE4StubProcessing"=C:\WINDOWS\system32\reg.exe DELETE "HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components" /v "NoIE4StubProcessing" /f

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)
"HideLegacyLogonScripts"=0 (0x0)
"HideLogoffScripts"=0 (0x0)
"RunLogonScriptSync"=1 (0x1)
"RunStartupScriptSync"=1 (0x1)
"HideStartupScripts"=0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"HideLegacyLogonScripts"=0 (0x0)
"HideLogoffScripts"=0 (0x0)
"RunLogonScriptSync"=1 (0x1)
"RunStartupScriptSync"=1 (0x1)
"HideStartupScripts"=0 (0x0)


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs BthServ
p2psvc p2psvc p2pimsvc p2pgasvc PNRPSvc

*Newly Created Service* - APPLE_MOBILE_DEVICE
*Newly Created Service* - BONJOUR_SERVICE
*Newly Created Service* - COMHOST
*Newly Created Service* - IPOD_SERVICE



-- End of Deckard's System Scanner: finished at 2008-04-20 13:22:59 ------------


Active Scan Log


;*******************************************************************************
*********************************************************************************
*******************
ANALYSIS: 2008-04-22 10:39:31
PROTECTIONS: 1
MALWARE: 42
SUSPECTS: 0
;*******************************************************************************
*********************************************************************************
*******************
PROTECTIONS
Description Version Active Updated
;===============================================================================
=================================================================================
===================
Norton Internet Security 2007 Yes Yes
;===============================================================================
=================================================================================
===================
MALWARE
Id Description Type Active Severity Disinfectable Disinfected Location
;===============================================================================
=================================================================================
===================
00034463 adware/wupd Adware No 0 Yes No c:\windows\system32\ide21201.vxd
00040415 adware/wintools Adware No 0 Yes No HKEY_LOCAL_MACHINE\software\classes\CLSID\{AF8B3C81-CD19-45FB-B6BE-160D27711DE8}
00040415 adware/wintools Adware No 0 Yes No hkey_classes_root\clsid\{af8b3c81-cd19-45fb-b6be-160d27711de8}
00041897 adware/aurora Adware No 0 Yes No hkey_local_machine\system\currentcontrolset\control\print\monitors\zepmon
00041897 adware/aurora Adware No 0 Yes No hkey_local_machine\system\controlset001\control\print\monitors\zepmon
00046097 adware/oemji Adware No 0 Yes No hkey_classes_root\clsid\{08a60acf-5b9e-489a-bed5-8dddaa7211d6}
00046097 adware/oemji Adware No 0 Yes No hkey_classes_root\clsid\{3d20508e-59b9-4602-9cf9-49387e9d9beb}
00046097 adware/oemji Adware No 0 Yes No hkey_classes_root\clsid\{471a13e6-8188-47f9-b35e-277de04ff2e2}
00046097 adware/oemji Adware No 0 Yes No hkey_classes_root\clsid\{5e022a40-7cc4-4eba-a143-8d5c3b8838db}
00046097 adware/oemji Adware No 0 Yes No hkey_classes_root\clsid\{ad2069f5-4ecd-48e0-a478-2d0e34d6dc32}
00046097 adware/oemji Adware No 0 Yes No c:\program files\common files\oem common
00046097 adware/oemji Adware No 0 Yes No HKEY_LOCAL_MACHINE\software\classes\CLSID\{08A60ACF-5B9E-489A-BED5-8DDDAA7211D6}
00046097 adware/oemji Adware No 0 Yes No hkey_classes_root\clsid\{d7f152aa-2fe1-4cfa-9838-6782bf85c929}
00046097 adware/oemji Adware No 0 Yes No hkey_classes_root\clsid\{d8cb10e7-601a-4176-b6b5-cefa244d4dea}
00046097 adware/oemji Adware No 0 Yes No hkey_classes_root\bayesobj.bayesianobject
00046097 adware/oemji Adware No 0 Yes No HKEY_CLASSES_ROOT\TypeLib\{0AC17D72-80F3-4F79-BFCC-9A779BA70334}
00046097 adware/oemji Adware No 0 Yes No HKEY_CLASSES_ROOT\TypeLib\{AEF5EB3E-0739-4A12-83F3-77249D80F63F}
00046097 adware/oemji Adware No 0 Yes No hkey_classes_root\bayesobj.whitelistobject
00046097 adware/oemji Adware No 0 Yes No hkey_classes_root\cconfirmationobject.cconfirmationob
00046097 adware/oemji Adware No 0 Yes No hkey_classes_root\cconfirmationobject.cconfirmationob.1.0
00046097 adware/oemji Adware No 0 Yes No hkey_classes_root\cemailprompt.cemailprompt
00046097 adware/oemji Adware No 0 Yes No hkey_classes_root\cemailprompt.cemailprompt.1.0
00046097 adware/oemji Adware No 0 Yes No HKEY_LOCAL_MACHINE\software\classes\CLSID\{3D20508E-59B9-4602-9CF9-49387E9D9BEB}
00046097 adware/oemji Adware No 0 Yes No HKEY_LOCAL_MACHINE\software\classes\CLSID\{471A13E6-8188-47F9-B35E-277DE04FF2E2}
00046097 adware/oemji Adware No 0 Yes No hkey_classes_root\noah.cdownloadprogresscontroller
00046097 adware/oemji Adware No 0 Yes No hkey_classes_root\noah.cdownloadprogresscontroller.1
00046097 adware/oemji Adware No 0 Yes No hkey_classes_root\noah.registrationobj
00046097 adware/oemji Adware No 0 Yes No hkey_classes_root\noah.registrationobj.1
00046097 adware/oemji Adware No 0 Yes No hkey_classes_root\bayesobj.mailitem
00046097 adware/oemji Adware No 0 Yes No hkey_classes_root\bayesobj.bayesianobject.1
00046097 adware/oemji Adware No 0 Yes No HKEY_LOCAL_MACHINE\software\classes\CLSID\{5E022A40-7CC4-4EBA-A143-8D5C3B8838DB}
00046097 adware/oemji Adware No 0 Yes No HKEY_LOCAL_MACHINE\software\classes\CLSID\{AD2069F5-4ECD-48E0-A478-2D0E34D6DC32}
00046097 adware/oemji Adware No 0 Yes No HKEY_LOCAL_MACHINE\software\classes\CLSID\{D8CB10E7-601A-4176-B6B5-CEFA244D4DEA}
00046097 adware/oemji Adware No 0 Yes No HKEY_LOCAL_MACHINE\software\classes\CLSID\{D7F152AA-2FE1-4cfa-9838-6782BF85C929}
00122030 adware/fastvideoplayer Adware No 0 Yes No HKEY_LOCAL_MACHINE\software\classes\CLSID\{B5DD9A64-5C4B-4A48-BE56-97C1A8F85708}
00122030 adware/fastvideoplayer Adware No 0 Yes No hkey_classes_root\fastvideoplayer.fastvideoplayerctrl.1
00122030 adware/fastvideoplayer Adware No 0 Yes No hkey_classes_root\fastvideoplayer.fastvideoplayerctrl
00122030 adware/fastvideoplayer Adware No 0 Yes No hkey_classes_root\clsid\{b5dd9a64-5c4b-4a48-be56-97c1a8f85708}
00122030 adware/fastvideoplayer Adware No 0 Yes No c:\windows\inf\fastvideoplayer.inf
00132717 dialer.xe Dialers No 0 Yes No hkey_local_machine\software\asdplugin
00133284 adware/hungryhands Adware No 0 Yes No HKEY_CLASSES_ROOT\TypeLib\{03f8822f-8877-4002-8bcd-b532d53d8471}
00139060 Cookie/Casalemedia TrackingCookie No 0 Yes No C:\Documents and Settings\Richard.RICHARD\Cookies\richard@casalemedia[2].txt
00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Documents and Settings\Richard.RICHARD\Cookies\richard@doubleclick[1].txt
00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\Richard.RICHARD\Cookies\richard@atdmt[1].txt
00139535 Application/Processor HackTools No 0 Yes No C:\Documents and Settings\Richard.RICHARD\My Documents\SmitfraudFix\Process.exe
00145393 Cookie/Tradedoubler TrackingCookie No 0 Yes No C:\Documents and Settings\Richard.RICHARD\Cookies\richard@tradedoubler[2].txt
00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\Documents and Settings\Richard.RICHARD\Cookies\richard@fastclick[2].txt
00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No C:\Documents and Settings\Richard.RICHARD\Cookies\richard@tribalfusion[1].txt
00145738 Cookie/Mediaplex TrackingCookie No 0 Yes No C:\Documents and Settings\Richard.RICHARD\Cookies\richard@mediaplex[1].txt
00145881 Cookie/NewMedia TrackingCookie No 0 Yes No C:\Documents and Settings\Richard.RICHARD\Cookies\[email protected][1].txt
00147824 Cookie/Clickbank TrackingCookie No 0 Yes No C:\Documents and Settings\Richard.RICHARD\Cookies\richard@clickbank[1].txt
00167430 Cookie/myaffiliateprogram TrackingCookie No 0 Yes No C:\Documents and Settings\Richard.RICHARD\Cookies\[email protected][1].txt
00167642 Cookie/Com.com TrackingCookie No 0 Yes No C:\Documents and Settings\Richard.RICHARD\Cookies\richard@com[1].txt
00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Richard.RICHARD\Cookies\richard@statcounter[2].txt
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\Richard.RICHARD\Cookies\[email protected][2].txt
00168061 Cookie/Apmebf TrackingCookie No 0 Yes No C:\Documents and Settings\Richard.RICHARD\Cookies\richard@apmebf[1].txt
00168076 Cookie/BurstNet TrackingCookie No 0 Yes No C:\Documents and Settings\Richard.RICHARD\Cookies\richard@burstnet[2].txt
00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\Richard.RICHARD\Cookies\richard@serving-sys[2].txt
00168093 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\Richard.RICHARD\Cookies\[email protected][1].txt
00168109 Cookie/Adtech TrackingCookie No 0 Yes No C:\Documents and Settings\Richard.RICHARD\Cookies\richard@adtech[1].txt
00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\Richard.RICHARD\Cookies\richard@advertising[1].txt
00169287 Cookie/Adrevolver TrackingCookie No 0 Yes No C:\Documents and Settings\Richard.RICHARD\Cookies\[email protected][2].txt
00170304 Cookie/WebtrendsLive TrackingCookie No 0 Yes No C:\Documents and Settings\Richard.RICHARD\Cookies\[email protected][2].txt
00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\Richard.RICHARD\Cookies\[email protected][1].txt
00170556 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\Richard.RICHARD\Cookies\richard@realmedia[1].txt
00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No C:\Documents and Settings\Richard.RICHARD\Cookies\richard@questionmarket[1].txt
00172221 Cookie/Zedo TrackingCookie No 0 Yes No C:\Documents and Settings\Richard.RICHARD\Cookies\richard@zedo[2].txt
00183284 Adware/Oemji Adware No 0 Yes No C:\Program Files\Common Files\Oem Common\bayesobj.dll
00184846 Cookie/Adrevolver TrackingCookie No 0 Yes No C:\Documents and Settings\Richard.RICHARD\Cookies\richard@adrevolver[2].txt
00207936 Cookie/Adviva TrackingCookie No 0 Yes No C:\Documents and Settings\Richard.RICHARD\Cookies\richard@adviva[2].txt
00293517 Cookie/AdDynamix TrackingCookie No 0 Yes No C:\Documents and Settings\Richard.RICHARD\Cookies\[email protected][1].txt
00517584 Application/SuperFast HackTools No 0 Yes No C:\Documents and Settings\Richard.RICHARD\My Documents\SmitfraudFix\restart.exe
01176994 Bck/VB.XB Virus/Trojan No 0 No No C:\Documents and Settings\Richard.RICHARD\Desktop\ComboFix.exe[327882R2FWJFW\NirCmdC.cfexe]
02197130 Trj/Rebooter.J Virus/Trojan No 1 Yes No C:\Documents and Settings\Richard.RICHARD\My Documents\SmitfraudFix\Reboot.exe
02913512 Application/PCCleaner HackTools No 0 Yes No C:\QooBox\Quarantine\C\Program Files\PC-Cleaner\com\pcsd.dll.vir
02914667 Spyware/Virtumonde Spyware No 1 Yes No C:\QooBox\Quarantine\catchme2008-04-16_182358.26.zip[wvUkKBqN.dll]
;===============================================================================
=================================================================================
===================
SUSPECTS
Sent Location
;===============================================================================
=================================================================================
===================
;===============================================================================
=================================================================================
===================
VULNERABILITIES
Id Severity Description
;===============================================================================
=================================================================================
===================
;===============================================================================
=================================================================================
===================

Edited by richt, 22 April 2008 - 03:50 AM.