Thanks again for this super help.
Yes, Firefox (thank goodness) works perfectly, but IE...
Here is the Rootkit reveal log
C:\Documents and Settings\TonyG\Application Data\Mozilla\Firefox\Profiles\p6nol2v2.default\Cache\09169791d01 9/9/2005 11:51 PM 60.32 KB Hidden from Windows API.
C:\Documents and Settings\TonyG\Application Data\Mozilla\Firefox\Profiles\p6nol2v2.default\Cache\5A78749Ad01 9/9/2005 11:49 PM 83.49 KB Hidden from Windows API.
C:\Documents and Settings\TonyG\Application Data\Mozilla\Firefox\Profiles\p6nol2v2.default\Cache\60C6EFD4d01 9/9/2005 11:47 PM 18.44 KB Hidden from Windows API.
C:\Documents and Settings\TonyG\Application Data\Mozilla\Firefox\Profiles\p6nol2v2.default\Cache\746454E6d01 9/9/2005 11:47 PM 55.98 KB Hidden from Windows API.
C:\Documents and Settings\TonyG\Application Data\Mozilla\Firefox\Profiles\p6nol2v2.default\Cache\7465E2B0d01 9/9/2005 11:46 PM 46.64 KB Hidden from Windows API.
C:\Documents and Settings\TonyG\Application Data\Mozilla\Firefox\Profiles\p6nol2v2.default\Cache\75C90D4Bd01 9/9/2005 11:52 PM 26.35 KB Hidden from Windows API.
C:\Documents and Settings\TonyG\Application Data\Mozilla\Firefox\Profiles\p6nol2v2.default\Cache\A3CC6654d01 9/9/2005 11:45 PM 37.22 KB Hidden from Windows API.
C:\Documents and Settings\TonyG\Application Data\Mozilla\Firefox\Profiles\p6nol2v2.default\Cache\B07E675Ad01 9/9/2005 11:51 PM 60.18 KB Hidden from Windows API.
C:\Documents and Settings\TonyG\Application Data\Mozilla\Firefox\Profiles\p6nol2v2.default\Cache\B17E675Ad01 9/9/2005 11:47 PM 60.80 KB Hidden from Windows API.
C:\Documents and Settings\TonyG\Application Data\Mozilla\Firefox\Profiles\p6nol2v2.default\Cache\B27E675Ad01 9/9/2005 11:49 PM 59.50 KB Hidden from Windows API.
C:\Documents and Settings\TonyG\Application Data\Mozilla\Firefox\Profiles\p6nol2v2.default\Cache\B417E180d01 9/9/2005 11:45 PM 69.52 KB Hidden from Windows API.
C:\Documents and Settings\TonyG\Application Data\Mozilla\Firefox\Profiles\p6nol2v2.default\Cache\D47E66ECd01 9/9/2005 11:46 PM 56.62 KB Hidden from Windows API.
C:\Documents and Settings\TonyG\Application Data\Mozilla\Firefox\Profiles\p6nol2v2.default\Cache\E3170285d01 9/9/2005 11:46 PM 25.79 KB Hidden from Windows API.
C:\Documents and Settings\TonyG\Application Data\Mozilla\Firefox\Profiles\p6nol2v2.default\Cache\F223376Bd01 9/9/2005 11:52 PM 115 bytes Hidden from Windows API.
C:\Documents and Settings\TonyG\Application Data\Mozilla\Firefox\Profiles\p6nol2v2.default\parent.lock 9/9/2005 11:45 PM 0 bytes Hidden from Windows API.
C:\Documents and Settings\TonyG\Local Settings\Temporary Internet Files\Content.IE5\Y0UMK6MJ\spdbupdate[1].htm 9/9/2005 11:44 PM 54 bytes Hidden from Windows API.
C:\WINDOWS\SoftwareDistribution\DataStore\Logs\tmp.edb 9/9/2005 11:40 PM 64.00 KB Visible in Windows API, but not in MFT or directory index.
Here is the Silent Runners output
"Silent Runners.vbs", revision 40.1,
http://www.silentrunners.org/Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"
Startup items buried in registry:
---------------------------------
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"AVG7_CC" = "C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP" ["GRISOFT, s.r.o."]
"AVG7_EMC" = "C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe" ["GRISOFT, s.r.o."]
"NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS]
"NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" [MS]
"nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"]
"NVMixerTray" = ""C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"" ["NVIDIA Corporation"]
"C-Media Mixer" = "Mixer.exe /startup" ["C-Media Electronic Inc. (www.cmedia.com.tw)"]
HKLM\Software\Microsoft\Active Setup\Installed Components\
>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}\(Default) = "Outlook Express"
\StubPath = "C:\WINDOWS\system32\shmgrate.exe OCInstallUserConfigOE" [MS]
{8b15971b-5355-4c82-8c07-7e181ea07608}\(Default) = "Fax"
\StubPath = "rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\fxsocm.inf,Fax.UnInstall.PerUser" [MS]
{94de52c8-2d59-4f1b-883e-79663d2d9a8c}\(Default) = "Fax Provider"
\StubPath = "rundll32.exe C:\WINDOWS\System32\Setup\FxsOcm.dll,XP_UninstallProvider" [MS]
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Spybot - Search & Destroy\SDHelper.dll" ["Safer Networking Limited"]
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
INFECTION WARNING! "{03A80B1D-5C6A-42c2-9DFB-81B6005D8023}" = "Trend Micro Anti-Spyware Shell Extension"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Trend Micro\Tmas\sshook.dll" ["Trend Micro Incorporated"]
HKLM\Software\Classes\PROTOCOLS\Filter\
INFECTION WARNING! text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS]
HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
Adobe.Acrobat.ContextMenu\(Default) = "{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802}"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\Acrobat Elements\ContextMenu.dll" ["Adobe Systems Inc."]
AVG7 Shell Extension\(Default) = "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."]
StuffIt Compress Menu\(Default) = "{3FBFD0B0-EB46-4797-9101-615610E87DA6}"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Aladdin Systems\StuffIt\CompressMenu.dll" ["Aladdin Systems, Inc."]
HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
AVG7 Shell Extension\(Default) = "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."]
BPS.Spyware.Adware.Remover\(Default) = "{7306D133-DBED-4096-84A3-8B98B23F02B4}"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\BulletProofSoft.com\BPS Spyware & Adware Remover\ContextMenu.dll" ["BulletProofSoft.com"]
StuffIt Compress Menu\(Default) = "{3FBFD0B0-EB46-4797-9101-615610E87DA6}"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Aladdin Systems\StuffIt\CompressMenu.dll" ["Aladdin Systems, Inc."]
Active Desktop and Wallpaper:
-----------------------------
Active Desktop is disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState
HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\Documents and Settings\TonyG\Local Settings\Application Data\Microsoft\Wallpaper1.bmp"
Enabled Screen Saver:
---------------------
HKCU\Control Panel\Desktop\
"SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS]
Startup items in "TonyG" & "All Users" startup folders:
-------------------------------------------------------
C:\Documents and Settings\All Users\Start Menu\Programs\Startup
"SATARaid" -> shortcut to: "C:\Program Files\Silicon Image\SiISATARaid\SATARaid.exe" ["Silicon Image, Inc."]
"Trend Micro Anti-Spyware" -> shortcut to: "C:\Program Files\Trend Micro\Tmas\Tmas.exe -autostart" ["Trend Micro Incorporated"]
Winsock2 Service Provider DLLs:
-------------------------------
Namespace Service Providers
HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
Transport Service Providers
HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 26
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05
Toolbars, Explorer Bars, Extensions:
------------------------------------
Toolbars
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\
"{47833539-D0C5-4125-9FA8-0819E2EAAC93}" = "Adobe PDF" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll" ["Adobe Systems Incorporated"]
Explorer Bars
Dormant Explorer Bars in "View, Explorer Bar" menu
HKLM\Software\Classes\CLSID\{182EC0BE-5110-49C8-A062-BEB1D02A220B}\ = "Adobe PDF"
Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]
InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll" ["Adobe Systems Incorporated"]
HKLM\Software\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\ = "&Research"
Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]
InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL" [MS]
Extensions (Tools menu items, main toolbar menu buttons)
HKLM\Software\Microsoft\Internet Explorer\Extensions\
{FB5F1910-F110-11D2-BB9E-00C04F795683}\
"ButtonText" = "Messenger"
"MenuText" = "Windows Messenger"
"Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS]
Miscellaneous IE Hijack Points
------------------------------
HKLM\Software\Microsoft\Internet Explorer\Version = (invalid data)
The Internet Explorer version cannot be found!
C:\WINDOWS\INF\IERESET.INF (used to "Reset Web Settings")
The contents of IERESET.INF cannot be reliably checked!
Added lines (compared with English-language version):
[Strings]: START_PAGE_URL="
http://www.microsoft...r=6&ar=msnhome"[Strings]: MS_START_PAGE_URL="
http://www.microsoft...r=6&ar=msnhome"Missing lines (compared with English-language version):
[Strings]: 2 lines
Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------
AVG7 Alert Manager Server, Avg7Alrt, "C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe" ["GRISOFT, s.r.o."]
AVG7 Update Service, Avg7UpdSvc, "C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe" ["GRISOFT, s.r.o."]
InCD Helper, InCDsrv, "C:\Program Files\Ahead\InCD\InCDsrv.exe" ["Nero AG"]
IPv6 Helper Service, 6to4, "C:\WINDOWS\system32\svchost.exe -k netsvcs" {"C:\WINDOWS\System32\6to4svc.dll" [MS]}
NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"]
Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS]
----------
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ The search for DESKTOP.INI DLL launch points on all local fixed drives
took 12 seconds.
+ The search for all Registry CLSIDs containing dormant Explorer Bars
took 9 seconds.
---------- (total run time: 41 seconds)