[faz123]

I keep getting pop ups at random times and i do not know what is causing them, it is mostly "FILM ON" websites but comes up with different things and anytime. Help would be greatly appreciated, Thank You

HiJackThis Log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 03:23:44, on 19/07/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16681)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\WLTRAY.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\sttray.exe
C:\Windows\System32\wpcumi.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe
C:\Windows\ehome\ehmsas.exe
c:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
C:\Windows\SYSTEM32\taskeng.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Trend Micro\TrendSecure\TSCFCommander.exe
C:\Program Files\Trend Micro\TrendSecure\TSCFPlatformCOMSvr.exe
C:\Program Files\Trend Micro\TrendSecure\TransactionProtector\Dependent\HSChkProxyExe.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
c:\program files\common files\installshield\updateservice\isuspm.exe
C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\kdfmgr.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\SearchFilterHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.co...amp;ibd=3071011
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co...amp;ibd=3071011
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by Dell
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O1 - Hosts: 75.67.92.226 paypal.com
O1 - Hosts: 75.67.92.226 www.paypal.com
O1 - Hosts: 75.67.92.226 http://paypal.com
O1 - Hosts: 75.67.92.226 http://www.paypal.com
O1 - Hosts: 75.67.92.226 paypal.co.uk
O1 - Hosts: 75.67.92.226 www.paypal.co.uk
O1 - Hosts: 75.67.92.226 http://paypal.co.uk
O1 - Hosts: 75.67.92.226 http://www.paypal.co.uk
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O2 - BHO: TransactionProtector BHO - {C1656CCA-D2EA-4A32-94AE-AE0B180E6449} - C:\Program Files\Trend Micro\TrendSecure\TransactionProtector\TSToolbar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Transaction Protector - {E7620C98-FCCC-40E5-92EC-C7685D2E1E40} - C:\Program Files\Trend Micro\TrendSecure\TransactionProtector\TSToolbar.dll
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\Windows\system32\WLTRAY.exe
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] sttray.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" -startup
O4 - HKLM\..\Run: [WPCUMI] C:\Windows\system32\WpcUmi.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [UfSeAgnt.exe] "C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe"
O4 - HKLM\..\Run: [PrinTray] C:\Windows\system32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [O2] "C:\Program Files\O2\bin\sprtcmd.exe" /P O2
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Sidebar] "C:\Program Files\Windows Sidebar\sidebar.exe"
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe
O4 - Global Startup: QuickSet.lnk = ?
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\npjpi160.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\npjpi160.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O13 - Gopher Prefix:
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebo...toUploader5.cab
O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) - file:///C:/Program%20Files/Monopoly/Images/stg_drm.ocx
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.srtest.co.../sysreqlab3.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zon...nt.cab56907.cab
O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} (ArmHelper Control) - file:///C:/Program%20Files/Monopoly/Images/armhelper.ocx
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O22 - SharedTaskScheduler: Windows DreamScene - {E31004D1-A431-41B8-826F-E902F9D95C81} - C:\Windows\System32\DreamScene.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Desktop Manager 5.7.712.18632 (GoogleDesktopManager-121807-210419) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\Windows\System32\LEXBCES.EXE
O23 - Service: McAfee Real-time Scanner (McShield) - Unknown owner - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe (file missing)
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Windows\system32\IoctlSvc.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Trend Micro Central Control Component (SfCtlCom) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: SupportSoft Sprocket Service (O2) (sprtsvc_O2) - SupportSoft, Inc. - C:\Program Files\O2\bin\sprtsvc.exe
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Program Files\SigmaTel\C-Major Audio\WDM\STacSV.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: SupportSoft RemoteAssist - SupportSoft, Inc. - C:\Program Files\Common Files\Supportsoft\bin\ssrc.exe
O23 - Service: Trend Micro Unauthorized Change Prevention Service (TMBMServer) - Trend Micro Inc. - C:\Program Files\Trend Micro\BM\TMBMSRV.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\TmProxy.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software GmbH - C:\Windows\System32\TuneUpDefragService.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 14431 bytes

[Advertisements]

Please print the below instructions or copy them to Notepad. Make sure to work through the fixes in the order mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes.

Download Hoster at http://www.greyknigh.../spy/Hoster.exe and run it. Click on Restore Original Hosts button and press OK. If you used a custom HOSTS file, you will need to restore the file back.

Run a scan in HijackThis. Check each of the following if they still exist and hit 'Fix Checked' after you checked the last one:

O1 - Hosts: 75.67.92.226 paypal.com
O1 - Hosts: 75.67.92.226 www.paypal.com
O1 - Hosts: 75.67.92.226 http://paypal.com
O1 - Hosts: 75.67.92.226 http://www.paypal.com
O1 - Hosts: 75.67.92.226 paypal.co.uk
O1 - Hosts: 75.67.92.226 www.paypal.co.uk
O1 - Hosts: 75.67.92.226 http://paypal.co.uk
O1 - Hosts: 75.67.92.226 http://www.paypal.co.uk
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O23 - Service: McAfee Real-time Scanner (McShield) - Unknown owner - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe (file missing)

Go to Start->Run and type in notepad and hit OK. Then copy and paste the following into Notepad:

sc stop McShield
sc delete McShield
del delete.bat

Save the file as "delete.bat". Make sure to save it with the quotes. Double click on it.

Locate the following Files/Folders and delete them if they exist (if no location given, just do a search for them):

C:\PROGRA~1\McAfee\

Download Malwarebytes ' Anti-Malware at http://www.besttechi.../mbam-setup.exe or http://www.majorgeek...ware_d5756.html Double-click on mbam-setup.exe to install the application.

* Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform Full Scan, then click Scan.
* The scan may take some time to finish, so please be patient.
* When the scan is complete, click OK, then Show Results to view the results.
* Make sure that everything is checked, and click Remove Selected.
* When disinfection is completed, a log will open in Notepad and you may be prompted to restart (see Extra Note below).
* The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
* Copy & paste the entire report into your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.

Go to http://www.bleepingc...to-use-combofix and follow the instructions on how to install the Recovery Console and run ComboFix. Go through all the steps until posting the log part. Post the combofix log here.

[greyknight17]

Please print the below instructions or copy them to Notepad. Make sure to work through the fixes in the order mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes.

Download Hoster at http://www.greyknigh.../spy/Hoster.exe and run it. Click on Restore Original Hosts button and press OK. If you used a custom HOSTS file, you will need to restore the file back.

Run a scan in HijackThis. Check each of the following if they still exist and hit 'Fix Checked' after you checked the last one:

O1 - Hosts: 75.67.92.226 paypal.com
O1 - Hosts: 75.67.92.226 www.paypal.com
O1 - Hosts: 75.67.92.226 http://paypal.com
O1 - Hosts: 75.67.92.226 http://www.paypal.com
O1 - Hosts: 75.67.92.226 paypal.co.uk
O1 - Hosts: 75.67.92.226 www.paypal.co.uk
O1 - Hosts: 75.67.92.226 http://paypal.co.uk
O1 - Hosts: 75.67.92.226 http://www.paypal.co.uk
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O23 - Service: McAfee Real-time Scanner (McShield) - Unknown owner - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe (file missing)

Go to Start->Run and type in notepad and hit OK. Then copy and paste the following into Notepad:

sc stop McShield
sc delete McShield
del delete.bat

Save the file as "delete.bat". Make sure to save it with the quotes. Double click on it.

Locate the following Files/Folders and delete them if they exist (if no location given, just do a search for them):

C:\PROGRA~1\McAfee\

Download Malwarebytes ' Anti-Malware at http://www.besttechi.../mbam-setup.exe or http://www.majorgeek...ware_d5756.html Double-click on mbam-setup.exe to install the application.

* Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform Full Scan, then click Scan.
* The scan may take some time to finish, so please be patient.
* When the scan is complete, click OK, then Show Results to view the results.
* Make sure that everything is checked, and click Remove Selected.
* When disinfection is completed, a log will open in Notepad and you may be prompted to restart (see Extra Note below).
* The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
* Copy & paste the entire report into your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.

Go to http://www.bleepingc...to-use-combofix and follow the instructions on how to install the Recovery Console and run ComboFix. Go through all the steps until posting the log part. Post the combofix log here.

[faz123]

Malware Bytes Log:

Malwarebytes' Anti-Malware 1.21
Database version: 971
Windows 6.0.6000

00:36:24 21/07/2008
mbam-log-7-21-2008 (00-36-24).txt

Scan type: Full Scan (C:\|D:\|)
Objects scanned: 196573
Time elapsed: 2 hour(s), 22 minute(s), 47 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 5

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Windows\System32\drivers\rspndrr.sys (Rootkit.Agent) -> Delete on reboot.
C:\Users\Faz\Documents\Keygens\nero7 Premium Keygen.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Windows\Fonts\acrsecB.fon (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\Fonts\acrsecI.fon (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\core.cache.dsk (Rootkit.Agent) -> Delete on reboot.




ComboFix Log:

ComboFix 08-07-20.5 - Faz 2008-07-21 2:29:25.1 - NTFSx86
Microsoft® Windows Vista™ Ultimate 6.0.6000.0.1252.1.1033.18.1049 [GMT 1:00]
Running from: C:\Users\Faz\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\temp\tn3

.
((((((((((((((((((((((((( Files Created from 2008-06-21 to 2008-07-21 )))))))))))))))))))))))))))))))
.

2008-07-20 21:39 . 2008-07-20 21:39 <DIR> d-------- C:\Users\Faz\AppData\Roaming\Malwarebytes
2008-07-20 21:39 . 2008-07-18 19:15 17,144 --a------ C:\Windows\System32\drivers\mbam.sys
2008-07-20 21:38 . 2008-07-20 21:38 <DIR> d-------- C:\Users\All Users\Malwarebytes
2008-07-20 21:38 . 2008-07-20 21:38 <DIR> d-------- C:\ProgramData\Malwarebytes
2008-07-20 21:38 . 2008-07-20 21:39 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-07-20 21:38 . 2008-07-18 19:15 36,472 --a------ C:\Windows\System32\drivers\mbamswissarmy.sys
2008-07-17 12:02 . 2008-07-17 12:02 <DIR> d-------- C:\Windows\Driving Test Complete
2008-07-17 12:02 . 2008-07-20 19:50 <DIR> d-------- C:\Program Files\Driving Test Complete
2008-07-15 20:24 . 2008-07-15 20:24 <DIR> d-------- C:\Program Files\iTunes
2008-07-15 20:24 . 2008-07-15 20:24 <DIR> d-------- C:\Program Files\iPod
2008-07-15 01:01 . 2008-07-15 01:01 0 --ah----- C:\Users\Default.LOG2
2008-07-15 01:01 . 2008-07-15 01:01 0 --ah----- C:\Users\Default.LOG1
2008-07-15 01:01 . 2008-07-15 01:01 0 --ah----- C:\ProgramData.LOG2
2008-07-15 01:01 . 2008-07-15 01:01 0 --ah----- C:\ProgramData.LOG1
2008-07-09 03:56 . 2008-06-26 01:33 12,240,896 --a------ C:\Windows\System32\NlsLexicons0007.dll
2008-07-09 03:54 . 2008-06-26 01:33 11,722,752 --a------ C:\Windows\System32\NlsLexicons0001.dll
2008-06-25 20:55 . 2008-06-25 20:55 <DIR> d-------- C:\Users\Guest\AppData\Roaming\Webroot

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-21 01:06 77,824 ----a-w C:\Windows\System32\kdfapi.dll
2008-07-21 01:06 722,472 ----a-w C:\Windows\System32\kdfmgr.exe
2008-07-21 01:06 53,248 ----a-w C:\Windows\System32\Kdfhok.dll
2008-07-21 01:06 192,512 ----a-w C:\Windows\System32\kdfvmgr.exe
2008-07-19 02:22 --------- d-----w C:\Program Files\Trend Micro
2008-07-17 10:58 --------- d-----w C:\Users\Faz\AppData\Roaming\uTorrent
2008-07-15 19:18 --------- d-----w C:\Program Files\QuickTime
2008-07-15 18:54 --------- d-----w C:\Users\Faz\AppData\Roaming\LimeWire
2008-07-09 11:28 174 --sha-w C:\Program Files\desktop.ini
2008-07-09 03:11 --------- d-----w C:\ProgramData\Microsoft Help
2008-07-09 03:07 --------- d-----w C:\Program Files\Windows Mail
2008-07-08 23:49 --------- d-----w C:\Program Files\Windows Live Safety Center
2008-06-26 00:34 7,964,672 ----a-w C:\Windows\System32\NlsLexicons0024.dll
2008-06-26 00:33 9,892,864 ----a-w C:\Windows\System32\NlsLexicons000a.dll
2008-06-19 23:27 --------- d-----w C:\Program Files\Cisco
2008-06-19 19:05 --------- d-----w C:\Program Files\LimeWire
2008-06-12 02:05 --------- d-----w C:\Program Files\LexmarkX73
2008-06-08 01:20 --------- d---a-w C:\ProgramData\TEMP
2008-06-08 00:17 --------- d-----w C:\Users\Faz\AppData\Roaming\SpinTop
2008-05-24 20:36 --------- d-----w C:\Users\Ozzy Temp.Faz-PC\AppData\Roaming\Webroot
2008-05-10 03:30 14,848 ----a-w C:\Windows\System32\wshrm.dll
2008-05-08 21:30 20,992 ----a-w C:\Windows\bw-uninstall.exe
2008-04-29 03:50 181,760 ----a-w C:\Windows\System32\fsquirt.exe
2008-04-26 13:45 76,288 ----a-w C:\Windows\freezerlive.exe
2008-04-26 08:02 1,327,104 ----a-w C:\Windows\System32\quartz.dll
2008-04-25 04:23 826,368 ----a-w C:\Windows\System32\wininet.dll
2008-04-25 04:23 56,320 ----a-w C:\Windows\System32\iesetup.dll
2008-04-25 04:23 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-04-25 04:22 26,624 ----a-w C:\Windows\System32\ieUnatt.exe
2008-04-23 04:27 428,032 ----a-w C:\Windows\System32\EncDec.dll
2008-04-23 04:27 292,352 ----a-w C:\Windows\System32\psisdecd.dll
2008-04-23 04:27 1,244,672 ----a-w C:\Windows\System32\mcmde.dll
2007-10-30 01:25 216 ----a-w C:\Users\Faz\AppData\Roaming\wklnhst.dat
2001-07-26 15:58 47 ----a-w C:\Program Files\ACMonitor_X73.ini
2001-07-05 11:46 8,116 ----a-w C:\Program Files\OSLO3071b2.USB
2001-05-11 10:39 53,248 ----a-w C:\Program Files\ACMonitor_X73.exe
2001-05-08 15:36 114,688 ----a-w C:\Program Files\lxarscan.dll
2001-04-23 13:22 1,437 ----a-w C:\Program Files\gtx73.ini
2001-02-22 08:54 768 ----a-w C:\Program Files\x73_lut.dat
2007-11-20 10:11 16,384 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2007-11-20 10:11 32,768 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
2007-11-20 10:11 16,384 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [2007-03-15 12:09 460784]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 13:34 125440]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-04-24 01:46 68856]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-09 15:51 1232896]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-02-28 17:07 1828136]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe" [2008-02-28 17:07 132392]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Broadcom Wireless Manager UI"="C:\Windows\system32\WLTRAY.exe" [2007-12-08 14:34 3444736]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2006-10-03 11:37 81920]
"IgfxTray"="C:\Windows\system32\igfxtray.exe" [2006-12-12 10:02 98304]
"HotKeysCmds"="C:\Windows\system32\hkcmd.exe" [2006-12-12 10:03 106496]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2006-10-03 11:35 221184]
"WPCUMI"="C:\Windows\system32\WpcUmi.exe" [2006-11-02 13:33 176128]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2007-12-26 21:27 29744]
"UfSeAgnt.exe"="C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe" [2008-03-17 15:58 1398024]
"PrinTray"="C:\Windows\system32\spool\DRIVERS\W32X86\3\printray.exe" [2001-10-12 07:42 36864]
"O2"="C:\Program Files\O2\bin\sprtcmd.exe" [2008-03-28 22:47 198184]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-04-11 17:10 185896]
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-02-18 16:29 2221352]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 20:51 39792]
"AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-10 09:47 116040]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-05-27 10:50 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-07-10 10:51 289064]
"SigmatelSysTrayApp"="sttray.exe" [2007-02-08 06:11 303104 C:\Windows\sttray.exe]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-11-03 17:55:50 703280]
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2007-10-11 11:40:51 50688]
QuickSet.lnk - C:\Windows\Installer\{7F0C4457-8E64-491B-8D7B-991504365D1E}\NewShortcut2_53A01CC614B04512A2E710D39BF83DC4.exe [2007-10-11 11:37:48 45056]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"LogonHoursAction"= 2 (0x2)
"DontDisplayLogonHoursWarnings"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"dscactivate"=c:\dell\dsca.exe 3
"ECenter"=C:\Dell\E-Center\EULALauncher.exe
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe"
"WPCUMI"=C:\Windows\system32\WpcUmi.exe
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" -atboottime
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
"RoxWatchTray"="C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AutoUpdateDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"TCP Query User{BB6EAEA7-EB24-4C09-A3CF-EE1F933BCF9F}C:\\program files\\utorrent\\utorrent.exe"= UDP:C:\program files\utorrent\utorrent.exe:uTorrent
"UDP Query User{B92798B9-7DF9-4A18-88FA-860428CF8E53}C:\\program files\\utorrent\\utorrent.exe"= TCP:C:\program files\utorrent\utorrent.exe:uTorrent
"TCP Query User{AB9FF158-4C4F-410B-BB17-D1E9E1B04D47}C:\\program files\\common files\\nero\\nero web\\setupx.exe"= UDP:C:\program files\common files\nero\nero web\setupx.exe:Nero Installer
"UDP Query User{4192C56C-4603-473D-A18C-3F78747A34D6}C:\\program files\\common files\\nero\\nero web\\setupx.exe"= TCP:C:\program files\common files\nero\nero web\setupx.exe:Nero Installer
"TCP Query User{7B43D7BD-DB4E-4969-AB56-10103F8C25A4}C:\\program files\\common files\\nero\\nero web\\setupx.exe"= UDP:C:\program files\common files\nero\nero web\setupx.exe:Nero Installer
"UDP Query User{BC91B21A-3FA1-40A1-B37B-7B6AC6177627}C:\\program files\\common files\\nero\\nero web\\setupx.exe"= TCP:C:\program files\common files\nero\nero web\setupx.exe:Nero Installer
"TCP Query User{B1F34259-B144-42E6-883E-35A3EC66F739}C:\\program files\\windows sidebar\\sidebar.exe"= UDP:C:\program files\windows sidebar\sidebar.exe:Windows Sidebar
"UDP Query User{ABC891D3-5186-4687-9D37-9407930E6EF1}C:\\program files\\windows sidebar\\sidebar.exe"= TCP:C:\program files\windows sidebar\sidebar.exe:Windows Sidebar
"TCP Query User{47C6A4E4-EAA0-4CB8-8200-39D72AF11FAF}C:\\program files\\sony ericsson\\update service\\update service.exe"= UDP:C:\program files\sony ericsson\update service\update service.exe:Update Service
"UDP Query User{B15890AC-DFE8-497E-BB4A-F3BAA3E924F9}C:\\program files\\sony ericsson\\update service\\update service.exe"= TCP:C:\program files\sony ericsson\update service\update service.exe:Update Service
"TCP Query User{4A6A264D-7609-4CA5-8EC2-A0395FCAA69C}C:\\program files\\utorrent\\utorrent.exe"= UDP:C:\program files\utorrent\utorrent.exe:uTorrent
"UDP Query User{B0CEA45A-1B5F-4980-9528-9C738D45EC8C}C:\\program files\\utorrent\\utorrent.exe"= TCP:C:\program files\utorrent\utorrent.exe:uTorrent
"{8A93EF39-8038-44CB-8746-66ABA7E88DC4}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{4913DA03-C6E6-4BF3-8C28-89632371E8C3}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{A3BCEF81-4CE8-4723-A80B-7195B02F4823}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{5891467B-7E7E-410B-AC9D-FF9ECFC60C99}"= UDP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{73EF8EC3-6A1E-497D-809E-8F80DC048CBC}"= TCP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"TCP Query User{0A9D981E-E423-4B23-A73B-EF548F2B5E8F}C:\\\\windows live\\messenger\\msnmsgr.exe"= UDP:C:\\windows live\messenger\msnmsgr.exe:msnmsgr.exe
"UDP Query User{BE515D76-1F18-4720-94ED-5CA80441A2AB}C:\\\\windows live\\messenger\\msnmsgr.exe"= TCP:C:\\windows live\messenger\msnmsgr.exe:msnmsgr.exe
"TCP Query User{6735CF40-4FE8-4F2D-8E3C-F822CE1D6376}C:\\program files\\veoh networks\\veoh\\veohclient.exe"= UDP:C:\program files\veoh networks\veoh\veohclient.exe:Veoh Client
"UDP Query User{DFC1F0BB-0E93-4A8D-BCF7-59D4CD171FE3}C:\\program files\\veoh networks\\veoh\\veohclient.exe"= TCP:C:\program files\veoh networks\veoh\veohclient.exe:Veoh Client
"{6AD90EAA-0A11-4C9E-AAE9-86EDCCB6D77C}"= C:\Program Files\Windows Live\Messenger\wlcsdk.exe:Windows Live Messenger (Phone)
"{73A9927E-4975-4540-AB3E-B4F825CB2B16}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{C00BDB00-818D-45CC-B306-3DA879F6FA13}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{2D2E10C2-9327-4CED-8F9E-754D5DD756E8}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{C58F748F-3796-4D05-8F60-CDE12A892656}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{3B3C545B-8CEB-4247-949F-A75250A26DFE}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{7349FA8B-5BE3-4175-9ED0-A1001AFA4890}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{9E4DC7AF-E787-4956-9E55-53B548090F87}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{4796D8AF-54E2-4F62-9185-B33396B55ECD}"= UDP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
"{565216AE-79E9-4523-9D0D-AD360904E9C8}"= TCP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
"{D6CC95B6-DCE3-4B26-AFD2-6EC2BDC45621}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{642E4ACC-7288-4CF4-9B0E-CF99B181C658}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{91800C38-5B81-47AE-B4A6-4D89C5A21AAD}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"TCP Query User{64925E29-99CD-41C8-BBA2-BF9C284637E6}C:\\users\\faz\\program files\\utorrent\\utorrent.exe"= UDP:C:\users\faz\program files\utorrent\utorrent.exe:utorrent.exe
"UDP Query User{1B809B00-B336-4727-AF52-F124D73E5B3F}C:\\users\\faz\\program files\\utorrent\\utorrent.exe"= TCP:C:\users\faz\program files\utorrent\utorrent.exe:utorrent.exe
"TCP Query User{2F29D0FE-8A7E-43D0-AF31-026AEDA5BF26}C:\\users\\faz\\program files\\utorrent\\utorrent.exe"= UDP:C:\users\faz\program files\utorrent\utorrent.exe:utorrent.exe
"UDP Query User{A9618213-49DE-462A-8391-42A7379BF9C1}C:\\users\\faz\\program files\\utorrent\\utorrent.exe"= TCP:C:\users\faz\program files\utorrent\utorrent.exe:utorrent.exe
"TCP Query User{7DD14560-5480-4338-B7E0-143CCD145201}C:\\program files\\veoh networks\\veoh\\veohclient.exe"= UDP:C:\program files\veoh networks\veoh\veohclient.exe:Veoh Client
"UDP Query User{57959CEA-CFBD-4477-97D3-4FD7D5BA4C20}C:\\program files\\veoh networks\\veoh\\veohclient.exe"= TCP:C:\program files\veoh networks\veoh\veohclient.exe:Veoh Client
"{2CC27BBE-0BEC-4E39-ACB2-FFEEF4AD19C0}"= Disabled:UDP:C:\Windows\System32\P2P Networking\P2P Networking.exe:P2P Networking
"{09BE2937-B72B-4770-86B5-2307024095A7}"= Disabled:TCP:C:\Windows\System32\P2P Networking\P2P Networking.exe:P2P Networking
"TCP Query User{8E9F9E2D-33D7-468E-B3CD-4D3B4FEA6FE0}C:\\program files\\limewire\\limewire.exe"= UDP:C:\program files\limewire\limewire.exe:LimeWire
"UDP Query User{D4D7B463-82C3-484E-8DDF-2593405B6628}C:\\program files\\limewire\\limewire.exe"= TCP:C:\program files\limewire\limewire.exe:LimeWire
"{FF605FCA-08DE-4E91-BC47-ACE3A858E9B1}"= C:\Program Files\Windows Live\Messenger\wlcsdk.exe:Windows Live Messenger (Phone)
"{D941381D-8FB4-4AE4-88D2-5F49357BCBDB}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{A1D59691-877A-45A1-A615-EEFAEAA927CD}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{A9A16AA6-EF05-491E-9C7D-E8254E027E02}"= C:\Program Files\Windows Live\Messenger\wlcsdk.exe:Windows Live Messenger (Phone)
"{CACEDAE5-CCA8-48E4-BEAA-8BEA1295A5E3}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"TCP Query User{A3E5E382-0243-44F6-B4A7-E6B813185C65}C:\\program files\\common files\\nokia\\service layer\\a\\nsl_host_process.exe"= UDP:C:\program files\common files\nokia\service layer\a\nsl_host_process.exe:Nokia Service Layer Host Process
"UDP Query User{1E0E3B28-4BFA-4F09-AF68-B21A5F110F41}C:\\program files\\common files\\nokia\\service layer\\a\\nsl_host_process.exe"= TCP:C:\program files\common files\nokia\service layer\a\nsl_host_process.exe:Nokia Service Layer Host Process
"{136721AC-9F2B-477C-AD39-9957358E6EDE}"= UDP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"{36069760-2DC8-4C6A-B4BB-2648EAFDD1DF}"= TCP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"TCP Query User{123F83CB-BAF5-4E14-AC1F-5A84D12E6DA5}C:\\users\\faz\\appdata\\local\\temp\\rar$ex00.994\\keygen.exe"= Disabled:UDP:C:\users\faz\appdata\local\temp\rar$ex00.994\keygen.exe:keygen.exe
"UDP Query User{C5CDFB66-A0B6-4E13-AB55-0ABB287EDF26}C:\\users\\faz\\appdata\\local\\temp\\rar$ex00.994\\keygen.exe"= Disabled:TCP:C:\users\faz\appdata\local\temp\rar$ex00.994\keygen.exe:keygen.exe
"TCP Query User{8B820D51-3912-4936-8E36-C17D208E5E16}C:\\users\\faz\\appdata\\local\\temp\\rar$ex04.312\\keygen.exe"= Disabled:UDP:C:\users\faz\appdata\local\temp\rar$ex04.312\keygen.exe:keygen.exe
"UDP Query User{5CB77D38-2C58-4128-AEDA-BD85350F9032}C:\\users\\faz\\appdata\\local\\temp\\rar$ex04.312\\keygen.exe"= Disabled:TCP:C:\users\faz\appdata\local\temp\rar$ex04.312\keygen.exe:keygen.exe
"TCP Query User{43F053B2-64C0-4365-AD5F-53119A93D151}C:\\program files\\dopewars-1.5.12\\dopewars.exe"= UDP:C:\program files\dopewars-1.5.12\dopewars.exe:dopewars
"UDP Query User{12F848C8-6D23-494E-88AA-3940258374F4}C:\\program files\\dopewars-1.5.12\\dopewars.exe"= TCP:C:\program files\dopewars-1.5.12\dopewars.exe:dopewars
"TCP Query User{EA399F8D-0D7A-4123-BD10-E3E510936B75}C:\\program files\\internet explorer\\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{09386F3F-0F48-4387-9673-7D944AABB58F}C:\\program files\\internet explorer\\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"{401BABB3-A157-4407-87B1-DB5395FD2B88}"= UDP:C:\Program Files\O2\bin\wificfg.exe:sprtcmd.exe
"{8472CBBB-395B-4774-9609-ECAC14AD97A3}"= TCP:C:\Program Files\O2\bin\wificfg.exe:sprtcmd.exe
"{37108114-9D2E-4F8F-BC43-E012B4FAEA28}"= UDP:C:\Program Files\O2\agent\bin\bcont.exe:bcont.exe
"{ABF0C67B-8A16-48F7-BAEE-E523E83F0061}"= TCP:C:\Program Files\O2\agent\bin\bcont.exe:bcont.exe
"{CCC7BD34-3E9B-4BD8-BECE-E112BB2493E3}"= UDP:C:\Program Files\Common Files\supportsoft\bin\ssrc.exe:ssrc.exe
"{DD2B8666-0331-4EA4-91BC-31CF2BFF8966}"= TCP:C:\Program Files\Common Files\supportsoft\bin\ssrc.exe:ssrc.exe
"{CCB506B9-A6FB-4E79-88BA-7DF1D2DA22B5}"= UDP:C:\Program Files\O2\agent\bin\bcont_nm.exe:bcont_nm.exe
"{04332331-0C97-468F-B501-3C53CF9D7FE5}"= TCP:C:\Program Files\O2\agent\bin\bcont_nm.exe:bcont_nm.exe
"{469DA2AD-3B42-4302-B858-A75B5C41D1C1}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{A47AD7AA-9475-4B50-9C14-3AA95AA9B7FA}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

R1 tmlwf;Trend Micro NDIS 6.0 Filter Driver;C:\Windows\system32\DRIVERS\tmlwf.sys [2007-09-28 11:02]
R2 LMIRfsDriver;LogMeIn Remote File System Driver;C:\Windows\system32\drivers\LMIRfsDriver.sys [2007-08-03 16:09]
R2 sprtsvc_O2;SupportSoft Sprocket Service (O2);C:\Program Files\O2\bin\sprtsvc.exe [2007-06-07 16:19]
R2 tmwfp;Trend Micro WFP Callout Driver;C:\Windows\system32\DRIVERS\tmwfp.sys [2007-09-28 11:02]
R2 UxTuneUp;TuneUp Theme Extension;C:\Windows\System32\svchost.exe [2006-11-02 10:45]
R3 btwaudio;Bluetooth Audio Device Service;C:\Windows\system32\drivers\btwaudio.sys [2006-11-07 02:37]
R3 btwavdt;Bluetooth AVDT Service;C:\Windows\system32\drivers\btwavdt.sys [2006-11-07 00:13]
R3 btwrchid;btwrchid;C:\Windows\system32\DRIVERS\btwrchid.sys [2006-11-07 00:13]
S3 ggflt;SEMC USB Flash Driver Filter;C:\Windows\system32\DRIVERS\ggflt.sys [2007-11-16 02:31]
S3 GoogleDesktopManager-121807-210419;Google Desktop Manager 5.7.712.18632;C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [2007-12-26 21:27]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\Windows\System32\TuneUpDefragService.exe [2008-01-21 03:59]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\K]
\shell\AutoRun\command - K:\Install.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3313ee02-c2b6-11dc-94fe-001c23a77774}]
\shell\Auto\command - L:\PegeFile.pif
\shell\AutoRun\command - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL L:\PegeFile.pif

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6f95ee54-8a08-11dc-92e5-001c23a77774}]
\shell\Auto\command - F:\PegeFile.pif
\shell\AutoRun\command - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL F:\PegeFile.pif

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{81905b20-c38a-11dc-ba5d-001c23a77774}]
\shell\AutoRun\command - L:\setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b1b86282-8ff8-11dc-a7b9-001c23a77774}]
\shell\Auto\command - F:\PegeFile.pif
\shell\AutoRun\command - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL F:\PegeFile.pif

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e8cf37ad-8b15-11dc-8bf2-001c23a77774}]
\shell\Auto\command - PegeFile.pif
\shell\AutoRun\command - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL PegeFile.pif

*Newly Created Service* - CATCHME

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7070D8E0-650A-46b3-B03C-9497582E6A74}]
%SystemRoot%\system32\soundschemes.exe /AddRegistration
.
Contents of the 'Scheduled Tasks' folder
"2008-05-23 16:21:13 C:\Windows\Tasks\1-Click Maintenance.job"
- C:\Program Files\TuneUp Utilities 2008\OneClick.exe
.
- - - - ORPHANS REMOVED - - - -

ShellIconOverlayIdentifiers-{8D2223A2-B3C6-4e32-B096-CDD11F628C60} - (no file)


.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://www.google.co.uk/
R0 -: HKLM-Main,Start Page = hxxp://www.google.co.uk/ig/dell?hl=en&client=dell-usuk&channel=uk&ibd=3071011

O16 -: {149E45D8-163E-4189-86FC-45022AB2B6C9} - file:///C:/Program%20Files/Monopoly/Images/stg_drm.ocx
C:\Windows\Downloaded Program Files\stg_drm.ocx

O16 -: {1E54D648-B804-468d-BC78-4AFFED8E262E} - hxxp://www.srtest.com/srl_bin/sysreqlab3.cab
C:\Windows\Downloaded Program Files\SysReqLab3.osd
C:\Windows\Downloaded Program Files\sysreqlab3.dll

O16 -: {CC450D71-CC90-424C-8638-1F2DBAC87A54} - file:///C:/Program%20Files/Monopoly/Images/armhelper.ocx
C:\Windows\Downloaded Program Files\armhelper.ocx


**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-21 02:36:06
Windows 6.0.6000 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


**************************************************************************
.
Completion time: 2008-07-21 2:38:44
ComboFix-quarantined-files.txt 2008-07-21 01:37:38
ComboFix2.txt 2007-11-02 01:50:19

Pre-Run: 55,678,423,040 bytes free
Post-Run: 55,813,758,976 bytes free

272 --- E O F --- 2008-07-09 03:16:06

[greyknight17]

I don't recommend using file sharing programs since they can contribute to malware. As you can see from one of the scans, it picked up some spyware on it.

Good job. Your log is clean.

To help prevent future spyware infections, read the Anti-Spyware Tutorial and use the tools provided.

Are there any problems now? If none, go to Start->Run, copy/paste in combofix /u and hit OK to remove it. You should be set to go.

[faz123]

Thank you, my computer is faster then it was! there are no malware problems, however i do keep getting the BSOD sometimes saying "IRQS DRIVER NOT EQUAL OR LESS" can you help?

[greyknight17]

Most likely some driver conflict. Ask this in the Windows board for more assistance.

[greyknight17]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.