[djpyst]

My computer was recently infected with Win Antivirus 2008 and then with Winspyware Protect, as well as a win32 worm I think. I used all the steps from your how to section prior to doing a hijackthis log, and their logs are attached, except for superantispyware, which I can't get to upload. Can you please check and make sure I got everything?
Thanks for any help.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:15:53 AM, on 6/30/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\Lexmark 5200 series\lxbtbmgr.exe
C:\WINDOWS\system32\RunDll32.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Lexmark 5200 series\lxbtbmon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Karen\Desktop\HiJackThis.exe
C:\WINDOWS\system32\NOTEPAD.EXE

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.7\NppBho.dll
O2 - BHO: (no name) - {429D9C4F-208A-4B8C-AB2C-872A47CDF182} - C:\WINDOWS\system32\ssqOEWQI.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.7\UIBHO.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [Lexmark 5200 series] "C:\Program Files\Lexmark 5200 series\lxbtbmgr.exe"
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DriverUpdaterPro] C:\Program Files\XPC Tools\Driver Updater Pro\DriverUpdaterPro.exe -t
O4 - HKCU\..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://dev.srtest.co.../sysreqlab3.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitd...can8/oscan8.cab
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symant...ex/symdlmgr.cab
O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-sec...m/ols/fscax.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.m...ash/swflash.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: lxbt_device - Lexmark International, Inc. - C:\WINDOWS\system32\lxbtcoms.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O24 - Desktop Component 0: Privacy Protection - (no file)

--
End of file - 8773 bytes

Attached Files

•  ActiveScan.txt   4.11KB   82 downloads
•  mbam_log_6_29_2008__13_33_24_.txt   5.28KB   106 downloads
•  mbam_log_6_30_2008__00_01_32_.txt   2.36KB   106 downloads

[Advertisements]

Welcome to GTG.

Run a scan in HijackThis. Check each of the following if they still exist and hit 'Fix Checked' after you checked the last one:

O2 - BHO: (no name) - {429D9C4F-208A-4B8C-AB2C-872A47CDF182} - C:\WINDOWS\system32\ssqOEWQI.dll (file missing)
O24 - Desktop Component 0: Privacy Protection - (no file)

1. Download combofix at http://download.blee...Bs/ComboFix.exe Save it to your Desktop before you run it.
2. Double-click combofix.exe & follow the prompts.
3. When finished, it will produce a log for you. Post that log in your next reply.

Note:
Do not click on combofix's window while it's running. That may cause it to stall.

[greyknight17]

Welcome to GTG.

Run a scan in HijackThis. Check each of the following if they still exist and hit 'Fix Checked' after you checked the last one:

O2 - BHO: (no name) - {429D9C4F-208A-4B8C-AB2C-872A47CDF182} - C:\WINDOWS\system32\ssqOEWQI.dll (file missing)
O24 - Desktop Component 0: Privacy Protection - (no file)

1. Download combofix at http://download.blee...Bs/ComboFix.exe Save it to your Desktop before you run it.
2. Double-click combofix.exe & follow the prompts.
3. When finished, it will produce a log for you. Post that log in your next reply.

Note:
Do not click on combofix's window while it's running. That may cause it to stall.

[djpyst]

Here is the combofix log:

ComboFix 08-06-30.2 - Karen 2008-07-01 11:46:30.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.599 [GMT -4:00]
Running from: C:\Documents and Settings\Karen\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\jSAbefii.ini
C:\WINDOWS\system32\jSAbefii.ini2
C:\WINDOWS\system32\kynikjkn.ini
C:\WINDOWS\system32\ogkecbhy.ini
C:\WINDOWS\system32\oXaadfii.ini
C:\WINDOWS\system32\oXaadfii.ini2
C:\WINDOWS\system32\vklatyos.ini

.
((((((((((((((((((((((((( Files Created from 2008-06-01 to 2008-07-01 )))))))))))))))))))))))))))))))
.

2008-06-29 15:27 . 2008-06-29 15:28 <DIR> d-------- C:\Program Files\Panda Security
2008-06-29 13:13 . 2008-06-29 13:13 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-06-29 13:13 . 2008-06-29 13:13 <DIR> d-------- C:\Documents and Settings\Karen\Application Data\Malwarebytes
2008-06-29 13:13 . 2008-06-29 13:13 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-06-29 13:13 . 2008-06-28 14:16 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-06-29 13:13 . 2008-06-28 14:16 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-06-29 13:12 . 2008-06-29 13:12 <DIR> d-------- C:\Program Files\Common Files\Download Manager
2008-06-27 12:37 . 2008-06-27 12:37 <DIR> d-------- C:\fsaua.data
2008-06-27 11:02 . 2008-06-27 11:02 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\SUPERAntiSpyware.com
2008-06-27 11:00 . 2008-06-27 11:00 <DIR> d-------- C:\Documents and Settings\Administrator
2008-06-27 09:36 . 2008-06-27 09:36 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-06-27 09:31 . 2008-06-27 09:32 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2008-06-27 09:31 . 2008-06-27 09:31 <DIR> d-------- C:\Documents and Settings\Karen\Application Data\SUPERAntiSpyware.com
2008-06-27 09:26 . 2008-06-27 09:26 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-06-27 09:22 . 2008-06-27 09:22 <DIR> d-------- C:\_OTMoveIt
2008-06-27 07:27 . 2008-06-27 09:55 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-06-27 07:27 . 2008-06-27 09:54 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-06-27 00:20 . 2008-06-27 09:06 <DIR> d-------- C:\Program Files\Enigma Software Group
2008-06-26 23:14 . 2008-06-27 00:16 <DIR> d-------- C:\WINDOWS\BDOSCAN8
2008-06-26 22:42 . 2008-06-26 23:02 <DIR> d-------- C:\VundoFix Backups
2008-06-26 10:26 . 2008-06-26 10:26 <DIR> d-------- C:\Program Files\ReflexiveArcade
2008-06-26 10:26 . 2008-06-26 18:52 <DIR> d-------- C:\Program Files\Mystery Case Files Prime Suspects
2008-06-26 10:26 . 2008-06-26 10:26 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Trymedia
2008-06-26 09:52 . 2008-06-26 09:54 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-06-24 15:14 . 2008-06-30 13:30 <DIR> d-------- C:\Documents and Settings\Karen\Application Data\BitTorrent
2008-06-24 15:13 . 2008-06-24 15:14 <DIR> d-------- C:\Program Files\DNA
2008-06-24 15:13 . 2008-06-24 15:14 <DIR> d-------- C:\Program Files\BitTorrent
2008-06-24 15:13 . 2008-07-01 11:51 <DIR> d-------- C:\Documents and Settings\Karen\Application Data\DNA
2008-06-20 10:11 . 2008-06-20 10:11 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\LightScribe
2008-06-19 20:40 . 2008-06-19 20:40 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Azureus
2008-06-19 20:39 . 2008-06-24 15:11 <DIR> d-------- C:\Documents and Settings\Karen\Application Data\Azureus
2008-06-16 15:10 . 2008-06-16 15:23 69 --a------ C:\WINDOWS\NeroDigital.ini
2008-06-12 05:49 . 2008-06-12 05:49 99,264 --a------ C:\WINDOWS\system32\drivers\AnyDVD.sys
2008-06-11 11:34 . 2008-06-13 09:10 272,128 --------- C:\WINDOWS\system32\drivers\bthport.sys
2008-06-11 11:34 . 2008-06-13 09:10 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
2008-06-03 21:37 . 2008-06-03 21:37 <DIR> d-------- C:\WINDOWS\nview
2008-06-03 21:37 . 2008-06-03 21:37 <DIR> d-------- C:\WINDOWS\nvidia icons
2008-06-03 21:37 . 2008-05-02 22:46 442,368 --a------ C:\WINDOWS\system32\nvudisp.exe
2008-06-03 21:37 . 2008-07-01 11:53 182,038 --a------ C:\WINDOWS\system32\nvapps.xml
2008-06-03 21:37 . 2008-05-02 22:46 181,895 --a------ C:\WINDOWS\system32\nvdsp.chm
2008-06-03 21:37 . 2008-05-02 22:46 121,529 --a------ C:\WINDOWS\system32\nvcpl.chm
2008-06-03 21:37 . 2008-05-02 22:46 116,384 --a------ C:\WINDOWS\system32\nv3d.chm
2008-06-03 21:37 . 2008-05-02 22:46 54,988 --a------ C:\WINDOWS\system32\nvmob.chm
2008-06-03 21:37 . 2008-05-02 22:46 18,070 --a------ C:\WINDOWS\system32\nvdisp.nvu
2008-06-03 21:36 . 2008-06-03 21:36 <DIR> d-------- C:\NVIDIA
2008-06-03 21:36 . 2008-04-30 17:27 442,368 --a------ C:\WINDOWS\system32\NVUNINST.EXE
2008-06-03 21:33 . 2008-06-03 21:33 <DIR> d-------- C:\Program Files\SystemRequirementsLab
2008-06-03 21:28 . 2008-05-02 22:46 6,554,496 --a------ C:\WINDOWS\system32\drivers\nv4_mini.sys
2008-06-03 21:28 . 2008-05-02 22:46 6,554,496 --a--c--- C:\WINDOWS\system32\dllcache\nv4_mini.sys
2008-06-03 21:28 . 2008-05-02 22:46 6,108,160 --a------ C:\WINDOWS\system32\nv4_disp.dll
2008-06-03 21:28 . 2004-08-04 00:56 4,274,816 --a--c--- C:\WINDOWS\system32\dllcache\nv4_disp.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-30 17:44 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-06-29 17:13 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-06-26 13:49 0 ----a-w C:\Program Files\temp01
2008-06-20 16:56 --------- d-----w C:\Program Files\Elaborate Bytes
2008-06-20 16:39 --------- d-----w C:\Program Files\SlySoft
2008-06-20 14:11 --------- d-----w C:\Documents and Settings\Karen\Application Data\Ahead
2008-05-30 23:56 805 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
2008-05-30 23:56 60,800 ----a-w C:\WINDOWS\system32\S32EVNT1.DLL
2008-05-30 23:56 123,952 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2008-05-30 23:56 10,671 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2008-05-30 23:56 --------- d-----w C:\Program Files\Symantec
2008-05-18 17:42 --------- d-----w C:\Program Files\Stamps.com Internet Postage
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
2008-05-07 05:18 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
2008-04-23 04:16 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2001-11-23 04:08 712,704 -c--a-r C:\WINDOWS\inf\OTHER\AUDIO3D.DLL
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-04-09 21:14 68856]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-12-23 19:05 143360]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-02-28 08:00 15360]
"AnyDVD"="C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe" [2008-06-14 12:38 2137024]
"BitTorrent DNA"="C:\Program Files\DNA\btdna.exe" [2008-06-24 15:14 289088]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-05-28 10:33 1506544]
"AdobeUpdater"="C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-03-01 11:37 2321600]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-07-17 21:54 116072]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd.exe" [2003-08-04 18:28 49152]
"Lexmark 5200 series"="C:\Program Files\Lexmark 5200 series\lxbtbmgr.exe" [2004-03-25 09:30 57344]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 16:40 155648]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 18:38 583048]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-02 22:46 13529088]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-02 22:46 86016]
"VTTimer"="VTTimer.exe" [2005-03-07 15:33 53248 C:\WINDOWS\system32\VTTimer.exe]
"VTTrayp"="VTtrayp.exe" [2005-03-11 05:33 147456 C:\WINDOWS\system32\VTTrayp.exe]
"nwiz"="nwiz.exe" [2008-05-02 22:46 1630208 C:\WINDOWS\system32\nwiz.exe]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2003-09-16 06:19:24 237568]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 02:01:04 83360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 10:13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\BitTorrent\\bittorrent.exe"=
"C:\\Program Files\\DNA\\btdna.exe"=


*Newly Created Service* - COMHOST
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-DriverUpdaterPro - C:\Program Files\XPC Tools\Driver Updater Pro\DriverUpdaterPro.exe
HKLM-Run-POINTER - point32.exe
HKLM-Run-Cmaudio - cmicnfg.cpl,CMICtrlWnd


**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-01 11:54:13
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\CCPROXY.EXE
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Lexmark 5200 Series\lxbtbmon.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
.
**************************************************************************
.
Completion time: 2008-07-01 12:03:23 - machine was rebooted
ComboFix-quarantined-files.txt 2008-07-01 16:03:11

Pre-Run: 30,918,651,904 bytes free
Post-Run: 31,015,792,640 bytes free

172 --- E O F --- 2008-06-20 12:28:27

[greyknight17]

Do you know what this folder is for?

C:\Program Files\temp01

If unsure, do the following:

Open up your Notepad editor (Start->Run, type in notepad and click OK). Copy the text from the quotebox below into Notepad:

DirLook::
C:\Program Files\temp01

Save this as CFScript.txt in the same location as the ComboFix.exe tool.
Drag the CFScript.txt into ComboFix.exe
Follow the prompts. When finished, it shall produce a log for you. Post that log in your next reply.

Note: Do not click on combofix's window while it's running. That may cause it to stall.

[djpyst]

Not sure what that file is. It contains no data, but was created about the time that the computer was infected. Here is the second combofix log:

ComboFix 08-06-30.2 - Karen 2008-07-01 21:21:43.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.607 [GMT -4:00]
Running from: C:\Documents and Settings\Karen\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Karen\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-06-02 to 2008-07-02 )))))))))))))))))))))))))))))))
.

2008-06-29 15:27 . 2008-06-29 15:28 <DIR> d-------- C:\Program Files\Panda Security
2008-06-29 13:13 . 2008-06-29 13:13 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-06-29 13:13 . 2008-06-29 13:13 <DIR> d-------- C:\Documents and Settings\Karen\Application Data\Malwarebytes
2008-06-29 13:13 . 2008-06-29 13:13 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-06-29 13:13 . 2008-06-28 14:16 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-06-29 13:13 . 2008-06-28 14:16 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-06-29 13:12 . 2008-06-29 13:12 <DIR> d-------- C:\Program Files\Common Files\Download Manager
2008-06-27 12:37 . 2008-06-27 12:37 <DIR> d-------- C:\fsaua.data
2008-06-27 11:02 . 2008-06-27 11:02 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\SUPERAntiSpyware.com
2008-06-27 11:00 . 2008-06-27 11:00 <DIR> d-------- C:\Documents and Settings\Administrator
2008-06-27 09:36 . 2008-06-27 09:36 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-06-27 09:31 . 2008-06-27 09:32 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2008-06-27 09:31 . 2008-06-27 09:31 <DIR> d-------- C:\Documents and Settings\Karen\Application Data\SUPERAntiSpyware.com
2008-06-27 09:26 . 2008-06-27 09:26 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-06-27 09:22 . 2008-06-27 09:22 <DIR> d-------- C:\_OTMoveIt
2008-06-27 07:27 . 2008-06-27 09:55 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-06-27 07:27 . 2008-06-27 09:54 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-06-27 00:20 . 2008-06-27 09:06 <DIR> d-------- C:\Program Files\Enigma Software Group
2008-06-26 23:14 . 2008-06-27 00:16 <DIR> d-------- C:\WINDOWS\BDOSCAN8
2008-06-26 22:42 . 2008-06-26 23:02 <DIR> d-------- C:\VundoFix Backups
2008-06-26 10:26 . 2008-06-26 10:26 <DIR> d-------- C:\Program Files\ReflexiveArcade
2008-06-26 10:26 . 2008-06-26 18:52 <DIR> d-------- C:\Program Files\Mystery Case Files Prime Suspects
2008-06-26 10:26 . 2008-06-26 10:26 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Trymedia
2008-06-26 09:52 . 2008-06-26 09:54 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-06-24 15:14 . 2008-07-01 21:16 <DIR> d-------- C:\Documents and Settings\Karen\Application Data\BitTorrent
2008-06-24 15:13 . 2008-06-24 15:14 <DIR> d-------- C:\Program Files\DNA
2008-06-24 15:13 . 2008-06-24 15:14 <DIR> d-------- C:\Program Files\BitTorrent
2008-06-24 15:13 . 2008-07-01 21:17 <DIR> d-------- C:\Documents and Settings\Karen\Application Data\DNA
2008-06-20 10:11 . 2008-06-20 10:11 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\LightScribe
2008-06-19 20:40 . 2008-06-19 20:40 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Azureus
2008-06-19 20:39 . 2008-06-24 15:11 <DIR> d-------- C:\Documents and Settings\Karen\Application Data\Azureus
2008-06-16 15:10 . 2008-06-16 15:23 69 --a------ C:\WINDOWS\NeroDigital.ini
2008-06-12 05:49 . 2008-06-12 05:49 99,264 --a------ C:\WINDOWS\system32\drivers\AnyDVD.sys
2008-06-11 11:34 . 2008-06-13 09:10 272,128 --------- C:\WINDOWS\system32\drivers\bthport.sys
2008-06-11 11:34 . 2008-06-13 09:10 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
2008-06-03 21:37 . 2008-06-03 21:37 <DIR> d-------- C:\WINDOWS\nview
2008-06-03 21:37 . 2008-06-03 21:37 <DIR> d-------- C:\WINDOWS\nvidia icons
2008-06-03 21:37 . 2008-05-02 22:46 442,368 --a------ C:\WINDOWS\system32\nvudisp.exe
2008-06-03 21:37 . 2008-07-01 11:53 182,038 --a------ C:\WINDOWS\system32\nvapps.xml
2008-06-03 21:37 . 2008-05-02 22:46 181,895 --a------ C:\WINDOWS\system32\nvdsp.chm
2008-06-03 21:37 . 2008-05-02 22:46 121,529 --a------ C:\WINDOWS\system32\nvcpl.chm
2008-06-03 21:37 . 2008-05-02 22:46 116,384 --a------ C:\WINDOWS\system32\nv3d.chm
2008-06-03 21:37 . 2008-05-02 22:46 54,988 --a------ C:\WINDOWS\system32\nvmob.chm
2008-06-03 21:37 . 2008-05-02 22:46 18,070 --a------ C:\WINDOWS\system32\nvdisp.nvu
2008-06-03 21:36 . 2008-06-03 21:36 <DIR> d-------- C:\NVIDIA
2008-06-03 21:36 . 2008-04-30 17:27 442,368 --a------ C:\WINDOWS\system32\NVUNINST.EXE
2008-06-03 21:33 . 2008-06-03 21:33 <DIR> d-------- C:\Program Files\SystemRequirementsLab
2008-06-03 21:28 . 2008-05-02 22:46 6,554,496 --a------ C:\WINDOWS\system32\drivers\nv4_mini.sys
2008-06-03 21:28 . 2008-05-02 22:46 6,554,496 --a--c--- C:\WINDOWS\system32\dllcache\nv4_mini.sys
2008-06-03 21:28 . 2008-05-02 22:46 6,108,160 --a------ C:\WINDOWS\system32\nv4_disp.dll
2008-06-03 21:28 . 2004-08-04 00:56 4,274,816 --a--c--- C:\WINDOWS\system32\dllcache\nv4_disp.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-30 17:44 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-06-29 17:13 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-06-26 13:49 0 ----a-w C:\Program Files\temp01
2008-06-20 16:56 --------- d-----w C:\Program Files\Elaborate Bytes
2008-06-20 16:39 --------- d-----w C:\Program Files\SlySoft
2008-06-20 14:11 --------- d-----w C:\Documents and Settings\Karen\Application Data\Ahead
2008-05-30 23:56 805 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
2008-05-30 23:56 60,800 ----a-w C:\WINDOWS\system32\S32EVNT1.DLL
2008-05-30 23:56 123,952 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2008-05-30 23:56 10,671 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2008-05-30 23:56 --------- d-----w C:\Program Files\Symantec
2008-05-18 17:42 --------- d-----w C:\Program Files\Stamps.com Internet Postage
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
2008-05-07 05:18 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
2008-04-23 04:16 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2001-11-23 04:08 712,704 -c--a-r C:\WINDOWS\inf\OTHER\AUDIO3D.DLL
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

---- Directory of C:\Program Files\temp01 ----

C:\Program Files\temp01\


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-04-09 21:14 68856]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-12-23 19:05 143360]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-02-28 08:00 15360]
"AnyDVD"="C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe" [2008-06-14 12:38 2137024]
"BitTorrent DNA"="C:\Program Files\DNA\btdna.exe" [2008-06-24 15:14 289088]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-05-28 10:33 1506544]
"AdobeUpdater"="C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-03-01 11:37 2321600]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-07-17 21:54 116072]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd.exe" [2003-08-04 18:28 49152]
"Lexmark 5200 series"="C:\Program Files\Lexmark 5200 series\lxbtbmgr.exe" [2004-03-25 09:30 57344]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 16:40 155648]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 18:38 583048]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-02 22:46 13529088]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-02 22:46 86016]
"VTTimer"="VTTimer.exe" [2005-03-07 15:33 53248 C:\WINDOWS\system32\VTTimer.exe]
"VTTrayp"="VTtrayp.exe" [2005-03-11 05:33 147456 C:\WINDOWS\system32\VTTrayp.exe]
"nwiz"="nwiz.exe" [2008-05-02 22:46 1630208 C:\WINDOWS\system32\nwiz.exe]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2003-09-16 06:19:24 237568]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 02:01:04 83360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 10:13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\BitTorrent\\bittorrent.exe"=
"C:\\Program Files\\DNA\\btdna.exe"=


*Newly Created Service* - COMHOST
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-01 21:25:43
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-07-01 21:27:51
ComboFix-quarantined-files.txt 2008-07-02 01:27:34
ComboFix2.txt 2008-07-01 16:03:28

Pre-Run: 26,712,543,232 bytes free
Post-Run: 26,703,163,392 bytes free

149 --- E O F --- 2008-06-20 12:28:27

[greyknight17]

You may delete that folder -> C:\Program Files\temp01

I don't recommend using file sharing programs like BitTorrent and Azureus as they can contribute to malware infections. I see that these were installed around the same time you were infected as well....

Good job. Your log is clean.

To help prevent future spyware infections, read the Anti-Spyware Tutorial and use the tools provided.

Are there any problems now? If none, go to Start->Run, copy/paste in combofix /u and hit OK to remove it. You should be set to go.

[djpyst]

Thanks for all your help.

[greyknight17]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.