[siddhu7_d]

Hi thunderbird!
This is my Combofix log
ComboFix 08-08-11.01 - user 2008-08-12 20:50:11.5 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1774 [GMT 5.5:30]
Running from: C:\Documents and Settings\user\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\user\Desktop\CFScript.txt
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2008-07-12 to 2008-08-12 )))))))))))))))))))))))))))))))
.

2008-08-11 20:13 . 2008-08-11 20:13 <DIR> d--hs---- C:\FOUND.000
2008-08-09 15:51 . 2008-08-09 15:51 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Adobe Systems
2008-08-09 15:48 . 2008-08-09 15:48 7,168 --ahs---- C:\WINDOWS\Thumbs.db
2008-08-09 15:46 . 2008-08-09 15:46 <DIR> d-------- C:\Program Files\Common Files\Adobe Systems Shared
2008-08-04 00:18 . 2008-08-04 00:18 <DIR> d-------- C:\Program Files\Kaspersky Lab
2008-08-04 00:18 . 2008-08-04 00:18 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-08-04 00:18 . 2008-08-11 20:36 741,920 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-08-04 00:18 . 2008-08-07 00:41 96,976 --a------ C:\WINDOWS\system32\drivers\klin.dat
2008-08-04 00:18 . 2008-08-04 01:06 87,855 --a------ C:\WINDOWS\system32\drivers\klick.dat
2008-08-04 00:18 . 2008-08-11 20:36 12,836 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-08-04 00:18 . 2008-08-11 20:36 11,552 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat
2008-08-04 00:18 . 2008-08-11 20:36 4,028 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx
2008-08-04 00:17 . 2008-08-04 00:17 <DIR> d-------- C:\kav
2008-08-04 00:02 . 2008-08-04 00:02 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-08-03 19:38 . 2008-08-03 19:38 <DIR> d-------- C:\Program Files\Trend Micro
2008-08-03 19:36 . 2008-08-03 19:36 <DIR> d-------- C:\Deckard
2008-08-03 19:30 . 2008-08-03 19:30 <DIR> d-------- C:\_OTMoveIt
2008-08-03 01:10 . 2008-08-03 01:10 <DIR> d---s---- C:\Documents and Settings\user\UserData
2008-08-02 03:17 . 2008-08-02 03:17 <DIR> d-------- C:\Program Files\RogueRemover FREE
2008-08-02 02:09 . 2001-08-23 12:00 4,224 --a------ C:\WINDOWS\system32\beep.sys
2008-08-02 02:06 . 2008-08-02 02:06 <DIR> d-------- C:\Program Files\uTorrent
2008-07-23 17:05 . 2008-07-23 17:05 <DIR> d-------- C:\WINDOWS\system32\Adobe
2008-07-21 20:38 . 2008-07-21 20:38 <DIR> d-------- C:\WINDOWS\Sun
2008-07-19 23:37 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-07-19 23:36 . 2008-07-19 23:36 <DIR> d-------- C:\Program Files\Java
2008-07-19 23:13 . 2008-07-19 23:13 <DIR> d-------- C:\Program Files\Common Files\Java
2008-07-18 21:53 . 2008-07-18 21:53 <DIR> d-------- C:\WINDOWS\EffectResources
2008-07-18 21:52 . 2008-07-18 21:52 <DIR> d-------- C:\Documents and Settings\user\Application Data\ArcSoft
2008-07-18 21:51 . 2008-07-18 21:51 <DIR> d-------- C:\Program Files\Common Files\ArcSoft
2008-07-18 21:51 . 2004-12-07 10:11 258,352 --a------ C:\WINDOWS\system32\unicows.dll
2008-07-18 21:51 . 2005-02-23 14:58 11,776 --a------ C:\WINDOWS\system32\drivers\afc.sys
2008-07-18 21:50 . 2008-07-18 21:50 <DIR> d-------- C:\Program Files\ArcSoft
2008-07-18 21:50 . 2008-07-18 21:50 <DIR> d-------- C:\Documents and Settings\user\Application Data\InstallShield
2008-07-18 21:50 . 1995-08-01 04:44 212,480 --a------ C:\WINDOWS\PCDLIB32.DLL
2008-07-18 21:49 . 2004-08-03 23:07 59,264 --a------ C:\WINDOWS\system32\drivers\USBAUDIO.sys
2008-07-18 21:48 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2008-07-17 22:04 . 2006-10-26 19:56 32,592 --a------ C:\WINDOWS\system32\msonpmon.dll
2008-07-17 22:01 . 2008-07-17 22:01 <DIR> d-------- C:\Program Files\MSBuild
2008-07-17 22:01 . 2008-07-17 22:01 <DIR> d-------- C:\Program Files\Microsoft Works
2008-07-17 21:59 . 2008-07-17 21:59 <DIR> d-------- C:\Program Files\Microsoft.NET
2008-07-17 21:50 . 2008-07-17 21:50 <DIR> dr-h----- C:\MSOCache
2008-07-17 16:59 . 2001-08-17 13:56 7,552 --a------ C:\WINDOWS\system32\drivers\SONYPVU1.SYS
2008-07-15 23:13 . 2007-02-07 14:21 44,544 --a------ C:\WINDOWS\system32\msxml4a.dll
2008-07-15 23:11 . 2006-11-22 22:26 1,706,800 --a------ C:\WINDOWS\system32\gdiplus.dll
2008-07-14 23:11 . 2008-07-14 23:11 <DIR> d-------- C:\Documents and Settings\user\Application Data\Corel
2008-07-14 23:11 . 2008-07-20 20:45 900 --ahs---- C:\WINDOWS\system32\KGyGaAvL.sys
2008-07-14 23:11 . 2008-07-20 20:44 88 -r-hs---- C:\WINDOWS\system32\789ED35EEC.sys
2008-07-14 23:10 . 2008-07-14 23:10 <DIR> d-------- C:\Program Files\Corel
2008-07-14 23:10 . 2008-07-14 23:10 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Corel
2008-07-14 12:20 . 2008-07-14 12:20 <DIR> d-------- C:\Documents and Settings\user\Application Data\U3
2008-07-13 20:03 . 2008-07-13 20:03 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-07-13 20:03 . 2008-07-13 20:03 <DIR> d-------- C:\Documents and Settings\user\Application Data\Malwarebytes
2008-07-13 20:03 . 2008-07-13 20:03 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-07-13 20:03 . 2008-07-07 17:35 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-07-13 20:03 . 2008-07-07 17:35 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-07-13 17:57 . 2008-07-13 17:57 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avg7

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-03 19:36 112,144 ----a-w C:\WINDOWS\system32\drivers\kl1.sys
2008-07-31 12:00 90,112 ----a-w C:\WINDOWS\DUMP758d.tmp
2008-07-11 18:29 --------- d-----w C:\Documents and Settings\user\Application Data\Sony
2008-07-11 18:17 --------- d-----w C:\Program Files\Total Video Converter
2008-07-11 18:16 --------- d-----w C:\Documents and Settings\user\Application Data\dxdlls
2008-07-11 18:16 --------- d-----w C:\Documents and Settings\All Users\Application Data\syswin
2008-07-11 11:56 --------- d-----w C:\Program Files\PhotomatixPro3
2008-07-11 11:20 --------- d-----w C:\Documents and Settings\user\Application Data\Yahoo!
2008-07-11 11:20 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-07-10 13:50 --------- d-----w C:\Documents and Settings\user\Application Data\AdobeUM
2008-07-09 19:10 --------- d-----w C:\Program Files\WMA Converter
2008-07-09 18:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo!
2008-07-09 18:06 --------- d-----w C:\Program Files\Yahoo!
2008-07-09 17:20 --------- d-----w C:\Program Files\AnswerWorks 4.0
2008-07-09 17:18 --------- d-----w C:\Program Files\AutoCAD 2006
2008-07-09 17:18 --------- d-----w C:\Documents and Settings\user\Application Data\Autodesk
2008-07-09 17:18 --------- d-----w C:\Documents and Settings\All Users\Application Data\Autodesk
2008-07-09 17:16 --------- d-----w C:\Program Files\Common Files\Autodesk Shared
2008-07-09 17:16 --------- d-----w C:\Program Files\Autodesk
2008-07-07 17:39 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-07-04 08:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\FLEXnet
2008-07-04 07:13 --------- d-----w C:\Program Files\Winamp
2008-07-04 07:10 --------- d-----w C:\Documents and Settings\user\Application Data\uTorrent
2008-07-04 07:09 --------- d-----w C:\Program Files\Google
2008-07-03 16:18 --------- d-----w C:\Documents and Settings\user\Application Data\CyberLink
2008-07-03 16:18 --------- d-----w C:\Documents and Settings\All Users\Application Data\CyberLink
2008-07-03 16:04 --------- d-----w C:\Program Files\Common Files\xing shared
2008-07-03 14:51 --------- d-----w C:\Documents and Settings\All Users\Application Data\ESET
2008-07-03 13:01 --------- d-----w C:\Documents and Settings\user\Application Data\vlc
2008-07-03 06:25 --------- d-----w C:\Program Files\VideoLAN
2008-07-03 06:23 --------- d-----w C:\Program Files\Real
2008-07-03 06:23 --------- d-----w C:\Program Files\Common Files\Real
2008-07-03 06:23 --------- d-----w C:\Program Files\Common Files\Adobe
2008-07-03 06:21 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll
2008-07-03 06:21 348,160 ------w C:\WINDOWS\system32\msvcr71.dll
2008-07-03 06:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\nView_Profiles
2008-07-03 06:12 --------- d-----w C:\Program Files\WIDCOMM
2008-07-03 06:07 --------- d-----w C:\Program Files\NetWaiting
2008-07-03 05:34 --------- d-----w C:\Program Files\CyberLink
2008-07-03 05:34 --------- d-----w C:\Program Files\Common Files\Nero
2008-07-03 05:33 --------- d-----w C:\Program Files\Common Files\Ahead
2008-07-03 05:33 --------- d-----w C:\Program Files\Ahead
2008-07-03 04:47 --------- d-----w C:\Program Files\CONEXANT
2008-07-03 04:46 --------- d-----w C:\Program Files\HPQ
2008-07-03 04:34 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-03 04:27 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-07-03 04:27 --------- d-----w C:\Program Files\Broadcom
2008-07-02 13:53 --------- d-----w C:\Program Files\microsoft frontpage
.

((((((((((((((((((((((((((((( snapshot@2008-08-04_18.34.00.85 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-08-09 10:16:12 65,536 ----a-r C:\WINDOWS\Installer\{236BB7C4-4419-42FD-0409-1E257A25E34D}\NewShortcut1_236BB7C4441942FD04091E257A25E34D.exe
+ 2008-08-09 10:16:38 65,536 ----a-r C:\WINDOWS\Installer\{B74D4E10-1033-0000-0000-000000000001}\AdobeBridge_B74D4E10103300000000000000000001_1.exe
+ 2008-08-09 10:16:38 65,536 ----a-r C:\WINDOWS\Installer\{B74D4E10-1033-0000-0000-000000000001}\BridgeCommonShortcut_B74D4E101033000000000001_1.exe
+ 2008-08-09 10:16:38 1,904,640 ----a-r C:\WINDOWS\Installer\{B74D4E10-1033-0000-0000-000000000001}\ESLaunchShortcut_B74D4E10103300000000000000000001.exe
+ 2008-08-09 10:16:38 61,440 ----a-r C:\WINDOWS\Installer\{B74D4E10-1033-0000-0000-000000000001}\NewShortcut2_B74D4E10103300000000000000000001.exe
+ 2008-08-09 10:17:22 65,536 ----a-r C:\WINDOWS\Installer\{E9787678-1033-0000-8E67-000000000001}\AppLanuchShortcut_E9787678103300008E67000000000001_1.exe
+ 2008-08-09 10:17:22 65,536 ----a-r C:\WINDOWS\Installer\{E9787678-1033-0000-8E67-000000000001}\ProgramMenuShortcut_E9787678103300008E670000000001_1.exe
+ 2008-08-10 07:29:30 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2008-08-10 07:29:30 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2008-07-29 05:41:24 1,664,072 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT
+ 2008-08-09 10:25:32 1,664,104 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT
- 2008-08-03 19:45:44 53,806 ----a-w C:\WINDOWS\system32\perfc009.dat
+ 2008-08-12 07:13:16 53,806 ----a-w C:\WINDOWS\system32\perfc009.dat
- 2008-08-03 19:45:44 383,492 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2008-08-12 07:13:16 383,492 ----a-w C:\WINDOWS\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:56 15360]
"Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" [2007-08-30 17:43 4670704]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-04-17 02:36 8437760]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Adobe Photoshop Lightroom 1.2\apdproxy.exe" [2007-08-30 06:32 61440]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-07-03 21:34 185896]
"googletalk"="C:\Program Files\Google\Google Talk\googletalk.exe" [2007-01-02 02:52 3739648]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2006-06-21 22:44 35328]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47 31016]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]

C:\Documents and Settings\user\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 19:16:50 113664]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
AutoCAD Startup Accelerator.lnk - C:\Program Files\Common Files\Autodesk Shared\acstart16.exe [2005-03-05 07:18:22 10872]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Bluetooth.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Bluetooth.lnk
backup=C:\WINDOWS\pss\Bluetooth.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
backup=C:\WINDOWS\pss\WinZip Quick Pick.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 10:50 155648 C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
--a------ 2007-04-17 02:36 8437760 C:\WINDOWS\system32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
--a------ 2007-04-17 02:36 81920 C:\WINDOWS\system32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--a------ 2004-11-02 20:24 32768 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2008-07-03 21:34 185896 C:\Program Files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a------ 2006-06-21 22:44 35328 C:\Program Files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\High Definition Audio Property Page Shortcut]
--a------ 2006-07-27 14:44 61952 C:\WINDOWS\system32\CHDAudPropShortcut.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 2007-04-17 02:36 1626112 C:\WINDOWS\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
"C:\\Program Files\\Google\\Google SketchUp 6\\SketchUp.exe"=
"C:\\Program Files\\Google\\Google SketchUp 6\\LayOut\\LayOut.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"G:\\dumps\\utorrent.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 7.0\\avp.exe"=

R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-12-13 13:28]
S3 usbvm328;HP Camera;C:\WINDOWS\system32\Drivers\usbvm326.sys [2006-10-13 06:12]
S3 vmfilter323;VC0326 filter service for Serome;C:\WINDOWS\system32\drivers\vmfilter323.sys [2006-08-11 09:30]
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-12 21:02:09
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-08-12 21:04:01
ComboFix-quarantined-files.txt 2008-08-12 15:33:56
ComboFix4.txt 2008-08-04 17:43:38
ComboFix3.txt 2008-08-06 20:05:52
ComboFix5.txt 2008-08-12 15:18:52
ComboFix2.txt 2008-08-09 09:07:58

Pre-Run: 6,948,470,784 bytes free
Post-Run: 6,908,035,072 bytes free

220



This is my Hijack This log..


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:04:45 PM, on 8/12/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Adobe\Adobe Photoshop Lightroom 1.2\lightroom.exe
C:\Program Files\Adobe\Adobe Photoshop CS2\Photoshop.exe
C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\YAHOO!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\YAHOO!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\YAHOO!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Adobe Photoshop Lightroom 1.2\apdproxy.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{880D8573-9C61-4DE4-B469-1836B9A473B8}: NameServer = 172.19.0.1,202.56.250.6
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe

--
End of file - 6481 bytes




My system is running just fine. And its all because of you! Thanks a tonne! By the way, I used to use NOD32 as my anti virus and recently, i've swtiched on to kaspersky. The system runs slower now. used to run with a very nice speed when i was using NOD32. Does kaspersky slow down the system???

[Advertisements]

Hello siddhu7_d,

The system runs slower now. used to run with a very nice speed when i was using NOD32. Does kaspersky slow down the system???

Well it slows the system more then NOD32 does. I however don't know how much more.

Follow these steps to uninstall Combofix and tools used in the removal of malware

• Click START then RUN
• Now type Combofix /u in the runbox and click OK. Note the space between the X and the U, it needs to be there.
  

Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

• Disable and Enable System Restore. - If you are using Windows ME or XP then you should disable and re-enable system restore to make sure there are no infected files found in a restore point.
  
  You can find instructions on how to enable and reenable system restore here:
  
  Managing Windows Millenium System Restore
  
  or
  
  Windows XP System Restore Guide
  
  Reenable system restore with instructions from tutorial above
  
  
• Make your Internet Explorer more secure - This can be done by following these simple instructions:
  • From within Internet Explorer click on the Tools menu and then click on Options.
  • Click once on the Security tab
  • Click once on the Internet icon so it becomes highlighted.
  • Click once on the Custom Level button.
    
    • Change the Download signed ActiveX controls to Prompt
    • Change the Download unsigned ActiveX controls to Disable
    • Change the Initialize and script ActiveX controls not marked as safe to Disable
    • Change the Installation of desktop items to Prompt
    • Change the Launching programs and files in an IFRAME to Prompt
    • Change the Navigate sub-frames across different domains to Prompt
    • When all these settings have been made, click on the OK button.
    • If it prompts you as to whether or not you want to save the settings, press the Yes button.
  • Next press the Apply button and then the OK to exit the Internet Properties page.
• Use an AntiVirus Software - It is very important that your computer has an anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future.
  
  See this link for a listing of some online & their stand-alone antivirus programs:
  
  Virus, Spyware, and Malware Protection and Removal Resources
  
  
• Update your AntiVirus Software - It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
  
  
• Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is succeptible to being hacked and taken over. I am very serious about this and see it happen almost every day with my clients. Simply using a Firewall in its default configuration can lower your risk greatly.
  
  For a tutorial on Firewalls and a listing of some available ones see the link below:
  
  Understanding and Using Firewalls
  
  
• Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
  
  
• Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an antivirus software.
  
  A tutorial on installing & using this product can be found here:
  
  Using Spybot - Search & Destroy to remove Spyware , Malware, and Hijackers
  
  
• Install Ad-Aware - Install and download Ad-Aware. ou should also scan your computer with program on a regular basis just as you would an antivirus software in conjunction with Spybot.
  
  A tutorial on installing & using this product can be found here:
  
  Using Ad-aware to remove Spyware, Malware, & Hijackers from Your Computer
  
  
• Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.
  
  A tutorial on installing & using this product can be found here:
  
  Using SpywareBlaster to protect your computer from Spyware and Malware
  
  
• Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.

Follow this list and your potential for being infected again will reduce dramatically.

here are some additional utilities that will enhance your safety

• MVPS Hosts file <= The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your coputer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer
• Google Toolbar <= Get the free google toolbar to help stop pop up windows.
• Winpatrol <= Download and install the free version of Winpatrol. a tutorial for this product is located here:
  Using Winpatrol to protect your computer from malicious software

Thunderbird1988

[Thunderbird1988]

Hello siddhu7_d,

The system runs slower now. used to run with a very nice speed when i was using NOD32. Does kaspersky slow down the system???

Well it slows the system more then NOD32 does. I however don't know how much more.

Follow these steps to uninstall Combofix and tools used in the removal of malware

• Click START then RUN
• Now type Combofix /u in the runbox and click OK. Note the space between the X and the U, it needs to be there.
  

Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

• Disable and Enable System Restore. - If you are using Windows ME or XP then you should disable and re-enable system restore to make sure there are no infected files found in a restore point.
  
  You can find instructions on how to enable and reenable system restore here:
  
  Managing Windows Millenium System Restore
  
  or
  
  Windows XP System Restore Guide
  
  Reenable system restore with instructions from tutorial above
  
  
• Make your Internet Explorer more secure - This can be done by following these simple instructions:
  • From within Internet Explorer click on the Tools menu and then click on Options.
  • Click once on the Security tab
  • Click once on the Internet icon so it becomes highlighted.
  • Click once on the Custom Level button.
    
    • Change the Download signed ActiveX controls to Prompt
    • Change the Download unsigned ActiveX controls to Disable
    • Change the Initialize and script ActiveX controls not marked as safe to Disable
    • Change the Installation of desktop items to Prompt
    • Change the Launching programs and files in an IFRAME to Prompt
    • Change the Navigate sub-frames across different domains to Prompt
    • When all these settings have been made, click on the OK button.
    • If it prompts you as to whether or not you want to save the settings, press the Yes button.
  • Next press the Apply button and then the OK to exit the Internet Properties page.
• Use an AntiVirus Software - It is very important that your computer has an anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future.
  
  See this link for a listing of some online & their stand-alone antivirus programs:
  
  Virus, Spyware, and Malware Protection and Removal Resources
  
  
• Update your AntiVirus Software - It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
  
  
• Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is succeptible to being hacked and taken over. I am very serious about this and see it happen almost every day with my clients. Simply using a Firewall in its default configuration can lower your risk greatly.
  
  For a tutorial on Firewalls and a listing of some available ones see the link below:
  
  Understanding and Using Firewalls
  
  
• Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
  
  
• Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an antivirus software.
  
  A tutorial on installing & using this product can be found here:
  
  Using Spybot - Search & Destroy to remove Spyware , Malware, and Hijackers
  
  
• Install Ad-Aware - Install and download Ad-Aware. ou should also scan your computer with program on a regular basis just as you would an antivirus software in conjunction with Spybot.
  
  A tutorial on installing & using this product can be found here:
  
  Using Ad-aware to remove Spyware, Malware, & Hijackers from Your Computer
  
  
• Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.
  
  A tutorial on installing & using this product can be found here:
  
  Using SpywareBlaster to protect your computer from Spyware and Malware
  
  
• Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.

Follow this list and your potential for being infected again will reduce dramatically.

here are some additional utilities that will enhance your safety

• MVPS Hosts file <= The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your coputer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer
• Google Toolbar <= Get the free google toolbar to help stop pop up windows.
• Winpatrol <= Download and install the free version of Winpatrol. a tutorial for this product is located here:
  Using Winpatrol to protect your computer from malicious software

Thunderbird1988

[Thunderbird1988]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.