Welcome to MalwareRemoval.com,
What if we told you that you could get malware removal help from experts, and that it was 100% free? MalwareRemoval.com provides free support for people with infected computers. Our help, and the tools we use are always 100% free. No hidden catch. We simply enjoy helping others. You enjoy a clean, safe computer.

Malware Removal Instructions

Gomyron

MalwareRemoval.com provides free support for people with infected computers. Using plain language that anyone can understand, our community of volunteer experts will walk you through each step.

Gomyron

Unread postby suerg » July 5th, 2007, 5:35 pm

Hey I have been infected with a form of malware that has reset my homepage to <live link removed> and also my desktop has been replaced and a red flashing ! is in my notification area and i am getting tons of popups. So if anyone knows what to do tnx.

Edited by Nellie2
suerg
Active Member
 
Posts: 6
Joined: July 5th, 2007, 5:29 pm
Advertisement
Register to Remove

Unread postby curlylad » July 5th, 2007, 5:54 pm

Hello and welcome to The Malware Removal Forums.

My name is curlylad and I will be helping you to remove any infection(s) that you may have.

I have to let experts check the content of my fixes before I post them so be patient.

I will be giving you a series of instructions that need to be followed in the order in which I give them to you.

If for any reason you do not understand an instruction or are just unsure then please do not guess , simply post back with your query and we will go through it again.

Please do not start another thread or topic, I will assist you at this thread until we solve your problems.

Lastly the fix may take several attempts and my replies may take some time but I will stick with it if you do the same.



The first thing I need you to do is:-

HijackThis ver 1.99.1


Please download HJTsetup.exe from here and save it to your desktop.
  • Double click on the HJTsetup.exe icon on your desktop.
  • By default it will install to C:\Program Files\Hijack This.
  • Continue to click Next in the setup dialogue boxes until you get to the Select Additional Tasks dialogue.
  • Put a check by Create a desktop icon then click Next again.
  • Continue to follow the rest of the prompts from there.
  • At the final dialogue box click Finish and it will launch HijackThis.
  • Click on the Do a system scan and save a log file button.
  • It will scan and then the log will open in notepad.
  • Paste the log as a reply to this thread.
Do NOT have HijackThis fix anything yet.

I will review the log and provide further instructions as soon as possible.
User avatar
curlylad
Retired Graduate
 
Posts: 1829
Joined: February 5th, 2006, 5:07 pm
Location: Birmingham

Unread postby suerg » July 5th, 2007, 6:06 pm

Here is my logfile

Logfile of HijackThis v1.99.1
Scan saved at 5:01:30 PM, on 7/5/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\TightVNC\WinVNC.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
D:\Adobe CS3 Master Collection\Acrobat 8.0\Acrobat\Acrotray.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http: //gomyron.com/NjU2NA==/2/3560/homepage/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = socks=localhost:1080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O1 - Hosts: 65.182.101.166 nicto.brinkster.net
O1 - Hosts: 72.14.221.19 gmail.com
O1 - Hosts: 65.59.234.97 bungie.net
O1 - Hosts: 216.178.39.15 myspace.com
O1 - Hosts: 145.97.39.155 en.wikipedia.org
O1 - Hosts: 66.81.80.141 roosterteeth.com
O1 - Hosts: 65.59.234.166 xbox.com
O1 - Hosts: 87.248.113.14 yahoo.com
O1 - Hosts: 212.162.1.124 hotmail.com
O1 - Hosts: 69.90.33.28 xbox-scene.com
O1 - Hosts: 65.182.102.190 brinkster.com
O1 - Hosts: 149.174.135.108 aol.com
O1 - Hosts: 64.236.29.114 adultswim.com
O1 - Hosts: 208.65.153.251 youtube.com
O1 - Hosts: 64.191.203.30 digg.com
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - D:\Adobe CS3 Master Collection\/Adobe Contribute CS3/contributeieplugin.dll
O2 - BHO: MSVPS System - {100B21CD-3B97-44FB-B1C0-EA6249E482E8} - C:\WINDOWS\ddesupport.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - D:\Adobe CS3 Master Collection\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Adobe CS3 Master Collection\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - D:\Adobe CS3 Master Collection\/Adobe Contribute CS3/contributeieplugin.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "D:\Adobe CS3 Master Collection\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [Adobe_ID0EYTHM] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
O4 - HKLM\..\Run: [LanzarP2006] "C:\DOCUME~1\David\LOCALS~1\Temp\{9A8B669E-CD8E-490B-A20C-CA0914ED86D7}\{EEBA9416-3207-47E0-9022-116440599DBC}\..\..\P2006tmp\Install.exe" /SETUP:"/l0x0009"
O4 - HKLM\..\Run: [avp] C:\WINDOWS\avp.exe
O4 - HKLM\..\Run: [smgr] mgrs.exe
O4 - HKLM\..\Run: [WinAntiSpyware 2007 Free] "C:\Program Files\WinAntiSpyware 2007\was7.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [Instant File Name Search] C:\Program Files\ifns\ifns.exe
O4 - HKCU\..\Run: [igndlm.exe] C:\Program Files\IGN\Download Manager\DLM.exe /windowsstart /startifwork
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Startup: GameSpot Download Manager.lnk = C:\Program Files\GameSpot\GDM_TrayApp.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O8 - Extra context menu item: Append to existing PDF - res://D:\Adobe CS3 Master Collection\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://D:\Adobe CS3 Master Collection\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://D:\Adobe CS3 Master Collection\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://D:\Adobe CS3 Master Collection\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://D:\Adobe CS3 Master Collection\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://D:\Adobe CS3 Master Collection\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://D:\Adobe CS3 Master Collection\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://D:\Adobe CS3 Master Collection\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (CDownloadCtrl Object) - http://www.fileplanet.com/fpdlmgr/cabs/ ... .2.100.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 4837470515
O17 - HKLM\System\CCS\Services\Tcpip\..\{1125EFB8-6938-472F-81E6-57ECC0604BB6}: NameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{222E2FB6-A1B8-452D-8C3D-5544A5A4BAFC}: NameServer = 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{1125EFB8-6938-472F-81E6-57ECC0604BB6}: NameServer = 192.168.2.1
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: igfxcui - igfxdev.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O21 - SSODL: msole - {8C814D89-82C1-4094-A434-B5714F718C0F} - C:\WINDOWS\msole.dll
O21 - SSODL: msdde - {B3E0042C-0967-493C-B159-48802049E20F} - C:\WINDOWS\msdde.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Version Cue CS3 - Unknown owner - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe" -win32service (file missing)
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: DNADownloader - CNET Networks - C:\Program Files\GameSpot\DownloadManager_Win32.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: mental ray 3.5 Satellite (32-bit) (mi-raysat_3dsmax9_32) - Unknown owner - C:\Program Files\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe
O23 - Service: NNServ - Unknown owner - C:\Program Files\NewDotNet\nnrun.exe" "C:\Program Files\NewDotNet\nncore.dll" ServiceStart (file missing)
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Unknown owner - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe (file missing)
O23 - Service: VNC Server (winvnc) - Unknown owner - C:\Program Files\TightVNC\WinVNC.exe" -service (file missing)
suerg
Active Member
 
Posts: 6
Joined: July 5th, 2007, 5:29 pm

Unread postby curlylad » July 6th, 2007, 12:24 pm

Good Evening suerg

As I pointed out in the first post, you really must follow my instructions exactly to make sure what I am attempting to do can succeed.
If you do not follow my step by step instructions the fix simply will not work, so if you are unsure then do not go on simply post back and ask.

Here are your first instructions

It appears that you may not be running a Firewall

It is very important that you use a Firewall on your computer. Without a firewall your computer is susceptible to being hacked and taken over.
It may be that you are using the Windows Firewall.The Windows Firewall only checks incoming Traffic to your system so is only doing half the job a good Firewall should be. Here are some firewalls which are free for personal use:-
Comodo
Kerio
ZoneAlarm

Please now choose one of the Firewalls then download and install it.
When you have done that reboot your system and continue on with the next instruction.


Download and Run ComboFix

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Next please do this:-



Download SDFix and save it to your Desktop.

Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)

Please then reboot your computer in Safe Mode by doing the following :

  • Restart your computer
  • After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
  • Instead of Windows loading as normal, the Advanced Options Menu should appear;
  • Select the first option, to run Windows in Safe Mode, then press Enter.
  • Choose your usual account.
  • Open the extracted SDFix folder and double click RunThis.bat to start the script.
  • Type Y to begin the cleanup process.
  • It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
  • Press any Key and it will restart the PC.
  • When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
  • Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
    (Report.txt will also be copied to Clipboard ready for posting back on the forum).
  • Finally paste the contents of the Report.txt back on the forum with a new HijackThis log.



Please now post back the Combofix Log and the Report.txt created by SDFix.

I will review the new information and provide your next instructions as soon as possible.
User avatar
curlylad
Retired Graduate
 
Posts: 1829
Joined: February 5th, 2006, 5:07 pm
Location: Birmingham

Unread postby suerg » July 6th, 2007, 1:42 pm

i am running a firewall it is nvidia firewall.
suerg
Active Member
 
Posts: 6
Joined: July 5th, 2007, 5:29 pm

Unread postby suerg » July 6th, 2007, 3:03 pm

Here are the Sdfix,combofix, and hackthis logs and also when i was running combofix it rebooted my computer and erased my boot options so
i had to fix them using the xp disc so i am guessing that was it removing the virus? ok anyway what do i have to do now?


SDFix: Version 1.90

Run by Suerg on Fri 07/06/2007 at 01:36 PM

Microsoft Windows XP [Version 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:






Restoring Windows Registry Values
Restoring Windows Default Hosts File
Restoring Missing SharedAccess Service

Rebooting...


Normal Mode:
Checking Files:

Below files will be copied to Backups folder then removed:

C:\Documents and Settings\David\My Documents\eradication\gomyron virus icons (currently unremovable)\Error Cleaner.url - Deleted
C:\Documents and Settings\David\My Documents\eradication\gomyron virus icons (currently unremovable)\Privacy Protector.url - Deleted
C:\Documents and Settings\David\My Documents\eradication\gomyron virus icons (currently unremovable)\Spyware&Malware Protection.url - Deleted



Removing Temp Files...

ADS Check:

Checking C:\WINDOWS
C:\WINDOWS
No streams found.

Checking C:\WINDOWS\system32
C:\WINDOWS\system32
No streams found.

Checking C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
No streams found.

Checking C:\WINDOWS\system32\ntoskrnl.exe
C:\WINDOWS\system32\ntoskrnl.exe
No streams found.



Final Check:

Remaining Services:
------------------



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

Remaining Files:
---------------

Backups Folder: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes:

C:\Documents and Settings\www.nicto.com\local\user\image\Thumbs.db
C:\Documents and Settings\www.nicto.com\temp\Thumbs.db
C:\Documents and Settings\David\Shared\Nero 7.0.1.2 Ultra Edition with Keygen - English\Nero-7.0.1.2_eng.exe
C:\Documents and Settings\David\Shared\Nero 7.0.1.2 Ultra Edition with Keygen - English\Nero 7 Keygen from Embrace\keygen.exe
C:\Documents and Settings\David\Shared\Nero 7.0.1.2 Ultra Edition with Keygen - English\Nero 7 Keygen from Paradox\Nero7Keygen.exe
C:\Documents and Settings\David\Shared\WinACE WinRAR WinZip WinISO + password & cracker\WinACE\ace25_kg.exe
C:\Documents and Settings\David\Shared\WinACE WinRAR WinZip WinISO + password & cracker\WinACE\wace25d.exe
C:\Documents and Settings\David\Shared\WinACE WinRAR WinZip WinISO + password & cracker\WinISO\WinISO v5.3.exe
C:\Documents and Settings\David\Shared\WinACE WinRAR WinZip WinISO + password & cracker\WinISO\WinISO_crk.exe
C:\Documents and Settings\David\Shared\WinACE WinRAR WinZip WinISO + password & cracker\WinRAR\wrar320.exe
C:\Documents and Settings\David\Shared\WinACE WinRAR WinZip WinISO + password & cracker\WinRAR\RAR Password Cracker v4.11\rpc411_setup.exe
C:\Documents and Settings\David\Shared\WinACE WinRAR WinZip WinISO + password & cracker\WinZIP\E-wz8kg.exe
C:\Documents and Settings\David\Shared\WinACE WinRAR WinZip WinISO + password & cracker\WinZIP\winzip81.exe
C:\Documents and Settings\David\Shared\WinACE WinRAR WinZip WinISO + password & cracker\WinZIP\wzipregwin.exe
C:\Documents and Settings\David\Shared\WinACE WinRAR WinZip WinISO + password & cracker\WinZIP\wzipse22.exe
C:\Documents and Settings\David\Shared\WinACE WinRAR WinZip WinISO + password & cracker\WinZIP\zip_password cracker.exe
C:\Documents and Settings\David\Shared\WinACE WinRAR WinZip WinISO + password & cracker\WinZIP\Password Recovery V3.54\setup.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\All Users\Application Data\Delete4Sure.tmp
C:\Documents and Settings\All Users\Application Data\GTek\GTUpdate\AUpdate\Channels\ch1\lock.tmp
C:\Documents and Settings\All Users\Application Data\GTek\GTUpdate\AUpdate\Channels\ch2\lock.tmp
C:\Documents and Settings\All Users\DRM\Cache\Indiv03.tmp
C:\Documents and Settings\David\Local Settings\Application Data\Microsoft\Zune\Zune\Downloads\0017B0C2\BIT152.tmp
C:\WINDOWS\LastGood.Tmp\INF\oem16.inf
C:\WINDOWS\LastGood.Tmp\INF\oem16.PNF
C:\WINDOWS\system32\config\default.tmp.LOG
C:\WINDOWS\system32\config\SAM.tmp.LOG
C:\WINDOWS\system32\config\SECURITY.tmp.LOG
C:\WINDOWS\system32\config\software.tmp.LOG
C:\WINDOWS\system32\config\system.tmp.LOG
C:\Documents and Settings\David\Shared\Adobe Photoshop CS 8 (serial include).zip
C:\Documents and Settings\David\Shared\Cubase Sx 3.0.1.514 Really Working!!! (With Serial,Crack, Install Instructions).zip
C:\Documents and Settings\David\Shared\Limewire Lime Wire Pro 4.12.3 (GOOD).zip
C:\Documents and Settings\David\Shared\Nero 7.0.1.2 Ultra Edition with Keygen - English.zip
C:\Documents and Settings\David\Shared\Nero Burning Rom 6.0 Ultra Edition Incl Keygen & Serial.zip
C:\Documents and Settings\David\Shared\WinACE WinRAR WinZip WinISO + password & cracker.zip

Finished

"Suerg" - 2007-07-06 12:43:53 - ComboFix 07-07-04.4 - Service Pack 2


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\DOCUME~1\ALLUSE~1\APPLIC~1.\TEMP
C:\DOCUME~1\ALLUSE~1\APPLIC~1.\winantispyware 2007
C:\DOCUME~1\ALLUSE~1\APPLIC~1.\winantispyware 2007\Data\Abbr
C:\DOCUME~1\ALLUSE~1\APPLIC~1.\winantispyware 2007\Data\ProductCode
C:\DOCUME~1\David\APPLIC~1.\winantispyware 2007
C:\DOCUME~1\David\APPLIC~1.\winantispyware 2007\Logs\update.log
C:\DOCUME~1\David\Desktop.\Error Cleaner.url
C:\DOCUME~1\David\Desktop.\internet explorer.lnk
C:\DOCUME~1\David\Desktop.\Privacy Protector.url
C:\DOCUME~1\David\Desktop.\Spyware&Malware Protection.url
C:\DOCUME~1\David\FAVORI~1.\Error Cleaner.url
C:\DOCUME~1\David\FAVORI~1.\Privacy Protector.url
C:\DOCUME~1\David\FAVORI~1.\Spyware&Malware Protection.url
C:\Program Files\Common Files\winantispyware 2007
C:\Program Files\Common Files\winantispyware 2007\uwas7cw.exe
C:\Program Files\Common Files\winantispyware 2007\WAS7Mon.exe
C:\WINDOWS\dat.txt
C:\WINDOWS\ddesupport.dll
C:\WINDOWS\main_uninstaller.exe
C:\WINDOWS\msdde.dll
C:\WINDOWS\msole.dll
C:\WINDOWS\privacy_danger
C:\WINDOWS\privacy_danger\images\capt.gif
C:\WINDOWS\privacy_danger\images\danger.jpg
C:\WINDOWS\privacy_danger\images\down.gif
C:\WINDOWS\privacy_danger\images\spacer.gif
C:\WINDOWS\privacy_danger\index.htm
C:\WINDOWS\rs.txt


((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))


-------\LEGACY_NM
-------\LEGACY_NNSERV
-------\LEGACY_NPF
-------\nm
-------\NNServ


((((((((((((((((((((((((( Files Created from 2007-06-06 to 2007-07-06 )))))))))))))))))))))))))))))))


2007-07-06 12:43 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-07-06 10:01 <DIR> d-------- C:\DOCUME~1\David\APPLIC~1\Uniblue
2007-07-06 09:46 <DIR> d-------- C:\WINDOWS\setupupd
2007-07-05 09:01 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2007-07-05 09:01 <DIR> d-------- C:\DOCUME~1\David\APPLIC~1\SUPERAntiSpyware.com
2007-07-05 09:01 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\SUPERAntiSpyware.com
2007-07-05 08:23 <DIR> d-------- C:\DOCUME~1\David\.SunDownloadManager
2007-07-04 21:20 18,432 --a------ C:\WINDOWS\system32\drivers\ApiMon.sys
2007-07-04 12:45 <DIR> d-------- C:\Program Files\GameSpot
2007-07-04 07:28 <DIR> d-------- C:\Program Files\Common Files\Autodesk Shared
2007-07-03 21:37 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Autodesk
2007-07-03 21:34 <DIR> d-------- C:\Program Files\Autodesk
2007-07-03 09:43 <DIR> d-------- C:\VB4Run
2007-07-03 09:36 <DIR> d-------- C:\VB3Run
2007-07-03 09:32 <DIR> d-------- C:\Program Files\Camelot Systems
2007-07-03 09:23 <DIR> d-------- C:\Program Files\IGN
2007-07-03 08:16 <DIR> d-------- C:\Program Files\ifns
2007-07-03 08:16 <DIR> d-------- C:\DOCUME~1\David\APPLIC~1\ifns
2007-07-03 07:39 <DIR> d-------- C:\Program Files\Common Files\Panda Software
2007-07-02 21:24 <DIR> d-------- C:\BSA
2007-07-02 14:41 <DIR> d-------- C:\Program Files\WGV
2007-07-02 11:23 21,504 --a------ C:\WINDOWS\system32\hidserv.dll
2007-07-02 11:23 14,848 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys
2007-07-02 11:23 12,160 --a------ C:\WINDOWS\system32\drivers\mouhid.sys
2007-07-02 11:22 9,600 --a------ C:\WINDOWS\system32\drivers\hidusb.sys
2007-07-02 11:22 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2007-07-02 09:49 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\FLEXnet
2007-07-02 09:43 <DIR> d-------- C:\Program Files\Common Files\Control Panels
2007-07-02 09:40 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\ALM
2007-07-02 08:46 <DIR> d-------- C:\Program Files\Bonjour
2007-07-02 08:39 <DIR> d-------- C:\Program Files\Common Files\Macrovision Shared
2007-07-01 19:13 2,463,976 --a------ C:\WINDOWS\system32\NPSWF32.dll
2007-07-01 19:13 190,696 --a------ C:\WINDOWS\system32\NPSWF32_FlashUtil.exe
2007-06-30 18:37 <DIR> d-------- C:\DOCUME~1\David\APPLIC~1\RecordPad
2007-06-30 18:37 <DIR> d-------- C:\DOCUME~1\David\APPLIC~1\NCH Swift Sound
2007-06-30 18:37 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\NCH Swift Sound
2007-06-30 18:36 <DIR> d-------- C:\Program Files\NCH Swift Sound
2007-06-30 14:48 <DIR> d-------- C:\Program Files\GetDiz
2007-06-30 13:00 <DIR> d-------- C:\Program Files\ePrompter
2007-06-29 06:31 <DIR> d-------- C:\Program Files\PowerISO
2007-06-29 03:00 <DIR> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-06-28 07:19 <DIR> d-------- C:\Program Files\Common Files\Logitech
2007-06-28 07:18 <DIR> d-------- C:\Program Files\Common Files\LogiShrd
2007-06-28 07:18 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Logitech
2007-06-28 07:17 <DIR> d-------- C:\Program Files\Logitech
2007-06-27 20:49 <DIR> d-------- C:\Program Files\Yawcam
2007-06-27 19:44 <DIR> d-------- C:\Program Files\TrackerChecker
2007-06-27 16:58 1,031,680 --a------ C:\WINDOWS\explorerkonshu.exe
2007-06-27 15:12 <DIR> d-------- C:\Program Files\TightVNC
2007-06-27 08:53 <DIR> d-------- C:\Program Files\Cain
2007-06-27 07:52 <DIR> d-------- C:\Program Files\Nmap
2007-06-26 12:37 <DIR> d-------- C:\Program Files\MSXML 6.0
2007-06-26 12:33 <DIR> d-------- C:\Program Files\MSBuild
2007-06-26 12:12 <DIR> d-------- C:\WINDOWS\system32\XPSViewer
2007-06-26 12:11 <DIR> d-------- C:\Program Files\Reference Assemblies
2007-06-26 12:10 180,224 --a------ C:\WINDOWS\system32\nvuaudio.exe
2007-06-26 12:10 14,048 --------- C:\WINDOWS\system32\spmsg2.dll
2007-06-26 11:53 36,352 --------- C:\WINDOWS\system32\tsgqec.dll
2007-06-26 11:53 288,768 --------- C:\WINDOWS\system32\rhttpaa.dll
2007-06-26 11:53 116,736 --------- C:\WINDOWS\system32\aaclient.dll
2007-06-26 11:30 <DIR> d-------- C:\Program Files\FairUse Wizard 2
2007-06-25 17:27 <DIR> d-------- C:\Program Files\PolderbitS
2007-06-25 13:49 <DIR> d-------- C:\Program Files\CounterPath
2007-06-25 13:39 <DIR> d-------- C:\Program Files\XemiComputers
2007-06-24 21:05 <DIR> d-------- C:\Program Files\Red Kawa
2007-06-24 11:50 <DIR> d-------- C:\Program Files\Fake_Name_Generator
2007-06-24 09:56 <DIR> d-------- C:\Program Files\XviD
2007-06-23 21:14 487,424 --a------ C:\WINDOWS\system32\msvcp70.dll
2007-06-23 21:14 <DIR> d-------- C:\WINDOWS\system32\RMBin
2007-06-23 21:14 <DIR> d-------- C:\Program Files\Apex
2007-06-23 14:04 <DIR> d-------- C:\Program Files\Microsoft Bootvis
2007-06-22 18:15 <DIR> d-------- C:\Program Files\Passware
2007-06-21 16:38 <DIR> d-------- C:\Program Files\MySecretCodes Toolbar
2007-06-21 14:46 <DIR> d-------- C:\Program Files\Myspace Enhanced
2007-06-21 14:46 <DIR> d-------- C:\DOCUME~1\David\APPLIC~1\MyspaceEnhanced
2007-06-21 11:43 <DIR> d-------- C:\DOCUME~1\David\APPLIC~1\tunebite
2007-06-21 11:42 16,640 --a------ C:\WINDOWS\system32\drivers\tbhsd.sys
2007-06-21 11:42 <DIR> d-------- C:\Program Files\Tunebite
2007-06-20 19:37 <DIR> d-------- C:\DOCUME~1\David\New Folder
2007-06-20 19:36 <DIR> d-------- C:\Program Files\CDBurnerXP Pro 3
2007-06-20 14:25 <DIR> d-------- C:\Program Files\HTTP-Tunnel
2007-06-20 13:59 <DIR> d-------- C:\DOCUME~1\David\APPLIC~1\Obsidium
2007-06-20 11:14 1,156 --a------ C:\WINDOWS\mozver.dat
2007-06-20 07:47 <DIR> d-------- C:\Program Files\XBC
2007-06-19 15:45 <DIR> d-------- C:\Program Files\A-FF Repair Station
2007-06-18 09:14 <DIR> d-------- C:\Program Files\Bethesda Softworks
2007-06-18 08:57 <DIR> d-------- C:\Program Files\Smart Projects
2007-06-17 20:34 <DIR> d-------- C:\DOCUME~1\David\APPLIC~1\Azureus
2007-06-17 20:34 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Azureus
2007-06-17 20:33 <DIR> d-------- C:\Program Files\Azureus
2007-06-16 21:54 <DIR> d-------- C:\Program Files\Telemarketing Blocker
2007-06-16 19:53 241,664 --a------ C:\ChaosMash_v2.5.exe
2007-06-16 19:36 <DIR> d-------- C:\Program Files\Any Password
2007-06-15 15:53 <DIR> d-------- C:\DOCUME~1\David\APPLIC~1\uTorrent
2007-06-14 22:31 <DIR> d-------- C:\ConverterOutput
2007-06-14 22:30 395,776 --a------ C:\WINDOWS\system32\libmplayer.dll
2007-06-14 22:30 262,144 --a------ C:\WINDOWS\system32\TomsMoComp_ff.dll
2007-06-14 22:30 2,255,360 --a------ C:\WINDOWS\system32\libavcodec.dll
2007-06-14 22:30 112,640 --a------ C:\WINDOWS\system32\libmpeg2_ff.dll
2007-06-14 22:30 <DIR> d-------- C:\Program Files\Cucusoft


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-05 21:23:12 -------- d--h--w C:\DOCUME~1\David\APPLIC~1\Move Networks
2007-07-05 14:00:56 -------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2007-07-04 23:02:16 -------- d-----w C:\DOCUME~1\David\APPLIC~1\IGN_DLM
2007-07-04 12:18:35 -------- d--h--w C:\Program Files\InstallShield Installation Information
2007-07-04 12:18:35 -------- d-----w C:\Program Files\CyberLink
2007-07-04 12:01:46 -------- d-----w C:\Program Files\gbVRML
2007-07-04 11:55:32 -------- d-----w C:\Program Files\Apple Software Update
2007-06-30 23:25:32 -------- d-s---w C:\Program Files\Xfire
2007-06-26 18:42:34 -------- d-----w C:\Program Files\AvRack
2007-06-26 15:30:12 -------- d-----w C:\Program Files\AlienGUIse
2007-06-25 18:49:51 -------- d-----w C:\DOCUME~1\David\APPLIC~1\Xfire
2007-06-21 14:14:25 -------- d-----w C:\Program Files\Free WMA to MP3 Converter
2007-06-15 00:44:43 -------- d-----w C:\DOCUME~1\David\APPLIC~1\Viewpoint
2007-06-14 17:16:09 -------- d-----w C:\Program Files\AIM6
2007-06-14 17:15:57 -------- d-----w C:\Program Files\Viewpoint
2007-06-14 14:43:55 -------- d-----w C:\Program Files\Twaddle Software
2007-06-13 21:24:30 -------- d-----w C:\DOCUME~1\David\APPLIC~1\CyberLink
2007-06-12 16:35:25 -------- d-----w C:\DOCUME~1\David\APPLIC~1\AdobeUM
2007-06-12 13:42:02 737,280 ----a-w C:\WINDOWS\iun6002.exe
2007-06-12 02:04:18 2,423,296 ----a-w C:\WINDOWS\system32\logonuiX.exe
2007-06-11 21:46:06 -------- d-----w C:\Program Files\Linksys EasyLink Advisor
2007-06-05 18:41:52 -------- d-----w C:\DOCUME~1\David\APPLIC~1\MySpace
2007-06-05 18:41:50 -------- d-----w C:\Program Files\MySpace
2007-06-04 14:37:18 -------- d-----w C:\Program Files\Free Internet Window Washer
2007-06-04 06:45:08 -------- d--h--w C:\DOCUME~1\David\APPLIC~1\GTek
2007-06-04 06:44:40 29,184 ----a-w C:\WINDOWS\system32\drivers\goprot51.sys
2007-06-03 21:06:49 -------- d-----w C:\Program Files\Microsoft Games
2007-05-20 21:36:43 15,781 ----a-w C:\WINDOWS\system32\drivers\mdc8021x.sys
2007-05-20 21:36:40 -------- d-----w C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor
2007-05-16 15:12:02 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
2007-05-11 21:37:58 -------- d-----w C:\Program Files\QuickTime
2007-04-25 14:21:15 144,896 ----a-w C:\WINDOWS\system32\schannel.dll
2007-04-18 16:12:23 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll
2007-04-17 03:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll
2007-04-17 03:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll
2007-04-17 03:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll
2007-04-17 03:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll
2007-04-17 03:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll
2007-04-17 03:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
2007-04-17 03:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe
2007-04-17 03:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll
2007-04-17 03:44:20 271,224 ----a-w C:\WINDOWS\system32\mucltui.dll
2007-04-17 03:44:18 208,248 ----a-w C:\WINDOWS\system32\muweb.dll
2007-04-08 14:36:49 967 ----a-w C:\WINDOWS\ScUnin.pif
2007-04-08 14:36:49 94,208 ----a-w C:\WINDOWS\ScUnin.exe
2007-04-08 14:36:49 10,494 ----a-w C:\WINDOWS\scunin.dat


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2006-10-22 23:08 62080 --a------ C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{074C1DC5-9320-4A9A-947D-C042949C6216}]
2007-03-16 15:13 118784 --a------ D:\Adobe CS3 Master Collection\/Adobe Contribute CS3/contributeieplugin.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
2005-05-31 01:04 853672 --a------ C:\PROGRA~1\SPYBOT~1\SDHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
2007-06-14 18:32 509592 --a------ C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}]
2007-03-29 22:11 321120 --a------ D:\Adobe CS3 Master Collection\Acrobat 8.0\Acrobat\AcroIEFavClient.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-07-03 08:56]
"Acrobat Assistant 8.0"="D:\Adobe CS3 Master Collection\Acrobat 8.0\Acrobat\Acrotray.exe" [2007-03-29 22:14]
"Adobe_ID0EYTHM"="C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE" [2007-03-20 16:40]
"LanzarP2006"="C:\DOCUME~1\David\LOCALS~1\Temp\{9A8B669E-CD8E-490B-A20C-CA0914ED86D7}\{EEBA9416-3207-47E0-9022-116440599DBC}\..\..\P2006tmp\Install.exe" []
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-06-14 18:32]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TeleBlocker"="" []
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 07:00]
"Aim6"="C:\Program Files\AIM6\aim6.exe" [2007-04-27 16:17]
"Instant File Name Search"="C:\Program Files\ifns\ifns.exe" [2007-04-06 00:57]
"igndlm.exe"="C:\Program Files\IGN\Download Manager\DLM.exe" [2007-03-05 13:57]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-06-21 14:06]

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
Source= file:///C:\WINDOWS\privacy_danger\index.htm
FriendlyName= Privacy Protection

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"="C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2006-12-20 13:55]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"{8C814D89-82C1-4094-A434-B5714F718C0F}"="C:\WINDOWS\msole.dll" []

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^David^Start Menu^Programs^Startup^Yahoo! Widget Engine.lnk]
path=C:\Documents and Settings\David\Start Menu\Programs\Startup\Yahoo! Widget Engine.lnk
backup=C:\WINDOWS\pss\Yahoo! Widget Engine.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
"C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Free Internet Window Washer]
C:\Program Files\Free Internet Window Washer\Clearpch.exe -Start

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
%systemroot%\system32\dumprep 0 -k

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechCommunicationsManager]
"C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechQuickCamRibbon]
"C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMService]
"C:\Program Files\CyberLink\PowerCinema\PCMService.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PVR]
C:\Program Files\XemiComputers\Pocket Voice Recorder\PVR.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ResChanger 2005]
C:\Program Files\ResChanger 2005\ResChanger2005.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Secrecy File & Folder Hider]
C:\TF\Secrecy File & Folder Hider\Secrethider.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
"D:\Steam\Steam.exe" -silent

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Taskbar Button Manager]
C:\Program Files\Innovative Solutions\Taskbar Button Manager\tbm.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zune Launcher]
"C:\Program Files\Zune\ZuneLauncher.exe"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" /background
"Aim6"="C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
"Free Internet Window Washer"=C:\Program Files\Free Internet Window Washer\Clearpch.exe -Start
"Taskbar Button Manager"=C:\Program Files\Innovative Solutions\Taskbar Button Manager\tbm.exe
"EasyLinkAdvisor"="C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" /startup
"MySpaceIM"=C:\Program Files\MySpace\IM\MySpaceIM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"nTrayFw"=C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
"SoundMan"=SOUNDMAN.EXE
"GuruClock"=C:\Program Files\ABIT\ABIT uGuru\GuruClock.exe
"ABIT uGuru"=C:\Program Files\ABIT\ABIT uGuru\uGuru.exe
"nwiz"=nwiz.exe /install
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
"NvMediaCenter"=RunDLL32.exe NvMCTray.dll,NvTaskbarInit
"Zune Launcher"="C:\Program Files\Zune\ZuneLauncher.exe"
"WinVNC"="C:\Program Files\TightVNC\WinVNC.exe" -servicehelper
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" -atboottime
"Ardamax Keylogger"=C:\Program Files\Ardamax Keylogger Lite\akl.exe
"NvCplDaemon"=RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
"XDc"=C:\Program Files\Xtreme Desktop\xdc\startxdc.exe
"NeroCheck"=C:\WINDOWS\system32\NeroCheck.exe


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
AutoRun\command- E:\autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a0fb0931-5cb6-11d9-b4be-806d6172696f}]
AutoRun\command- E:\autorun.exe


**************************************************************************

catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-06 13:18:39
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-06 13:21:53 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-07-06 13:21

--- E O F ---


Logfile of HijackThis v1.99.1
Scan saved at 2:00:25 PM, on 7/6/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\TightVNC\WinVNC.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
D:\Adobe CS3 Master Collection\Acrobat 8.0\Acrobat\Acrotray.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\Program Files\Azureus\Azureus.exe
C:\Program Files\GameSpot\GDM_TrayApp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gmail.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = socks=localhost:1080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - D:\Adobe CS3 Master Collection\/Adobe Contribute CS3/contributeieplugin.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - D:\Adobe CS3 Master Collection\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Adobe CS3 Master Collection\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - D:\Adobe CS3 Master Collection\/Adobe Contribute CS3/contributeieplugin.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "D:\Adobe CS3 Master Collection\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [Adobe_ID0EYTHM] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
O4 - HKLM\..\Run: [LanzarP2006] "C:\DOCUME~1\David\LOCALS~1\Temp\{9A8B669E-CD8E-490B-A20C-CA0914ED86D7}\{EEBA9416-3207-47E0-9022-116440599DBC}\..\..\P2006tmp\Install.exe" /SETUP:"/l0x0009"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [Instant File Name Search] C:\Program Files\ifns\ifns.exe
O4 - HKCU\..\Run: [igndlm.exe] C:\Program Files\IGN\Download Manager\DLM.exe /windowsstart /startifwork
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Startup: Azureus Vuze.lnk = C:\Program Files\Azureus\Azureus.exe
O4 - Startup: GameSpot Download Manager.lnk = C:\Program Files\GameSpot\GDM_TrayApp.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O8 - Extra context menu item: Append to existing PDF - res://D:\Adobe CS3 Master Collection\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://D:\Adobe CS3 Master Collection\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://D:\Adobe CS3 Master Collection\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://D:\Adobe CS3 Master Collection\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://D:\Adobe CS3 Master Collection\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://D:\Adobe CS3 Master Collection\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://D:\Adobe CS3 Master Collection\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://D:\Adobe CS3 Master Collection\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (CDownloadCtrl Object) - http://www.fileplanet.com/fpdlmgr/cabs/ ... .2.100.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 4837470515
O17 - HKLM\System\CCS\Services\Tcpip\..\{1125EFB8-6938-472F-81E6-57ECC0604BB6}: NameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{222E2FB6-A1B8-452D-8C3D-5544A5A4BAFC}: NameServer = 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{1125EFB8-6938-472F-81E6-57ECC0604BB6}: NameServer = 192.168.2.1
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: igfxcui - igfxdev.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Version Cue CS3 - Unknown owner - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe" -win32service (file missing)
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: DNADownloader - CNET Networks - C:\Program Files\GameSpot\DownloadManager_Win32.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: mental ray 3.5 Satellite (32-bit) (mi-raysat_3dsmax9_32) - Unknown owner - C:\Program Files\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Unknown owner - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe (file missing)
O23 - Service: VNC Server (winvnc) - Unknown owner - C:\Program Files\TightVNC\WinVNC.exe" -service (file missing)
suerg
Active Member
 
Posts: 6
Joined: July 5th, 2007, 5:29 pm

Unread postby curlylad » July 8th, 2007, 11:44 am

Good Day suerg

I do apologise for the delay in replying, I had to make sure I provided the correct advice and this unfortunately can take a little time.

Here are your next set of instructions:-


STEP 1

Uninstall Programs

There are a few programs that I need you to look for and uninstall if they are still present.

To find and uninstall them please do the following:-
  • Click Start
  • Click Run
  • In the Open: dialog box type appwiz.cpl, click OK
  • Ad and Remove Programs now opens
  • Locate the following programs (if present), click to highlight one at a time and click Remove.
  • The programs are

Viewpoint
Panda Software
WinAntiSpyware
Cain


Please Note

Some of the programs in the list may not be there.



STEP 2

SmitfraudFix

Please download SmitfraudFix (by S!Ri)

Double-click SmitfraudFix.exe.
Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present).
Please copy/paste the content of that report into your next reply.

**If the tool fails to launch from the Desktop, please move SmitfraudFix.exe directly to the root of the system drive (usually C:), and launch from there.

Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.
http://www.beyondlogic.org/consulting/proc...processutil.htm



STEP 3

Upload Files

Please visit this link http://virusscan.jotti.org/
  • Click the Browse... button
  • Navigate to the following file C:\WINDOWS\explorerkonshu.exe
  • Click Open
  • Please let me know the results.



STEP 4

Cracks and keygens

I notice from your SFDIx Log that there are a number of programs in this folder C:\Documents and Settings\David\Shared\ that may have been obtained illegally.

The programs I talk of are all in zip folders, they are:-

Adobe Photoshop CS 8 (serial include).zip
Cubase Sx 3.0.1.514 Really Working!!! (With Serial,Crack, Install Instructions).zip
Limewire Lime Wire Pro 4.12.3 (GOOD).zip
Nero 7.0.1.2 Ultra Edition with Keygen - English.zip
Nero Burning Rom 6.0 Ultra Edition Incl Keygen & Serial.zip
WinACE WinRAR WinZip WinISO + password & cracker.zip


I do not know how they came to be on your system or who put them there.
However, I would like you to delete all the above zip folders.
I will give you instructions on how I would like you to do this in the next step.

Later on I will be advising you to run a series of scans that will tell me whether you have deleted the programs or not.
If you have not deleted the programs I will no longer be able to help you, similarly no other helpers here at Malwareremoval will help you either.

We do not and will not condone using pirated or stolen software on this forum and will not help those who help themselves free of charge to software that requires purchase.

As I have said though, I do not know who obtained the software but if it is not removed then I can longer assist you.



STEP 5

ComboFix

Open Notepad and copy/paste the text in the quotebox below into it:
File::
C:\WINDOWS\ScUnin.pif
C:\WINDOWS\msole.dll
C:\Documents and Settings\David\Shared\Adobe Photoshop CS 8 (serial include).zip
C:\Documents and Settings\David\Shared\Cubase Sx 3.0.1.514 Really Working!!! (With Serial,Crack, Install Instructions).zip
C:\Documents and Settings\David\Shared\Limewire Lime Wire Pro 4.12.3 (GOOD).zip
C:\Documents and Settings\David\Shared\Nero 7.0.1.2 Ultra Edition with Keygen - English.zip
C:\Documents and Settings\David\Shared\ero Burning Rom 6.0 Ultra Edition Incl Keygen & Serial.zip
C:\Documents and Settings\David\Shared\WinACE WinRAR WinZip WinISO + password & cracker.zip

Folder::
C:\Program Files\Common Files\winantispyware 2007
C:\DOCUME~1\David\APPLIC~1\Viewpoint
C:\Program Files\Viewpoint
C:\WINDOWS\privacy_danger
C:\Program Files\Common Files\Panda Software

  • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

    Image
  • Referring to the screenshot above, drag ComboFix-Do.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

Please post the new ComboFix log in your next reply.



STEP 6

Report Back

There are several documents and some information that I now require from you.
  1. The SmitfraudFix.txt file created by the SmitfraudFix program.
  2. The results of uploading the file C:\WINDOWS\explorerkonshu.exe to Jotti
  3. The CFScript.txt from Combofix
  4. A fresh HijackThis Log


I will review all the new information and provide any further necessary steps as soon as possible.
User avatar
curlylad
Retired Graduate
 
Posts: 1829
Joined: February 5th, 2006, 5:07 pm
Location: Birmingham

Unread postby suerg » July 8th, 2007, 2:35 pm

First off i have to apologize you know when you told me to delete those zip files at C:\Documents and Settings\David\Shared well i did but i manually deleted them(i went there and clicked on them and then i clicked delete) but not till your last step did i realize that you had instructed combofix to delete them for me......but i am telling you this to assure you they ARE DELETED !!!!!!!! and also here are those logs you asked for. Here is the combo fix log

"David" - 2007-07-08 13:02:19 - ComboFix 07-07-04.4 - Service Pack 2
Command switches used :: C:\Documents and Settings\David\Desktop\CFScript.txt


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\DOCUME~1\David\APPLIC~1\Viewpoint
C:\DOCUME~1\David\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\URLCache.ini
C:\DOCUME~1\David\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\URLCache.ini
C:\DOCUME~1\David\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\URLCache.ini
C:\DOCUME~1\David\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\-1699046308.mtj&p2=1&p3=12369614062899471727616304244719&p4=50463258
C:\DOCUME~1\David\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\URLCache.ini
C:\DOCUME~1\David\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\UpdateVersionList_v2.mtx
C:\DOCUME~1\David\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\URLCache.ini
C:\DOCUME~1\David\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\URLCache.ini
C:\DOCUME~1\David\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_02\URLCache.ini
C:\DOCUME~1\David\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\URLCache.ini
C:\DOCUME~1\David\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\UpdateVersionList_v2.mtx
C:\Program Files\Common Files\Panda Software
C:\Program Files\Viewpoint
C:\Program Files\Viewpoint\Viewpoint Experience Technology\AxMetaStream.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\AxMetaStream_0305000D.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\ClassIDs.ini
C:\Program Files\Viewpoint\Viewpoint Experience Technology\ComponentMgr_0305001C.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\ComponentRegistry.ini
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\AOLArt.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\AOLShell.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\AOLUserShell.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\Cursors.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\DataTracking.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\GifReader.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\JpegReader.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\LensFlares.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\Mts3Reader.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\ObjectMovie.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\SceneComponent.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\ServiceComponent.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\SreeDMMX.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\SWFView.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\VectorView.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\VMPAudio.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\VMPExtras.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\VMPSpeech.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\VMPVideo.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\WaveletReader.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\ZoomView.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\DownLoadHist.ini
C:\Program Files\Viewpoint\Viewpoint Experience Technology\HostRegistry.ini
C:\Program Files\Viewpoint\Viewpoint Experience Technology\MetaStreamConfig.ini
C:\Program Files\Viewpoint\Viewpoint Experience Technology\MetaStreamID.ini
C:\Program Files\Viewpoint\Viewpoint Experience Technology\MtsAxInstaller.exe
C:\Program Files\Viewpoint\Viewpoint Experience Technology\MTSDownloadSites.txt
C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.xpt
C:\Program Files\Viewpoint\Viewpoint Media Player\AxMetaStream.dll
C:\Program Files\Viewpoint\Viewpoint Media Player\AxMetaStream_0305000D.dll
C:\Program Files\Viewpoint\Viewpoint Media Player\ClassIDs.ini
C:\Program Files\Viewpoint\Viewpoint Media Player\ComponentMgr_0305000D.dll
C:\Program Files\Viewpoint\Viewpoint Media Player\ComponentRegistry.ini
C:\Program Files\Viewpoint\Viewpoint Media Player\Components\AOLUserShell.dll
C:\Program Files\Viewpoint\Viewpoint Media Player\DownLoadHist.ini
C:\Program Files\Viewpoint\Viewpoint Media Player\HostRegistry.ini
C:\Program Files\Viewpoint\Viewpoint Media Player\MetaStreamConfig.ini
C:\Program Files\Viewpoint\Viewpoint Media Player\MetaStreamID.ini
C:\Program Files\Viewpoint\Viewpoint Media Player\MtsAxInstaller.exe
C:\Program Files\Viewpoint\Viewpoint Media Player\MTSDownloadSites.txt
C:\Program Files\Viewpoint\Viewpoint Media Player\NewComponents\AOLUserShell.dll
C:\Program Files\Viewpoint\Viewpoint Media Player\NewComponents\SceneComponent.dll
C:\Program Files\Viewpoint\Viewpoint Media Player\NewComponents\SWFView.dll
C:\WINDOWS\ScUnin.pif


((((((((((((((((((((((((( Files Created from 2007-06-08 to 2007-07-08 )))))))))))))))))))))))))))))))


2007-07-08 12:53 53,248 --a------ C:\WINDOWS\system32\Process.exe
2007-07-08 12:53 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2007-07-08 12:53 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2007-07-08 12:53 1,250 --a------ C:\WINDOWS\system32\tmp.reg
2007-07-07 15:20 <DIR> d-------- C:\Program Files\7-Zip
2007-07-06 13:35 <DIR> d-------- C:\WINDOWS\ERUNT
2007-07-06 12:43 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-07-06 10:01 <DIR> d-------- C:\DOCUME~1\David\APPLIC~1\Uniblue
2007-07-06 09:46 <DIR> d-------- C:\WINDOWS\setupupd
2007-07-05 09:01 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2007-07-05 09:01 <DIR> d-------- C:\DOCUME~1\David\APPLIC~1\SUPERAntiSpyware.com
2007-07-05 09:01 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\SUPERAntiSpyware.com
2007-07-05 08:23 <DIR> d-------- C:\DOCUME~1\David\.SunDownloadManager
2007-07-04 21:20 18,432 --a------ C:\WINDOWS\system32\drivers\ApiMon.sys
2007-07-04 12:45 <DIR> d-------- C:\Program Files\GameSpot
2007-07-03 21:37 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Autodesk
2007-07-03 21:34 <DIR> d-------- C:\Program Files\Autodesk
2007-07-03 09:43 <DIR> d-------- C:\VB4Run
2007-07-03 09:36 <DIR> d-------- C:\VB3Run
2007-07-03 09:32 <DIR> d-------- C:\Program Files\Camelot Systems
2007-07-03 09:23 <DIR> d-------- C:\Program Files\IGN
2007-07-03 08:16 <DIR> d-------- C:\Program Files\ifns
2007-07-03 08:16 <DIR> d-------- C:\DOCUME~1\David\APPLIC~1\ifns
2007-07-02 21:24 <DIR> d-------- C:\BSA
2007-07-02 14:41 <DIR> d-------- C:\Program Files\WGV
2007-07-02 11:23 21,504 --a------ C:\WINDOWS\system32\hidserv.dll
2007-07-02 11:23 14,848 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys
2007-07-02 11:23 12,160 --a------ C:\WINDOWS\system32\drivers\mouhid.sys
2007-07-02 11:22 9,600 --a------ C:\WINDOWS\system32\drivers\hidusb.sys
2007-07-02 11:22 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2007-07-02 09:49 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\FLEXnet
2007-07-02 09:43 <DIR> d-------- C:\Program Files\Common Files\Control Panels
2007-07-02 09:40 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\ALM
2007-07-02 08:46 <DIR> d-------- C:\Program Files\Bonjour
2007-07-02 08:39 <DIR> d-------- C:\Program Files\Common Files\Macrovision Shared
2007-07-01 19:13 2,463,976 --a------ C:\WINDOWS\system32\NPSWF32.dll
2007-07-01 19:13 190,696 --a------ C:\WINDOWS\system32\NPSWF32_FlashUtil.exe
2007-06-30 18:37 <DIR> d-------- C:\DOCUME~1\David\APPLIC~1\RecordPad
2007-06-30 18:37 <DIR> d-------- C:\DOCUME~1\David\APPLIC~1\NCH Swift Sound
2007-06-30 18:37 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\NCH Swift Sound
2007-06-30 18:36 <DIR> d-------- C:\Program Files\NCH Swift Sound
2007-06-30 14:48 <DIR> d-------- C:\Program Files\GetDiz
2007-06-30 13:00 <DIR> d-------- C:\Program Files\ePrompter
2007-06-29 06:31 <DIR> d-------- C:\Program Files\PowerISO
2007-06-29 03:00 <DIR> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-06-28 07:19 <DIR> d-------- C:\Program Files\Common Files\Logitech
2007-06-28 07:18 <DIR> d-------- C:\Program Files\Common Files\LogiShrd
2007-06-28 07:18 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Logitech
2007-06-28 07:17 <DIR> d-------- C:\Program Files\Logitech
2007-06-27 20:49 <DIR> d-------- C:\Program Files\Yawcam
2007-06-27 19:44 <DIR> d-------- C:\Program Files\TrackerChecker
2007-06-27 16:58 1,031,680 --a------ C:\WINDOWS\explorerkonshu.exe
2007-06-27 15:12 <DIR> d-------- C:\Program Files\TightVNC
2007-06-27 08:53 <DIR> d-------- C:\Program Files\Cain
2007-06-27 07:52 <DIR> d-------- C:\Program Files\Nmap
2007-06-26 12:37 <DIR> d-------- C:\Program Files\MSXML 6.0
2007-06-26 12:33 <DIR> d-------- C:\Program Files\MSBuild
2007-06-26 12:12 <DIR> d-------- C:\WINDOWS\system32\XPSViewer
2007-06-26 12:11 <DIR> d-------- C:\Program Files\Reference Assemblies
2007-06-26 12:10 180,224 --a------ C:\WINDOWS\system32\nvuaudio.exe
2007-06-26 12:10 14,048 --------- C:\WINDOWS\system32\spmsg2.dll
2007-06-26 11:53 36,352 --------- C:\WINDOWS\system32\tsgqec.dll
2007-06-26 11:53 288,768 --------- C:\WINDOWS\system32\rhttpaa.dll
2007-06-26 11:53 116,736 --------- C:\WINDOWS\system32\aaclient.dll
2007-06-26 11:30 <DIR> d-------- C:\Program Files\FairUse Wizard 2
2007-06-25 17:27 <DIR> d-------- C:\Program Files\PolderbitS
2007-06-25 13:49 <DIR> d-------- C:\Program Files\CounterPath
2007-06-25 13:39 <DIR> d-------- C:\Program Files\XemiComputers
2007-06-24 21:05 <DIR> d-------- C:\Program Files\Red Kawa
2007-06-24 09:56 <DIR> d-------- C:\Program Files\XviD
2007-06-23 21:14 487,424 --a------ C:\WINDOWS\system32\msvcp70.dll
2007-06-23 21:14 <DIR> d-------- C:\WINDOWS\system32\RMBin
2007-06-23 21:14 <DIR> d-------- C:\Program Files\Apex
2007-06-23 14:04 <DIR> d-------- C:\Program Files\Microsoft Bootvis
2007-06-22 18:15 <DIR> d-------- C:\Program Files\Passware
2007-06-21 16:38 <DIR> d-------- C:\Program Files\MySecretCodes Toolbar
2007-06-21 14:46 <DIR> d-------- C:\Program Files\Myspace Enhanced
2007-06-21 14:46 <DIR> d-------- C:\DOCUME~1\David\APPLIC~1\MyspaceEnhanced
2007-06-21 11:43 <DIR> d-------- C:\DOCUME~1\David\APPLIC~1\tunebite
2007-06-21 11:42 16,640 --a------ C:\WINDOWS\system32\drivers\tbhsd.sys
2007-06-21 11:42 <DIR> d-------- C:\Program Files\Tunebite
2007-06-20 19:37 <DIR> d-------- C:\DOCUME~1\David\New Folder
2007-06-20 14:25 <DIR> d-------- C:\Program Files\HTTP-Tunnel
2007-06-20 13:59 <DIR> d-------- C:\DOCUME~1\David\APPLIC~1\Obsidium
2007-06-20 11:14 1,156 --a------ C:\WINDOWS\mozver.dat
2007-06-20 07:47 <DIR> d-------- C:\Program Files\XBC
2007-06-19 15:45 <DIR> d-------- C:\Program Files\A-FF Repair Station
2007-06-18 09:14 <DIR> d-------- C:\Program Files\Bethesda Softworks
2007-06-18 08:57 <DIR> d-------- C:\Program Files\Smart Projects
2007-06-16 21:54 <DIR> d-------- C:\Program Files\Telemarketing Blocker
2007-06-16 19:53 241,664 --a------ C:\ChaosMash_v2.5.exe
2007-06-14 22:31 <DIR> d-------- C:\ConverterOutput


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-05 21:23:12 -------- d--h--w C:\DOCUME~1\David\APPLIC~1\Move Networks
2007-07-05 14:00:56 -------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2007-07-04 23:02:16 -------- d-----w C:\DOCUME~1\David\APPLIC~1\IGN_DLM
2007-07-04 12:18:35 -------- d--h--w C:\Program Files\InstallShield Installation Information
2007-07-04 12:18:35 -------- d-----w C:\Program Files\CyberLink
2007-07-04 12:01:46 -------- d-----w C:\Program Files\gbVRML
2007-07-04 11:55:32 -------- d-----w C:\Program Files\Apple Software Update
2007-06-30 23:25:32 -------- d-s---w C:\Program Files\Xfire
2007-06-26 18:42:34 -------- d-----w C:\Program Files\AvRack
2007-06-26 15:30:12 -------- d-----w C:\Program Files\AlienGUIse
2007-06-25 18:49:51 -------- d-----w C:\DOCUME~1\David\APPLIC~1\Xfire
2007-06-21 14:14:25 -------- d-----w C:\Program Files\Free WMA to MP3 Converter
2007-06-14 17:16:09 -------- d-----w C:\Program Files\AIM6
2007-06-14 14:43:55 -------- d-----w C:\Program Files\Twaddle Software
2007-06-13 21:24:30 -------- d-----w C:\DOCUME~1\David\APPLIC~1\CyberLink
2007-06-12 16:35:25 -------- d-----w C:\DOCUME~1\David\APPLIC~1\AdobeUM
2007-06-12 13:42:02 737,280 ----a-w C:\WINDOWS\iun6002.exe
2007-06-12 02:04:18 2,423,296 ----a-w C:\WINDOWS\system32\logonuiX.exe
2007-06-11 21:46:06 -------- d-----w C:\Program Files\Linksys EasyLink Advisor
2007-06-08 01:33:40 -------- d-----w C:\Program Files\MidiMeow
2007-06-07 19:47:28 -------- d-----w C:\Program Files\WAVSPLITTER
2007-06-07 19:41:33 -------- d-----w C:\Program Files\MP3 to WAV Decoder
2007-06-05 18:41:52 -------- d-----w C:\DOCUME~1\David\APPLIC~1\MySpace
2007-06-05 18:41:50 -------- d-----w C:\Program Files\MySpace
2007-06-04 14:37:18 -------- d-----w C:\Program Files\Free Internet Window Washer
2007-06-04 06:45:08 -------- d--h--w C:\DOCUME~1\David\APPLIC~1\GTek
2007-06-04 06:44:40 29,184 ----a-w C:\WINDOWS\system32\drivers\goprot51.sys
2007-06-03 21:06:49 -------- d-----w C:\Program Files\Microsoft Games
2007-05-20 21:36:43 15,781 ----a-w C:\WINDOWS\system32\drivers\mdc8021x.sys
2007-05-20 21:36:40 -------- d-----w C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor
2007-05-16 15:12:02 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
2007-05-11 21:37:58 -------- d-----w C:\Program Files\QuickTime
2007-04-25 14:21:15 144,896 ----a-w C:\WINDOWS\system32\schannel.dll
2007-04-18 16:12:23 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll
2007-04-17 03:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll
2007-04-17 03:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll
2007-04-17 03:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll
2007-04-17 03:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll
2007-04-17 03:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll
2007-04-17 03:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
2007-04-17 03:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe
2007-04-17 03:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll
2007-04-17 03:44:20 271,224 ----a-w C:\WINDOWS\system32\mucltui.dll
2007-04-17 03:44:18 208,248 ----a-w C:\WINDOWS\system32\muweb.dll
2007-04-08 14:36:49 94,208 ----a-w C:\WINDOWS\ScUnin.exe
2007-04-08 14:36:49 10,494 ----a-w C:\WINDOWS\scunin.dat


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2006-10-22 23:08 62080 --a------ C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{074C1DC5-9320-4A9A-947D-C042949C6216}]
2007-03-16 15:13 118784 --a------ D:\Adobe CS3 Master Collection\/Adobe Contribute CS3/contributeieplugin.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
2005-05-31 01:04 853672 --a------ C:\PROGRA~1\SPYBOT~1\SDHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
2007-06-14 18:32 509592 --a------ C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}]
2007-03-29 22:11 321120 --a------ D:\Adobe CS3 Master Collection\Acrobat 8.0\Acrobat\AcroIEFavClient.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-07-03 08:56]
"Acrobat Assistant 8.0"="D:\Adobe CS3 Master Collection\Acrobat 8.0\Acrobat\Acrotray.exe" [2007-03-29 22:14]
"Adobe_ID0EYTHM"="C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE" [2007-03-20 16:40]
"LanzarP2006"="C:\DOCUME~1\David\LOCALS~1\Temp\{9A8B669E-CD8E-490B-A20C-CA0914ED86D7}\{EEBA9416-3207-47E0-9022-116440599DBC}\..\..\P2006tmp\Install.exe" []
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-06-14 18:32]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TeleBlocker"="" []
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 07:00]
"Aim6"="C:\Program Files\AIM6\aim6.exe" [2007-04-27 16:17]
"Instant File Name Search"="C:\Program Files\ifns\ifns.exe" [2007-04-06 00:57]
"igndlm.exe"="C:\Program Files\IGN\Download Manager\DLM.exe" [2007-03-05 13:57]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-06-21 14:06]

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
Source= file:///C:\WINDOWS\privacy_danger\index.htm
FriendlyName= Privacy Protection

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"="C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2006-12-20 13:55]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^David^Start Menu^Programs^Startup^Yahoo! Widget Engine.lnk]
path=C:\Documents and Settings\David\Start Menu\Programs\Startup\Yahoo! Widget Engine.lnk
backup=C:\WINDOWS\pss\Yahoo! Widget Engine.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
"C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Free Internet Window Washer]
C:\Program Files\Free Internet Window Washer\Clearpch.exe -Start

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
%systemroot%\system32\dumprep 0 -k

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechCommunicationsManager]
"C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechQuickCamRibbon]
"C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMService]
"C:\Program Files\CyberLink\PowerCinema\PCMService.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PVR]
C:\Program Files\XemiComputers\Pocket Voice Recorder\PVR.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ResChanger 2005]
C:\Program Files\ResChanger 2005\ResChanger2005.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Secrecy File & Folder Hider]
C:\TF\Secrecy File & Folder Hider\Secrethider.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
"D:\Steam\Steam.exe" -silent

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Taskbar Button Manager]
C:\Program Files\Innovative Solutions\Taskbar Button Manager\tbm.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zune Launcher]
"C:\Program Files\Zune\ZuneLauncher.exe"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" /background
"Aim6"="C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
"Free Internet Window Washer"=C:\Program Files\Free Internet Window Washer\Clearpch.exe -Start
"Taskbar Button Manager"=C:\Program Files\Innovative Solutions\Taskbar Button Manager\tbm.exe
"EasyLinkAdvisor"="C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" /startup
"MySpaceIM"=C:\Program Files\MySpace\IM\MySpaceIM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"nTrayFw"=C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
"SoundMan"=SOUNDMAN.EXE
"GuruClock"=C:\Program Files\ABIT\ABIT uGuru\GuruClock.exe
"ABIT uGuru"=C:\Program Files\ABIT\ABIT uGuru\uGuru.exe
"nwiz"=nwiz.exe /install
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
"NvMediaCenter"=RunDLL32.exe NvMCTray.dll,NvTaskbarInit
"Zune Launcher"="C:\Program Files\Zune\ZuneLauncher.exe"
"WinVNC"="C:\Program Files\TightVNC\WinVNC.exe" -servicehelper
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" -atboottime
"Ardamax Keylogger"=C:\Program Files\Ardamax Keylogger Lite\akl.exe
"NvCplDaemon"=RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
"XDc"=C:\Program Files\Xtreme Desktop\xdc\startxdc.exe
"NeroCheck"=C:\WINDOWS\system32\NeroCheck.exe


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a0fb0931-5cb6-11d9-b4be-806d6172696f}]
AutoRun\command- E:\autorun.exe


**************************************************************************

catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-08 13:03:50
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-08 13:04:26
C:\ComboFix-quarantined-files.txt ... 2007-07-08 13:04
C:\ComboFix2.txt ... 2007-07-06 13:21

--- E O F ---


here is that smart fraud fix log

SmitFraudFix v2.201

Scan done at 12:53:34.01, Sun 07/08/2007
Run from C:\Program Files\Mozilla Firefox\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
D:\Adobe CS3 Master Collection\Acrobat 8.0\Acrobat\Acrotray.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\GameSpot\GDM_TrayApp.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\David


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\David\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Start Menu


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\David\FAVORI~1


»»»»»»»»»»»»»»»»»»»»»»»» Desktop


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="file:///C:\\WINDOWS\\privacy_danger\\index.htm"
"SubscribedURL"=""
"FriendlyName"="Privacy Protection"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\1]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Rustock



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: NVIDIA nForce Networking Controller - Packet Scheduler Miniport
DNS Server Search Order: 192.168.1.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{1125EFB8-6938-472F-81E6-57ECC0604BB6}: NameServer=192.168.2.1
HKLM\SYSTEM\CCS\Services\Tcpip\..\{222E2FB6-A1B8-452D-8C3D-5544A5A4BAFC}: NameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{222E2FB6-A1B8-452D-8C3D-5544A5A4BAFC}: NameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{F8EEB660-CEC7-464B-AEB9-06D98CD4F94F}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{1125EFB8-6938-472F-81E6-57ECC0604BB6}: NameServer=192.168.2.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{222E2FB6-A1B8-452D-8C3D-5544A5A4BAFC}: NameServer=192.168.1.1


»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection


»»»»»»»»»»»»»»»»»»»»»»»» End



Here is that hijackthis log

Logfile of HijackThis v1.99.1
Scan saved at 1:16:18 PM, on 7/8/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
D:\Adobe CS3 Master Collection\Acrobat 8.0\Acrobat\Acrotray.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\GameSpot\GDM_TrayApp.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gmail.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = socks=localhost:1080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - D:\Adobe CS3 Master Collection\/Adobe Contribute CS3/contributeieplugin.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - D:\Adobe CS3 Master Collection\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Adobe CS3 Master Collection\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - D:\Adobe CS3 Master Collection\/Adobe Contribute CS3/contributeieplugin.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "D:\Adobe CS3 Master Collection\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [Adobe_ID0EYTHM] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
O4 - HKLM\..\Run: [LanzarP2006] "C:\DOCUME~1\David\LOCALS~1\Temp\{9A8B669E-CD8E-490B-A20C-CA0914ED86D7}\{EEBA9416-3207-47E0-9022-116440599DBC}\..\..\P2006tmp\Install.exe" /SETUP:"/l0x0009"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [Instant File Name Search] C:\Program Files\ifns\ifns.exe
O4 - HKCU\..\Run: [igndlm.exe] C:\Program Files\IGN\Download Manager\DLM.exe /windowsstart /startifwork
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Startup: GameSpot Download Manager.lnk = C:\Program Files\GameSpot\GDM_TrayApp.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O8 - Extra context menu item: Append to existing PDF - res://D:\Adobe CS3 Master Collection\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://D:\Adobe CS3 Master Collection\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://D:\Adobe CS3 Master Collection\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://D:\Adobe CS3 Master Collection\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://D:\Adobe CS3 Master Collection\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://D:\Adobe CS3 Master Collection\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://D:\Adobe CS3 Master Collection\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://D:\Adobe CS3 Master Collection\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (CDownloadCtrl Object) - http://www.fileplanet.com/fpdlmgr/cabs/ ... .2.100.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 4837470515
O17 - HKLM\System\CCS\Services\Tcpip\..\{1125EFB8-6938-472F-81E6-57ECC0604BB6}: NameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{222E2FB6-A1B8-452D-8C3D-5544A5A4BAFC}: NameServer = 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{1125EFB8-6938-472F-81E6-57ECC0604BB6}: NameServer = 192.168.2.1
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: igfxcui - igfxdev.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Version Cue CS3 - Unknown owner - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe" -win32service (file missing)
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: DNADownloader - CNET Networks - C:\Program Files\GameSpot\DownloadManager_Win32.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: mental ray 3.5 Satellite (32-bit) (mi-raysat_3dsmax9_32) - Unknown owner - C:\Program Files\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Unknown owner - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe (file missing)
O23 - Service: VNC Server (winvnc) - Unknown owner - C:\Program Files\TightVNC\WinVNC.exe" -service (file missing)


and finally here is that hxxp://virusscan.jotti.org/ (tell me if i am posting this right i was not sure how to post this as it did not give me alog)

Jotti's malware scan 2.99-TRANSITION_TO_3.00-R1
File to upload & scan: Virus

Service
Service load:
0% 100%
File: explorerkonshu.exe
Status:
OK
MD5: 112592915e16229842a61ba521110fdc
Packers detected:
-
Bit9 reports: File not found
Scanner results
Scan taken on 08 Jul 2007 17:56:11 (GMT)
A-Squared
Found nothing
AntiVir
Found nothing
ArcaVir
Found nothing
Avast
Found nothing
AVG Antivirus
Found nothing
BitDefender
Found nothing
ClamAV
Found nothing
Dr.Web
Found nothing
F-Prot Antivirus
Found nothing
F-Secure Anti-Virus
Found nothing
Fortinet
Found nothing
Kaspersky Anti-Virus
Found nothing
NOD32
Found nothing
Norman Virus Control
Found nothing
Panda Antivirus
Found nothing
Rising Antivirus
Found nothing
Sophos Antivirus
Found nothing
VirusBuster
Found nothing
VBA32
Found nothing

Powered by
images/asquared.png images/antivir.png images/arcabit.png images/avast.png images/avg.gif images/bitdefender.png images/clamav-logo1.png images/drweb.gif images/f-prot.png images/f-secure_logo.gif images/fortinet.gif images/kaspersky.png images/nod32.gif images/norman.png images/panda.png images/rising.gif images/sophos.gif images/virusbuster.gif images/vba32.png Bit9
Disclaimer
This service is by no means 100% safe. If this scanner says 'OK', it does not necessarily mean the file is clean. There could be a whole new virus on the loose. NEVER EVER rely on one single product only, not even this service, even though it utilizes several products. Therefore, We cannot and will not be held responsible for any damage caused by results presented by this non-profit online service.

Also, we are aware of the implications of a setup like this. We are sure this whole thing is by no means scientifically correct, since this is a fully automated service (although manual correction is possible). We are aware, in spite of efforts to proactively counter these, false positives might occur, for example. We do not consider this a very big issue, so please do not e-mail us about it. This is a simple online scan service, not the university of Wichita.

Scanning can take a while, since several scanners are being used, plus the fact some scanners use very high levels of (time consuming) heuristics. Scanners used are Linux versions, differences with Windows scanners may or may not occur. Another note: some scanners will only report one virus when scanning archives with multiple pieces of malware.

Virus definitions are updated every hour. There is a 10Mb limit per file. Please refrain from uploading tons of hex-edited or repacked variants of the same sample.

Please do not ask for viruses uploaded here, unless you work for an anti-virus vendor. They are not for trade. This is a legitimate service, not a VX site. Viruses uploaded here will be distributed to antivirus vendors without exception. Read more about this in our privacy policy. If you do not want your files to be distributed, please do not send them at all.

Sponsored by donations (in random order) from: Stormbyte Technologies LLC, The ClamAV project, Steve S., Eric Johansen, Eric Schechter, Paul Bokel, Wilders Security, Wilfried Lilie, Prevx, SonicWALL, Lance Mueller, Ewido networks, HotelScraper.com, people who donated in the past, and some people who prefer to remain anonymous... many thanks to all!
Statistics
Last file scanned at least one scanner reported something about: server.exe (MD5: b35b85eb86b8f9b122770cdbee7e933c, size: 516096 bytes), detected by:

Scanner Malware name
A-Squared X
AntiVir HEUR/Crypted
ArcaVir X
Avast X
AVG Antivirus X
BitDefender X
ClamAV X
Dr.Web X
F-Prot Antivirus X
F-Secure Anti-Virus X
Fortinet X
Kaspersky Anti-Virus X
NOD32 X
Norman Virus Control X
Panda Antivirus X
Rising Antivirus X
Sophos Antivirus X
VirusBuster X
VBA32 X


You're free to (mis)interpret these automated, flawed statistics at your own discretion. For antivirus comparisons, visit AV comparatives
We are not affiliated with any third parties that conduct tests using this service.

PLEASE IF I DIDN'T REMOVE ANY AND ALL ILLEGAL PRODUCTS THAT THIS GOMYRON VIRUS OBTAINED TELL ME WITH INSTRUCTIONS BECAUSE I BELIEVE THAT ANYONE WHO WORKS HARD TO DESIGN AND MAKE PRODUCTS SHOULD RECIEVE FULL PAYMENT.

get back to me as soon as you figure out what i need to do next.
suerg
Active Member
 
Posts: 6
Joined: July 5th, 2007, 5:29 pm

Unread postby suerg » July 9th, 2007, 1:43 pm

Hey i am pretty sure the virus is gone now so thanks for your help.
suerg
Active Member
 
Posts: 6
Joined: July 5th, 2007, 5:29 pm

Unread postby curlylad » July 9th, 2007, 4:03 pm

Hi suerg

Your infections may appear to have gone but there is still a threat to your system that definately needs addressing.

I of course cannot force you to be helped but if you no longer require my help then that is fine but please inform me of this so I can archive the thread. :)
User avatar
curlylad
Retired Graduate
 
Posts: 1829
Joined: February 5th, 2006, 5:07 pm
Location: Birmingham

Unread postby NonSuch » July 13th, 2007, 5:27 am

This topic is now closed due to inactivity. If you wish it reopened, please send us an email to 'admin at malwareremoval.com' with a link to your thread.

You can help support this site from this link :
Donations For Malware Removal

Please do not contact us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
User avatar
NonSuch
Administrator
Administrator
 
Posts: 28747
Joined: February 23rd, 2005, 7:08 am
Location: California
Advertisement
Register to Remove


Return to Infected? Virus, malware, adware, ransomware, oh my!



Who is online

Users browsing this forum: No registered users and 299 guests

Contact us:

Advertisements do not imply our endorsement of that product or service. Register to remove all ads. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks are the property of their respective owners.

Member site: UNITE Against Malware