[newvibe]

Hi,
I downloaded a big package of garbage today onto my PC. I feel like such a dope, since it was completely my laziness - trusting the download.
Anyway, I've used Adaware from lavasoft, with no result. then followed the instructions I found in this forum and ran Malwarebytes followed by Super Antispyware, which got rid of most of the bad stuff that was going on, such as lots of Popups for antivirus and anti spyware downloads, a popup for Antivirus XP2008, which was downloaded already, warnings from the system tray, etc.

The remaining symptom that I see is that when I search from Google, the paid ads appear on the left, and when I click on a search result, I get a random website.

Thanks in advance for any help you can provide.
I set up a system restore point as directed and after running the programs listed above, I ran the HiJack This and got this result:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:27:43 PM, on 7/6/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\portsv.exe
C:\WINDOWS\Explorer.EXE
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe
C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WMP54Gv4.exe
C:\Documents and Settings\All Users\Application Data\yfsvcxul\mbqpefsz.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\D-Link\AirPlus G\AirGCFG.exe
C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: mysidesearch search enhancer - {94ae428c-20d6-4db5-8a26-a4406e12aaa2} - C:\WINDOWS\system32\rsftvrejdasbjaow.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [D-Link AirPlus G] C:\Program Files\D-Link\AirPlus G\AirGCFG.exe
O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [aghacuqc] C:\WINDOWS\system32\kzghsxsj.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKLM\..\Policies\Explorer\Run: [smDzif02Gq] C:\Documents and Settings\All Users\Application Data\yfsvcxul\mbqpefsz.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2....re/HPDEXAXO.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O21 - SSODL: ApiCmdCom - {7672D99D-5AFC-EDAE-CC21-0A94D0BAFC4E} - C:\Program Files\pxmqcxb\ApiCmdCom.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: Plug and Play (RPC) (PlugPlayRPC) - Unknown owner - C:\WINDOWS\portsv.exe
O23 - Service: WMP54Gv4SVC - GEMTEKS - C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe

--
End of file - 7197 bytes

[Advertisements]

Hi there,

Welcome to GeeksToGo. My name is RatHat, and I will help you get through the process of cleaning the malware from your computer.


OK firstly, I need you to print out each post I make so that you can refer to it while we fix your computer. This is because there will be times when you are unable to be online to read my instructions, and I will want you to do everything very carefully. I also need you to follow my instructions in the order that they are given. If however, you cannot carry out one of them, please continue on with the next and let me know what you were unsuccessful with. Please ensure you turn off word wrap in Notepad. To do this, open Notepad, choose Format, then Un-check Word Wrap. (Word Wrap makes reading your log difficult).

Next, I would like to make sure that you can view hidden files and folders;

• Click Start.
• Open My Computer.
• Select the Tools menu and click Folder Options.
• Select the View tab.
• Under the Hidden files and folders heading SELECT Show hidden files and folders.
• UNCHECK the Hide protected operating system files (recommended) option.
• UNCHECK the Hide extensions for known file types option.
• Click Yes to confirm.
• Click OK.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Please go to Jotti's malware scan

• Copy and paste the following file path into the "File to upload & scan"box on the top of the page:
  
  
  • C:\WINDOWS\system32\kzghsxsj.exe
• Click on the submit button
• When the scan is complete, highlight all the results and copy them into Notepad
• Save the Notepad file to your desktop as kzghsxsj.txt

Now do the same for this file:

C:\Program Files\pxmqcxb\ApiCmdCom.dll

Save the Notepad file to your desktop as ApiCmdCom.txt

Post the contents of both files in your next reply, and make sure to tell me which is which.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Please download ATF Cleaner by Atribune.Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Please download OTMoveIt2 by OldTimer.

• Save it to your desktop.
• Double-click OTMoveIt2.exe to run it.

Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):

C:\WINDOWS\portsv.exe
C:\WINDOWS\system32\rsftvrejdasbjaow.dll
C:\Documents and Settings\All Users\Application Data\yfsvcxul



Return to OTMoveIt, right click on the "Paste List of Files/Folders to be moved" window and choose Paste.

• Click the red Moveit! button.
• Open Notepad, and copy everything in the Results window to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy).
• Save the Notepad file to your Desktop as OTM.txt.
• Close OTMoveIt

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

Please include the contents of OTM.txt in your next reply.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Please run an online scan with Kaspersky WebScanner. Note: You must use Internet Explorer to run this scan.

Click the Accept button.

You will be promted to install an ActiveX component from Kaspersky, Click Yes.

• The program will launch and then begin downloading the latest definition files:
• Once the files have been downloaded click on NEXT
  
• Now click on Scan Settings
• In the scan settings make that the following are selected:
  • Scan using the following Anti-Virus database:
  Extended (if available otherwise Standard)
  
  • Scan Options:
  Scan Archives
  Scan Mail Bases
• Click OK
• Now under select a target to scan:Select My Computer
• This will program will start and scan your system.
• The scan will take a while so be patient and let it run.
• Once the scan is complete it will display the results if your system has been infected.
  
  • Now click on the Save Report As Text button:
• Under Save as type, choose Text file (*.txt)
• Save the file to your desktop as Kaspersky.txt
• Copy and paste that information in your next post.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Please download Deckard's System Scanner (DSS) and save it to your Desktop.

• Close all other windows before proceeding.
• Double-click on dss.exe and follow the prompts.
• When it has finished, DSS will open two Notepad files: main.txt and extra.txt
• Use Save As to save both Notepad files to your Desktop and post them in your next reply.

Note: A copy of these files can be found in you root drive, usually C:\Deckard\System Scanner\

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


So in your next reply, please include the following logs:

• The contents kzghsxsj.txt
• The contents of ApiCmdCom.txt
• The contents of OTM.txt
• The contents of Kaspersky.txt
• The contents of DSS main.txt
• The contents of DSS extra.txt

Note that you will need to make three or four posts to ensure all the logs are complete.

Regards,
RatHat

[RatHat]

Hi there,

Welcome to GeeksToGo. My name is RatHat, and I will help you get through the process of cleaning the malware from your computer.


OK firstly, I need you to print out each post I make so that you can refer to it while we fix your computer. This is because there will be times when you are unable to be online to read my instructions, and I will want you to do everything very carefully. I also need you to follow my instructions in the order that they are given. If however, you cannot carry out one of them, please continue on with the next and let me know what you were unsuccessful with. Please ensure you turn off word wrap in Notepad. To do this, open Notepad, choose Format, then Un-check Word Wrap. (Word Wrap makes reading your log difficult).

Next, I would like to make sure that you can view hidden files and folders;

• Click Start.
• Open My Computer.
• Select the Tools menu and click Folder Options.
• Select the View tab.
• Under the Hidden files and folders heading SELECT Show hidden files and folders.
• UNCHECK the Hide protected operating system files (recommended) option.
• UNCHECK the Hide extensions for known file types option.
• Click Yes to confirm.
• Click OK.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Please go to Jotti's malware scan

• Copy and paste the following file path into the "File to upload & scan"box on the top of the page:
  
  
  • C:\WINDOWS\system32\kzghsxsj.exe
• Click on the submit button
• When the scan is complete, highlight all the results and copy them into Notepad
• Save the Notepad file to your desktop as kzghsxsj.txt

Now do the same for this file:

C:\Program Files\pxmqcxb\ApiCmdCom.dll

Save the Notepad file to your desktop as ApiCmdCom.txt

Post the contents of both files in your next reply, and make sure to tell me which is which.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Please download ATF Cleaner by Atribune.Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Please download OTMoveIt2 by OldTimer.

• Save it to your desktop.
• Double-click OTMoveIt2.exe to run it.

Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):

C:\WINDOWS\portsv.exe
C:\WINDOWS\system32\rsftvrejdasbjaow.dll
C:\Documents and Settings\All Users\Application Data\yfsvcxul



Return to OTMoveIt, right click on the "Paste List of Files/Folders to be moved" window and choose Paste.

• Click the red Moveit! button.
• Open Notepad, and copy everything in the Results window to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy).
• Save the Notepad file to your Desktop as OTM.txt.
• Close OTMoveIt

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

Please include the contents of OTM.txt in your next reply.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Please run an online scan with Kaspersky WebScanner. Note: You must use Internet Explorer to run this scan.

Click the Accept button.

You will be promted to install an ActiveX component from Kaspersky, Click Yes.

• The program will launch and then begin downloading the latest definition files:
• Once the files have been downloaded click on NEXT
  
• Now click on Scan Settings
• In the scan settings make that the following are selected:
  • Scan using the following Anti-Virus database:
  Extended (if available otherwise Standard)
  
  • Scan Options:
  Scan Archives
  Scan Mail Bases
• Click OK
• Now under select a target to scan:Select My Computer
• This will program will start and scan your system.
• The scan will take a while so be patient and let it run.
• Once the scan is complete it will display the results if your system has been infected.
  
  • Now click on the Save Report As Text button:
• Under Save as type, choose Text file (*.txt)
• Save the file to your desktop as Kaspersky.txt
• Copy and paste that information in your next post.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Please download Deckard's System Scanner (DSS) and save it to your Desktop.

• Close all other windows before proceeding.
• Double-click on dss.exe and follow the prompts.
• When it has finished, DSS will open two Notepad files: main.txt and extra.txt
• Use Save As to save both Notepad files to your Desktop and post them in your next reply.

Note: A copy of these files can be found in you root drive, usually C:\Deckard\System Scanner\

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


So in your next reply, please include the following logs:

• The contents kzghsxsj.txt
• The contents of ApiCmdCom.txt
• The contents of OTM.txt
• The contents of Kaspersky.txt
• The contents of DSS main.txt
• The contents of DSS extra.txt

Note that you will need to make three or four posts to ensure all the logs are complete.

Regards,
RatHat

[newvibe]

Thank you so much. I am pasting the text of the files below:

kzghsxsj.txt
The file you uploaded is 0 bytes. It is very likely a firewall or a piece of malware is prohibiting you from uploading this file

ApiCmdCom.txt
Scan taken on 07 Jul 2008 12:38:21 (GMT)
A-Squared
Found nothing
AntiVir
Found nothing
ArcaVir
Found nothing
Avast
Found nothing
AVG Antivirus
Found nothing
BitDefender
Found nothing
ClamAV
Found nothing
CPsecure
Found nothing
Dr.Web
Found nothing
F-Prot Antivirus
Found nothing
F-Secure Anti-Virus
Found nothing
Fortinet
Found nothing
Ikarus
Found nothing
Kaspersky Anti-Virus
Found nothing
NOD32
Found nothing
Norman Virus Control
Found nothing
Panda Antivirus
Found nothing
Sophos Antivirus
Found Mal/EncPk-DG
VirusBuster
Found nothing
VBA32
Found nothing

OMT.txt
C:\WINDOWS\portsv.exe moved successfully.
C:\WINDOWS\system32\rsftvrejdasbjaow.dll unregistered successfully.
C:\WINDOWS\system32\rsftvrejdasbjaow.dll moved successfully.
C:\Documents and Settings\All Users\Application Data\yfsvcxul moved successfully.

OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 07072008_084522

kaspersky.txt
--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Monday, July 7, 2008
Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Monday, July 07, 2008 12:21:10
Records in database: 920982
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\

Scan statistics:
Files scanned: 89760
Threat name: 14
Infected objects: 36
Suspicious objects: 0
Duration of the scan: 01:37:53


File name / Threat name / Threats count
C:\Program Files\rhcp2vj0e9bc\rhcp2vj0e9bc.exe/C:\Program Files\rhcp2vj0e9bc\rhcp2vj0e9bc.exe Infected: not-a-virus:FraudTool.Win32.AntivirusXP2008.a 1
C:\WINDOWS\system32\pphct2vj0e9bc.exe/C:\WINDOWS\system32\pphct2vj0e9bc.exe Infected: not-a-virus:FraudTool.Win32.MalwareProtector.d 1
C:\Documents and Settings\Administrator\.housecall6.6\Quarantine\msiexec[1].exe.bac_a02928 Infected: Trojan-Clicker.Win32.Agent.tg 1
C:\Documents and Settings\Administrator\.housecall6.6\Quarantine\syswcc32.exe.bac_a02928 Infected: not-a-virus:AdWare.Win32.WebHancer.423 1
C:\Documents and Settings\Administrator\.housecall6.6\Quarantine\syswcc32.exe.bac_a02928 Infected: not-a-virus:AdWare.Win32.WebHancer.390 3
C:\Documents and Settings\Administrator\.housecall6.6\Quarantine\syswcc32.exe.bac_a03420 Infected: not-a-virus:AdWare.Win32.WebHancer.423 1
C:\Documents and Settings\Administrator\.housecall6.6\Quarantine\syswcc32.exe.bac_a03420 Infected: not-a-virus:AdWare.Win32.WebHancer.390 3
C:\Documents and Settings\Administrator\.housecall6.6\Quarantine\syswcc32[1].exe.bac_a02928 Infected: not-a-virus:AdWare.Win32.WebHancer.423 1
C:\Documents and Settings\Administrator\.housecall6.6\Quarantine\syswcc32[1].exe.bac_a02928 Infected: not-a-virus:AdWare.Win32.WebHancer.390 3
C:\Documents and Settings\Administrator\.housecall6.6\Quarantine\syswcc32[1].exe.bac_a03420 Infected: not-a-virus:AdWare.Win32.WebHancer.423 1
C:\Documents and Settings\Administrator\.housecall6.6\Quarantine\syswcc32[1].exe.bac_a03420 Infected: not-a-virus:AdWare.Win32.WebHancer.390 3
C:\Documents and Settings\Administrator\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Quarantine\QUAR1.55542 Infected: Trojan-Clicker.Win32.Agent.tg 1
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Outlook\Outlook.pst Infected: Email-Worm.Win32.Zhelatin.a 1
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Outlook\Outlook.pst Infected: Trojan-Downloader.Win32.Tibs.kj 1
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Outlook\Outlook.pst Infected: Email-Worm.Win32.Zhelatin.ab 1
C:\Program Files\rhcp2vj0e9bc\rhcp2vj0e9bc.exe Infected: not-a-virus:FraudTool.Win32.AntivirusXP2008.a 1
C:\temp\outlook express\Deleted Items.dbx Infected: Email-Worm.Win32.Zhelatin.a 1
C:\temp\outlook express\Deleted Items.dbx Infected: Trojan-Downloader.Win32.Tibs.kj 1
C:\temp\outlook express\Deleted Items.dbx Infected: Email-Worm.Win32.Zhelatin.ab 1
C:\temp\StreamViewer\Setup-SopCast-2.0.4-2007-11-26.exe Infected: Trojan-Downloader.Win32.Agent.uwu 1
C:\temp\StreamViewer.zip Infected: Trojan-Downloader.Win32.Agent.uwu 1
C:\WINDOWS\444.470 Infected: Trojan.Win32.DNSChanger.eys 1
C:\WINDOWS\444.471 Infected: Trojan.Win32.DNSChanger.eys 1
C:\WINDOWS\system32\1030\icmsetup.exe Infected: Trojan.Win32.DNSChanger.eyr 1
C:\WINDOWS\system32\olixds06\olixds061083.exe Infected: Trojan-Downloader.Win32.VB.eyc 1
C:\WINDOWS\system32\pphct2vj0e9bc.exe Infected: not-a-virus:FraudTool.Win32.MalwareProtector.d 1
C:\_OTMoveIt\MovedFiles\07072008_084522\Documents and Settings\All Users\Application Data\yfsvcxul\mbqpefsz.exe Infected: Trojan.Win32.Obfuscated.gx 1
C:\_OTMoveIt\MovedFiles\07072008_084522\WINDOWS\portsv.exe Infected: Trojan.Win32.Agent.sdd 1

The selected area was scanned.

[newvibe]

Thanks very much. here is another reply containing more data:

main.txt
Deckard's System Scanner v20071014.68
Run by Administrator on 2008-07-07 10:40:08
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Successfully created a Deckard's System Scanner Restore Point.


-- Last 2 Restore Point(s) --
2: 2008-07-07 14:40:20 UTC - RP2 - Deckard's System Scanner Restore Point
1: 2008-07-07 12:26:20 UTC - RP1 - System Checkpoint


Backed up registry hives.
Performed disk cleanup.

Total Physical Memory: 503 MiB (512 MiB recommended).


-- HijackThis (run as Administrator.exe) ---------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:41:25 AM, on 7/7/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\portsv.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe
C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WMP54Gv4.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\All Users\Application Data\yfsvcxul\mbqpefsz.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\D-Link\AirPlus G\AirGCFG.exe
C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
C:\WINDOWS\system32\lphct2vj0e9bc.exe
C:\Program Files\rhcp2vj0e9bc\rhcp2vj0e9bc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\WINDOWS\system32\pphct2vj0e9bc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Administrator\Desktop\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Administrator.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [D-Link AirPlus G] C:\Program Files\D-Link\AirPlus G\AirGCFG.exe
O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
O4 - HKLM\..\Run: [lphct2vj0e9bc] C:\WINDOWS\system32\lphct2vj0e9bc.exe
O4 - HKLM\..\Run: [SMrhcp2vj0e9bc] C:\Program Files\rhcp2vj0e9bc\rhcp2vj0e9bc.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [aghacuqc] C:\WINDOWS\system32\kzghsxsj.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [taamijre] C:\WINDOWS\system32\bszanejk.exe
O4 - HKLM\..\Policies\Explorer\Run: [smDzif02Gq] C:\Documents and Settings\All Users\Application Data\yfsvcxul\mbqpefsz.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2....re/HPDEXAXO.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O21 - SSODL: ApiCmdCom - {7672D99D-5AFC-EDAE-CC21-0A94D0BAFC4E} - C:\Program Files\pxmqcxb\ApiCmdCom.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: Plug and Play (RPC) (PlugPlayRPC) - Unknown owner - C:\WINDOWS\portsv.exe (file missing)
O23 - Service: WMP54Gv4SVC - GEMTEKS - C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe

--
End of file - 7487 bytes

-- File Associations -----------------------------------------------------------

.js - JSFile - DefaultIcon - "C:\Program Files\Macromedia\Dreamweaver 8\dreamweaver.exe",2
.reg - regfile - shell\open\command - regedit.exe "%1" %*
.scr - scrfile - shell\open\command - "%1" %*


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R1 SASDIFSV - c:\program files\superantispyware\sasdifsv.sys
R1 SASKUTIL - c:\program files\superantispyware\saskutil.sys
R2 ANIO (ANIO Service) - c:\windows\system32\anio.sys <Not Verified; Alpha Networks Inc.; ANIO (NT5) Driver>
R3 GTNDIS5 (GTNDIS5 NDIS Protocol Driver) - c:\windows\system32\gtndis5.sys <Not Verified; Printing Communications Assoc., Inc. (PCAUSA); PCAUSA Rawether for Windows>
R3 SASENUM - c:\program files\superantispyware\sasenum.sys <Not Verified; SuperAdBlocker, Inc.; SuperAntiSpyware>

S1 amdk77 - c:\windows\system32\drivers\amdk77.sys (file missing)


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 PlugPlayRPC (Plug and Play (RPC)) - c:\windows\portsv.exe service (file missing)

S2 ANIWZCSdService (ANIWZCSd Service) - c:\program files\ani\aniwzcs2 service\aniwzcsds.exe <Not Verified; Alpha Networks Inc.; ANIWZCS2 Service Launcher (NT)>


-- Device Manager: Disabled ----------------------------------------------------

No disabled devices found.


-- Files created between 2008-06-07 and 2008-07-07 -----------------------------

2008-07-06 21:51:35 94208 --a------ C:\WINDOWS\system32\pphct2vj0e9bc.exe
2008-07-06 21:51:34 0 d-------- C:\Documents and Settings\Administrator\Application Data\rhcp2vj0e9bc
2008-07-06 21:51:27 0 d-------- C:\Program Files\rhcp2vj0e9bc
2008-07-06 21:51:09 60928 --a------ C:\WINDOWS\system32\blphct2vj0e9bc.scr <Not Verified; Sysinternals; Sysinternals Blue Screen>
2008-07-06 21:51:03 109056 --a------ C:\WINDOWS\system32\lphct2vj0e9bc.exe
2008-07-06 21:26:32 0 d-------- C:\Program Files\Trend Micro
2008-07-06 21:02:17 0 --a------ C:\WINDOWS\ORUN32.EXE
2008-07-06 21:02:13 0 --a------ C:\WINDOWS\system32\CMMGR32.EXE
2008-07-06 20:58:28 0 d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-07-06 20:58:21 0 d-------- C:\Program Files\SUPERAntiSpyware
2008-07-06 20:58:21 0 d-------- C:\Documents and Settings\Administrator\Application Data\SUPERAntiSpyware.com
2008-07-06 20:42:19 0 d-------- C:\Documents and Settings\Administrator\Application Data\Malwarebytes
2008-07-06 20:42:15 0 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-07-06 20:42:13 0 d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-07-06 20:41:42 0 d-------- C:\Program Files\Common Files\Download Manager
2008-07-06 18:52:26 0 d-------- C:\Program Files\Panda Security
2008-07-06 14:15:53 0 d-------- C:\Documents and Settings\Administrator\.housecall6.6
2008-07-06 13:12:04 0 d-------- C:\WINDOWS\system32\1374
2008-07-06 12:30:36 0 d-------- C:\Program Files\Lavasoft
2008-07-06 12:30:35 0 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-07-06 12:28:11 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-07-06 12:24:46 0 d-------- C:\Documents and Settings\LocalService\Application Data\AdobeUM
2008-07-06 12:24:42 0 d-------- C:\Documents and Settings\LocalService\My Documents
2008-07-06 12:19:16 0 d--hs---- C:\Documents and Settings\LocalService\UserData
2008-07-06 12:17:34 0 d-------- C:\Documents and Settings\LocalService\Application Data\Google
2008-07-06 12:11:59 0 d--hs---- C:\WINDOWS\dGVtcA
2008-07-06 12:11:45 0 d-------- C:\WINDOWS\system32\tfig
2008-07-06 12:11:45 0 d-------- C:\WINDOWS\system32\net
2008-07-06 12:11:45 0 d-------- C:\WINDOWS\system32\cREG
2008-07-06 12:11:45 0 d-------- C:\WINDOWS\system32\1030
2008-07-06 12:11:37 0 d-------- C:\WINDOWS\system32\olixds06
2008-07-06 12:11:12 0 d-------- C:\Program Files\pxmqcxb
2008-07-06 12:10:48 0 d-------- C:\Documents and Settings\LocalService\Application Data\Macromedia
2008-07-06 12:10:48 0 d-------- C:\Documents and Settings\LocalService\Application Data\Adobe
2008-07-06 12:10:42 4 --a------ C:\WINDOWS\system32\hljwugsf.bin
2008-07-06 12:10:42 0 dr------- C:\Documents and Settings\LocalService\Favorites
2008-07-03 08:43:41 0 d-------- C:\Program Files\Microsoft Visual Studio 9.0
2008-07-03 08:41:53 0 d-------- C:\Program Files\Microsoft Web Designer Tools
2008-07-03 08:41:52 0 d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-07-03 08:41:10 0 d-------- C:\Program Files\Microsoft SDKs
2008-07-03 08:38:41 0 d-------- C:\Program Files\MSBuild
2008-07-03 08:38:32 0 d-------- C:\WINDOWS\system32\XPSViewer
2008-07-03 08:38:24 0 d-------- C:\Program Files\Reference Assemblies
2008-07-03 08:31:59 0 d-------- C:\Program Files\MSXML 6.0
2008-07-03 08:14:54 0 d-------- C:\Program Files\Microsoft Silverlight
2008-06-29 20:57:07 0 d-------- C:\Program Files\MSPress
2008-06-27 08:48:01 0 d-------- C:\WINDOWS\system32\Adobe
2008-06-18 17:17:55 94208 --a------ C:\WINDOWS\system32\GTW32N50.dll
2008-06-18 17:17:55 15872 --a------ C:\WINDOWS\system32\GTNDIS5.sys <Not Verified; Printing Communications Assoc., Inc. (PCAUSA); PCAUSA Rawether for Windows>
2008-06-18 17:17:43 0 d-------- C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor
2008-06-07 14:50:39 0 d-------- C:\Program Files\Jufsoft
2008-06-07 10:55:11 0 d-------- C:\Documents and Settings\Administrator\Application Data\Walgreens


-- Find3M Report ---------------------------------------------------------------

2008-07-06 20:41:42 0 d-------- C:\Program Files\Common Files
2008-07-06 12:35:44 0 d-------- C:\Program Files\Google
2008-07-03 08:55:03 0 d-------- C:\Program Files\Microsoft SQL Server
2008-07-03 08:50:49 0 d-------- C:\Program Files\Microsoft.NET
2008-06-29 20:57:10 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-06-27 18:04:18 0 d-------- C:\Program Files\Common Files\Symantec Shared
2008-06-27 08:47:17 0 d-------- C:\Documents and Settings\Administrator\Application Data\AdobeUM
2008-05-27 13:59:40 0 d-------- C:\Program Files\Java


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [04/04/2005 11:22 PM]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [04/04/2005 11:19 PM]
"Persistence"="C:\WINDOWS\system32\igfxpers.exe" [04/04/2005 11:23 PM]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [06/23/2005 04:31 PM]
"DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [09/08/2005 05:20 AM]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [07/27/2004 04:50 PM]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [07/27/2004 04:50 PM]
"Synchronization Manager"="C:\WINDOWS\system32\mobsync.exe" [08/04/2004 05:00 AM]
"vptray"="C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe" [05/21/2003 01:21 AM]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [02/22/2008 04:25 AM]
"D-Link AirPlus G"="C:\Program Files\D-Link\AirPlus G\AirGCFG.exe" [03/29/2005 11:41 AM]
"ANIWZCS2Service"="C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe" [12/16/2004 05:49 PM]
"lphct2vj0e9bc"="C:\WINDOWS\system32\lphct2vj0e9bc.exe" [07/06/2008 09:51 PM]
"SMrhcp2vj0e9bc"="C:\Program Files\rhcp2vj0e9bc\rhcp2vj0e9bc.exe" [07/06/2008 04:08 AM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [10/13/2004 12:24 PM]
"aghacuqc"="C:\WINDOWS\system32\kzghsxsj.exe" []
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 05:00 AM]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [02/27/2007 11:39 AM]
"taamijre"="C:\WINDOWS\system32\bszanejk.exe" []

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Acrobat Assistant.lnk - C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [10/24/2003 12:37:56 AM]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"=1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"=0 (0x0)
"NoDispScrSavPage"=1 (0x1)
"NoDispBackgroundPage"=1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\Run]
"smDzif02Gq"=C:\Documents and Settings\All Users\Application Data\yfsvcxul\mbqpefsz.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [12/20/2006 12:55 PM 77824]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"ApiCmdCom"= {7672D99D-5AFC-EDAE-CC21-0A94D0BAFC4E} - C:\Program Files\pxmqcxb\ApiCmdCom.dll [07/06/2008 12:11 PM 114688]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 02/27/2007 11:39 AM 282624 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

*Newly Created Service* - GTNDIS5



-- End of Deckard's System Scanner: finished at 2008-07-07 10:42:17 ------------



extra.txt
Deckard's System Scanner v20071014.68
Extra logfile - please post this as an attachment with your post.
--------------------------------------------------------------------------------

-- System Information ----------------------------------------------------------

Microsoft Windows XP Professional (build 2600) SP 2.0
Architecture: X86; Language: English

CPU 0: Intel® Pentium® 4 CPU 2.80GHz
Percentage of Memory in Use: 55%
Physical Memory (total/avail): 502.08 MiB / 221.04 MiB
Pagefile Memory (total/avail): 1995.29 MiB / 1437.98 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1928.23 MiB

C: is Fixed (NTFS) - 148.96 GiB total, 132.04 GiB free.
D: is CDROM (No Media)

\\.\PHYSICALDRIVE0 - WDC WD1600JS-75NCB3 - 149.01 GiB - 2 partitions
\PARTITION0 - Unknown - 39.19 MiB
\PARTITION1 (bootable) - Installable File System - 148.96 GiB - C:



-- Security Center -------------------------------------------------------------

AUOptions is scheduled to auto-install.
Windows Internal Firewall is enabled.

FirstRunDisabled is set.


[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\WINDOWS\\system32\\fxsclnt.exe"="C:\\WINDOWS\\system32\\fxsclnt.exe:*:Enabled:Microsoft Fax Console"
"C:\\Program Files\\NetMeeting\\conf.exe"="C:\\Program Files\\NetMeeting\\conf.exe:*:Enabled:Windows® NetMeeting®"
"C:\\Program Files\\NEC Infrontia\\IPK II ACD MIS Server\\MISServer.exe"="C:\\Program Files\\NEC Infrontia\\IPK II ACD MIS Server\\MISServer.exe:*:Enabled: "
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Macromedia\\Dreamweaver 8\\Dreamweaver.exe"="C:\\Program Files\\Macromedia\\Dreamweaver 8\\Dreamweaver.exe:*:Enabled:Dreamweaver 8"
"C:\\Program Files\\ACT\\ActUpdt.exe"="C:\\Program Files\\ACT\\ActUpdt.exe:*:Enabled:ACT! Update"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:µTorrent"


-- Environment Variables -------------------------------------------------------

ALLUSERSPROFILE=C:\Documents and Settings\All Users
APPDATA=C:\Documents and Settings\Administrator\Application Data
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=CHADOFWAR
ComSpec=C:\WINDOWS\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Documents and Settings\Administrator
LOGONSERVER=\\CHADOFWAR
NUMBER_OF_PROCESSORS=1
OS=Windows_NT
Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Program Files\Microsoft SQL Server\80\Tools\Binn\;c:\Program Files\Microsoft SQL Server\90\Tools\binn\
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 15 Model 4 Stepping 9, GenuineIntel
PROCESSOR_LEVEL=15
PROCESSOR_REVISION=0409
ProgramFiles=C:\Program Files
PROMPT=$P$G
SESSIONNAME=Console
SonicCentral=C:\Program Files\Common Files\Sonic Shared\Sonic Central\
SystemDrive=C:
SystemRoot=C:\WINDOWS
TEMP=C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp
TMP=C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp
USERDOMAIN=CHADOFWAR
USERNAME=Administrator
USERPROFILE=C:\Documents and Settings\Administrator
windir=C:\WINDOWS


-- User Profiles ---------------------------------------------------------------

temp (new local, admin)
chadp (new local, admin)
Administrator (admin)
chad (admin)
marshall (new local, net ready)
allan (new local, net ready)
administrator.NFS (new local, admin, net ready)


-- Add/Remove Programs ---------------------------------------------------------

--> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Hewlett-Packard\HP PrecisionScan\Uninst.isu"
--> C:\WINDOWS\IsUninst.exe -fC:\WINDOWS\orun32.isu
--> C:\WINDOWS\system32\\MSIEXEC.EXE /x {075473F5-846A-448B-BCB3-104AA1760205}
--> C:\WINDOWS\system32\\MSIEXEC.EXE /x {1206EF92-2E83-4859-ACCB-2048C3CB7DA6}
--> C:\WINDOWS\system32\\MSIEXEC.EXE /x {AB708C9B-97C8-4AC9-899B-DBF226AC9382}
--> C:\WINDOWS\system32\\MSIEXEC.EXE /x {B12665F4-4E93-4AB4-B7FC-37053B524629}
--> MsiExec.exe /I{403EF592-953B-4794-BCEF-ECAB835C2095}
--> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
ACT! --> C:\WINDOWS\IsUninstAct.exe -f"C:\Program Files\ACT\Uninst6.isu" -c"C:\Program Files\ACT\UNINSTAL.DLL"
Ad-Aware --> MsiExec.exe /I{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}
Adobe Acrobat - Reader 6.0.2 Update --> MsiExec.exe /I{AC76BA86-0000-0000-0000-6028747ADE01}
Adobe Acrobat 6.0.1 Standard --> MsiExec.exe /I{AC76BA86-1033-0000-BA7E-000000000001}
Adobe Acrobat and Reader 6.0.3 Update --> MsiExec.exe /I{AC76BA86-0000-7EC8-7489-000000000603}
Adobe Acrobat and Reader 6.0.4 Update --> MsiExec.exe /I{AC76BA86-0000-7EC8-7489-000000000604}
Adobe Acrobat and Reader 6.0.5 Update --> MsiExec.exe /I{AC76BA86-0000-7EC8-7489-000000000605}
Adobe Acrobat and Reader 6.0.6 Update --> MsiExec.exe /I{AC76BA86-0000-7EC8-7489-000000000606}
Adobe Flash Player ActiveX --> C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Reader 6.0.1 --> MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A00000000001}
Adobe Shockwave Player 11 --> C:\WINDOWS\system32\adobe\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Adobe\SHOCKW~1\Install.log
AirPlus G --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\10\INTEL3~1\IDriver.exe /M{2B7E4354-0492-460A-BDB1-1F59EE141025} /l1033
ANIO Service --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{7B5CE976-C7A9-4E38-A7F3-6C8EF025DD8E}\Setup.exe"
ANIWZCS2 Service --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{4C590030-7469-453E-8589-D15DA9D03F52}\Setup.exe"
AntivirXP08 --> "C:\Program Files\rhcp2vj0e9bc\uninstall.exe"
BadCopy Pro --> C:\PROGRA~1\Jufsoft\BadCopy\UNWISE.EXE C:\PROGRA~1\Jufsoft\BadCopy\INSTALL.LOG
Dell Software Uninstall --> C:\Program Files\Dell_HostCD\Install\x86\Uninstall.exe
High Definition Audio Driver Package - KB835221 --> C:\WINDOWS\$NtUninstallKB835221WXP$\spuninst\spuninst.exe
HijackThis 2.0.2 --> "C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Intel® Graphics Media Accelerator Driver --> RUNDLL32.EXE C:\WINDOWS\system32\ialmrem.dll,UninstallW2KIGfx2ID PCI\VEN_8086&DEV_2782 PCI\VEN_8086&DEV_2582
Intel® PRO Network Connections Drivers --> Prounstl.exe
Intel® PROSet for Wired Connections --> MsiExec.exe /I{83F793B5-8BBF-42FD-A8A6-868CB3E2AAEA}
IPK II ACD MIS Admin --> MsiExec.exe /I{2484EB0C-7F5F-405A-9A72-354B8895D733}
IPK II ACD MIS Monitor --> MsiExec.exe /I{051F9616-4320-4A8A-81F9-8C3FAD1C0216}
IPK II ACD MIS Reports --> MsiExec.exe /I{20E4D83C-9F80-4E9B-85CB-CC19E759655C}
IPK II ACD MIS Server --> MsiExec.exe /I{0BD34C32-73CC-4400-8CEB-A564D0A7D4A7}
J2SE Runtime Environment 5.0 Update 11 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150110}
Java 2 Runtime Environment, SE v1.4.2_03 --> MsiExec.exe /I{7148F0A8-6813-11D6-A77B-00B0D0142030}
Java™ 6 Update 2 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160020}
Java™ 6 Update 3 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160030}
Java™ 6 Update 5 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050}
Java™ SE Runtime Environment 6 Update 1 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160010}
Linksys Wireless-G PCI Adapter --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{4DDC3BED-CC68-44AA-B435-D727B620CA5B}\setup.exe" -l0x9
LiveUpdate 1.80 (Symantec Corporation) --> C:\Program Files\Symantec\LiveUpdate\LSETUP.EXE /U
Macromedia Dreamweaver 8 --> MsiExec.exe /I{0837A661-FEC3-48B3-876C-91E7D32048A9}
Macromedia Extension Manager --> MsiExec.exe /I{5546CDB5-2CE2-498B-B059-5B3BF81FC41F}
Macromedia Fireworks 8 --> MsiExec.exe /I{4C24A8C1-7CFA-4650-AF15-732F5BD7B46D}
Macromedia Flash 8 --> MsiExec.exe /I{2BD5C305-1B27-4D41-B690-7A61172D2FEB}
Macromedia Flash 8 Video Encoder --> MsiExec.exe /X{8BF2C401-02CE-424D-BC26-6C4F9FB446B6}
Macromedia Flash Player 8 Plugin --> MsiExec.exe /X{91057632-CA70-413C-B628-2D3CDBBB906B}
Malwarebytes' Anti-Malware --> "C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Microsoft Office Access 2003 --> MsiExec.exe /I{90150409-6000-11D3-8CFE-0150048383C9}
Microsoft Office Outlook 2003 with Business Contact Manager Update --> MsiExec.exe /I{BA68600E-96D9-4E92-80F2-26B9681B5A63}
Microsoft Office Shared MUI (English) 2007 --> MsiExec.exe /X{90120000-006E-0409-0000-0000000FF1CE}
Microsoft Office Shared Setup Metadata MUI (English) 2007 --> MsiExec.exe /X{90120000-0115-0409-0000-0000000FF1CE}
Microsoft Office Small Business Edition 2003 --> MsiExec.exe /I{91CA0409-6000-11D3-8CFE-0150048383C9}
Microsoft Office Visual Web Developer 2007 --> MsiExec.exe /X{90120000-0021-0000-0000-0000000FF1CE}
Microsoft Office Visual Web Developer MUI (English) 2007 --> MsiExec.exe /X{90120000-0021-0409-0000-0000000FF1CE}
Microsoft Silverlight --> MsiExec.exe /I{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft SQL Server 2005 --> "c:\Program Files\Microsoft SQL Server\90\Setup Bootstrap\ARPWrapper.exe" /Remove
Microsoft SQL Server 2005 Express Edition (SQLEXPRESS) --> MsiExec.exe /I{2AFFFDD7-ED85-4A90-8C52-5DA9EBDC9B8F}
Microsoft SQL Server 2005 Tools Express Edition --> MsiExec.exe /I{2750B389-A2D2-4953-99CA-27C1F2A8E6FD}
Microsoft SQL Server Database Publishing Wizard 1.2 --> MsiExec.exe /X{9A33B83D-FFC4-44CF-BEEF-632DECEF2FCD}
Microsoft SQL Server Desktop Engine (MICROSOFTSMLBIZ) --> MsiExec.exe /X{E09B48B5-E141-427A-AB0C-D3605127224A}
Microsoft SQL Server Native Client --> MsiExec.exe /I{F9B3DD02-B0B3-42E9-8650-030DFF0D133D}
Microsoft SQL Server Setup Support Files (English) --> MsiExec.exe /X{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}
Microsoft SQL Server VSS Writer --> MsiExec.exe /I{E9F44C98-B8B6-480F-AF7B-E42A0A46F4E3}
Microsoft Visual C Sharp .NET Step by Step Version 2003 eBook --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{E6DE4F95-AB96-4162-8C1A-09E2C0CD5639}\setup.exe"
Microsoft Visual Studio Web Authoring Component --> "C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall VISUALWEBDEVELOPER /dll OSETUP.DLL
Microsoft Visual Web Developer 2008 Express Edition - ENU --> C:\Program Files\Microsoft Visual Studio 9.0\Microsoft Visual Web Developer 2008 Express Edition - ENU\setup.exe
Microsoft Visual Web Developer 2008 Express Edition - ENU --> MsiExec.exe /X{19700927-105D-3812-8548-53EDA3F5A22D}
Microsoft Windows SDK for Visual Studio 2008 Express Tools for Web --> MsiExec.exe /X{3C7EEEC3-464F-3FE9-8795-3CC8B4EAD82A}
Mozilla Firefox (2.0.0.12) --> C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSXML 6.0 Parser (KB933579) --> MsiExec.exe /I{0A869A65-8C94-4F7C-A5C7-972D3C8CED9E}
MySidesearch Search Assistant Adzgalore --> C:\WINDOWS\system32\rsftvrejdasbjaow.dll-uninst.exe
Panda ActiveScan 2.0 --> C:\Program Files\Panda Security\ActiveScan 2.0\as2uninst.exe
Pdf995 --> C:\Program Files\TaxCut06\pdf995\setup.exe uninstall
PdfEdit995 --> C:\Program Files\TaxCut06\pdf995\res\utilities\thinsetup.exe - uninstall
PowerDVD OD --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\setup.exe" -uninstall
Quicken 2005 --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{2DBE41DD-2129-4C65-A3D3-5647236A60F3} anything
Roxio DLA --> MsiExec.exe /I{1206EF92-2E83-4859-ACCB-2048C3CB7DA6}
Roxio Express Labeler --> MsiExec.exe /I{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}
Roxio RecordNow Audio --> MsiExec.exe /I{AB708C9B-97C8-4AC9-899B-DBF226AC9382}
Roxio RecordNow Copy --> MsiExec.exe /I{B12665F4-4E93-4AB4-B7FC-37053B524629}
Roxio RecordNow Data --> MsiExec.exe /I{075473F5-846A-448B-BCB3-104AA1760205}
Search Assist --> MsiExec.exe /X{DF6A589A-7A1A-430C-9FF2-A0BDB42669DC}
Security Update for Step By Step Interactive Training (KB898458) --> "C:\WINDOWS\$NtUninstallKB898458$\spuninst\spuninst.exe"
Security Update for Step By Step Interactive Training (KB923723) --> "C:\WINDOWS\$NtUninstallKB923723$\spuninst\spuninst.exe"
Sonic Update Manager --> MsiExec.exe /I{30465B6C-B53F-49A1-9EBA-A3F187AD502E}
SUPERAntiSpyware Free Edition --> MsiExec.exe /X{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}
Symantec AntiVirus Client --> MsiExec.exe /X{0EFC6259-3AD8-4CD2-BC57-D4937AF5CC0E}
TaxCut Premium 2006 --> C:\PROGRA~1\TaxCut06\Program\removetc.exe
URL Assistant --> regsvr32 /u /s "C:\Program Files\BAE\BAE.dll"
Windows Imaging Component --> "C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe"
XML Paper Specification Shared Components Pack 1.0 -->


-- Application Event Log -------------------------------------------------------

Event Record #/Type6067 / Warning
Event Submitted/Written: 07/07/2008 08:26:12 AM
Event ID/Source: 32068 / Microsoft Fax
Event Description:
The outgoing routing rule is not valid because it cannot find a valid device. The outgoing faxes that use this rule will not be routed. Verify that the targeted device or devices (if routed to a group of devices) is connected and installed correctly, and turned on. If routed to a group, verify that the group is configured correctly.
Country/region code: '*'
Area code: '*'

Event Record #/Type6066 / Warning
Event Submitted/Written: 07/07/2008 08:26:12 AM
Event ID/Source: 32026 / Microsoft Fax
Event Description:
Fax Service failed to initialize any assigned fax devices (virtual or TAPI).
No faxes can be sent or received until a fax device is installed.

Event Record #/Type6045 / Warning
Event Submitted/Written: 07/07/2008 08:26:05 AM
Event ID/Source: 19011 / MSSQL$MICROSOFTSMLBIZ
Event Description:
(SpnRegister) : Error 1355

Event Record #/Type6043 / Warning
Event Submitted/Written: 07/07/2008 08:26:05 AM
Event ID/Source: 3 / SQLBrowser
Event Description:
The configuration of the AdminConnection\TCP protocol in the SQL instance SQLEXPRESS is not valid.

Event Record #/Type6020 / Warning
Event Submitted/Written: 07/06/2008 09:20:53 PM
Event ID/Source: 32068 / Microsoft Fax
Event Description:
The outgoing routing rule is not valid because it cannot find a valid device. The outgoing faxes that use this rule will not be routed. Verify that the targeted device or devices (if routed to a group of devices) is connected and installed correctly, and turned on. If routed to a group, verify that the group is configured correctly.
Country/region code: '*'
Area code: '*'



-- Security Event Log ----------------------------------------------------------

No Errors/Warnings found.


-- System Event Log ------------------------------------------------------------

Event Record #/Type9748 / Warning
Event Submitted/Written: 07/07/2008 08:26:13 AM
Event ID/Source: 1003 / Dhcp
Event Description:
Your computer was not able to renew its address from the network (from the
DHCP Server) for the Network Card with network address 0016B65D017E. The following
error occurred:
%%1223.
Your computer will continue to try and obtain an address on its own from
the network address (DHCP) server.

Event Record #/Type9743 / Error
Event Submitted/Written: 07/07/2008 08:26:10 AM
Event ID/Source: 7000 / Service Control Manager
Event Description:
The ASPI32 service failed to start due to the following error:
%%2

Event Record #/Type9709 / Error
Event Submitted/Written: 07/06/2008 09:20:51 PM
Event ID/Source: 7000 / Service Control Manager
Event Description:
The ASPI32 service failed to start due to the following error:
%%2

Event Record #/Type9672 / Error
Event Submitted/Written: 07/06/2008 08:55:38 PM
Event ID/Source: 7000 / Service Control Manager
Event Description:
The ASPI32 service failed to start due to the following error:
%%2

Event Record #/Type9649 / Error
Event Submitted/Written: 07/06/2008 00:36:21 PM
Event ID/Source: 7034 / Service Control Manager
Event Description:
The Command Service service terminated unexpectedly. It has done this 1 time(s).



-- End of Deckard's System Scanner: finished at 2008-07-07 10:42:17 ------------

[RatHat]

We need to get rid of one of the services running on your machine. To do this, copy (Ctrl +C) and paste (Ctrl +V) the text in the code box below to Notepad.

@echo off
sc stop PlugPlayRPC
sc delete PlugPlayRPC
del service.cmd and exit

Save it to your desktop as File name: service.cmd
Save as type: All Files

Once done, double click service.cmd to run it. A command window will open briefly, then close. This is quite normal.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Next, I need you to run a small registry script to clean up some entries. Please copy the entire contents of the codebox below into Notepad:

• Open Notepad
• Copy the contents of the codebox below using CTRL C

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"lphct2vj0e9bc"=-
"SMrhcp2vj0e9bc"=-

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"aghacuqc"=-
"taamijre"=-

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"=-

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"NoDispScrSavPage"=0
"NoDispBackgroundPage"=0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
"smDzif02Gq"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion]
"rhcp2vj0e9bc"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"AntivirXP08"=-

[-HKEY_LOCAL_MACHINE\SOFTWARE\rhcp2vj0e9bc]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\rhcp2vj0e9bc]

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\\Program Files\\uTorrent\\uTorrent.exe"=-

• Now return to Notepad and use CTRL V to paste the script
• Verify that you have pasted the complete script
• Save the Notepad file to your Desktop as FixReg.reg using Save as Type: All files
• Locate FixReg.reg on your desktop
• Double click to run, and when prompted Allow the file to merge with your registry
• OK your way out.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Run OTMoveIt2 again:

• Double-click OTMoveIt2.exe to run it.

Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):

C:\Program Files\rhcp2vj0e9bc\rhcp2vj0e9bc.exe
C:\temp\outlook express\Deleted Items.dbx
C:\temp\StreamViewer\Setup-SopCast-2.0.4-2007-11-26.exe
C:\temp\StreamViewer.zip
C:\WINDOWS\444.470
C:\WINDOWS\444.471
C:\WINDOWS\system32\1030\icmsetup.exe
C:\WINDOWS\system32\olixds06\olixds061083.exe
C:\WINDOWS\system32\pphct2vj0e9bc.exe
C:\WINDOWS\portsv.exe
C:\WINDOWS\system32\lphct2vj0e9bc.exe
C:\WINDOWS\system32\kzghsxsj.exe
C:\Program Files\rhcp2vj0e9bc
C:\Documents and Settings\Administrator\Application Data\rhcp2vj0e9bc


Return to OTMoveIt, right click on the "Paste List of Files/Folders to be moved" window and choose Paste.

• Click the red Moveit! button.
• Open Notepad, and copy everything in the Results window to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy).
• Save the Notepad file to your Desktop as OTM.txt.
• Close OTMoveIt

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

If OTMoveIt doesn't need to reboot your computer, Reboot anyway.

Please include the contents of OTM.txt in your next reply.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Your version of Java is out of date. Please update to the latest version here (Java Runtime Environment (JRE) 6 Update 6). Once downloaded, install it and then Reboot your computer.

It is most important that you also uninstall older versions of Java.

Please uninstall the following programs:

J2SE Runtime Environment 5.0 Update 11
Java 2 Runtime Environment, SE v1.4.2_03
Java™ 6 Update 2
Java™ 6 Update 3
Java™ 6 Update 5
Java™ SE Runtime Environment 6 Update 1

• Go to Start then Settings, then Control Panel
• Choose Add or Remove Programs
• Remove all of the above

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Next, run another Kaspersky online scan as outlined in my previous post, then run DSS again and post me the single log it produces.


So in your next reply, please include the following logs:

• The contents of OTM.txt
• The contents of Kaspersky.txt
• The contents of DSS main.txt

Also tell me if you use Outlook or Outlook Express for your email, as one of your Outlook files contains some infected emails, that I will want to get rid of soon.

Regards,
RatHat

[newvibe]

Thanks! I completed all steps. I am using Outlook.
By the way, the program "Anti-Virus XP 2008" has changed to new name and look: "Malware Protector 2008". Is does basically the same thing as before, just with a new skin.

Here are the results:

DSSmain.txt
Deckard's System Scanner v20071014.68
Run by Administrator on 2008-07-08 10:59:37
Computer is in Normal Mode.
--------------------------------------------------------------------------------

Total Physical Memory: 503 MiB (512 MiB recommended).


-- HijackThis (run as Administrator.exe) ---------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:59:44 AM, on 7/8/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe
C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WMP54Gv4.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\D-Link\AirPlus G\AirGCFG.exe
C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
C:\Program Files\shcr2vj0e9bc\shcr2vj0e9bc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
C:\Documents and Settings\Administrator\Desktop\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\ADMINI~1.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [D-Link AirPlus G] C:\Program Files\D-Link\AirPlus G\AirGCFG.exe
O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
O4 - HKLM\..\Run: [SMshcr2vj0e9bc] C:\Program Files\shcr2vj0e9bc\shcr2vj0e9bc.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2....re/HPDEXAXO.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O21 - SSODL: ApiCmdCom - {7672D99D-5AFC-EDAE-CC21-0A94D0BAFC4E} - C:\Program Files\pxmqcxb\ApiCmdCom.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: WMP54Gv4SVC - GEMTEKS - C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe

--
End of file - 6827 bytes

-- Files created between 2008-06-08 and 2008-07-08 -----------------------------

2008-07-08 08:23:02 0 d-------- C:\Documents and Settings\Administrator\.SunDownloadManager
2008-07-08 08:10:36 0 d-------- C:\Documents and Settings\Administrator\Application Data\shcr2vj0e9bc
2008-07-08 08:10:27 0 d-------- C:\Program Files\shcr2vj0e9bc
2008-07-06 21:51:09 60928 --a------ C:\WINDOWS\system32\blphct2vj0e9bc.scr <Not Verified; Sysinternals; Sysinternals Blue Screen>
2008-07-06 21:26:32 0 d-------- C:\Program Files\Trend Micro
2008-07-06 21:02:17 0 --a------ C:\WINDOWS\ORUN32.EXE
2008-07-06 21:02:13 0 --a------ C:\WINDOWS\system32\CMMGR32.EXE
2008-07-06 20:58:28 0 d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-07-06 20:58:21 0 d-------- C:\Program Files\SUPERAntiSpyware
2008-07-06 20:58:21 0 d-------- C:\Documents and Settings\Administrator\Application Data\SUPERAntiSpyware.com
2008-07-06 20:42:19 0 d-------- C:\Documents and Settings\Administrator\Application Data\Malwarebytes
2008-07-06 20:42:15 0 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-07-06 20:42:13 0 d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-07-06 20:41:42 0 d-------- C:\Program Files\Common Files\Download Manager
2008-07-06 18:52:26 0 d-------- C:\Program Files\Panda Security
2008-07-06 14:15:53 0 d-------- C:\Documents and Settings\Administrator\.housecall6.6
2008-07-06 13:12:04 0 d-------- C:\WINDOWS\system32\1374
2008-07-06 12:30:36 0 d-------- C:\Program Files\Lavasoft
2008-07-06 12:30:35 0 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-07-06 12:28:11 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-07-06 12:24:46 0 d-------- C:\Documents and Settings\LocalService\Application Data\AdobeUM
2008-07-06 12:24:42 0 d-------- C:\Documents and Settings\LocalService\My Documents
2008-07-06 12:19:16 0 d--hs---- C:\Documents and Settings\LocalService\UserData
2008-07-06 12:17:34 0 d-------- C:\Documents and Settings\LocalService\Application Data\Google
2008-07-06 12:11:59 0 d--hs---- C:\WINDOWS\dGVtcA
2008-07-06 12:11:45 0 d-------- C:\WINDOWS\system32\tfig
2008-07-06 12:11:45 0 d-------- C:\WINDOWS\system32\net
2008-07-06 12:11:45 0 d-------- C:\WINDOWS\system32\cREG
2008-07-06 12:11:45 0 d-------- C:\WINDOWS\system32\1030
2008-07-06 12:11:37 0 d-------- C:\WINDOWS\system32\olixds06
2008-07-06 12:11:12 0 d-------- C:\Program Files\pxmqcxb
2008-07-06 12:10:48 0 d-------- C:\Documents and Settings\LocalService\Application Data\Macromedia
2008-07-06 12:10:48 0 d-------- C:\Documents and Settings\LocalService\Application Data\Adobe
2008-07-06 12:10:42 4 --a------ C:\WINDOWS\system32\hljwugsf.bin
2008-07-06 12:10:42 0 dr------- C:\Documents and Settings\LocalService\Favorites
2008-07-03 08:43:41 0 d-------- C:\Program Files\Microsoft Visual Studio 9.0
2008-07-03 08:41:53 0 d-------- C:\Program Files\Microsoft Web Designer Tools
2008-07-03 08:41:52 0 d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-07-03 08:41:10 0 d-------- C:\Program Files\Microsoft SDKs
2008-07-03 08:38:41 0 d-------- C:\Program Files\MSBuild
2008-07-03 08:38:32 0 d-------- C:\WINDOWS\system32\XPSViewer
2008-07-03 08:38:24 0 d-------- C:\Program Files\Reference Assemblies
2008-07-03 08:31:59 0 d-------- C:\Program Files\MSXML 6.0
2008-07-03 08:14:54 0 d-------- C:\Program Files\Microsoft Silverlight
2008-06-29 20:57:07 0 d-------- C:\Program Files\MSPress
2008-06-27 08:48:01 0 d-------- C:\WINDOWS\system32\Adobe
2008-06-18 17:17:55 94208 --a------ C:\WINDOWS\system32\GTW32N50.dll
2008-06-18 17:17:55 15872 --a------ C:\WINDOWS\system32\GTNDIS5.sys <Not Verified; Printing Communications Assoc., Inc. (PCAUSA); PCAUSA Rawether for Windows>
2008-06-18 17:17:43 0 d-------- C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor


-- Find3M Report ---------------------------------------------------------------

2008-07-08 08:37:37 0 d-------- C:\Program Files\Java
2008-07-06 20:41:42 0 d-------- C:\Program Files\Common Files
2008-07-06 12:35:44 0 d-------- C:\Program Files\Google
2008-07-03 08:55:03 0 d-------- C:\Program Files\Microsoft SQL Server
2008-07-03 08:50:49 0 d-------- C:\Program Files\Microsoft.NET
2008-06-29 20:57:10 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-06-27 18:04:18 0 d-------- C:\Program Files\Common Files\Symantec Shared
2008-06-27 08:47:17 0 d-------- C:\Documents and Settings\Administrator\Application Data\AdobeUM
2008-06-07 14:50:39 0 d-------- C:\Program Files\Jufsoft
2008-06-07 10:55:22 0 d-------- C:\Documents and Settings\Administrator\Application Data\Walgreens


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [04/04/2005 11:22 PM]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [04/04/2005 11:19 PM]
"Persistence"="C:\WINDOWS\system32\igfxpers.exe" [04/04/2005 11:23 PM]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [06/23/2005 04:31 PM]
"DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [09/08/2005 05:20 AM]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [07/27/2004 04:50 PM]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [07/27/2004 04:50 PM]
"Synchronization Manager"="C:\WINDOWS\system32\mobsync.exe" [08/04/2004 05:00 AM]
"vptray"="C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe" [05/21/2003 01:21 AM]
"D-Link AirPlus G"="C:\Program Files\D-Link\AirPlus G\AirGCFG.exe" [03/29/2005 11:41 AM]
"ANIWZCS2Service"="C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe" [12/16/2004 05:49 PM]
"SMshcr2vj0e9bc"="C:\Program Files\shcr2vj0e9bc\shcr2vj0e9bc.exe" [07/07/2008 01:25 AM]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [03/25/2008 04:28 AM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [10/13/2004 12:24 PM]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 05:00 AM]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [02/27/2007 11:39 AM]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Acrobat Assistant.lnk - C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [10/24/2003 12:37:56 AM]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"=0 (0x0)
"NoDispScrSavPage"=1 (0x1)
"NoDispBackgroundPage"=1 (0x1)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [12/20/2006 12:55 PM 77824]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"ApiCmdCom"= {7672D99D-5AFC-EDAE-CC21-0A94D0BAFC4E} - C:\Program Files\pxmqcxb\ApiCmdCom.dll [07/06/2008 12:11 PM 114688]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 02/27/2007 11:39 AM 282624 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

*Newly Created Service* - GTNDIS5



-- End of Deckard's System Scanner: finished at 2008-07-08 11:00:07 ------------


kaspersky.txt
--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Tuesday, July 8, 2008
Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Tuesday, July 08, 2008 13:19:39
Records in database: 926890
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\

Scan statistics:
Files scanned: 87866
Threat name: 14
Infected objects: 34
Suspicious objects: 0
Duration of the scan: 01:58:50


File name / Threat name / Threats count
C:\Documents and Settings\Administrator\.housecall6.6\Quarantine\msiexec[1].exe.bac_a02928 Infected: Trojan-Clicker.Win32.Agent.tg 1
C:\Documents and Settings\Administrator\.housecall6.6\Quarantine\syswcc32.exe.bac_a02928 Infected: not-a-virus:AdWare.Win32.WebHancer.423 1
C:\Documents and Settings\Administrator\.housecall6.6\Quarantine\syswcc32.exe.bac_a02928 Infected: not-a-virus:AdWare.Win32.WebHancer.390 3
C:\Documents and Settings\Administrator\.housecall6.6\Quarantine\syswcc32.exe.bac_a03420 Infected: not-a-virus:AdWare.Win32.WebHancer.423 1
C:\Documents and Settings\Administrator\.housecall6.6\Quarantine\syswcc32.exe.bac_a03420 Infected: not-a-virus:AdWare.Win32.WebHancer.390 3
C:\Documents and Settings\Administrator\.housecall6.6\Quarantine\syswcc32[1].exe.bac_a02928 Infected: not-a-virus:AdWare.Win32.WebHancer.423 1
C:\Documents and Settings\Administrator\.housecall6.6\Quarantine\syswcc32[1].exe.bac_a02928 Infected: not-a-virus:AdWare.Win32.WebHancer.390 3
C:\Documents and Settings\Administrator\.housecall6.6\Quarantine\syswcc32[1].exe.bac_a03420 Infected: not-a-virus:AdWare.Win32.WebHancer.423 1
C:\Documents and Settings\Administrator\.housecall6.6\Quarantine\syswcc32[1].exe.bac_a03420 Infected: not-a-virus:AdWare.Win32.WebHancer.390 3
C:\Documents and Settings\Administrator\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Quarantine\QUAR1.55542 Infected: Trojan-Clicker.Win32.Agent.tg 1
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Outlook\Outlook.pst Infected: Email-Worm.Win32.Zhelatin.a 1
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Outlook\Outlook.pst Infected: Trojan-Downloader.Win32.Tibs.kj 1
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Outlook\Outlook.pst Infected: Email-Worm.Win32.Zhelatin.ab 1
C:\_OTMoveIt\MovedFiles\07072008_084522\Documents and Settings\All Users\Application Data\yfsvcxul\mbqpefsz.exe Infected: Trojan.Win32.Obfuscated.gx 1
C:\_OTMoveIt\MovedFiles\07072008_084522\WINDOWS\portsv.exe Infected: Trojan.Win32.Agent.sdd 1
C:\_OTMoveIt\MovedFiles\07082008_081543\Program Files\rhcp2vj0e9bc\rhcp2vj0e9bc.exe Infected: not-a-virus:FraudTool.Win32.AntivirusXP2008.a 1
C:\_OTMoveIt\MovedFiles\07082008_081543\temp\outlook express\Deleted Items.dbx Infected: Email-Worm.Win32.Zhelatin.a 1
C:\_OTMoveIt\MovedFiles\07082008_081543\temp\outlook express\Deleted Items.dbx Infected: Trojan-Downloader.Win32.Tibs.kj 1
C:\_OTMoveIt\MovedFiles\07082008_081543\temp\outlook express\Deleted Items.dbx Infected: Email-Worm.Win32.Zhelatin.ab 1
C:\_OTMoveIt\MovedFiles\07082008_081543\temp\StreamViewer\Setup-SopCast-2.0.4-2007-11-26.exe Infected: Trojan-Downloader.Win32.Agent.uwu 1
C:\_OTMoveIt\MovedFiles\07082008_081543\temp\StreamViewer.zip Infected: Trojan-Downloader.Win32.Agent.uwu 1
C:\_OTMoveIt\MovedFiles\07082008_081543\WINDOWS\444.470 Infected: Trojan.Win32.DNSChanger.eys 1
C:\_OTMoveIt\MovedFiles\07082008_081543\WINDOWS\444.471 Infected: Trojan.Win32.DNSChanger.eys 1
C:\_OTMoveIt\MovedFiles\07082008_081543\WINDOWS\system32\1030\icmsetup.exe Infected: Trojan.Win32.DNSChanger.eyr 1
C:\_OTMoveIt\MovedFiles\07082008_081543\WINDOWS\system32\olixds06\olixds061083.exe Infected: Trojan-Downloader.Win32.VB.eyc 1
C:\_OTMoveIt\MovedFiles\07082008_081543\WINDOWS\system32\pphct2vj0e9bc.exe Infected: not-a-virus:FraudTool.Win32.MalwareProtector.d 1

The selected area was scanned.


OTM.txt
C:\Program Files\rhcp2vj0e9bc\rhcp2vj0e9bc.exe moved successfully.
C:\temp\outlook express\Deleted Items.dbx moved successfully.
C:\temp\StreamViewer\Setup-SopCast-2.0.4-2007-11-26.exe moved successfully.
C:\temp\StreamViewer.zip moved successfully.
C:\WINDOWS\444.470 moved successfully.
C:\WINDOWS\444.471 moved successfully.
C:\WINDOWS\system32\1030\icmsetup.exe moved successfully.
C:\WINDOWS\system32\olixds06\olixds061083.exe moved successfully.
C:\WINDOWS\system32\pphct2vj0e9bc.exe moved successfully.
File/Folder C:\WINDOWS\portsv.exe not found.
C:\WINDOWS\system32\lphct2vj0e9bc.exe moved successfully.
File/Folder C:\WINDOWS\system32\kzghsxsj.exe not found.
C:\Program Files\rhcp2vj0e9bc moved successfully.
C:\Documents and Settings\Administrator\Application Data\rhcp2vj0e9bc\Quarantine\Packages moved successfully.
C:\Documents and Settings\Administrator\Application Data\rhcp2vj0e9bc\Quarantine\BrowserObjects moved successfully.
C:\Documents and Settings\Administrator\Application Data\rhcp2vj0e9bc\Quarantine\Autorun\StartMenuCurrentUser moved successfully.
C:\Documents and Settings\Administrator\Application Data\rhcp2vj0e9bc\Quarantine\Autorun\StartMenuAllUsers moved successfully.
C:\Documents and Settings\Administrator\Application Data\rhcp2vj0e9bc\Quarantine\Autorun\HKLM\RunOnce moved successfully.
C:\Documents and Settings\Administrator\Application Data\rhcp2vj0e9bc\Quarantine\Autorun\HKLM moved successfully.
C:\Documents and Settings\Administrator\Application Data\rhcp2vj0e9bc\Quarantine\Autorun\HKCU\RunOnce moved successfully.
C:\Documents and Settings\Administrator\Application Data\rhcp2vj0e9bc\Quarantine\Autorun\HKCU moved successfully.
C:\Documents and Settings\Administrator\Application Data\rhcp2vj0e9bc\Quarantine\Autorun moved successfully.
C:\Documents and Settings\Administrator\Application Data\rhcp2vj0e9bc\Quarantine moved successfully.
C:\Documents and Settings\Administrator\Application Data\rhcp2vj0e9bc moved successfully.

OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 07082008_081543

Edited by newvibe, 08 July 2008 - 09:08 AM.

[RatHat]

Could you tell me how your computer is behaving now, and also upload another file that I am not sure of?

Go to Jotti's malware scan

• Copy and paste the following file path into the "File to upload & scan"box on the top of the page:
  
  
  • C:\Program Files\shcr2vj0e9bc\shcr2vj0e9bc.exe
• Click on the submit button
• When the scan is complete, highlight all the results and copy them into Notepad
• Save the Notepad file to your desktop as Jotti.txt
• Please post the contents in your next reply.

Regards,
RatHat

[newvibe]

Thanks again.
A number of symptoms have disappeared. Google works fine now in IE. Here are the symptoms my computer still displays:
My wallpaper reads "Your computer is infected with Spyware"...etc.
A program calling itself "Malware Protector 2008" runs in the system tray and pops up messages about my system being infected. It also pretends to run a system scan and offers to clean my system.
On occasion, a simulated "blue screen" event happens, displaying a scary message and then appearing to reboot the system. If I hit escape, the event disappears.

I have to say, this whole process is fascinating to me. You seem to be systematically ripping the whole structure down. Very cool.
I'm using Outlook, and I know you mentioned I had things there I needed to delete.

Looks like that file is visible now (when I ran it before on Jotti's, it couldn't be scanned). Here are the results:
Jotti.txt
File: shcr2vj0e9bc.exe
Status: INFECTED/MALWARE
MD5: a6061c81b78642663b449fd22e71b635
Packers detected: -

Scanner results
Scan taken on 08 Jul 2008 15:23:23 (GMT)
A-Squared Found nothing
AntiVir Found TR/Peed.job.27
ArcaVir Found nothing
Avast Found nothing
AVG Antivirus Found Agent.YAF
BitDefender Found Trojan.Peed.JOB
ClamAV Found nothing
CPsecure Found nothing
Dr.Web Found nothing
F-Prot Antivirus Found nothing
F-Secure Anti-Virus Found nothing
Fortinet Found FakeAlert.B!tr
Ikarus Found Trojan.Peed.JOB
Kaspersky Anti-Virus Found nothing
NOD32 Found nothing
Norman Virus Control Found W32/Renos.ZB
Panda Antivirus Found nothing
Sophos Antivirus Found nothing
VirusBuster Found nothing
VBA32 Found nothing

Thanks again!

[RatHat]

Lets tear down a bit more! Firstly though, I would like you to upload that file for me to look at.

Please go to The Spy Killer

• Read the post named Instructions for uploading files
• Click on "New Topic"
• Put your name, e-mail address, and this as the title: shcr2vj0e9bc.exe - For RatHat
• Put a link to this Geeks to Go topic in the description box.
• Then next to the file box, at the bottom, click the browse button, then navigate to this file:
  • C:\Program Files\shcr2vj0e9bc\shcr2vj0e9bc.exe
• Click Open
• Then click Post

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Please re-open HiJackThis and scan. Check the boxes next to all the entries listed below.

O4 - HKLM\..\Run: [SMshcr2vj0e9bc] C:\Program Files\shcr2vj0e9bc\shcr2vj0e9bc.exe
O21 - SSODL: ApiCmdCom - {7672D99D-5AFC-EDAE-CC21-0A94D0BAFC4E} - C:\Program Files\pxmqcxb\ApiCmdCom.dll

Now close all windows other than HiJackThis, then click Fix Checked. Close HiJackThis.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Run OTMoveIt2 again:

• Double-click OTMoveIt2.exe to run it.

Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):

C:\WINDOWS\system32\lphct2vj0e9bc.exe
C:\WINDOWS\system32\blphct2vj0e9bc.scr
C:\Program Files\shcr2vj0e9bc\shcr2vj0e9bc.exe
C:\Program Files\shcr2vj0e9bc


Return to OTMoveIt, right click on the "Paste List of Files/Folders to be moved" window and choose Paste.

• Click the red Moveit! button.
• Open Notepad, and copy everything in the Results window to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy).
• Save the Notepad file to your Desktop as OTM.txt.
• Close OTMoveIt

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

Please include the contents of OTM.txt in your next reply.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Now please have a look in this folder and tell me what it contains:

C:\Program Files\pxmqcxb

Regards,
RatHat

[newvibe]

It looks like we are really close!

I posted the file on SpyKiller.
When I ran the scan in HiJackThis and fixed the checked items, ALL POPUPS STOPPED and the bogus malware program disappeared from the system tray.

OTM.txt
File/Folder C:\WINDOWS\system32\lphct2vj0e9bc.exe not found.
C:\WINDOWS\system32\blphct2vj0e9bc.scr moved successfully.
C:\Program Files\shcr2vj0e9bc\shcr2vj0e9bc.exe moved successfully.
C:\Program Files\shcr2vj0e9bc moved successfully.

OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 07082008_123613

The folder contains this file: ApiCmdCom.dll

The only remaining symptom I see is the wallpaper of my desktop, and I am unable to access this setting through the display properties as normal (the tab is missing).

Thanks very much,
Chad

[RatHat]

Hey Chad,

Run OTMoveIt2 again:

• Double-click OTMoveIt2.exe to run it.

Copy the file path below to the clipboard by highlighting it and pressing CTRL + C (or, after highlighting, right-click and choose copy):

C:\Program Files\pxmqcxb


Return to OTMoveIt, right click on the "Paste List of Files/Folders to be moved" window and choose Paste.

• Click the red Moveit! button.
• Open Notepad, and copy everything in the Results window to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy).
• Save the Notepad file to your Desktop as OTM.txt.
• Close OTMoveIt

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

Please include the contents of OTM.txt in your next reply.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Next I want to see if we can get the display properties working properly, so lets run a small registry script to see if we can change it back to normal.

Please copy the entire contents of the codebox below into Notepad:

• Open Notepad
• Copy the contents of the codebox below using CTRL C

REGEDIT4

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"NoDispScrSavPage"=-
"NoDispBackgroundPage"=-

• Now return to Notepad and use CTRL V to paste the script
• Verify that you have pasted the complete script
• Save the Notepad file to your Desktop as FixReg.reg using Save as Type: All files
• Locate FixReg.reg on your desktop
• Double click to run, and when prompted Allow the file to merge with your registry
• OK your way out.

After that, Reboot and see if you can change your wall paper back to normal.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Now lets run an F-Secure online scan to see if we can get rid of the bad emails without resorting to deleting the Outlook.pst file:

• Go to http://support.f-sec.../home/ols.shtml
• Scroll to the bottom of the page and click the Start scanning button. A window will pop up.
• Allow the Active X control to be installed on your computer, then click the Accept button
• Click Full System Scan and allow the components to download and the scan to complete.
• If malware is found, check Submit samples to F-Secure then select Automatic cleaning
• When cleaning has finished, click Show report (this will open an Internet Explorer window containing the report)
• Highlight and Copy (CTRL + C) the complete report, and Paste (CTRL + V) in a new reply to this post

If Automatic cleaning with Submit samples hangs, click Cancel, then New Scan

• When the cleaning option is presented, Uncheck Submit samples to F-Secure
• Click Automatic cleaning
• When cleaning has finitished, click Show report (this will open an Internet Explorer window containing the report)
• Highlight and Copy (CTRL + C) the complete report, and Paste (CTRL + V) in a new reply to this post

Notes:

• This scan will only work with Internet Explorer
• You must have administrator rights to run this scan
• This scan can take a while, so please be patient

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Post me the results from OTMoveIt, the F-Secure Scan, along with a fresh DSS log, taken after completing all the above, and let me know if you have got your desktop background back to normal again.

Thanks for the file, I will download it and let it infect my machine, then see what else it produces!

Regards,
RatHat

[newvibe]

The desktop is back to normal - excellent! Infect your machine with it?! Well, I guess it's no threat to you

Here are the results of the Fsecure scan, MoveIt!, and DSS:

fsecure.txt
Scanning Report
Wednesday, July 09, 2008 07:59:11 - 09:17:24
Computer name: CHADOFWAR
Scanning type: Scan system for malware, rootkits
Target: C:\


--------------------------------------------------------------------------------

Result: 5 malware found
Trojan-Downloader.Win32.VB.eyc (virus)
C:\_OTMOVEIT\MOVEDFILES\07082008_081543\WINDOWS\SYSTEM32\OLIXDS06\OLIXDS061083.EXE (Renamed & Submitted)
Trojan.Win32.Agent.sdd (virus)
C:\_OTMOVEIT\MOVEDFILES\07072008_084522\WINDOWS\PORTSV.EXE (Renamed & Submitted)
Trojan.Win32.DNSChanger.eyr (virus)
C:\_OTMOVEIT\MOVEDFILES\07082008_081543\WINDOWS\SYSTEM32\1030\ICMSETUP.EXE (Renamed & Submitted)
Trojan.Win32.Obfuscated.gx (virus)
C:\_OTMOVEIT\MOVEDFILES\07072008_084522\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\YFSVCXUL\MBQPEFSZ.EXE (Renamed & Submitted)
Trojan:W32/Renos.DC (virus)
C:\_OTMOVEIT\MOVEDFILES\07082008_081543\WINDOWS\SYSTEM32\PPHCT2VJ0E9BC.EXE (Submitted)

--------------------------------------------------------------------------------

Statistics
Scanned:
Files: 61300
System: 3751
Not scanned: 6
Actions:
Disinfected: 0
Renamed: 4
Deleted: 0
None: 1
Submitted: 5
Files not scanned:
C:\PAGEFILE.SYS
C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT
C:\WINDOWS\SYSTEM32\CONFIG\SAM
C:\WINDOWS\SYSTEM32\CONFIG\SECURITY
C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM

--------------------------------------------------------------------------------

Options
Scanning engines:
F-Secure USS: 2.30.0
F-Secure Hydra: 2.8.8110, 2008-07-09
F-Secure AVP: 7.0.171, 2008-07-09
F-Secure Pegasus: 1.20.0, 2008-04-14
F-Secure Blacklight: 1.0.68
Scanning options:
Scan defined files: COM EXE SYS OV? BIN SCR DLL SHS HTM HTML HTT VBS JS INF VXD DO? XL? RTF CPL WIZ HTA PP? PWZ P?T MSO PIF . ACM ASP AX CNV CSC DRV INI MDB MPD MPP MPT OBD OBT OCX PCI TLB TSP WBK WBT WPC WSH VWP WML BOO HLP TD0 TT6 MSG ASD JSE VBE WSC CHM EML PRC SHB LNK WSF {* PDF ZL? XML ZIP XXX ANI AVB BAT CMD JPG LSP MAP MHT MIF PHP POT SWF WMF NWS TAR
Use Advanced heuristics

--------------------------------------------------------------------------------

Copyright © 1998-2007 Product support |Send virus sample to F-Secure
F-Secure assumes no responsibility for material created or published by third parties that F-Secure World Wide Web pages have a link to. Unless you have clearly stated otherwise, by submitting material to any of our servers, for example by E-mail or via our F-Secure's CGI E-mail, you agree that the material you make available may be published in the F-Secure World Wide Pages or hard-copy publications. You will reach F-Secure public web site by clicking on underlined links. While doing this, your access will be logged to our private access statistics with your domain name.This information will not be given to any third party. You agree not to take action against us in relation to material that you submit. Unless you have clearly stated otherwise, by submitting material you warrant that F-Secure may incorporate any concepts described in it in the F-Secure products/publications without liability.



OTM.txt
C:\Program Files\pxmqcxb moved successfully.

OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 07092008_074430



DSSmain.txt
Deckard's System Scanner v20071014.68
Run by Administrator on 2008-07-09 09:23:46
Computer is in Normal Mode.
--------------------------------------------------------------------------------

Total Physical Memory: 503 MiB (512 MiB recommended).


-- HijackThis (run as Administrator.exe) ---------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:23:56 AM, on 7/9/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe
C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WMP54Gv4.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\D-Link\AirPlus G\AirGCFG.exe
C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Administrator\Desktop\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\ADMINI~1.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [D-Link AirPlus G] C:\Program Files\D-Link\AirPlus G\AirGCFG.exe
O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2....re/HPDEXAXO.cab
O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-sec...m/ols/fscax.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: WMP54Gv4SVC - GEMTEKS - C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe

--
End of file - 6911 bytes

-- Files created between 2008-06-09 and 2008-07-09 -----------------------------

2008-07-09 07:54:03 0 d-------- C:\fsaua.data
2008-07-08 08:23:02 0 d-------- C:\Documents and Settings\Administrator\.SunDownloadManager
2008-07-08 08:10:36 0 d-------- C:\Documents and Settings\Administrator\Application Data\shcr2vj0e9bc
2008-07-06 21:26:32 0 d-------- C:\Program Files\Trend Micro
2008-07-06 21:02:17 0 --a------ C:\WINDOWS\ORUN32.EXE
2008-07-06 21:02:13 0 --a------ C:\WINDOWS\system32\CMMGR32.EXE
2008-07-06 20:58:28 0 d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-07-06 20:58:21 0 d-------- C:\Program Files\SUPERAntiSpyware
2008-07-06 20:58:21 0 d-------- C:\Documents and Settings\Administrator\Application Data\SUPERAntiSpyware.com
2008-07-06 20:42:19 0 d-------- C:\Documents and Settings\Administrator\Application Data\Malwarebytes
2008-07-06 20:42:15 0 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-07-06 20:42:13 0 d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-07-06 20:41:42 0 d-------- C:\Program Files\Common Files\Download Manager
2008-07-06 18:52:26 0 d-------- C:\Program Files\Panda Security
2008-07-06 14:15:53 0 d-------- C:\Documents and Settings\Administrator\.housecall6.6
2008-07-06 13:12:04 0 d-------- C:\WINDOWS\system32\1374
2008-07-06 12:30:36 0 d-------- C:\Program Files\Lavasoft
2008-07-06 12:30:35 0 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-07-06 12:28:11 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-07-06 12:24:46 0 d-------- C:\Documents and Settings\LocalService\Application Data\AdobeUM
2008-07-06 12:24:42 0 d-------- C:\Documents and Settings\LocalService\My Documents
2008-07-06 12:19:16 0 d--hs---- C:\Documents and Settings\LocalService\UserData
2008-07-06 12:17:34 0 d-------- C:\Documents and Settings\LocalService\Application Data\Google
2008-07-06 12:11:59 0 d--hs---- C:\WINDOWS\dGVtcA
2008-07-06 12:11:45 0 d-------- C:\WINDOWS\system32\tfig
2008-07-06 12:11:45 0 d-------- C:\WINDOWS\system32\net
2008-07-06 12:11:45 0 d-------- C:\WINDOWS\system32\cREG
2008-07-06 12:11:45 0 d-------- C:\WINDOWS\system32\1030
2008-07-06 12:11:37 0 d-------- C:\WINDOWS\system32\olixds06
2008-07-06 12:10:48 0 d-------- C:\Documents and Settings\LocalService\Application Data\Macromedia
2008-07-06 12:10:48 0 d-------- C:\Documents and Settings\LocalService\Application Data\Adobe
2008-07-06 12:10:42 4 --a------ C:\WINDOWS\system32\hljwugsf.bin
2008-07-06 12:10:42 0 dr------- C:\Documents and Settings\LocalService\Favorites
2008-07-03 08:43:41 0 d-------- C:\Program Files\Microsoft Visual Studio 9.0
2008-07-03 08:41:53 0 d-------- C:\Program Files\Microsoft Web Designer Tools
2008-07-03 08:41:52 0 d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-07-03 08:41:10 0 d-------- C:\Program Files\Microsoft SDKs
2008-07-03 08:38:41 0 d-------- C:\Program Files\MSBuild
2008-07-03 08:38:32 0 d-------- C:\WINDOWS\system32\XPSViewer
2008-07-03 08:38:24 0 d-------- C:\Program Files\Reference Assemblies
2008-07-03 08:31:59 0 d-------- C:\Program Files\MSXML 6.0
2008-07-03 08:14:54 0 d-------- C:\Program Files\Microsoft Silverlight
2008-06-29 20:57:07 0 d-------- C:\Program Files\MSPress
2008-06-27 08:48:01 0 d-------- C:\WINDOWS\system32\Adobe
2008-06-18 17:17:55 94208 --a------ C:\WINDOWS\system32\GTW32N50.dll
2008-06-18 17:17:55 15872 --a------ C:\WINDOWS\system32\GTNDIS5.sys <Not Verified; Printing Communications Assoc., Inc. (PCAUSA); PCAUSA Rawether for Windows>
2008-06-18 17:17:43 0 d-------- C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor


-- Find3M Report ---------------------------------------------------------------

2008-07-08 08:37:37 0 d-------- C:\Program Files\Java
2008-07-06 20:41:42 0 d-------- C:\Program Files\Common Files
2008-07-06 12:35:44 0 d-------- C:\Program Files\Google
2008-07-03 08:55:03 0 d-------- C:\Program Files\Microsoft SQL Server
2008-07-03 08:50:49 0 d-------- C:\Program Files\Microsoft.NET
2008-06-29 20:57:10 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-06-27 18:04:18 0 d-------- C:\Program Files\Common Files\Symantec Shared
2008-06-27 08:47:17 0 d-------- C:\Documents and Settings\Administrator\Application Data\AdobeUM
2008-06-07 14:50:39 0 d-------- C:\Program Files\Jufsoft
2008-06-07 10:55:22 0 d-------- C:\Documents and Settings\Administrator\Application Data\Walgreens


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [04/04/2005 11:22 PM]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [04/04/2005 11:19 PM]
"Persistence"="C:\WINDOWS\system32\igfxpers.exe" [04/04/2005 11:23 PM]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [06/23/2005 04:31 PM]
"DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [09/08/2005 05:20 AM]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [07/27/2004 04:50 PM]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [07/27/2004 04:50 PM]
"Synchronization Manager"="C:\WINDOWS\system32\mobsync.exe" [08/04/2004 05:00 AM]
"vptray"="C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe" [05/21/2003 01:21 AM]
"D-Link AirPlus G"="C:\Program Files\D-Link\AirPlus G\AirGCFG.exe" [03/29/2005 11:41 AM]
"ANIWZCS2Service"="C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe" [12/16/2004 05:49 PM]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [03/25/2008 04:28 AM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [10/13/2004 12:24 PM]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 05:00 AM]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [02/27/2007 11:39 AM]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Acrobat Assistant.lnk - C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [10/24/2003 12:37:56 AM]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"=0 (0x0)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [12/20/2006 12:55 PM 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 02/27/2007 11:39 AM 282624 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

*Newly Created Service* - F-SECURE_STANDALONE_MINIFILTER
*Newly Created Service* - GTNDIS5



-- End of Deckard's System Scanner: finished at 2008-07-09 09:24:16 ------------

Thanks again and again!
Chad

[RatHat]

OK, looks like you are all good except for that Outlook.pst file.

Do you have any important emails that you want to keep?

[newvibe]

Thanks very much! You've really saved me here. I'm going to make a donation for sure! What does one study to learn how to do what you do?

I have about 4 years of emails in there, but I've been using another account primarily for the past year, so I could probably live without them. It would be nice to keep them if possible just in case I need to search through them for something, which I do on occasion. Do I have an option other than deleting it?

Thanks again,
Chad

[RatHat]

Chad,

I would look through all the emails that you have in Outlook with attachments. Any that look odd to you, delete. The Kaspersky scan showed that there are three different malware in your Outlook.pst file, which is the main file that holds all of your Outlook folders, including the Inbox, Calendar, and Contacts.

If you can go through and delete all the emails with suspicious looking attachments, then run another Kaspersky scan and post me the results, I will check to see if the problems have gone. Needless to say, don't open any of the attachments, or click on any links until I have seen the Kaspersky log.

If you are interested in learning more about removing malware, there is a link to GeekU in my signature. It is a bit starnge to learn at first, but the more involved you get, the more interesting it becomes.

And just for your info, the file you uploaded for me was part of the fake antispyware, Malware Protector 2008. On it's own it didn't do much as it needed other files to run. I only infect virtual machines, kind of like a computer within my computer, and if I want to, I can delete the whole thing with a couple of mouse clicks. Makes it a bit easier for me to see what other people may have in their machines, and also easier to know where to look and how to get rid of bad files.

Anyway, please post me another Kaspersky log after cleaning out your old emails of anything suspicious, then we can clean up the tools that you have used.

Regards,
RatHat