This is a read-only archive of malwareremoval.com. No new posts or registrations. Privacy Page
Malware Removal Forums

HJT Log - can anyone help me please?

59 min read

This thread's last reply is from March 16, 2008, 1:04 PM UTC. Software, malware, and removal-tool advice below may be out of date — treat specific steps and download links with caution.

ipplepen
March 13, 2008, 11:13 PM UTC
PC AVG virus software is reporting LOP and Trogan's (Generic10.AEV). I have tried to clean with AVG, spybot and various online scanners but am really stuck. Please help me get it running again if you can.

Seems to stop loading certain websites - (Ebay), puts 'fix your spyware' banners on some sites I view, and changes homepage on internet explorer.

update - CFMON.exe is attempting to make reg changes today

Thank you in anticipation.

Logfile of HijackThis v1.99.1
Scan saved at 23:09:44, on 13/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\ZONELABS\vsmon.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINNT\system32\bgsvcgen.exe
C:\WINNT\system32\E_S00RP1.EXE
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINNT\system32\slserv.exe
C:\WINNT\system32\SAgent4.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\ctfmon.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\igfxtray.exe
C:\WINNT\system32\hkcmd.exe
C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE
C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\SlipStream Web Accelerator\slipcore.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\WINNT\system32\rundll32.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINNT\system32\taskswitch.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Muiltmedia keyboard utility\KbdAp32A.exe
C:\WINNT\system32\Rundll32.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Garmin\gStart.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\Program Files\Wireless LAN Utility\SiWake.exe
C:\Program Files\FinePixViewer\QuickDCF2.exe
C:\Program Files\DeskSweeper\DeskSweeper.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
O3 - Toolbar: StumbleUpon Toolbar - {5093EB4C-3E93-40AB-9266-B607BA87BDC8} - C:\Program Files\StumbleUpon\StumbleUponIEBar.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\system32\hkcmd.exe
O4 - HKLM\..\Run: [EPSON Stylus D68 Series] C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE /P23 "EPSON Stylus D68 Series" /O6 "USB001" /M "Stylus D68"
O4 - HKLM\..\Run: [EPSON Stylus D68 Series (Copy 1)] C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE /P32 "EPSON Stylus D68 Series (Copy 1)" /O6 "USB001" /M "Stylus D68"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SlipStream] "C:\Program Files\SlipStream Web Accelerator\slipcore.exe"
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [FLMK08KB] C:\Program Files\Muiltmedia keyboard utility\MMKEYBD.EXE
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [CoolSwitch] C:\WINNT\system32\taskswitch.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ScreenGif] a
O4 - HKLM\..\Run: [BM8bbe4931] Rundll32.exe "C:\WINNT\system32\eueycdco.dll",s
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [EPSON Stylus D68 Series] C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE /P23 "EPSON Stylus D68 Series" /M "Stylus D68" /EF "HKCU"
O4 - HKCU\..\Run: [gStart] C:\Garmin\gStart.exe
O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: DeskSweeper.lnk = C:\Program Files\DeskSweeper\DeskSweeper.exe
O4 - Global Startup: SiWake.lnk = C:\Program Files\Wireless LAN Utility\SiWake.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Exif Launcher 2.lnk = ?
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINNT\system32\GPhotos.scr/200
O8 - Extra context menu item: StumbleUpon: &Blog This - res://StumbleUponIEBar.dll/blogimage
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://www.tiscali.co.uk/
O15 - Trusted Zone: *.stumbleupon.com
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partne ... nicode.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {74FFE28D-2378-11D5-990C-006094235084} (IBM Access Support) - http://www-307.ibm.com/pc/support/IbmEgath.cab
O16 - DPF: {8BC53B30-32E4-4ED3-BEF9-DB761DB77453} (CInstallLPCtrl Object) - http://u3.sandisk.com/download/apps/LPInstaller.CAB
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\WINNT\system32\bgsvcgen.exe
O23 - Service: EPSON V3 Service2(03) (EPSON_PM_RPCV2_01) - SEIKO EPSON CORPORATION - C:\WINNT\system32\E_S00RP1.EXE
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: Franson GpsGate 2.0 - Unknown owner - C:\Program Files\Franson\GpsGate 2.0\GpsGateService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\VIRUSfighter\Nvc\BIN\nipsvc.exe (file missing)
O23 - Service: SmartLinkService (SLService) - - C:\WINNT\SYSTEM32\slserv.exe
O23 - Service: Epson Printer Status Agent4 (StatusAgent4) - SEIKO EPSON CORPORATION - C:\WINNT\system32\SAgent4.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINNT\system32\ZONELABS\vsmon.exe
dan12
March 14, 2008, 5:26 PM UTC
Hi, and welcome.
your HJT version is out of date please go to control panel add and remove and remove "HijackThis v1.99.1"

____________

Download and Run HijackThis
Download HJTInstall.exe to your Desktop.

* Doubleclick HJTInstall.exe to install it.
* By default it will install to C:\Program Files\Trend Micro\HijackThis .
* Click on Install.
* It will create a HijackThis icon on the desktop.
* Once installed, it will launch Hijackthis.
* Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
* Copy/Paste the log to your next reply please.

Don't use the Analyse This button, its findings are dangerous if misinterpreted.
Don't have Hijackthis fix anything yet. Most of what it finds will be harmless or even required.

please post new HJT log
dan
ipplepen
March 14, 2008, 9:34 PM UTC
Thank you Dan for picking my log up - here is the new one as requested.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:33:01, on 14/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\ZONELABS\vsmon.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINNT\system32\bgsvcgen.exe
C:\WINNT\system32\E_S00RP1.EXE
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINNT\system32\slserv.exe
C:\WINNT\system32\SAgent4.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\ctfmon.exe
C:\WINNT\system32\wuauclt.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\igfxtray.exe
C:\WINNT\system32\hkcmd.exe
C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE
C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\SlipStream Web Accelerator\slipcore.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\WINNT\system32\rundll32.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINNT\system32\taskswitch.exe
C:\Program Files\Muiltmedia keyboard utility\KbdAp32A.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Garmin\gStart.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Wireless LAN Utility\SiWake.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\Program Files\FinePixViewer\QuickDCF2.exe
C:\Program Files\DeskSweeper\DeskSweeper.exe
C:\WINNT\system32\rundll32.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.msn.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
O3 - Toolbar: StumbleUpon Toolbar - {5093EB4C-3E93-40AB-9266-B607BA87BDC8} - C:\Program Files\StumbleUpon\StumbleUponIEBar.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\system32\hkcmd.exe
O4 - HKLM\..\Run: [EPSON Stylus D68 Series] C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE /P23 "EPSON Stylus D68 Series" /O6 "USB001" /M "Stylus D68"
O4 - HKLM\..\Run: [EPSON Stylus D68 Series (Copy 1)] C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE /P32 "EPSON Stylus D68 Series (Copy 1)" /O6 "USB001" /M "Stylus D68"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SlipStream] "C:\Program Files\SlipStream Web Accelerator\slipcore.exe"
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [FLMK08KB] C:\Program Files\Muiltmedia keyboard utility\MMKEYBD.EXE
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [CoolSwitch] C:\WINNT\system32\taskswitch.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ScreenGif] a
O4 - HKLM\..\Run: [BM8bbe4931] Rundll32.exe "C:\WINNT\system32\kjlqkctm.dll",s
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [EPSON Stylus D68 Series] C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE /P23 "EPSON Stylus D68 Series" /M "Stylus D68" /EF "HKCU"
O4 - HKCU\..\Run: [gStart] C:\Garmin\gStart.exe
O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [internat.exe] internat.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [internat.exe] internat.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [internat.exe] internat.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [internat.exe] internat.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')
O4 - Startup: DeskSweeper.lnk = C:\Program Files\DeskSweeper\DeskSweeper.exe
O4 - Global Startup: SiWake.lnk = C:\Program Files\Wireless LAN Utility\SiWake.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Exif Launcher 2.lnk = ?
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINNT\system32\GPhotos.scr/200
O8 - Extra context menu item: StumbleUpon: &Blog This - res://StumbleUponIEBar.dll/blogimage
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.tiscali.co.uk/
O15 - Trusted Zone: *.stumbleupon.com
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partne ... nicode.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {74FFE28D-2378-11D5-990C-006094235084} (IBM Access Support) - http://www-307.ibm.com/pc/support/IbmEgath.cab
O16 - DPF: {8BC53B30-32E4-4ED3-BEF9-DB761DB77453} (CInstallLPCtrl Object) - http://u3.sandisk.com/download/apps/LPInstaller.CAB
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\WINNT\system32\bgsvcgen.exe
O23 - Service: EPSON V3 Service2(03) (EPSON_PM_RPCV2_01) - SEIKO EPSON CORPORATION - C:\WINNT\system32\E_S00RP1.EXE
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: Franson GpsGate 2.0 - Unknown owner - C:\Program Files\Franson\GpsGate 2.0\GpsGateService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\VIRUSfighter\Nvc\BIN\nipsvc.exe (file missing)
O23 - Service: SmartLinkService (SLService) - - C:\WINNT\SYSTEM32\slserv.exe
O23 - Service: Epson Printer Status Agent4 (StatusAgent4) - SEIKO EPSON CORPORATION - C:\WINNT\system32\SAgent4.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINNT\system32\ZONELABS\vsmon.exe

--
End of file - 9713 bytes
dan12
March 14, 2008, 9:36 PM UTC
I believe we have some files hiding from us, I'm going to flush them out.

Please go to the C:\Program Files\Trend Micro\HijackThis\HijackThis.exe. Right click on the HijackThis.exe file and select "Rename". Rename it removal.exe,

Then run HijackThis again and post a new log please.

Thanks dan
ipplepen
March 14, 2008, 9:44 PM UTC
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:43:31, on 14/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\ZONELABS\vsmon.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINNT\system32\bgsvcgen.exe
C:\WINNT\system32\E_S00RP1.EXE
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINNT\system32\slserv.exe
C:\WINNT\system32\SAgent4.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\ctfmon.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\igfxtray.exe
C:\WINNT\system32\hkcmd.exe
C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE
C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\SlipStream Web Accelerator\slipcore.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\WINNT\system32\rundll32.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINNT\system32\taskswitch.exe
C:\Program Files\Muiltmedia keyboard utility\KbdAp32A.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Garmin\gStart.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Wireless LAN Utility\SiWake.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\Program Files\FinePixViewer\QuickDCF2.exe
C:\Program Files\DeskSweeper\DeskSweeper.exe
C:\WINNT\system32\rundll32.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Trend Micro\HijackThis\removal.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.msn.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: StumbleUpon Launcher - {145B29F4-A56B-4b90-BBAC-45784EBEBBB7} - C:\Program Files\StumbleUpon\StumbleUponIEBar.dll
O2 - BHO: (no name) - {27A82D47-9A2A-4B39-B4EC-792BBDFD03FA} - C:\WINNT\system32\urqnkig.dll
O2 - BHO: PBlockHelper Class - {4115122B-85FF-4DD3-9515-F075BEDE5EB5} - C:\Program Files\SlipStream Web Accelerator\PBHelper.dll
O2 - BHO: (no name) - {4BF0181B-D776-4830-BA0D-31B48661E4CA} - C:\WINNT\system32\vtsqr.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O3 - Toolbar: StumbleUpon Toolbar - {5093EB4C-3E93-40AB-9266-B607BA87BDC8} - C:\Program Files\StumbleUpon\StumbleUponIEBar.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\system32\hkcmd.exe
O4 - HKLM\..\Run: [EPSON Stylus D68 Series] C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE /P23 "EPSON Stylus D68 Series" /O6 "USB001" /M "Stylus D68"
O4 - HKLM\..\Run: [EPSON Stylus D68 Series (Copy 1)] C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE /P32 "EPSON Stylus D68 Series (Copy 1)" /O6 "USB001" /M "Stylus D68"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SlipStream] "C:\Program Files\SlipStream Web Accelerator\slipcore.exe"
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [FLMK08KB] C:\Program Files\Muiltmedia keyboard utility\MMKEYBD.EXE
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [CoolSwitch] C:\WINNT\system32\taskswitch.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ScreenGif] a
O4 - HKLM\..\Run: [BM8bbe4931] Rundll32.exe "C:\WINNT\system32\kjlqkctm.dll",s
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [EPSON Stylus D68 Series] C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE /P23 "EPSON Stylus D68 Series" /M "Stylus D68" /EF "HKCU"
O4 - HKCU\..\Run: [gStart] C:\Garmin\gStart.exe
O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [internat.exe] internat.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [internat.exe] internat.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [internat.exe] internat.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [internat.exe] internat.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')
O4 - Startup: DeskSweeper.lnk = C:\Program Files\DeskSweeper\DeskSweeper.exe
O4 - Global Startup: SiWake.lnk = C:\Program Files\Wireless LAN Utility\SiWake.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Exif Launcher 2.lnk = ?
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINNT\system32\GPhotos.scr/200
O8 - Extra context menu item: StumbleUpon: &Blog This - res://StumbleUponIEBar.dll/blogimage
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.tiscali.co.uk/
O15 - Trusted Zone: *.stumbleupon.com
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partne ... nicode.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {74FFE28D-2378-11D5-990C-006094235084} (IBM Access Support) - http://www-307.ibm.com/pc/support/IbmEgath.cab
O16 - DPF: {8BC53B30-32E4-4ED3-BEF9-DB761DB77453} (CInstallLPCtrl Object) - http://u3.sandisk.com/download/apps/LPInstaller.CAB
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O20 - Winlogon Notify: urqnkig - C:\WINNT\SYSTEM32\urqnkig.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\WINNT\system32\bgsvcgen.exe
O23 - Service: EPSON V3 Service2(03) (EPSON_PM_RPCV2_01) - SEIKO EPSON CORPORATION - C:\WINNT\system32\E_S00RP1.EXE
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: Franson GpsGate 2.0 - Unknown owner - C:\Program Files\Franson\GpsGate 2.0\GpsGateService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\VIRUSfighter\Nvc\BIN\nipsvc.exe (file missing)
O23 - Service: SmartLinkService (SLService) - - C:\WINNT\SYSTEM32\slserv.exe
O23 - Service: Epson Printer Status Agent4 (StatusAgent4) - SEIKO EPSON CORPORATION - C:\WINNT\system32\SAgent4.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINNT\system32\ZONELABS\vsmon.exe

--
End of file - 10660 bytes

Thanks
dan12
March 14, 2008, 10:55 PM UTC
Download Combofix from any of the links below, and save it to your desktop. For information regarding this download, please visit this webpage: http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Link 1
Link 2
Link 3


**Note: It is important that it is saved directly to your desktop**

--------------------------------------------------------------------

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

--------------------------------------------------------------------

Double click on combofix.exe & follow the prompts.
    When finished, it will produce a report for you.
  • Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.


Note:
Do not mouseclick combofix's window while it's running. That may cause it to stall

Dan
ipplepen
March 15, 2008, 9:39 AM UTC
Hopefully what was required! Loads of reg change requests on reboot!

Thanks
Andy


ComboFix 08-03-14.4 - Andy 2008-03-15 9:09:08.1 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.128 [GMT 0:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINNT\BM8bbe4931.xml
C:\WINNT\pskt.ini
C:\WINNT\system32\eueycdco.dll
C:\WINNT\system32\kjlqkctm.dll
C:\WINNT\system32\rqstv.ini
C:\WINNT\system32\rqstv.ini2
C:\WINNT\system32\urqnkig.dll
C:\WINNT\system32\vtsqr.dll
C:\WINNT\Web\default.htt
E:\Autorun.inf
Z:\Autorun.inf

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\LEGACY_
-------\LEGACY_WINDOWS_LOG
-------\npf


((((((((((((((((((((((((( Files Created from 2008-02-15 to 2008-03-15 )))))))))))))))))))))))))))))))
.

2008-03-15 09:04 . 2008-03-15 09:04 <DIR> d-------- C:\ComboFix(2)
2008-03-14 21:30 . 2008-03-14 21:30 <DIR> d-------- C:\Program Files\Trend Micro
2008-03-13 18:08 . 2008-03-13 18:08 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab
2008-03-13 18:07 . 2008-03-13 18:08 <DIR> d-------- C:\WINNT\system32\Kaspersky Lab
2008-03-12 20:12 . 2008-03-12 20:25 3,674 --a------ C:\WINNT\system32\tmp.reg
2008-03-12 20:11 . 2007-09-05 23:22 289,144 --a------ C:\WINNT\system32\VCCLSID.exe
2008-03-12 20:11 . 2006-04-27 16:49 288,417 --a------ C:\WINNT\system32\SrchSTS.exe
2008-03-12 20:11 . 2008-03-09 01:15 86,528 --a------ C:\WINNT\system32\VACFix.exe
2008-03-12 20:11 . 2008-03-05 22:29 82,432 --a------ C:\WINNT\system32\IEDFix.exe
2008-03-12 20:11 . 2003-06-05 20:13 53,248 --a------ C:\WINNT\system32\Process.exe
2008-03-12 20:11 . 2004-07-31 17:50 51,200 --a------ C:\WINNT\system32\dumphive.exe
2008-03-12 20:11 . 2007-10-03 23:36 25,600 --a------ C:\WINNT\system32\WS2Fix.exe
2008-03-12 19:47 . 2008-03-12 19:47 <DIR> d-------- C:\Program Files\RogueRemover FREE
2008-03-12 19:28 . 2008-03-12 19:28 <DIR> d-------- C:\Program Files\Opera
2008-03-12 18:08 . 2008-03-12 18:00 691,545 --a------ C:\WINNT\unins000.exe
2008-03-12 18:08 . 2008-03-12 18:08 2,538 --a------ C:\WINNT\unins000.dat
2008-03-12 17:15 . 2008-03-12 17:15 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-03-12 17:15 . 2008-03-12 17:15 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
2008-03-10 22:52 . 2008-03-10 22:52 <DIR> d-------- C:\Program Files\Common Files\ColorPlaza
2008-03-05 15:55 . 2008-03-05 15:55 <DIR> d--hs---- C:\FOUND.000
2008-03-05 15:55 . 2008-03-15 09:20 335 --a------ C:\WINNT\system32\vsconfig.xml
2008-03-04 22:44 . 2008-03-04 22:44 54,156 --ah----- C:\WINNT\QTFont.qfn
2008-03-04 22:44 . 2008-03-04 22:44 1,409 --a------ C:\WINNT\QTFont.for
2008-03-03 18:33 . 2008-03-03 18:33 <DIR> d-------- C:\Program Files\Colormailer
2008-03-03 17:29 . 2008-03-03 17:29 <DIR> d-------- C:\Program Files\MyPhotoIndex

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-15 09:17 6,872 --sha-w C:\WINNT\system32\drivers\fidbox.idx
2008-03-15 09:17 405,536 --sha-w C:\WINNT\system32\drivers\fidbox.dat
2008-03-15 09:17 35,840 ------w C:\WINNT\Internet Logs\xDBC5.tmp
2008-03-14 08:57 32,256 ------w C:\WINNT\Internet Logs\xDBC4.tmp
2008-03-14 08:16 14,597,431 ------w C:\WINNT\Internet Logs\tvDebug.zip
2008-03-13 23:58 40,960 ------w C:\WINNT\Internet Logs\xDBC3.tmp
2008-03-12 23:52 33,792 ------w C:\WINNT\Internet Logs\xDBC2.tmp
2008-03-12 20:32 3,514,880 ------w C:\WINNT\Internet Logs\xDBC1.tmp
2008-03-12 20:06 55,808 ------w C:\WINNT\Internet Logs\xDBC0.tmp
2008-03-12 08:17 33,792 ------w C:\WINNT\Internet Logs\xDBBF.tmp
2008-03-11 23:09 3,484,672 ------w C:\WINNT\Internet Logs\xDBBE.tmp
2008-03-11 10:11 32,256 ------w C:\WINNT\Internet Logs\xDBBD.tmp
2008-03-11 00:10 45,056 ------w C:\WINNT\Internet Logs\xDBBC.tmp
2008-03-09 21:52 36,864 ------w C:\WINNT\Internet Logs\xDBBB.tmp
2008-03-09 14:34 3,467,264 ------w C:\WINNT\Internet Logs\xDBBA.tmp
2008-03-09 12:45 41,472 ------w C:\WINNT\Internet Logs\xDBB9.tmp
2008-03-08 17:50 48,128 ------w C:\WINNT\Internet Logs\xDBB8.tmp
2008-03-06 23:19 38,912 ------w C:\WINNT\Internet Logs\xDBB7.tmp
2008-03-06 11:19 31,232 ------w C:\WINNT\Internet Logs\xDBB6.tmp
2008-03-06 09:33 3,476,480 ------w C:\WINNT\Internet Logs\xDBB5.tmp
2008-03-05 22:53 38,912 ------w C:\WINNT\Internet Logs\xDBB4.tmp
2008-03-04 23:03 39,936 ------w C:\WINNT\Internet Logs\xDBB3.tmp
2008-03-03 22:36 86,016 ------w C:\WINNT\Internet Logs\xDBB2.tmp
2008-02-27 16:45 58,880 ------w C:\WINNT\Internet Logs\xDBB1.tmp
2008-02-23 23:18 48,640 ------w C:\WINNT\Internet Logs\xDBB0.tmp
2008-02-20 22:55 42,496 ------w C:\WINNT\Internet Logs\xDBAF.tmp
2008-02-18 21:52 56,320 ------w C:\WINNT\Internet Logs\xDBAE.tmp
2008-02-13 23:57 32,768 ------w C:\WINNT\Internet Logs\xDBAD.tmp
2008-02-13 18:06 33,792 ------w C:\WINNT\Internet Logs\xDBAC.tmp
2008-02-13 17:54 --------- d-----w C:\Program Files\Animated ScreenGif
2008-02-13 13:44 33,792 ------w C:\WINNT\Internet Logs\xDBAB.tmp
2008-02-13 09:27 31,232 ------w C:\WINNT\Internet Logs\xDBAA.tmp
2008-02-12 22:54 36,864 ------w C:\WINNT\Internet Logs\xDBA9.tmp
2008-02-11 23:09 40,448 ------w C:\WINNT\Internet Logs\xDBA8.tmp
2008-02-10 23:25 73,728 ------w C:\WINNT\Internet Logs\xDBA7.tmp
2008-02-07 23:00 35,840 ------w C:\WINNT\Internet Logs\xDBA6.tmp
2008-02-06 22:40 40,448 ------w C:\WINNT\Internet Logs\xDBA5.tmp
2008-02-05 22:54 84,480 ------w C:\WINNT\Internet Logs\xDBA4.tmp
2008-02-01 23:25 36,864 ------w C:\WINNT\Internet Logs\xDBA3.tmp
2008-01-31 22:33 37,888 ------w C:\WINNT\Internet Logs\xDBA2.tmp
2008-01-31 22:12 --------- d-----w C:\Program Files\Belarc
2008-01-30 22:47 47,104 ------w C:\WINNT\Internet Logs\xDBA1.tmp
2008-01-30 22:41 --------- d-----w C:\Program Files\Common Files\SWF Studio
2008-01-30 22:40 --------- d-----w C:\Program Files\bootAmp
2008-01-29 22:31 49,152 ------w C:\WINNT\Internet Logs\xDBA0.tmp
2008-01-28 15:17 39,424 ------w C:\WINNT\Internet Logs\xDB9F.tmp
2008-01-27 21:55 61,440 ------w C:\WINNT\Internet Logs\xDB9E.tmp
2008-01-26 12:36 --------- d-----w C:\Program Files\Kontiki
2008-01-26 00:48 34,816 ------w C:\WINNT\Internet Logs\xDB9D.tmp
2008-01-25 17:04 41,472 ------w C:\WINNT\Internet Logs\xDB9C.tmp
2008-01-24 11:51 32,256 ------w C:\WINNT\Internet Logs\xDB9B.tmp
2008-01-24 11:17 70,656 ------w C:\WINNT\Internet Logs\xDB9A.tmp
2008-01-20 20:51 --------- d-----w C:\Documents and Settings\Andy .HOME-J68SS7HK0H\Application Data\stickies
2008-01-20 20:50 --------- d-----w C:\Program Files\Stickies
2008-01-20 12:15 --------- d-----w C:\Program Files\Software by Design
2008-01-19 22:55 39,936 ------w C:\WINNT\Internet Logs\xDB99.tmp
2008-01-19 22:18 796,672 ----a-w C:\WINNT\GPInstall.exe
2008-01-19 22:18 --------- d-----w C:\Program Files\Aardvark
2008-01-19 21:28 86,016 ------w C:\WINNT\Internet Logs\xDB98.tmp
2008-01-19 21:18 --------- d-----w C:\Program Files\Shock Utility
2008-01-19 21:17 65,536 ----a-w C:\WINNT\IFinst27.exe
2008-01-19 20:55 --------- d-----w C:\Program Files\BellCraft.com
2008-01-19 20:32 --------- d-----w C:\Program Files\ClocX
2008-01-19 20:16 --------- d-----w C:\Program Files\DeskSweeper
2008-01-19 13:12 50,176 ------w C:\WINNT\Internet Logs\xDB97.tmp
2008-01-18 21:04 75,776 ------w C:\WINNT\Internet Logs\xDB96.tmp
2008-01-17 22:57 365,568 ------w C:\WINNT\Internet Logs\xDB95.tmp
2008-01-16 19:43 3,318,784 ------w C:\WINNT\Internet Logs\xDB94.tmp
2008-01-16 19:39 --------- d-----w C:\Program Files\Thoosje
2008-01-15 23:06 3,321,344 ------w C:\WINNT\Internet Logs\xDB93.tmp
2008-01-15 21:42 --------- d-----w C:\Documents and Settings\Andy .HOME-J68SS7HK0H\Application Data\Desktop Sidebar
2008-01-15 16:52 606,208 ------w C:\WINNT\Internet Logs\xDB92.tmp
2008-01-15 16:41 --------- d-----w C:\Program Files\RocketDock
2008-01-13 16:39 2,355,813 ----a-w C:\WINNT\system32\qt3A.tmp
2008-01-13 15:42 2,378,297 ----a-w C:\WINNT\system32\qt1A.tmp
2008-01-12 22:21 260,608 ------w C:\WINNT\Internet Logs\xDB91.tmp
2008-01-11 23:51 273,920 ------w C:\WINNT\Internet Logs\xDB90.tmp
2008-01-11 05:53 44,544 ----a-w C:\WINNT\system32\dllcache\pngfilt.dll
2008-01-10 23:00 248,832 ------w C:\WINNT\Internet Logs\xDB8F.tmp
2008-01-09 23:26 1,079,808 ------w C:\WINNT\Internet Logs\xDB8E.tmp
2008-01-07 18:20 686,080 ------w C:\WINNT\Internet Logs\xDB8D.tmp
2008-01-05 18:24 3,240,448 ------w C:\WINNT\Internet Logs\xDB8C.tmp
2008-01-05 18:24 1,409,024 ------w C:\WINNT\Internet Logs\xDB8B.tmp
2008-01-03 21:48 1,523,200 ------w C:\WINNT\Internet Logs\xDB8A.tmp
2008-01-01 00:49 471,040 ------w C:\WINNT\Internet Logs\xDB89.tmp
2007-12-30 23:08 513,024 ------w C:\WINNT\Internet Logs\xDB88.tmp
2007-12-28 23:39 273,920 ------w C:\WINNT\Internet Logs\xDB87.tmp
2007-12-27 23:53 266,240 ------w C:\WINNT\Internet Logs\xDB86.tmp
2007-12-26 22:51 464,384 ------w C:\WINNT\Internet Logs\xDB85.tmp
2007-12-24 21:37 691,200 ------w C:\WINNT\Internet Logs\xDB84.tmp
2007-12-22 23:32 640,512 ------w C:\WINNT\Internet Logs\xDB83.tmp
2007-12-21 19:15 644,096 ------w C:\WINNT\Internet Logs\xDB81.tmp
2007-12-21 19:15 3,217,920 ------w C:\WINNT\Internet Logs\xDB82.tmp
2007-12-19 23:01 347,136 ----a-w C:\WINNT\system32\dllcache\dxtmsft.dll
2007-12-19 22:35 880,640 ------w C:\WINNT\Internet Logs\xDB80.tmp
2007-12-18 09:51 179,584 ------w C:\WINNT\system32\dllcache\mrxdav.sys
2007-12-18 06:18 3,213,824 ------w C:\WINNT\Internet Logs\xDB7F.tmp
2007-12-18 06:18 1,233,920 ------w C:\WINNT\Internet Logs\xDB7E.tmp
2007-12-10 11:51 37,376 ------w C:\WINNT\Internet Logs\xDB7D.tmp
2007-12-09 17:57 37,376 ------w C:\WINNT\Internet Logs\xDB7C.tmp
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{27A82D47-9A2A-4B39-B4EC-792BBDFD03FA}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8AC5B8A1-D6F1-4D1B-8B15-06D512CCC722}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24 1694208]
"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe" [2006-06-26 16:13 1207080]
"EPSON Stylus D68 Series"="C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.exe" [2005-01-25 06:00 98304]
"gStart"="C:\Garmin\gStart.exe" [2007-03-04 23:08 1891416]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-10-23 21:18 443968]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Synchronization Manager"="mobsync.exe" [2004-08-04 00:56 143360 C:\WINNT\system32\mobsync.exe]
"IgfxTray"="C:\WINNT\system32\igfxtray.exe" [2004-11-02 09:03 155648]
"HotKeysCmds"="C:\WINNT\system32\hkcmd.exe" [2004-11-02 08:59 126976]
"EPSON Stylus D68 Series"="C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.exe" [2005-01-25 06:00 98304]
"EPSON Stylus D68 Series (Copy 1)"="C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.exe" [2005-01-25 06:00 98304]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [2007-12-21 11:19 579072]
"SlipStream"="C:\Program Files\SlipStream Web Accelerator\slipcore.exe" [2006-03-23 11:03 258048]
"zBrowser Launcher"="C:\Program Files\Logitech\iTouch\iTouch.exe" [2002-11-23 02:15 631362]
"MMTray"="C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe" [2002-05-20 19:36 90112]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 00:56 110592 C:\WINNT\system32\bthprops.cpl]
"FLMK08KB"="C:\Program Files\Muiltmedia keyboard utility\MMKEYBD.EXE" [2007-09-20 20:06 207360]
"REGSHAVE"="C:\Program Files\REGSHAVE\REGSHAVE.exe" [2002-02-04 22:32 53248]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-11-14 16:05 919016]
"CoolSwitch"="C:\WINNT\system32\taskswitch.exe" [2002-03-19 17:30 45632]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24 286720]
"ScreenGif"="a" []

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"internat.exe"="internat.exe" [1999-12-07 17:00 20752 C:\WINNT\system32\internat.exe]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe" [2007-10-24 09:27 219136]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-10-23 21:18 443968]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"tscuninstall"="C:\WINNT\system32\tscupgrd.exe" [2004-08-03 22:59 44544]

C:\Documents and Settings\Andy .HOME-J68SS7HK0H\Start Menu\Programs\Startup\
DeskSweeper.lnk - C:\Program Files\DeskSweeper\DeskSweeper.exe [1999-03-09 236032]

C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\Startup\
SiWake.lnk - C:\Program Files\Wireless LAN Utility\SiWake.exe [2006-07-20 16:52:32 135168]
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26 29696]
Exif Launcher 2.lnk - C:\Program Files\FinePixViewer\QuickDCF2.exe [2007-10-24 18:34:35 294912]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\urqnkig]
urqnkig.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R1 bizVSerial;Franson VSerial;C:\WINNT\system32\drivers\bizVSerialNT.sys [2006-04-03 21:00]
R1 Ext2fs;Ext2fs;C:\WINNT\system32\DRIVERS\ext2fs.sys [2006-10-23 18:20]
R1 IfsDrives;IfsDrives;C:\WINNT\system32\DRIVERS\IfsDrives.sys [2004-09-25 00:28]
R3 HCWBT8XX;Hauppauge WinTV 848/9 WDM Video Driver;C:\WINNT\system32\drivers\HCWBT8XX.sys [2006-01-25 16:14]
R3 LCcfltr;Logitech USB Filter Driver;C:\WINNT\system32\drivers\lccfltr.sys [2002-11-08 09:50]
S3 Franson GpsGate 2.0;Franson GpsGate 2.0;C:\Program Files\Franson\GpsGate 2.0\GpsGateService.exe [2006-12-01 19:00]
S3 LucentSoftModem;Lucent Technologies Soft Modem;C:\WINNT\system32\DRIVERS\LTSM.sys [2001-08-17 13:28]
S3 V90drv;v90drv;C:\WINNT\system32\DRIVERS\v90drv.sys [2001-11-29 16:10]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\Shell\AutoRun\command - E:\PortableApps\PortableAppsMenu\PortableAppsMenu.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2467094c-2346-11dc-95ec-00096b7d5e1b}]
\Shell\AutoRun\command - E:\PortableApps\PortableAppsMenu\PortableAppsMenu.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{44e851c6-1d6b-11db-9890-00096b7d5e1b}]
\Shell\AutoRun\command - E:\setupSNK.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{99f70218-ef0a-11db-9558-00096b7d5e1b}]
\Shell\AutoRun\command - PortableApps\PortableAppsMenu\PortableAppsMenu.exe

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-15 09:19:31
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINNT\system32\rundll32.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Muiltmedia keyboard utility\KbdAp32A.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINNT\system32\bgsvcgen.exe
C:\WINNT\system32\E_S00RP1.EXE
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINNT\system32\SAgent4.exe
.
**************************************************************************
.
Completion time: 2008-03-15 9:22:52 - machine was rebooted
ComboFix-quarantined-files.txt 2008-03-15 09:22:42
.
2008-03-13 08:04:14 --- E O F ---



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:27:00, on 15/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\ZONELABS\vsmon.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\igfxtray.exe
C:\WINNT\system32\hkcmd.exe
C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE
C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\SlipStream Web Accelerator\slipcore.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\WINNT\system32\rundll32.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINNT\system32\taskswitch.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Garmin\gStart.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Wireless LAN Utility\SiWake.exe
C:\Program Files\FinePixViewer\QuickDCF2.exe
C:\Program Files\DeskSweeper\DeskSweeper.exe
C:\Program Files\Muiltmedia keyboard utility\KbdAp32A.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINNT\system32\bgsvcgen.exe
C:\WINNT\system32\E_S00RP1.EXE
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINNT\system32\SAgent4.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\ctfmon.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\wuauclt.exe
C:\WINNT\explorer.exe
C:\WINNT\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\removal.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.msn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: StumbleUpon Launcher - {145B29F4-A56B-4b90-BBAC-45784EBEBBB7} - C:\Program Files\StumbleUpon\StumbleUponIEBar.dll
O2 - BHO: PBlockHelper Class - {4115122B-85FF-4DD3-9515-F075BEDE5EB5} - C:\Program Files\SlipStream Web Accelerator\PBHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O3 - Toolbar: StumbleUpon Toolbar - {5093EB4C-3E93-40AB-9266-B607BA87BDC8} - C:\Program Files\StumbleUpon\StumbleUponIEBar.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\system32\hkcmd.exe
O4 - HKLM\..\Run: [EPSON Stylus D68 Series] C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE /P23 "EPSON Stylus D68 Series" /O6 "USB001" /M "Stylus D68"
O4 - HKLM\..\Run: [EPSON Stylus D68 Series (Copy 1)] C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE /P32 "EPSON Stylus D68 Series (Copy 1)" /O6 "USB001" /M "Stylus D68"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SlipStream] "C:\Program Files\SlipStream Web Accelerator\slipcore.exe"
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [FLMK08KB] C:\Program Files\Muiltmedia keyboard utility\MMKEYBD.EXE
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [CoolSwitch] C:\WINNT\system32\taskswitch.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ScreenGif] a
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [EPSON Stylus D68 Series] C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE /P23 "EPSON Stylus D68 Series" /M "Stylus D68" /EF "HKCU"
O4 - HKCU\..\Run: [gStart] C:\Garmin\gStart.exe
O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [internat.exe] internat.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [internat.exe] internat.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [internat.exe] internat.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [internat.exe] internat.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')
O4 - Startup: DeskSweeper.lnk = C:\Program Files\DeskSweeper\DeskSweeper.exe
O4 - Global Startup: SiWake.lnk = C:\Program Files\Wireless LAN Utility\SiWake.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Exif Launcher 2.lnk = ?
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINNT\system32\GPhotos.scr/200
O8 - Extra context menu item: StumbleUpon: &Blog This - res://StumbleUponIEBar.dll/blogimage
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.tiscali.co.uk/
O15 - Trusted Zone: *.stumbleupon.com
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partne ... nicode.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {74FFE28D-2378-11D5-990C-006094235084} (IBM Access Support) - http://www-307.ibm.com/pc/support/IbmEgath.cab
O16 - DPF: {8BC53B30-32E4-4ED3-BEF9-DB761DB77453} (CInstallLPCtrl Object) - http://u3.sandisk.com/download/apps/LPInstaller.CAB
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O20 - Winlogon Notify: urqnkig - urqnkig.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\WINNT\system32\bgsvcgen.exe
O23 - Service: EPSON V3 Service2(03) (EPSON_PM_RPCV2_01) - SEIKO EPSON CORPORATION - C:\WINNT\system32\E_S00RP1.EXE
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: Franson GpsGate 2.0 - Unknown owner - C:\Program Files\Franson\GpsGate 2.0\GpsGateService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\VIRUSfighter\Nvc\BIN\nipsvc.exe (file missing)
O23 - Service: SmartLinkService (SLService) - - C:\WINNT\SYSTEM32\slserv.exe
O23 - Service: Epson Printer Status Agent4 (StatusAgent4) - SEIKO EPSON CORPORATION - C:\WINNT\system32\SAgent4.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINNT\system32\ZONELABS\vsmon.exe

--
End of file - 10582 bytes
dan12
March 15, 2008, 11:44 AM UTC
1. Close any open browsers.

2. Open notepad and copy/paste the text in the quotebox below into it:



    File::

C:\WINNT\system32\tmp.reg

C:\WINNT\system32\VCCLSID.exe

C:\WINNT\system32\SrchSTS.exe  

C:\WINNT\system32\VACFix.exe

C:\WINNT\system32\IEDFix.exe

C:\WINNT\system32\Process.exe

C:\WINNT\system32\dumphive.exe

C:\WINNT\system32\WS2Fix.exe

C:\WINNT\IFinst27.exe



   Registry::

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{27A82D47-9A2A-4B39-B4EC-792BBDFD03FA}]



[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\urqnkig]



[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ScreenGif"=-


Save this as CFScript.txt, in the same location as ComboFix.exe




Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at "C:\ComboFix.txt"

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

--------------------------------



: Malwarebytes' Anti-Malware :

Please download Malwarebytes' Anti-Malware to your desktop.

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to
    • Update Malwarebytes' Anti-Malware
    • and Launch Malwarebytes' Anti-Malware
  • then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform full scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected.
  • When completed, a log will open in Notepad. please copy and paste the log into your next reply
    • If you accidently close it, the log file is saved here and will be named like this:
    • C:\\Documents and Settings\\Username\\Application Data\\Malwarebytes\\Malwarebytes' Anti-Malware\\Logs\\mbam-log-date (time).txt



Please do an online scan with Kaspersky WebScanner. (You will need to use Internet Explorer to run this scan)

On the welcome screen, click Accept.

You will be promted to install an ActiveX component from Kaspersky, click Install.

  • The program will launch and then begin downloading the latest definition files.
  • Once the files have been downloaded click on Next.
  • Now click on Scan Settings.
  • In the scan settings make sure that the following are selected:


  • Scan using the following Anti-Virus database:

    Extended (if available, otherwise Standard)


  • Scan Options:

    Scan Archives
    Scan Mail Bases


  • Click OK.
  • Now under Select a Target to Scan:

    Select My Computer.


  • The program will start and scan your system.
  • The scan will take a while so be patient and let it run.
  • Once the scan is complete it will display if your system has been infected.
  • Now click on the Save as Text button and save the file to your desktop.


Please include in your next post:
  • Combofix log txt
  • Malwarebytes log
  • Kaspersky scan log
  • New highjackthis log


Thanks dan
ipplepen
March 15, 2008, 4:32 PM UTC
Thanks Dan - PC just finished doing as asked. Here it all is.....

ComboFix 08-03-14.4 - Andy 2008-03-15 12:28:39.2 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.182 [GMT 0:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Andy .HOME-J68SS7HK0H\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-02-15 to 2008-03-15 )))))))))))))))))))))))))))))))
.

2008-03-15 12:22 . 2008-03-15 12:22 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-03-15 12:22 . 2008-03-15 12:22 <DIR> d-------- C:\Documents and Settings\Andy .HOME-J68SS7HK0H\Application Data\Malwarebytes
2008-03-15 12:22 . 2008-03-15 12:22 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
2008-03-15 09:04 . 2008-03-15 09:04 <DIR> d-------- C:\ComboFix(2)
2008-03-14 21:30 . 2008-03-14 21:30 <DIR> d-------- C:\Program Files\Trend Micro
2008-03-13 18:08 . 2008-03-13 18:08 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab
2008-03-13 18:07 . 2008-03-13 18:08 <DIR> d-------- C:\WINNT\system32\Kaspersky Lab
2008-03-12 20:12 . 2008-03-12 20:25 3,674 --a------ C:\WINNT\system32\tmp.reg
2008-03-12 20:11 . 2007-09-05 23:22 289,144 --a------ C:\WINNT\system32\VCCLSID.exe
2008-03-12 20:11 . 2006-04-27 16:49 288,417 --a------ C:\WINNT\system32\SrchSTS.exe
2008-03-12 20:11 . 2008-03-09 01:15 86,528 --a------ C:\WINNT\system32\VACFix.exe
2008-03-12 20:11 . 2008-03-05 22:29 82,432 --a------ C:\WINNT\system32\IEDFix.exe
2008-03-12 20:11 . 2003-06-05 20:13 53,248 --a------ C:\WINNT\system32\Process.exe
2008-03-12 20:11 . 2004-07-31 17:50 51,200 --a------ C:\WINNT\system32\dumphive.exe
2008-03-12 20:11 . 2007-10-03 23:36 25,600 --a------ C:\WINNT\system32\WS2Fix.exe
2008-03-12 19:47 . 2008-03-12 19:47 <DIR> d-------- C:\Program Files\RogueRemover FREE
2008-03-12 19:28 . 2008-03-12 19:28 <DIR> d-------- C:\Program Files\Opera
2008-03-12 18:08 . 2008-03-12 18:00 691,545 --a------ C:\WINNT\unins000.exe
2008-03-12 18:08 . 2008-03-12 18:08 2,538 --a------ C:\WINNT\unins000.dat
2008-03-12 17:15 . 2008-03-12 17:15 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-03-12 17:15 . 2008-03-12 17:15 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
2008-03-10 22:52 . 2008-03-10 22:52 <DIR> d-------- C:\Program Files\Common Files\ColorPlaza
2008-03-05 15:55 . 2008-03-05 15:55 <DIR> d--hs---- C:\FOUND.000
2008-03-05 15:55 . 2008-03-15 09:20 335 --a------ C:\WINNT\system32\vsconfig.xml
2008-03-04 22:44 . 2008-03-04 22:44 54,156 --ah----- C:\WINNT\QTFont.qfn
2008-03-04 22:44 . 2008-03-04 22:44 1,409 --a------ C:\WINNT\QTFont.for
2008-03-03 18:33 . 2008-03-03 18:33 <DIR> d-------- C:\Program Files\Colormailer
2008-03-03 17:29 . 2008-03-03 17:29 <DIR> d-------- C:\Program Files\MyPhotoIndex

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-15 09:17 6,872 --sha-w C:\WINNT\system32\drivers\fidbox.idx
2008-03-15 09:17 407,584 --sha-w C:\WINNT\system32\drivers\fidbox.dat
2008-03-15 09:17 35,840 ------w C:\WINNT\Internet Logs\xDBC5.tmp
2008-03-14 08:57 32,256 ------w C:\WINNT\Internet Logs\xDBC4.tmp
2008-03-14 08:16 14,597,431 ------w C:\WINNT\Internet Logs\tvDebug.zip
2008-03-13 23:58 40,960 ------w C:\WINNT\Internet Logs\xDBC3.tmp
2008-03-12 23:52 33,792 ------w C:\WINNT\Internet Logs\xDBC2.tmp
2008-03-12 20:32 3,514,880 ------w C:\WINNT\Internet Logs\xDBC1.tmp
2008-03-12 20:06 55,808 ------w C:\WINNT\Internet Logs\xDBC0.tmp
2008-03-12 08:17 33,792 ------w C:\WINNT\Internet Logs\xDBBF.tmp
2008-03-11 23:09 3,484,672 ------w C:\WINNT\Internet Logs\xDBBE.tmp
2008-03-11 10:11 32,256 ------w C:\WINNT\Internet Logs\xDBBD.tmp
2008-03-11 00:10 45,056 ------w C:\WINNT\Internet Logs\xDBBC.tmp
2008-03-09 21:52 36,864 ------w C:\WINNT\Internet Logs\xDBBB.tmp
2008-03-09 14:34 3,467,264 ------w C:\WINNT\Internet Logs\xDBBA.tmp
2008-03-09 12:45 41,472 ------w C:\WINNT\Internet Logs\xDBB9.tmp
2008-03-08 17:50 48,128 ------w C:\WINNT\Internet Logs\xDBB8.tmp
2008-03-06 23:19 38,912 ------w C:\WINNT\Internet Logs\xDBB7.tmp
2008-03-06 11:19 31,232 ------w C:\WINNT\Internet Logs\xDBB6.tmp
2008-03-06 09:33 3,476,480 ------w C:\WINNT\Internet Logs\xDBB5.tmp
2008-03-05 22:53 38,912 ------w C:\WINNT\Internet Logs\xDBB4.tmp
2008-03-04 23:03 39,936 ------w C:\WINNT\Internet Logs\xDBB3.tmp
2008-03-03 22:36 86,016 ------w C:\WINNT\Internet Logs\xDBB2.tmp
2008-02-27 16:45 58,880 ------w C:\WINNT\Internet Logs\xDBB1.tmp
2008-02-23 23:18 48,640 ------w C:\WINNT\Internet Logs\xDBB0.tmp
2008-02-20 22:55 42,496 ------w C:\WINNT\Internet Logs\xDBAF.tmp
2008-02-18 21:52 56,320 ------w C:\WINNT\Internet Logs\xDBAE.tmp
2008-02-13 23:57 32,768 ------w C:\WINNT\Internet Logs\xDBAD.tmp
2008-02-13 18:06 33,792 ------w C:\WINNT\Internet Logs\xDBAC.tmp
2008-02-13 17:54 --------- d-----w C:\Program Files\Animated ScreenGif
2008-02-13 13:44 33,792 ------w C:\WINNT\Internet Logs\xDBAB.tmp
2008-02-13 09:27 31,232 ------w C:\WINNT\Internet Logs\xDBAA.tmp
2008-02-12 22:54 36,864 ------w C:\WINNT\Internet Logs\xDBA9.tmp
2008-02-11 23:09 40,448 ------w C:\WINNT\Internet Logs\xDBA8.tmp
2008-02-10 23:25 73,728 ------w C:\WINNT\Internet Logs\xDBA7.tmp
2008-02-07 23:00 35,840 ------w C:\WINNT\Internet Logs\xDBA6.tmp
2008-02-06 22:40 40,448 ------w C:\WINNT\Internet Logs\xDBA5.tmp
2008-02-05 22:54 84,480 ------w C:\WINNT\Internet Logs\xDBA4.tmp
2008-02-01 23:25 36,864 ------w C:\WINNT\Internet Logs\xDBA3.tmp
2008-01-31 22:33 37,888 ------w C:\WINNT\Internet Logs\xDBA2.tmp
2008-01-31 22:12 --------- d-----w C:\Program Files\Belarc
2008-01-30 22:47 47,104 ------w C:\WINNT\Internet Logs\xDBA1.tmp
2008-01-30 22:41 --------- d-----w C:\Program Files\Common Files\SWF Studio
2008-01-30 22:40 --------- d-----w C:\Program Files\bootAmp
2008-01-29 22:31 49,152 ------w C:\WINNT\Internet Logs\xDBA0.tmp
2008-01-28 15:17 39,424 ------w C:\WINNT\Internet Logs\xDB9F.tmp
2008-01-27 21:55 61,440 ------w C:\WINNT\Internet Logs\xDB9E.tmp
2008-01-26 12:36 --------- d-----w C:\Program Files\Kontiki
2008-01-26 00:48 34,816 ------w C:\WINNT\Internet Logs\xDB9D.tmp
2008-01-25 17:04 41,472 ------w C:\WINNT\Internet Logs\xDB9C.tmp
2008-01-24 11:51 32,256 ------w C:\WINNT\Internet Logs\xDB9B.tmp
2008-01-24 11:17 70,656 ------w C:\WINNT\Internet Logs\xDB9A.tmp
2008-01-20 20:51 --------- d-----w C:\Documents and Settings\Andy .HOME-J68SS7HK0H\Application Data\stickies
2008-01-20 20:50 --------- d-----w C:\Program Files\Stickies
2008-01-20 12:15 --------- d-----w C:\Program Files\Software by Design
2008-01-19 22:55 39,936 ------w C:\WINNT\Internet Logs\xDB99.tmp
2008-01-19 22:18 796,672 ----a-w C:\WINNT\GPInstall.exe
2008-01-19 22:18 --------- d-----w C:\Program Files\Aardvark
2008-01-19 21:28 86,016 ------w C:\WINNT\Internet Logs\xDB98.tmp
2008-01-19 21:18 --------- d-----w C:\Program Files\Shock Utility
2008-01-19 21:17 65,536 ----a-w C:\WINNT\IFinst27.exe
2008-01-19 20:55 --------- d-----w C:\Program Files\BellCraft.com
2008-01-19 20:32 --------- d-----w C:\Program Files\ClocX
2008-01-19 20:16 --------- d-----w C:\Program Files\DeskSweeper
2008-01-19 13:12 50,176 ------w C:\WINNT\Internet Logs\xDB97.tmp
2008-01-18 21:04 75,776 ------w C:\WINNT\Internet Logs\xDB96.tmp
2008-01-17 22:57 365,568 ------w C:\WINNT\Internet Logs\xDB95.tmp
2008-01-16 19:43 3,318,784 ------w C:\WINNT\Internet Logs\xDB94.tmp
2008-01-16 19:39 --------- d-----w C:\Program Files\Thoosje
2008-01-15 23:06 3,321,344 ------w C:\WINNT\Internet Logs\xDB93.tmp
2008-01-15 21:42 --------- d-----w C:\Documents and Settings\Andy .HOME-J68SS7HK0H\Application Data\Desktop Sidebar
2008-01-15 16:52 606,208 ------w C:\WINNT\Internet Logs\xDB92.tmp
2008-01-15 16:41 --------- d-----w C:\Program Files\RocketDock
2008-01-13 16:39 2,355,813 ----a-w C:\WINNT\system32\qt3A.tmp
2008-01-13 15:42 2,378,297 ----a-w C:\WINNT\system32\qt1A.tmp
2008-01-12 22:21 260,608 ------w C:\WINNT\Internet Logs\xDB91.tmp
2008-01-11 23:51 273,920 ------w C:\WINNT\Internet Logs\xDB90.tmp
2008-01-11 05:53 44,544 ----a-w C:\WINNT\system32\dllcache\pngfilt.dll
2008-01-10 23:00 248,832 ------w C:\WINNT\Internet Logs\xDB8F.tmp
2008-01-09 23:26 1,079,808 ------w C:\WINNT\Internet Logs\xDB8E.tmp
2008-01-07 18:20 686,080 ------w C:\WINNT\Internet Logs\xDB8D.tmp
2008-01-05 18:24 3,240,448 ------w C:\WINNT\Internet Logs\xDB8C.tmp
2008-01-05 18:24 1,409,024 ------w C:\WINNT\Internet Logs\xDB8B.tmp
2008-01-03 21:48 1,523,200 ------w C:\WINNT\Internet Logs\xDB8A.tmp
2008-01-01 00:49 471,040 ------w C:\WINNT\Internet Logs\xDB89.tmp
2007-12-30 23:08 513,024 ------w C:\WINNT\Internet Logs\xDB88.tmp
2007-12-28 23:39 273,920 ------w C:\WINNT\Internet Logs\xDB87.tmp
2007-12-27 23:53 266,240 ------w C:\WINNT\Internet Logs\xDB86.tmp
2007-12-26 22:51 464,384 ------w C:\WINNT\Internet Logs\xDB85.tmp
2007-12-24 21:37 691,200 ------w C:\WINNT\Internet Logs\xDB84.tmp
2007-12-22 23:32 640,512 ------w C:\WINNT\Internet Logs\xDB83.tmp
2007-12-21 19:15 644,096 ------w C:\WINNT\Internet Logs\xDB81.tmp
2007-12-21 19:15 3,217,920 ------w C:\WINNT\Internet Logs\xDB82.tmp
2007-12-19 23:01 347,136 ----a-w C:\WINNT\system32\dllcache\dxtmsft.dll
2007-12-19 22:35 880,640 ------w C:\WINNT\Internet Logs\xDB80.tmp
2007-12-18 09:51 179,584 ------w C:\WINNT\system32\dllcache\mrxdav.sys
2007-12-18 06:18 3,213,824 ------w C:\WINNT\Internet Logs\xDB7F.tmp
2007-12-18 06:18 1,233,920 ------w C:\WINNT\Internet Logs\xDB7E.tmp
2007-12-10 11:51 37,376 ------w C:\WINNT\Internet Logs\xDB7D.tmp
2007-12-09 17:57 37,376 ------w C:\WINNT\Internet Logs\xDB7C.tmp
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24 1694208]
"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe" [2006-06-26 16:13 1207080]
"EPSON Stylus D68 Series"="C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.exe" [2005-01-25 06:00 98304]
"gStart"="C:\Garmin\gStart.exe" [2007-03-04 23:08 1891416]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-10-23 21:18 443968]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Synchronization Manager"="mobsync.exe" [2004-08-04 00:56 143360 C:\WINNT\system32\mobsync.exe]
"IgfxTray"="C:\WINNT\system32\igfxtray.exe" [2004-11-02 09:03 155648]
"HotKeysCmds"="C:\WINNT\system32\hkcmd.exe" [2004-11-02 08:59 126976]
"EPSON Stylus D68 Series"="C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.exe" [2005-01-25 06:00 98304]
"EPSON Stylus D68 Series (Copy 1)"="C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.exe" [2005-01-25 06:00 98304]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [2007-12-21 11:19 579072]
"SlipStream"="C:\Program Files\SlipStream Web Accelerator\slipcore.exe" [2006-03-23 11:03 258048]
"zBrowser Launcher"="C:\Program Files\Logitech\iTouch\iTouch.exe" [2002-11-23 02:15 631362]
"MMTray"="C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe" [2002-05-20 19:36 90112]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 00:56 110592 C:\WINNT\system32\bthprops.cpl]
"FLMK08KB"="C:\Program Files\Muiltmedia keyboard utility\MMKEYBD.EXE" [2007-09-20 20:06 207360]
"REGSHAVE"="C:\Program Files\REGSHAVE\REGSHAVE.exe" [2002-02-04 22:32 53248]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-11-14 16:05 919016]
"CoolSwitch"="C:\WINNT\system32\taskswitch.exe" [2002-03-19 17:30 45632]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24 286720]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"internat.exe"="internat.exe" [1999-12-07 17:00 20752 C:\WINNT\system32\internat.exe]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe" [2007-10-24 09:27 219136]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-10-23 21:18 443968]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"tscuninstall"="C:\WINNT\system32\tscupgrd.exe" [2004-08-03 22:59 44544]

C:\Documents and Settings\Andy .HOME-J68SS7HK0H\Start Menu\Programs\Startup\
DeskSweeper.lnk - C:\Program Files\DeskSweeper\DeskSweeper.exe [1999-03-09 236032]

C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\Startup\
SiWake.lnk - C:\Program Files\Wireless LAN Utility\SiWake.exe [2006-07-20 16:52:32 135168]
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26 29696]
Exif Launcher 2.lnk - C:\Program Files\FinePixViewer\QuickDCF2.exe [2007-10-24 18:34:35 294912]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R1 bizVSerial;Franson VSerial;C:\WINNT\system32\drivers\bizVSerialNT.sys [2006-04-03 21:00]
R1 Ext2fs;Ext2fs;C:\WINNT\system32\DRIVERS\ext2fs.sys [2006-10-23 18:20]
R1 IfsDrives;IfsDrives;C:\WINNT\system32\DRIVERS\IfsDrives.sys [2004-09-25 00:28]
R3 HCWBT8XX;Hauppauge WinTV 848/9 WDM Video Driver;C:\WINNT\system32\drivers\HCWBT8XX.sys [2006-01-25 16:14]
R3 LCcfltr;Logitech USB Filter Driver;C:\WINNT\system32\drivers\lccfltr.sys [2002-11-08 09:50]
S3 Franson GpsGate 2.0;Franson GpsGate 2.0;C:\Program Files\Franson\GpsGate 2.0\GpsGateService.exe [2006-12-01 19:00]
S3 LucentSoftModem;Lucent Technologies Soft Modem;C:\WINNT\system32\DRIVERS\LTSM.sys [2001-08-17 13:28]
S3 V90drv;v90drv;C:\WINNT\system32\DRIVERS\v90drv.sys [2001-11-29 16:10]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\Shell\AutoRun\command - E:\PortableApps\PortableAppsMenu\PortableAppsMenu.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2467094c-2346-11dc-95ec-00096b7d5e1b}]
\Shell\AutoRun\command - E:\PortableApps\PortableAppsMenu\PortableAppsMenu.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{44e851c6-1d6b-11db-9890-00096b7d5e1b}]
\Shell\AutoRun\command - E:\setupSNK.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{99f70218-ef0a-11db-9558-00096b7d5e1b}]
\Shell\AutoRun\command - PortableApps\PortableAppsMenu\PortableAppsMenu.exe

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-15 12:32:38
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-03-15 12:34:36
ComboFix-quarantined-files.txt 2008-03-15 12:34:28
ComboFix2.txt 2008-03-15 09:22:56
.
2008-03-13 08:04:14 --- E O F ---





Malwarebytes' Anti-Malware 1.08
Database version: 493

Scan type: Full Scan (A:\|C:\|E:\|X:\|Y:\|Z:\|)
Objects scanned: 224327
Time elapsed: 52 minute(s), 16 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Saturday, March 15, 2008 4:27:25 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 15/03/2008
Kaspersky Anti-Virus database records: 631406
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\
X:\
Y:\
Z:\

Scan Statistics:
Total number of scanned objects: 183561
Number of viruses found: 5
Number of infected objects: 14
Number of suspicious objects: 0
Duration of the scan process: 02:47:07

Infected Object Name / Virus Name / Last Action
C:\WINNT\system32\config\system.LOG Object is locked skipped
C:\WINNT\system32\config\software.LOG Object is locked skipped
C:\WINNT\system32\config\default.LOG Object is locked skipped
C:\WINNT\system32\config\SECURITY.LOG Object is locked skipped
C:\WINNT\system32\config\SAM.LOG Object is locked skipped
C:\WINNT\system32\config\AppEvent.Evt Object is locked skipped
C:\WINNT\system32\config\SecEvent.Evt Object is locked skipped
C:\WINNT\system32\config\SysEvent.Evt Object is locked skipped
C:\WINNT\system32\config\Internet.evt Object is locked skipped
C:\WINNT\system32\config\SECURITY Object is locked skipped
C:\WINNT\system32\config\SOFTWARE Object is locked skipped
C:\WINNT\system32\config\SYSTEM Object is locked skipped
C:\WINNT\system32\config\DEFAULT Object is locked skipped
C:\WINNT\system32\config\SAM Object is locked skipped
C:\WINNT\system32\drivers\fidbox.dat Object is locked skipped
C:\WINNT\system32\drivers\fidbox.idx Object is locked skipped
C:\WINNT\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINNT\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINNT\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINNT\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINNT\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINNT\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINNT\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINNT\system32\CatRoot2\edb.log Object is locked skipped
C:\WINNT\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINNT\system32\h323log.txt Object is locked skipped
C:\WINNT\Temp\ZLT038f2.TMP Object is locked skipped
C:\WINNT\Temp\ZLT038fc.TMP Object is locked skipped
C:\WINNT\Debug\PASSWD.LOG Object is locked skipped
C:\WINNT\SchedLgU.Txt Object is locked skipped
C:\WINNT\Sti_Trace.log Object is locked skipped
C:\WINNT\wiaservc.log Object is locked skipped
C:\WINNT\wiadebug.log Object is locked skipped
C:\WINNT\WindowsUpdate.log Object is locked skipped
C:\WINNT\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINNT\Internet Logs\fwpktlog.txt Object is locked skipped
C:\WINNT\Internet Logs\IBM.ldb Object is locked skipped
C:\WINNT\Internet Logs\IAMDB.RDB Object is locked skipped
C:\WINNT\Internet Logs\fwdbglog.txt Object is locked skipped
C:\WINNT\Internet Logs\tvDebug.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped
C:\Documents and Settings\Andy .HOME-J68SS7HK0H\ntuser.dat Object is locked skipped
C:\Documents and Settings\Andy .HOME-J68SS7HK0H\Local Settings\Temp\WCESLog.log Object is locked skipped
C:\Documents and Settings\Andy .HOME-J68SS7HK0H\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Andy .HOME-J68SS7HK0H\Local Settings\History\History.IE5\MSHist012008031520080316\index.dat Object is locked skipped
C:\Documents and Settings\Andy .HOME-J68SS7HK0H\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Andy .HOME-J68SS7HK0H\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
C:\Documents and Settings\Andy .HOME-J68SS7HK0H\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Andy .HOME-J68SS7HK0H\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Andy .HOME-J68SS7HK0H\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped
C:\Documents and Settings\Andy .HOME-J68SS7HK0H\Local Settings\Application Data\Identities\{F2578160-F065-4B43-A0BF-FB7B717432D6}\Microsoft\Outlook Express\Hotmail - Deleted Items.dbx/[From M:e:d Source <[removed]>][Date Thu, 27 Jul 2006 13:28:10 -0800]/PLEASE_VISIT_OUR_MEDSITE_HERE.html Infected: Trojan.JS.Redirector.b skipped
C:\Documents and Settings\Andy .HOME-J68SS7HK0H\Local Settings\Application Data\Identities\{F2578160-F065-4B43-A0BF-FB7B717432D6}\Microsoft\Outlook Express\Hotmail - Deleted Items.dbx Mail MS Outlook 5: infected - 1 skipped
C:\Documents and Settings\Andy .HOME-J68SS7HK0H\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Andy .HOME-J68SS7HK0H\Application Data\$_hpcst$.hpc Object is locked skipped
C:\Documents and Settings\Andy .HOME-J68SS7HK0H\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Andy .HOME-J68SS7HK0H\UserData\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat Object is locked skipped
C:\System Volume Information\_restore{5008BB72-D7D3-46B1-B613-F92FB2652DB1}\RP549\A0093676.exe/data.rar/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\System Volume Information\_restore{5008BB72-D7D3-46B1-B613-F92FB2652DB1}\RP549\A0093676.exe/data.rar Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\System Volume Information\_restore{5008BB72-D7D3-46B1-B613-F92FB2652DB1}\RP549\A0093676.exe RarSFX: infected - 2 skipped
C:\System Volume Information\_restore{5008BB72-D7D3-46B1-B613-F92FB2652DB1}\RP549\A0093683.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\System Volume Information\_restore{5008BB72-D7D3-46B1-B613-F92FB2652DB1}\RP550\A0093750.exe Infected: Trojan-Proxy.Win32.Horst.zc skipped
C:\System Volume Information\_restore{5008BB72-D7D3-46B1-B613-F92FB2652DB1}\RP550\A0095748.DLL Object is locked skipped
C:\System Volume Information\_restore{5008BB72-D7D3-46B1-B613-F92FB2652DB1}\RP550\A0095755.dll Object is locked skipped
C:\System Volume Information\_restore{5008BB72-D7D3-46B1-B613-F92FB2652DB1}\RP551\A0095862.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{5008BB72-D7D3-46B1-B613-F92FB2652DB1}\RP551\A0095863.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{5008BB72-D7D3-46B1-B613-F92FB2652DB1}\RP552\change.log Object is locked skipped
C:\QooBox\Quarantine\C\WINNT\system32\eueycdco.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINNT\system32\kjlqkctm.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\catchme2008-03-15_ 91910.39.zip/urqnkig.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jwy skipped
C:\QooBox\Quarantine\catchme2008-03-15_ 91910.39.zip/vtsqr.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\catchme2008-03-15_ 91910.39.zip ZIP: infected - 2 skipped
E:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
Y:\usr\lib\Adobe\Acrobat7.0\Reader\HowTo\ENU\images Object is locked skipped
Z:\andyk\.gdesklets\displays Object is locked skipped

Scan process completed.





Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:29:12, on 15/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\ZONELABS\vsmon.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\igfxtray.exe
C:\WINNT\system32\hkcmd.exe
C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE
C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE
C:\Program Files\SlipStream Web Accelerator\slipcore.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\WINNT\system32\rundll32.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINNT\system32\taskswitch.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Garmin\gStart.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Wireless LAN Utility\SiWake.exe
C:\Program Files\FinePixViewer\QuickDCF2.exe
C:\Program Files\DeskSweeper\DeskSweeper.exe
C:\Program Files\Muiltmedia keyboard utility\KbdAp32A.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINNT\system32\bgsvcgen.exe
C:\WINNT\system32\E_S00RP1.EXE
C:\WINNT\system32\SAgent4.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\ctfmon.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\explorer.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Trend Micro\HijackThis\removal.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.msn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: StumbleUpon Launcher - {145B29F4-A56B-4b90-BBAC-45784EBEBBB7} - C:\Program Files\StumbleUpon\StumbleUponIEBar.dll
O2 - BHO: PBlockHelper Class - {4115122B-85FF-4DD3-9515-F075BEDE5EB5} - C:\Program Files\SlipStream Web Accelerator\PBHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O3 - Toolbar: StumbleUpon Toolbar - {5093EB4C-3E93-40AB-9266-B607BA87BDC8} - C:\Program Files\StumbleUpon\StumbleUponIEBar.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\system32\hkcmd.exe
O4 - HKLM\..\Run: [EPSON Stylus D68 Series] C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE /P23 "EPSON Stylus D68 Series" /O6 "USB001" /M "Stylus D68"
O4 - HKLM\..\Run: [EPSON Stylus D68 Series (Copy 1)] C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE /P32 "EPSON Stylus D68 Series (Copy 1)" /O6 "USB001" /M "Stylus D68"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SlipStream] "C:\Program Files\SlipStream Web Accelerator\slipcore.exe"
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [FLMK08KB] C:\Program Files\Muiltmedia keyboard utility\MMKEYBD.EXE
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [CoolSwitch] C:\WINNT\system32\taskswitch.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ScreenGif] a
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [EPSON Stylus D68 Series] C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE /P23 "EPSON Stylus D68 Series" /M "Stylus D68" /EF "HKCU"
O4 - HKCU\..\Run: [gStart] C:\Garmin\gStart.exe
O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [internat.exe] internat.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [internat.exe] internat.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [internat.exe] internat.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [internat.exe] internat.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')
O4 - Startup: DeskSweeper.lnk = C:\Program Files\DeskSweeper\DeskSweeper.exe
O4 - Global Startup: SiWake.lnk = C:\Program Files\Wireless LAN Utility\SiWake.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Exif Launcher 2.lnk = ?
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINNT\system32\GPhotos.scr/200
O8 - Extra context menu item: StumbleUpon: &Blog This - res://StumbleUponIEBar.dll/blogimage
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.tiscali.co.uk/
O15 - Trusted Zone: *.stumbleupon.com
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partne ... nicode.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {74FFE28D-2378-11D5-990C-006094235084} (IBM Access Support) - http://www-307.ibm.com/pc/support/IbmEgath.cab
O16 - DPF: {8BC53B30-32E4-4ED3-BEF9-DB761DB77453} (CInstallLPCtrl Object) - http://u3.sandisk.com/download/apps/LPInstaller.CAB
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O20 - Winlogon Notify: urqnkig - C:\WINNT\
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\WINNT\system32\bgsvcgen.exe
O23 - Service: EPSON V3 Service2(03) (EPSON_PM_RPCV2_01) - SEIKO EPSON CORPORATION - C:\WINNT\system32\E_S00RP1.EXE
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: Franson GpsGate 2.0 - Unknown owner - C:\Program Files\Franson\GpsGate 2.0\GpsGateService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\VIRUSfighter\Nvc\BIN\nipsvc.exe (file missing)
O23 - Service: SmartLinkService (SLService) - - C:\WINNT\SYSTEM32\slserv.exe
O23 - Service: Epson Printer Status Agent4 (StatusAgent4) - SEIKO EPSON CORPORATION - C:\WINNT\system32\SAgent4.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINNT\system32\ZONELABS\vsmon.exe

--
End of file - 10423 bytes
dan12
March 15, 2008, 5:31 PM UTC
Firstly did you have norman A\V at some point, have you uninstalled it?

Delete contents of outlook express folder namely this mail:[From M:e:d Source <[removed]>][Date Thu, 27 Jul 2006 13:28:10 -0800]

I'd like to diable these programs as I believe interfering with fix. We will reinstate when clean. however your ewido is out of date.

(We can enable when clean)
  • Open Ewido
  • Click Guard
  • Click under "resident shield is"
  • Change it to inactive
  • Close Ewido


TeaTimer

1) Run Spybot-S&D
2) Go to the Mode menu, and make sure "Advanced Mode" is selected
3) On the left hand side, choose Tools -> Resident
4) Uncheck "Resident TeaTimer" and OK any prompts
5) Restart your computer.


----------------------------------

Run HijackThis, select Do a system scan only and place checks against the following entries (if they are still present)

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
O4 - HKLM\..\Run: [ScreenGif] a
O15 - Trusted Zone: *.stumbleupon.com
O20 - Winlogon Notify: urqnkig - C:\WINNT\


WITH ALL OTHER WINDOWS CLOSED Click on Fix Checked and exit


Can you run the cf script I gave you as it's not carried out the deletions I wanted, I think the malware programs are blocking it.

-------------------------------


Your Java is out of date Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older version Java components and update.

Updating Java:
  • Download the latest version of [url=http://java.sun.com/javase/downloads/index.jsp:2p88gctg]Java Runtime Environment (JRE) 6 Update 5.
  • Scroll down to where it says " Java Runtime Environment (JRE) 6 Update 5".
  • Click the "Download" button to the right.
  • Check the box that says: "Accept License Agreement".
  • The page will refresh.
  • Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
  • Check any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on the download to install the newest version.


Please include in your next post:
  • Combofix log txt
  • New highjackthis log


Thanks dan
ipplepen
March 15, 2008, 7:10 PM UTC
Hi Dan

I don't recall ever hearing of norman A/V - so I don't think it's been on my machine.

Ewido is the free version - so the resident shield is not operational according to its menu.

Teatimer has been unchecked.

Entries were all still present, have been checked and hopefully fixed.

Here are the latest logs:

ComboFix 08-03-14.4 - Andy 2008-03-15 18:52:08.3 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.159 [GMT 0:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Andy .HOME-J68SS7HK0H\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-02-15 to 2008-03-15 )))))))))))))))))))))))))))))))
.

2008-03-15 12:22 . 2008-03-15 12:22 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-03-15 12:22 . 2008-03-15 12:22 <DIR> d-------- C:\Documents and Settings\Andy .HOME-J68SS7HK0H\Application Data\Malwarebytes
2008-03-15 12:22 . 2008-03-15 12:22 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
2008-03-15 09:04 . 2008-03-15 09:04 <DIR> d-------- C:\ComboFix(2)
2008-03-14 21:30 . 2008-03-14 21:30 <DIR> d-------- C:\Program Files\Trend Micro
2008-03-13 18:08 . 2008-03-13 18:08 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab
2008-03-13 18:07 . 2008-03-13 18:08 <DIR> d-------- C:\WINNT\system32\Kaspersky Lab
2008-03-12 20:12 . 2008-03-12 20:25 3,674 --a------ C:\WINNT\system32\tmp.reg
2008-03-12 20:11 . 2007-09-05 23:22 289,144 --a------ C:\WINNT\system32\VCCLSID.exe
2008-03-12 20:11 . 2006-04-27 16:49 288,417 --a------ C:\WINNT\system32\SrchSTS.exe
2008-03-12 20:11 . 2008-03-09 01:15 86,528 --a------ C:\WINNT\system32\VACFix.exe
2008-03-12 20:11 . 2008-03-05 22:29 82,432 --a------ C:\WINNT\system32\IEDFix.exe
2008-03-12 20:11 . 2003-06-05 20:13 53,248 --a------ C:\WINNT\system32\Process.exe
2008-03-12 20:11 . 2004-07-31 17:50 51,200 --a------ C:\WINNT\system32\dumphive.exe
2008-03-12 20:11 . 2007-10-03 23:36 25,600 --a------ C:\WINNT\system32\WS2Fix.exe
2008-03-12 19:47 . 2008-03-12 19:47 <DIR> d-------- C:\Program Files\RogueRemover FREE
2008-03-12 19:28 . 2008-03-12 19:28 <DIR> d-------- C:\Program Files\Opera
2008-03-12 18:08 . 2008-03-12 18:00 691,545 --a------ C:\WINNT\unins000.exe
2008-03-12 18:08 . 2008-03-12 18:08 2,538 --a------ C:\WINNT\unins000.dat
2008-03-12 17:15 . 2008-03-12 17:15 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-03-12 17:15 . 2008-03-12 17:15 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
2008-03-10 22:52 . 2008-03-10 22:52 <DIR> d-------- C:\Program Files\Common Files\ColorPlaza
2008-03-05 15:55 . 2008-03-05 15:55 <DIR> d--hs---- C:\FOUND.000
2008-03-05 15:55 . 2008-03-15 18:42 335 --a------ C:\WINNT\system32\vsconfig.xml
2008-03-04 22:44 . 2008-03-04 22:44 54,156 --ah----- C:\WINNT\QTFont.qfn
2008-03-04 22:44 . 2008-03-04 22:44 1,409 --a------ C:\WINNT\QTFont.for
2008-03-03 18:33 . 2008-03-03 18:33 <DIR> d-------- C:\Program Files\Colormailer
2008-03-03 17:29 . 2008-03-03 17:29 <DIR> d-------- C:\Program Files\MyPhotoIndex

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-15 18:40 6,896 --sha-w C:\WINNT\system32\drivers\fidbox.idx
2008-03-15 18:40 409,632 --sha-w C:\WINNT\system32\drivers\fidbox.dat
2008-03-15 18:40 37,888 ------w C:\WINNT\Internet Logs\xDBC6.tmp
2008-03-15 09:17 35,840 ------w C:\WINNT\Internet Logs\xDBC5.tmp
2008-03-14 08:57 32,256 ------w C:\WINNT\Internet Logs\xDBC4.tmp
2008-03-14 08:16 14,597,431 ------w C:\WINNT\Internet Logs\tvDebug.zip
2008-03-13 23:58 40,960 ------w C:\WINNT\Internet Logs\xDBC3.tmp
2008-03-12 23:52 33,792 ------w C:\WINNT\Internet Logs\xDBC2.tmp
2008-03-12 20:32 3,514,880 ------w C:\WINNT\Internet Logs\xDBC1.tmp
2008-03-12 20:06 55,808 ------w C:\WINNT\Internet Logs\xDBC0.tmp
2008-03-12 08:17 33,792 ------w C:\WINNT\Internet Logs\xDBBF.tmp
2008-03-11 23:09 3,484,672 ------w C:\WINNT\Internet Logs\xDBBE.tmp
2008-03-11 10:11 32,256 ------w C:\WINNT\Internet Logs\xDBBD.tmp
2008-03-11 00:10 45,056 ------w C:\WINNT\Internet Logs\xDBBC.tmp
2008-03-09 21:52 36,864 ------w C:\WINNT\Internet Logs\xDBBB.tmp
2008-03-09 14:34 3,467,264 ------w C:\WINNT\Internet Logs\xDBBA.tmp
2008-03-09 12:45 41,472 ------w C:\WINNT\Internet Logs\xDBB9.tmp
2008-03-08 17:50 48,128 ------w C:\WINNT\Internet Logs\xDBB8.tmp
2008-03-06 23:19 38,912 ------w C:\WINNT\Internet Logs\xDBB7.tmp
2008-03-06 11:19 31,232 ------w C:\WINNT\Internet Logs\xDBB6.tmp
2008-03-06 09:33 3,476,480 ------w C:\WINNT\Internet Logs\xDBB5.tmp
2008-03-05 22:53 38,912 ------w C:\WINNT\Internet Logs\xDBB4.tmp
2008-03-04 23:03 39,936 ------w C:\WINNT\Internet Logs\xDBB3.tmp
2008-03-03 22:36 86,016 ------w C:\WINNT\Internet Logs\xDBB2.tmp
2008-02-27 16:45 58,880 ------w C:\WINNT\Internet Logs\xDBB1.tmp
2008-02-23 23:18 48,640 ------w C:\WINNT\Internet Logs\xDBB0.tmp
2008-02-20 22:55 42,496 ------w C:\WINNT\Internet Logs\xDBAF.tmp
2008-02-18 21:52 56,320 ------w C:\WINNT\Internet Logs\xDBAE.tmp
2008-02-13 23:57 32,768 ------w C:\WINNT\Internet Logs\xDBAD.tmp
2008-02-13 18:06 33,792 ------w C:\WINNT\Internet Logs\xDBAC.tmp
2008-02-13 17:54 --------- d-----w C:\Program Files\Animated ScreenGif
2008-02-13 13:44 33,792 ------w C:\WINNT\Internet Logs\xDBAB.tmp
2008-02-13 09:27 31,232 ------w C:\WINNT\Internet Logs\xDBAA.tmp
2008-02-12 22:54 36,864 ------w C:\WINNT\Internet Logs\xDBA9.tmp
2008-02-11 23:09 40,448 ------w C:\WINNT\Internet Logs\xDBA8.tmp
2008-02-10 23:25 73,728 ------w C:\WINNT\Internet Logs\xDBA7.tmp
2008-02-07 23:00 35,840 ------w C:\WINNT\Internet Logs\xDBA6.tmp
2008-02-06 22:40 40,448 ------w C:\WINNT\Internet Logs\xDBA5.tmp
2008-02-05 22:54 84,480 ------w C:\WINNT\Internet Logs\xDBA4.tmp
2008-02-01 23:25 36,864 ------w C:\WINNT\Internet Logs\xDBA3.tmp
2008-01-31 22:33 37,888 ------w C:\WINNT\Internet Logs\xDBA2.tmp
2008-01-31 22:12 --------- d-----w C:\Program Files\Belarc
2008-01-30 22:47 47,104 ------w C:\WINNT\Internet Logs\xDBA1.tmp
2008-01-30 22:41 --------- d-----w C:\Program Files\Common Files\SWF Studio
2008-01-30 22:40 --------- d-----w C:\Program Files\bootAmp
2008-01-29 22:31 49,152 ------w C:\WINNT\Internet Logs\xDBA0.tmp
2008-01-28 15:17 39,424 ------w C:\WINNT\Internet Logs\xDB9F.tmp
2008-01-27 21:55 61,440 ------w C:\WINNT\Internet Logs\xDB9E.tmp
2008-01-26 12:36 --------- d-----w C:\Program Files\Kontiki
2008-01-26 00:48 34,816 ------w C:\WINNT\Internet Logs\xDB9D.tmp
2008-01-25 17:04 41,472 ------w C:\WINNT\Internet Logs\xDB9C.tmp
2008-01-24 11:51 32,256 ------w C:\WINNT\Internet Logs\xDB9B.tmp
2008-01-24 11:17 70,656 ------w C:\WINNT\Internet Logs\xDB9A.tmp
2008-01-20 20:51 --------- d-----w C:\Documents and Settings\Andy .HOME-J68SS7HK0H\Application Data\stickies
2008-01-20 20:50 --------- d-----w C:\Program Files\Stickies
2008-01-20 12:15 --------- d-----w C:\Program Files\Software by Design
2008-01-19 22:55 39,936 ------w C:\WINNT\Internet Logs\xDB99.tmp
2008-01-19 22:18 796,672 ----a-w C:\WINNT\GPInstall.exe
2008-01-19 22:18 --------- d-----w C:\Program Files\Aardvark
2008-01-19 21:28 86,016 ------w C:\WINNT\Internet Logs\xDB98.tmp
2008-01-19 21:18 --------- d-----w C:\Program Files\Shock Utility
2008-01-19 21:17 65,536 ----a-w C:\WINNT\IFinst27.exe
2008-01-19 20:55 --------- d-----w C:\Program Files\BellCraft.com
2008-01-19 20:32 --------- d-----w C:\Program Files\ClocX
2008-01-19 20:16 --------- d-----w C:\Program Files\DeskSweeper
2008-01-19 13:12 50,176 ------w C:\WINNT\Internet Logs\xDB97.tmp
2008-01-18 21:04 75,776 ------w C:\WINNT\Internet Logs\xDB96.tmp
2008-01-17 22:57 365,568 ------w C:\WINNT\Internet Logs\xDB95.tmp
2008-01-16 19:43 3,318,784 ------w C:\WINNT\Internet Logs\xDB94.tmp
2008-01-16 19:39 --------- d-----w C:\Program Files\Thoosje
2008-01-15 23:06 3,321,344 ------w C:\WINNT\Internet Logs\xDB93.tmp
2008-01-15 21:42 --------- d-----w C:\Documents and Settings\Andy .HOME-J68SS7HK0H\Application Data\Desktop Sidebar
2008-01-15 16:52 606,208 ------w C:\WINNT\Internet Logs\xDB92.tmp
2008-01-15 16:41 --------- d-----w C:\Program Files\RocketDock
2008-01-13 16:39 2,355,813 ----a-w C:\WINNT\system32\qt3A.tmp
2008-01-13 15:42 2,378,297 ----a-w C:\WINNT\system32\qt1A.tmp
2008-01-12 22:21 260,608 ------w C:\WINNT\Internet Logs\xDB91.tmp
2008-01-11 23:51 273,920 ------w C:\WINNT\Internet Logs\xDB90.tmp
2008-01-11 05:53 44,544 ----a-w C:\WINNT\system32\dllcache\pngfilt.dll
2008-01-10 23:00 248,832 ------w C:\WINNT\Internet Logs\xDB8F.tmp
2008-01-09 23:26 1,079,808 ------w C:\WINNT\Internet Logs\xDB8E.tmp
2008-01-07 18:20 686,080 ------w C:\WINNT\Internet Logs\xDB8D.tmp
2008-01-05 18:24 3,240,448 ------w C:\WINNT\Internet Logs\xDB8C.tmp
2008-01-05 18:24 1,409,024 ------w C:\WINNT\Internet Logs\xDB8B.tmp
2008-01-03 21:48 1,523,200 ------w C:\WINNT\Internet Logs\xDB8A.tmp
2008-01-01 00:49 471,040 ------w C:\WINNT\Internet Logs\xDB89.tmp
2007-12-30 23:08 513,024 ------w C:\WINNT\Internet Logs\xDB88.tmp
2007-12-28 23:39 273,920 ------w C:\WINNT\Internet Logs\xDB87.tmp
2007-12-27 23:53 266,240 ------w C:\WINNT\Internet Logs\xDB86.tmp
2007-12-26 22:51 464,384 ------w C:\WINNT\Internet Logs\xDB85.tmp
2007-12-24 21:37 691,200 ------w C:\WINNT\Internet Logs\xDB84.tmp
2007-12-22 23:32 640,512 ------w C:\WINNT\Internet Logs\xDB83.tmp
2007-12-21 19:15 644,096 ------w C:\WINNT\Internet Logs\xDB81.tmp
2007-12-21 19:15 3,217,920 ------w C:\WINNT\Internet Logs\xDB82.tmp
2007-12-19 23:01 347,136 ----a-w C:\WINNT\system32\dllcache\dxtmsft.dll
2007-12-19 22:35 880,640 ------w C:\WINNT\Internet Logs\xDB80.tmp
2007-12-18 09:51 179,584 ------w C:\WINNT\system32\dllcache\mrxdav.sys
2007-12-18 06:18 3,213,824 ------w C:\WINNT\Internet Logs\xDB7F.tmp
2007-12-18 06:18 1,233,920 ------w C:\WINNT\Internet Logs\xDB7E.tmp
2007-12-10 11:51 37,376 ------w C:\WINNT\Internet Logs\xDB7D.tmp
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24 1694208]
"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe" [2006-06-26 16:13 1207080]
"EPSON Stylus D68 Series"="C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.exe" [2005-01-25 06:00 98304]
"gStart"="C:\Garmin\gStart.exe" [2007-03-04 23:08 1891416]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-10-23 21:18 443968]
"ctfmon.exe"="C:\WINNT\system32\ctfmon.exe" [2004-08-04 00:56 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Synchronization Manager"="mobsync.exe" [2004-08-04 00:56 143360 C:\WINNT\system32\mobsync.exe]
"IgfxTray"="C:\WINNT\system32\igfxtray.exe" [2004-11-02 09:03 155648]
"HotKeysCmds"="C:\WINNT\system32\hkcmd.exe" [2004-11-02 08:59 126976]
"EPSON Stylus D68 Series"="C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.exe" [2005-01-25 06:00 98304]
"EPSON Stylus D68 Series (Copy 1)"="C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.exe" [2005-01-25 06:00 98304]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [2007-12-21 11:19 579072]
"SlipStream"="C:\Program Files\SlipStream Web Accelerator\slipcore.exe" [2006-03-23 11:03 258048]
"zBrowser Launcher"="C:\Program Files\Logitech\iTouch\iTouch.exe" [2002-11-23 02:15 631362]
"MMTray"="C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe" [2002-05-20 19:36 90112]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 00:56 110592 C:\WINNT\system32\bthprops.cpl]
"FLMK08KB"="C:\Program Files\Muiltmedia keyboard utility\MMKEYBD.EXE" [2007-09-20 20:06 207360]
"REGSHAVE"="C:\Program Files\REGSHAVE\REGSHAVE.exe" [2002-02-04 22:32 53248]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-11-14 16:05 919016]
"CoolSwitch"="C:\WINNT\system32\taskswitch.exe" [2002-03-19 17:30 45632]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24 286720]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"internat.exe"="internat.exe" [1999-12-07 17:00 20752 C:\WINNT\system32\internat.exe]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe" [2007-10-24 09:27 219136]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-10-23 21:18 443968]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"tscuninstall"="C:\WINNT\system32\tscupgrd.exe" [2004-08-03 22:59 44544]

C:\Documents and Settings\Andy .HOME-J68SS7HK0H\Start Menu\Programs\Startup\
DeskSweeper.lnk - C:\Program Files\DeskSweeper\DeskSweeper.exe [1999-03-09 236032]

C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\Startup\
SiWake.lnk - C:\Program Files\Wireless LAN Utility\SiWake.exe [2006-07-20 16:52:32 135168]
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26 29696]
Exif Launcher 2.lnk - C:\Program Files\FinePixViewer\QuickDCF2.exe [2007-10-24 18:34:35 294912]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R1 bizVSerial;Franson VSerial;C:\WINNT\system32\drivers\bizVSerialNT.sys [2006-04-03 21:00]
R1 Ext2fs;Ext2fs;C:\WINNT\system32\DRIVERS\ext2fs.sys [2006-10-23 18:20]
R1 IfsDrives;IfsDrives;C:\WINNT\system32\DRIVERS\IfsDrives.sys [2004-09-25 00:28]
R3 HCWBT8XX;Hauppauge WinTV 848/9 WDM Video Driver;C:\WINNT\system32\drivers\HCWBT8XX.sys [2006-01-25 16:14]
R3 LCcfltr;Logitech USB Filter Driver;C:\WINNT\system32\drivers\lccfltr.sys [2002-11-08 09:50]
S3 Franson GpsGate 2.0;Franson GpsGate 2.0;C:\Program Files\Franson\GpsGate 2.0\GpsGateService.exe [2006-12-01 19:00]
S3 LucentSoftModem;Lucent Technologies Soft Modem;C:\WINNT\system32\DRIVERS\LTSM.sys [2001-08-17 13:28]
S3 V90drv;v90drv;C:\WINNT\system32\DRIVERS\v90drv.sys [2001-11-29 16:10]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2467094c-2346-11dc-95ec-00096b7d5e1b}]
\Shell\AutoRun\command - E:\PortableApps\PortableAppsMenu\PortableAppsMenu.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{44e851c6-1d6b-11db-9890-00096b7d5e1b}]
\Shell\AutoRun\command - E:\setupSNK.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{99f70218-ef0a-11db-9558-00096b7d5e1b}]
\Shell\AutoRun\command - PortableApps\PortableAppsMenu\PortableAppsMenu.exe

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-15 18:55:33
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-03-15 18:57:27
ComboFix-quarantined-files.txt 2008-03-15 18:57:20
ComboFix3.txt 2008-03-15 09:22:56
ComboFix2.txt 2008-03-15 12:34:40
.
2008-03-13 08:04:14 --- E O F ---


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:10:06, on 15/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\ZONELABS\vsmon.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINNT\system32\bgsvcgen.exe
C:\WINNT\system32\E_S00RP1.EXE
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINNT\system32\SAgent4.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\ctfmon.exe
C:\WINNT\system32\igfxtray.exe
C:\WINNT\system32\hkcmd.exe
C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE
C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\SlipStream Web Accelerator\slipcore.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\WINNT\system32\rundll32.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINNT\system32\taskswitch.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Muiltmedia keyboard utility\KbdAp32A.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Garmin\gStart.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Wireless LAN Utility\SiWake.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\Program Files\FinePixViewer\QuickDCF2.exe
C:\Program Files\DeskSweeper\DeskSweeper.exe
C:\WINNT\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\removal.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.msn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: StumbleUpon Launcher - {145B29F4-A56B-4b90-BBAC-45784EBEBBB7} - C:\Program Files\StumbleUpon\StumbleUponIEBar.dll
O2 - BHO: PBlockHelper Class - {4115122B-85FF-4DD3-9515-F075BEDE5EB5} - C:\Program Files\SlipStream Web Accelerator\PBHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O3 - Toolbar: StumbleUpon Toolbar - {5093EB4C-3E93-40AB-9266-B607BA87BDC8} - C:\Program Files\StumbleUpon\StumbleUponIEBar.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\system32\hkcmd.exe
O4 - HKLM\..\Run: [EPSON Stylus D68 Series] C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE /P23 "EPSON Stylus D68 Series" /O6 "USB001" /M "Stylus D68"
O4 - HKLM\..\Run: [EPSON Stylus D68 Series (Copy 1)] C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE /P32 "EPSON Stylus D68 Series (Copy 1)" /O6 "USB001" /M "Stylus D68"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SlipStream] "C:\Program Files\SlipStream Web Accelerator\slipcore.exe"
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [FLMK08KB] C:\Program Files\Muiltmedia keyboard utility\MMKEYBD.EXE
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [CoolSwitch] C:\WINNT\system32\taskswitch.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [EPSON Stylus D68 Series] C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE /P23 "EPSON Stylus D68 Series" /M "Stylus D68" /EF "HKCU"
O4 - HKCU\..\Run: [gStart] C:\Garmin\gStart.exe
O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINNT\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [internat.exe] internat.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [internat.exe] internat.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [internat.exe] internat.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [internat.exe] internat.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')
O4 - Startup: DeskSweeper.lnk = C:\Program Files\DeskSweeper\DeskSweeper.exe
O4 - Global Startup: SiWake.lnk = C:\Program Files\Wireless LAN Utility\SiWake.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Exif Launcher 2.lnk = ?
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINNT\system32\GPhotos.scr/200
O8 - Extra context menu item: StumbleUpon: &Blog This - res://StumbleUponIEBar.dll/blogimage
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.tiscali.co.uk/
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partne ... nicode.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {74FFE28D-2378-11D5-990C-006094235084} (IBM Access Support) - http://www-307.ibm.com/pc/support/IbmEgath.cab
O16 - DPF: {8BC53B30-32E4-4ED3-BEF9-DB761DB77453} (CInstallLPCtrl Object) - http://u3.sandisk.com/download/apps/LPInstaller.CAB
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\WINNT\system32\bgsvcgen.exe
O23 - Service: EPSON V3 Service2(03) (EPSON_PM_RPCV2_01) - SEIKO EPSON CORPORATION - C:\WINNT\system32\E_S00RP1.EXE
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: Franson GpsGate 2.0 - Unknown owner - C:\Program Files\Franson\GpsGate 2.0\GpsGateService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\VIRUSfighter\Nvc\BIN\nipsvc.exe (file missing)
O23 - Service: SmartLinkService (SLService) - - C:\WINNT\SYSTEM32\slserv.exe
O23 - Service: Epson Printer Status Agent4 (StatusAgent4) - SEIKO EPSON CORPORATION - C:\WINNT\system32\SAgent4.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINNT\system32\ZONELABS\vsmon.exe

--
End of file - 10161 bytes


Thanks for your ongoing help.

Andy
dan12
March 15, 2008, 7:36 PM UTC
Did you run ther script as detailed here
as were still not getting the deletions I want.
Just let me know before we try something else :)
also your java is still the old version.
ipplepen
March 15, 2008, 7:48 PM UTC
Hi Dan

yes followed instructions to the letter.

I have updated Java now.

Thanks Andy
dan12
March 15, 2008, 8:00 PM UTC last edited March 15, 2008, 11:03 PM UTC
How's machine doing by the way?

Norman entry could be remnants from the past!

Please copy (Ctrl+C) and paste (Ctrl+V) the following text in the quote to Notepad. Save it as
All Files and name it FixServices.bat. Please save it on your desktop.

@echo off

sc stop NipSvc

sc delete NipSvc

exit



Double click FixServices.bat. A window will open and close. This is normal.


Run HijackThis, select Do a system scan only and place checks against the following entries (if they are still present)

O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\VIRUSfighter\Nvc\BIN\nipsvc.exe (file missing)

WITH ALL OTHER WINDOWS CLOSED Click on Fix Checked and exit

--------------------------------


Please download the OTMoveIt2 by OldTimer.
  • Save it to your desktop.
  • Please double-click OTMoveIt2.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
  • Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):


    
C:\WINNT\system32\tmp.reg
    
C:\WINNT\system32\VCCLSID.exe
    
C:\WINNT\system32\SrchSTS.exe 
    
C:\WINNT\system32\VACFix.exe
    
C:\WINNT\system32\IEDFix.exe
    
C:\WINNT\system32\Process.exe
    
C:\WINNT\system32\dumphive.exe
    
C:\WINNT\system32\WS2Fix.exe
    
C:\WINNT\IFinst27.exe


  • Return to OTMoveIt2, right click in the "Paste Standard List of Files/Folders to Move" window (under the light blue bar) and choose Paste.
  • Click the red Moveit! button.
  • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  • Close OTMoveIt2

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

post a new HJT log and OTMoveIt log
thanks dan :)
ipplepen
March 15, 2008, 8:16 PM UTC
Are the file paths missing from your post?

# Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):



# Return to OTMoveIt2, right click in the "Paste Custom List Of Files/Patterns To Move" window (under the yellow bar) and choose Paste.