Thanks again, this has been so helpful!
Posted below are the new reports:
Malwarebytes' Anti-Malware 1.36
Database version: 2154
Windows 5.1.2600 Service Pack 3
5/19/2009 12:30:05 PM
mbam-log-2009-05-19 (12-29-49).txt
Scan type: Full Scan (C:\|)
Objects scanned: 140150
Time elapsed: 42 minute(s), 39 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 0
Registry Data Items Infected: 1
Folders Infected: 3
Files Infected: 8
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\AdwareAlert (Rogue.AdwareAlert) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\gxvxcserv.sys (Trojan.Agent) -> No action taken.
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.80,85.255.112.168 -> No action taken.
Folders Infected:
C:\Documents and Settings\pekhaml\Application Data\AdwareAlert (Rogue.AdwareAlert) -> No action taken.
C:\Documents and Settings\pekhaml\Application Data\AdwareAlert\Log (Rogue.AdwareAlert) -> No action taken.
C:\Documents and Settings\pekhaml\Application Data\AdwareAlert\Settings (Rogue.AdwareAlert) -> No action taken.
Files Infected:
C:\System Volume Information\_restore{D0D4C289-1775-4E84-B8F1-E8133151EDAF}\RP1426\A0062017.rbf (Rogue.SpyCleaner) -> No action taken.
C:\System Volume Information\_restore{D0D4C289-1775-4E84-B8F1-E8133151EDAF}\RP1427\A0062159.dll (Rogue.SpyCleaner) -> No action taken.
C:\System Volume Information\_restore{D0D4C289-1775-4E84-B8F1-E8133151EDAF}\RP1427\A0062161.exe (Rogue.Installer) -> No action taken.
C:\System Volume Information\_restore{D0D4C289-1775-4E84-B8F1-E8133151EDAF}\RP1427\A0062177.exe (Rogue.Installer) -> No action taken.
C:\Documents and Settings\pekhaml\Application Data\AdwareAlert\rs.dat (Rogue.AdwareAlert) -> No action taken.
C:\Documents and Settings\pekhaml\Application Data\AdwareAlert\Log\2009 May 11 - 09_11_46 AM_984.log (Rogue.AdwareAlert) -> No action taken.
C:\Documents and Settings\pekhaml\Application Data\AdwareAlert\Log\2009 May 11 - 09_11_54 AM_000.log (Rogue.AdwareAlert) -> No action taken.
C:\Documents and Settings\pekhaml\Application Data\AdwareAlert\Settings\ScanResults.pie (Rogue.AdwareAlert) -> No action taken.
New Hijack This log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:36:51 PM, on 5/19/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Program Files\Webroot\WebrootSecurity\WRConsumerService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\Caere\PageKeeper30\system\PKJobs.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Webroot\WebrootSecurity\SpySweeper.exe
C:\Program Files\Caere\PageKeeper30\SYSTEM\PKSlapi.exe
C:\Program Files\Caere\PageKeeper30\SYSTEM\PKTOPASS.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.stillwatergazette.comR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft....k/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft....k/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft....k/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://go.microsoft....k/?LinkId=69157R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [IgfxTray] "C:\WINDOWS\system32\igfxtray.exe"
O4 - HKLM\..\Run: [HotKeysCmds] "C:\WINDOWS\system32\hkcmd.exe"
O4 - HKLM\..\Run: [DrvLsnr] "C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe"
O4 - HKLM\..\Run: [srmclean] "C:\Cpqs\Scom\srmclean.exe"
O4 - HKLM\..\Run: [SetRefresh] "C:\Program Files\Compaq\SetRefresh\SetRefresh.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] "C:\PROGRA~1\AVG\AVG8\avgtray.exe"
O4 - HKLM\..\Run: [WorksFUD] "C:\Program Files\Microsoft Works\wkfud.exe"
O4 - HKLM\..\Run: [Microsoft Works Portfolio] "C:\Program Files\Microsoft Works\WksSb.exe" /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] "C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\RunOnce: [washindex] C:\Program Files\Washer\washidx.exe
O4 - HKLM\..\RunServicesOnce: [washindex] C:\Program Files\Washer\washidx.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Washer] C:\Program Files\Washer\washer.exe /0
O4 - HKCU\..\Run: [scheduler_monitor] "C:\Program Files\ReaConverter 5.5 Pro\init_scheduler.exe"
O4 - HKCU\..\RunOnce: [washindex] C:\Program Files\Washer\washidx.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O4 - Global Startup: PageKeeper Jobs.lnk = C:\Program Files\Caere\PageKeeper30\system\PKJobs.exe
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) -
http://cdn.scan.onec...lscbase5483.cabO18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Sony SPTI Service for DVE (ICDSPTSV) - Sony Corporation - C:\WINDOWS\system32\IcdSptSv.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: ReaConverter scheduler service (rcp_service) - ReaSoft - C:\Program Files\ReaConverter 5.5 Pro\rcp_scheduler.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. (www.webroot.com) - C:\Program Files\Webroot\WebrootSecurity\SpySweeper.exe
O23 - Service: Webroot Client Service (WRConsumerService) - Webroot Software, Inc. - C:\Program Files\Webroot\WebrootSecurity\WRConsumerService.exe
--
End of file - 7648 bytes
New Combofix log:
ComboFix 09-05-17.08 - pekhaml 05/19/2009 12:56.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.631.306 [GMT -5:00]
Running from: c:\documents and settings\pekhaml\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\pekhaml\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
file zipped: c:\documents and settings\pekhaml\cmdd.bat
file zipped: c:\windows\kcmd.exe
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\pekhaml\cmdd.bat
c:\windows\kcmd.exe
.
((((((((((((((((((((((((( Files Created from 2009-04-19 to 2009-05-19 )))))))))))))))))))))))))))))))
.
2009-05-19 16:44 . 2009-05-19 16:44 -------- d-----w c:\documents and settings\pekhaml\Application Data\Malwarebytes
2009-05-19 16:44 . 2009-04-06 20:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-05-19 16:44 . 2009-04-06 20:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-19 16:44 . 2009-05-19 16:44 -------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-05-19 16:44 . 2009-05-19 16:44 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-05-16 18:04 . 2009-05-17 00:34 -------- d-----w c:\program files\Games
2009-05-16 17:18 . 2009-05-16 17:18 -------- d-----w c:\program files\bfgclient
2009-05-16 17:17 . 2009-05-16 17:18 -------- d-----w c:\documents and settings\All Users\Application Data\BigFishGamesCache
2009-05-12 18:21 . 2009-05-12 18:21 -------- d-----w c:\program files\Trend Micro
2009-05-11 16:35 . 2009-05-11 16:53 -------- d-----w c:\program files\Registry Fix Pro
2009-05-10 22:35 . 2009-05-10 22:48 -------- d-----w c:\program files\PC Registry Cleaner
2009-05-10 22:25 . 2009-05-10 22:32 -------- d-----w c:\program files\PCRegistryCleaner
2009-05-10 22:17 . 2009-05-10 22:17 -------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-05-10 22:17 . 2009-05-10 22:17 -------- d-----w c:\program files\Spybot - Search & Destroy
2009-05-10 20:04 . 2009-05-11 17:37 -------- d-----w c:\program files\Windows Live Safety Center
2009-05-10 18:50 . 2009-05-10 18:50 -------- d-----w c:\windows\system32\LogFiles
2009-05-09 22:17 . 2009-05-09 22:17 -------- d-----w c:\documents and settings\LocalService\Local Settings\Application Data\Google
2009-05-09 22:17 . 2009-05-09 22:17 -------- d-----w c:\documents and settings\LocalService\Application Data\AVGTOOLBAR
2009-05-09 17:19 . 2009-05-16 17:48 -------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-05-03 17:55 . 2008-12-05 02:42 815104 ----a-w c:\windows\system32\xvidcore.dll
2009-05-03 17:55 . 2008-12-05 02:46 180224 ----a-w c:\windows\system32\xvidvfw.dll
2009-05-03 17:55 . 2009-05-03 17:55 -------- d-----w c:\program files\Xvid
2009-04-22 15:47 . 2009-04-22 15:47 360580 ----a-w c:\windows\eSellerateEngine.dll
2009-04-22 15:47 . 2009-04-22 15:47 -------- d-----w c:\program files\Common Files\eSellerate
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-19 17:48 . 2008-07-07 13:35 -------- d-----w c:\program files\Common Files\Adobe
2009-05-17 23:02 . 2008-12-26 20:40 -------- d-----w c:\program files\Common Files\Symantec Shared
2009-05-17 23:00 . 2008-12-26 20:40 -------- d-----w c:\program files\Norton Security Scan
2009-05-11 00:09 . 2008-06-25 15:41 -------- d-----w c:\program files\Google
2009-05-08 14:39 . 2008-07-03 16:11 11952 ----a-w c:\windows\system32\avgrsstx.dll
2009-05-08 14:39 . 2008-07-03 16:11 325896 ----a-w c:\windows\system32\drivers\avgldx86.sys
2009-05-08 14:39 . 2008-07-03 16:11 108552 ----a-w c:\windows\system32\drivers\avgtdix.sys
2009-05-05 17:30 . 2008-06-25 15:40 60 ----a-w c:\windows\wpd99.drv
2009-04-18 18:53 . 2009-04-18 18:00 56 ---h--w c:\windows\popcreg.dat
2009-04-18 18:53 . 2009-04-18 18:00 18 ----a-w c:\windows\popcinfot.dat
2009-04-18 16:35 . 2009-04-18 16:35 -------- d-----w c:\program files\ReflexiveArcade
2009-04-15 21:47 . 2009-04-15 21:47 -------- d-----w c:\program files\Bonjour
2009-04-15 21:46 . 2008-10-16 20:08 -------- d-----w c:\program files\QuickTime
2009-04-15 21:44 . 2008-10-16 20:07 -------- d-----w c:\program files\Common Files\Apple
2009-04-03 18:55 . 2005-05-03 23:55 -------- d-----w c:\program files\Java
2009-03-30 00:15 . 2009-02-22 19:29 -------- d-----w c:\program files\WinSysClean 2009 Trial
2009-03-26 08:00 . 2009-03-26 08:00 -------- d-----w c:\program files\MSXML 4.0
2009-03-25 18:44 . 2009-03-25 18:44 130 ----a-w c:\documents and settings\pekhaml\Local Settings\Application Data\fusioncache.dat
2009-03-25 18:43 . 2009-03-25 18:43 -------- d-----w c:\program files\MSSOAP
2009-03-25 18:43 . 2009-03-25 18:43 -------- d-----w c:\program files\Webroot
2009-03-24 22:21 . 2009-03-24 21:41 -------- d-----w c:\program files\bctool - Scanner Programming Tool
2009-03-09 10:19 . 2009-01-12 20:14 410984 ----a-w c:\windows\system32\deploytk.dll
2009-03-06 14:22 . 2004-08-04 08:00 284160 ----a-w c:\windows\system32\pdh.dll
2009-03-05 22:10 . 2009-03-25 18:43 1553784 ----a-w c:\windows\WRSetup.dll
2009-03-03 00:18 . 2004-08-04 08:00 826368 ----a-w c:\windows\system32\wininet.dll
2009-02-25 20:24 . 2009-02-25 20:24 23152 ----a-w c:\windows\system32\drivers\sshrmd.sys
2009-02-25 20:24 . 2009-02-25 20:24 176752 ----a-w c:\windows\system32\drivers\ssidrv.sys
2009-02-25 20:24 . 2009-02-25 20:24 29808 ----a-w c:\windows\system32\drivers\ssfs0bbc.sys
2009-02-20 18:09 . 2004-08-04 08:00 78336 ----a-w c:\windows\system32\ieencode.dll
.
(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
---- Directory of c:\program files\WinPx ----
((((((((((((((((((((((((((((( SnapShot@2009-05-18_19.43.06 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-05-19 17:33 . 2009-05-19 17:33 16384 c:\windows\Temp\Perflib_Perfdata_4a8.dat
+ 2005-05-26 13:50 . 2009-05-19 17:33 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2005-05-26 13:50 . 2009-05-18 19:10 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2005-05-26 13:50 . 2009-05-19 17:33 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2005-05-26 13:50 . 2009-05-18 19:10 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2005-05-26 13:50 . 2009-05-19 17:33 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2005-05-26 13:50 . 2009-05-18 19:10 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"Washer"="c:\program files\Washer\washer.exe" [2000-03-13 885760]
"scheduler_monitor"="c:\program files\ReaConverter 5.5 Pro\init_scheduler.exe" [2007-06-15 27136]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2003-03-11 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2003-03-11 114688]
"DrvLsnr"="c:\program files\Analog Devices\SoundMAX\DrvLsnr.exe" [2003-05-08 69632]
"srmclean"="c:\cpqs\Scom\srmclean.exe" [2001-07-24 36864]
"SetRefresh"="c:\program files\Compaq\SetRefresh\SetRefresh.exe" [2003-11-20 525824]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-05-08 1947928]
"WorksFUD"="c:\program files\Microsoft Works\wkfud.exe" [2001-10-06 24576]
"Microsoft Works Portfolio"="c:\program files\Microsoft Works\WksSb.exe" [2001-08-23 331830]
"Microsoft Works Update Detection"="c:\program files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2001-08-17 28738]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce]
"washindex"="c:\program files\Washer\washidx.exe" [1999-12-18 61952]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" - c:\windows\system32\narrator.exe [2008-04-14 53760]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-3-28 113664]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]
Microsoft Works Calendar Reminders.lnk - c:\program files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe [2001-8-7 24633]
PageKeeper Jobs.lnk - c:\program files\Caere\PageKeeper30\system\PKJobs.exe [2008-6-25 150016]
QuickBooks Update Agent.lnk - c:\program files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2004-11-11 806912]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-05-08 14:39 11952 ----a-w c:\windows\system32\avgrsstx.dll
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32
"MIDI1"= SYNCOR11.DLL
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WRConsumerService]
@="Service"
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableNotifications"= 1 (0x1)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
R0 ssfs0bbc;ssfs0bbc;c:\windows\system32\drivers\ssfs0bbc.sys [2/25/2009 3:24 PM 29808]
R1 ATMhelpr;ATMhelpr;c:\windows\system32\drivers\ATMHELPR.SYS [6/25/2008 10:49 AM 4064]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [7/3/2008 11:11 AM 325896]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [7/3/2008 11:11 AM 108552]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [7/9/2008 9:06 AM 298776]
R2 WRConsumerService;Webroot Client Service;c:\program files\Webroot\WebrootSecurity\WRConsumerService.exe [3/25/2009 1:44 PM 1178728]
S2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [7/9/2008 9:06 AM 908568]
S3 rcp_service;ReaConverter scheduler service;c:\program files\ReaConverter 5.5 Pro\rcp_scheduler.exe [11/30/2007 12:27 PM 558592]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\hptray]
c:\windows\hptray.exe
.
Contents of the 'Scheduled Tasks' folder
2009-05-13 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.stillwatergazette.com
uInternet Settings,ProxyOverride = *.local
FF - ProfilePath - c:\documents and settings\pekhaml\Application Data\Mozilla\Firefox\Profiles\ngjbqdfj.default\
FF - prefs.js: browser.startup.homepage - www.google.com
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2009-05-19 12:58
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2009-05-19 13:00
ComboFix-quarantined-files.txt 2009-05-19 17:59
ComboFix2.txt 2009-05-18 19:45
Pre-Run: 24,877,457,408 bytes free
Post-Run: 24,866,021,376 bytes free
173 --- E O F --- 2009-05-13 22:42
Upload was successful
And finally the Kaspersky log:--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0 REPORT
Tuesday, May 19, 2009
Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Program database last update: Tuesday, May 19, 2009 20:32:57
Records in database: 2198945
--------------------------------------------------------------------------------
Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes
Scan area - My Computer:
C:\
D:\
Scan statistics:
Files scanned: 60058
Threat name: 0
Infected objects: 0
Suspicious objects: 0
Duration of the scan: 02:01:40
No malware has been detected. The scan area is clean.
The selected area was scanned.