Free Malware Removal Forum

by **nanrector** » March 30th, 2009, 11:11 am

I am getting popups... with ads but many times just blank pages (as tabs). I'm using IE. Also pages will not load.... just started a few days ago.
Here is my Hijack log. Thanks in advance!
XP PRO
Edit: Its now spread to my main computer and AVG is constantly popping up.
Edit: Updated log below 04/03

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:09:07 AM, on 4/3/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Olympus\DeviceDetector\DM1Service.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Hotkey CD Eject\cdeject.exe
C:\Program Files\AllToTray\AllToTray.exe
C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe
C:\Program Files\Olympus\DSSPlayer\DirectrecConfig.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Program Files\twhirl\twhirl.exe
C:\Program Files\TweetDeck\TweetDeck.exe
C:\Program Files\BillingTracker Pro 4\BillingTracker.exe
C:\Program Files\Maxthon2\Maxthon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O1 - Hosts: 82.98.235.133 url.adtrgt.com
O1 - Hosts: 82.98.235.133 best-click-scanner.info
O1 - Hosts: 82.98.235.133 antivirus-xp-pro-2009.com
O1 - Hosts: 82.98.235.133 microsoft.infosecuritycenter.com
O1 - Hosts: 82.98.235.133 microsoft.softwaresecurityhelp.com
O1 - Hosts: 82.98.235.133 onlinenotifyq.net
O1 - Hosts: 82.98.235.133 antivirusxp-pro-2009.com
O1 - Hosts: 82.98.235.133 microsoft.browser-security-center.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {3419acba-553c-445e-a7e8-5c10b2db2b44} - C:\WINDOWS\system32\ralavepe.dll (file missing)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: RoboForm - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [WinSys2] C:\WINDOWS\system32\winsys2.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [itype] "C:\Program Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [Recordpad] "C:\Program Files\NCH Swift Sound\Recordpad\recordpad.exe" -logon
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [melurayeto] Rundll32.exe "C:\WINDOWS\system32\huhasuso.dll",s
O4 - HKLM\..\Run: [1ca3a4ba] rundll32.exe "C:\WINDOWS\system32\selaziya.dll",b
O4 - HKLM\..\Run: [CPM1f909726] Rundll32.exe "c:\windows\system32\rutefori.dll",a
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [L09AXLRD_139214234] "C:\Program Files\Microsoft Student\Microsoft Student with Encarta Premium 2009 DVD\EDICT.EXE" -m
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Hotkey CD Eject] C:\Program Files\Hotkey CD Eject\cdeject.exe
O4 - HKCU\..\Run: [AllToTray] C:\Program Files\AllToTray\AllToTray.exe
O4 - HKCU\..\Run: [Second Copy] "C:\Program Files\SecCopy\SecCopy.exe"
O4 - HKUS\S-1-5-19\..\Run: [melurayeto] Rundll32.exe "C:\WINDOWS\system32\huhasuso.dll",s (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [melurayeto] Rundll32.exe "C:\WINDOWS\system32\huhasuso.dll",s (User 'NETWORK SERVICE')
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Device Detector 3.lnk = C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe
O4 - Global Startup: Directrec Configuration Tool.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: Copy plain text for WhizFolders - C:\Program Files\WhizFolders Organizer Deluxe\copytool.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Encarta Search Bar - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://asia.msi.com.tw
O15 - Trusted Zone: http://global.msi.com.tw
O15 - Trusted Zone: http://www.msi.com.tw
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/200 ... oader5.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 5859193093
O16 - DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} (WebSDev Control) - http://liveupdate.msi.com.tw/autobios/L ... nstall.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://wwwimages.adobe.com/www.adobe.co ... nos/gp.cab
O18 - Filter hijack: text/html - {e081ae42-4efb-4298-8afb-091f09f1fa5b} - C:\WINDOWS\system32\dsound3dd.dll
O20 - AppInit_DLLs: C:\WINDOWS\system32\jagohala.dll c:\windows\system32\rutefori.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\rutefori.dll (file missing)
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\rutefori.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: DM1Service - OLYMPUS Corporation - C:\Program Files\Olympus\DeviceDetector\DM1Service.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe

--
End of file - 11577 bytes

by **Bio-Hazard** » April 6th, 2009, 3:02 am

Hello and Welcome to forums!

My name is Bio-Hazard and I will be helping you to remove any infection(s) that you may have.

Please observe these rules while we work:

I will be working on your Malware issues this may or may not solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for this issue on this machine.
I f you don't know or understand something please don't hesitate to ask.
Please DO NOT run any other tools or scans whilst I am helping you.
It is important that you reply to this thread. Do not start a new topic.
Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
Absence of symptoms does not mean that everything is clear.

No Reply Within 5 Days Will Result In Your Topic Being Closed!!

by **Bio-Hazard** » April 6th, 2009, 3:15 am

Download and Run ComboFix

Download ComboFix from one of these locations:

Link 1
Link 2
Link 3

Here you can find a tutorial about Combofix: HOW TO USE COMBOFIX

IMPORTANT: combofix.exe MUST be on your Desktop for us to proceed.

Please continue as follows:

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
Double click on ComboFix.exe and follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

NOTE: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
Click on Yes, to continue scanning for malware.
Do not mouseclick combofix's window whilst it's running. That may cause it to stall.

Combofix should never take more that 20 minutes including the reboot if malware is detected.

Next Reply

Please reply with:

ComboFix log (found at C:\Combofix.txt)
New HijackThis log

by **nanrector** » April 6th, 2009, 7:05 am

Thank you SO much Bio-Hazard for your time. I began to ran CombFix however it tells me AVG is still running after I closed it. I The task manager does indeed show three files apparently belonging to AVG. It will not let me end their processes . One I can delete and it immediatly regenrates it. Tried to uninstall it. Gives me an error so it will not uninstlal. AVG crashed pretty badly when I first tried to remove one of the initial virus popups it gave me a week ago. Not sure if that is the cause.

Very nerverous to reboot as I've been having trouble getting the computer back up.

Suggestions?

Thanks again.
Nancy

by **Bio-Hazard** » April 6th, 2009, 1:23 pm

Hello Nancy!

You are pretty heavily infected and that could be reason why AVG is not working or you are not able to uninstall it.

STEP 1

Back Up registry with ERUNT

Please use the following link and scroll down to ERUNT and download it on to your desktop. HERE
Click on the erunt-setup.exe
Follow the prompts to install ERUNT
Choose language
A set up window will pop up. It will ask: Create ERUNT entry in to the Start up folder, answer NO
Backup your registry to the default location

Note: To restore your registry (if needed), go to the folder and start ERDNT.exe

STEP 2

Download this tool AVG Remover to remove AVG.

This is a quote from the AVG site:

AVG Remover

AVG Remover utility removes all parts of AVG installation on your computer, including registry items, installation and user files on your disk, etc. AVG Remover is the least option to be used in case the AVG uninstallation / repair installation process has failed repeatedly.

Warning

All AVG user settings will be removed after the uninstallation, as well as the Virus Vault content and other item related to AVG installation and use. During the removal procedure you will be asked to restart your computer. Therefore please make sure to finish your work and to save all important data prior to AVG Remover launch.

STEP 3

Rerun Combofix according the instructions i gave you.

STEP 4

Install AVG again. Here is the link for the AVG Anti-Virus Free Edition.

Logs/Information to Post in Next Reply

Please post the following logs/Information in your reply:

Combofix Log
A fresh HijackThis Log ( after all the above has been done)
A description of how your computer is behaving

by **nanrector** » April 7th, 2009, 7:59 pm

NOTE: Computer booted in RECORD TIME! Not sure about anything else yet.
Edit: I installed AVG after posting the logs.

ComboFix 09-04-04.01 - NancyGail 2009-04-07 19:29:36.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3071.2520 [GMT -7:00]
Running from: c:\documents and settings\NancyGail\Desktop\ComboFix.exe
.

((((((((((((((((((((((((( Files Created from 2009-03-08 to 2009-04-08 )))))))))))))))))))))))))))))))
.

2009-04-07 18:29 . 2009-04-07 18:29 <DIR> d-------- c:\program files\ERUNT
2009-04-07 13:43 . 2009-04-07 13:43 <DIR> d-------- c:\program files\twhirl
2009-04-02 06:47 . 2009-04-02 06:47 43,585 --a------ C:\BillingTracker.elf
2009-04-01 18:46 . 2009-04-01 18:50 <DIR> d-------- c:\documents and settings\NancyGail\Application Data\Uniblue
2009-04-01 18:46 . 2009-04-01 18:50 <DIR> d-------- c:\documents and settings\All Users\Application Data\DriverScanner
2009-04-01 18:23 . 2009-04-01 18:25 <DIR> d-------- c:\program files\USB-IF Test Suite
2009-04-01 18:23 . 2008-04-17 14:40 50,304 --a------ c:\windows\system32\drivers\hcdriver.sys
2009-03-31 10:42 . 2009-03-31 10:42 <DIR> d-------- c:\documents and settings\NancyGail\Application Data\Centered Systems
2009-03-31 10:36 . 2009-03-31 10:38 <DIR> d-------- c:\program files\SecCopy
2009-03-31 10:36 . 2006-12-21 15:18 497,496 --a------ c:\windows\system32\XceedZip.dll
2009-03-30 10:03 . 2009-03-30 10:03 <DIR> d-------- c:\program files\Trend Micro
2009-03-29 10:58 . 2009-03-29 10:58 <DIR> d-------- c:\program files\Fraps
2009-03-29 09:24 . 2009-04-04 06:56 <DIR> d-------- c:\program files\XoftSpySE
2009-03-28 09:47 . 2001-05-11 13:18 420,240 --a------ c:\windows\system32\mpg4c32.dll
2009-03-28 09:47 . 2001-05-16 17:54 309,616 --a------ c:\windows\system32\wmv8dmod.dll
2009-03-28 09:47 . 2001-03-26 04:41 245,760 --a------ c:\windows\system32\mp4sds32.ax
2009-03-28 09:45 . 2009-03-29 10:56 <DIR> d-------- c:\program files\Game Cam
2009-03-25 14:33 . 2009-03-25 14:51 <DIR> d-------- c:\program files\Game Cam V2
2009-03-24 14:54 . 2009-03-24 14:54 5,242,934 --ah----- c:\windows\system32\toyhide.bmp
2009-03-24 14:24 . 2009-03-24 14:24 187,072 --a------ c:\windows\walltoyUninst.exe
2009-03-23 10:36 . 2009-03-23 10:36 <DIR> d-------- c:\program files\IrfanView
2009-03-21 13:21 . 2009-03-21 13:21 <DIR> d-------- c:\program files\Hotkey CD Eject
2009-03-20 11:24 . 2009-03-20 11:24 <DIR> d-------- c:\program files\iTunes
2009-03-20 11:24 . 2009-03-20 11:24 <DIR> d-------- c:\program files\iPod
2009-03-20 11:24 . 2009-03-20 11:24 <DIR> d-------- c:\program files\Common Files\Apple
2009-03-20 11:24 . 2009-03-20 11:24 <DIR> d-------- c:\program files\Bonjour
2009-03-20 11:24 . 2009-03-20 11:24 <DIR> d-------- c:\documents and settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
2009-03-20 11:24 . 2008-04-17 12:12 107,368 --a------ c:\windows\system32\GEARAspi.dll
2009-03-20 11:24 . 2009-01-15 12:19 23,848 --a------ c:\windows\system32\drivers\GEARAspiWDM.sys
2009-03-20 11:02 . 2009-03-20 11:02 <DIR> d-------- c:\program files\NCH Software
2009-03-20 11:02 . 2009-03-20 11:02 <DIR> d-------- c:\documents and settings\NancyGail\Application Data\Recordpad
2009-03-20 11:02 . 2009-03-20 11:02 <DIR> d-------- c:\documents and settings\NancyGail\Application Data\NCH Swift Sound
2009-03-20 11:02 . 2009-03-20 11:02 <DIR> d-------- c:\documents and settings\All Users\Application Data\NCH Swift Sound
2009-03-20 11:01 . 2009-03-20 11:02 <DIR> d-------- c:\program files\NCH Swift Sound
2009-03-20 10:50 . 2009-03-20 11:11 <DIR> d-------- c:\program files\All Sound Recorder XP
2009-03-19 10:33 . 2009-03-19 10:33 <DIR> d-------- c:\program files\MAPILab Ltd
2009-03-19 10:13 . 2009-03-19 10:13 <DIR> dr-h----- C:\MSOCache
2009-03-19 10:13 . 2009-03-20 03:23 <DIR> d-------- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-03-19 03:00 . 2009-03-19 03:00 <DIR> d-------- c:\program files\Microsoft CAPICOM 2.1.0.2
2009-03-18 10:49 . 2009-03-18 10:49 2,344 --a------ c:\windows\hpbvspst.his
2009-03-18 10:49 . 2009-03-18 10:49 414 --a------ c:\windows\hpbvspst.ini
2009-03-18 10:44 . 2009-04-03 17:16 50,895 --a------ c:\windows\hpdj6500.hi2
2009-03-18 10:44 . 2009-04-03 17:16 8,768 --a------ c:\windows\hpdj6500.bu2
2009-03-18 10:35 . 2003-12-11 11:15 626,960 -ra------ c:\windows\system32\hpvaut32.dll
2009-03-18 10:35 . 2003-12-11 11:15 487,424 -ra------ c:\windows\system32\hpvcp70.dll
2009-03-18 10:35 . 2003-12-11 11:15 344,064 -ra------ c:\windows\system32\hpvcr70.dll
2009-03-18 10:35 . 2003-12-11 11:15 44,544 -ra------ c:\windows\system32\MSXML4a.dll
2009-03-18 10:30 . 2009-04-03 17:18 42,237 --a------ c:\windows\hpdj6500.hi1
2009-03-18 10:30 . 2009-04-03 17:18 5,586 --a------ c:\windows\hpdj6500.bu1
2009-03-14 15:58 . 2009-03-14 15:58 <DIR> d-------- c:\program files\Common Files\Blizzard Entertainment
2009-03-12 09:11 . 2009-03-12 09:11 <DIR> d-------- c:\program files\Realtek Sound Manager
2009-03-12 09:11 . 2009-03-12 09:11 <DIR> d-------- c:\program files\Realtek AC97
2009-03-12 09:11 . 2009-03-12 09:11 <DIR> d-------- c:\program files\AvRack
2009-03-12 09:11 . 2006-03-22 16:23 10,524,672 --a------ c:\windows\system32\RTLCPL.exe
2009-03-12 09:11 . 2006-03-31 14:38 3,960,896 -ra------ c:\windows\system32\drivers\alcxwdm.sys
2009-03-12 09:11 . 2006-03-20 11:48 315,392 --a------ c:\windows\alcupd.exe
2009-03-12 09:11 . 2005-11-18 11:20 217,088 --a------ c:\windows\alcrmv.exe
2009-03-12 09:11 . 2002-02-05 13:54 141,016 --a------ c:\windows\system32\alsndmgr.wav
2009-03-12 09:11 . 2006-01-10 13:38 135,168 --a------ c:\windows\system32\RtlCPAPI.dll
2009-03-12 09:11 . 2001-07-06 00:19 164 --a------ c:\windows\avrack.ini
2009-03-10 10:15 . 2009-03-10 10:15 <DIR> d-------- c:\program files\MSECache
2009-03-08 13:11 . 2009-03-08 13:11 <DIR> d-------- c:\program files\FTP Now
2009-03-08 08:47 . 2009-03-08 08:47 <DIR> d-------- c:\documents and settings\NancyGail\Application Data\AdobeUM
2009-03-08 08:46 . 2009-03-08 08:46 <DIR> d-------- c:\program files\Common Files\Adobe Systems Shared
2009-03-08 08:46 . 2009-03-08 08:46 <DIR> d-------- c:\documents and settings\All Users\Application Data\Adobe Systems

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-08 02:29 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-04-08 02:24 --------- d-----w c:\documents and settings\NancyGail\Application Data\nView_Wallpaper
2009-04-08 02:22 --------- d-----w c:\documents and settings\All Users\Application Data\avg8
2009-04-08 00:56 --------- d-----w c:\documents and settings\NancyGail\Application Data\UseNeXT
2009-04-07 23:13 --------- d-----w c:\program files\BillingTracker Pro 4
2009-04-06 12:35 --------- d-----w c:\documents and settings\NancyGail\Application Data\ZoomBrowser EX
2009-04-06 12:35 --------- d-----w c:\documents and settings\All Users\Application Data\ZoomBrowser
2009-04-05 19:54 --------- d-----w c:\documents and settings\NancyGail\Application Data\U3
2009-04-02 23:37 --------- d-----w c:\program files\World of Warcraft
2009-04-01 00:35 5,014 --sha-w c:\windows\system32\KGyGaAvL.sys
2009-03-29 17:56 --------- d--h--w c:\program files\InstallShield Installation Information
2009-03-25 21:33 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2009-03-24 17:18 --------- d-----w c:\program files\UseNeXT
2009-03-20 18:25 --------- d-----w c:\documents and settings\NancyGail\Application Data\Apple Computer
2009-03-20 18:24 --------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer
2009-03-19 17:34 --------- d-----w c:\program files\Rules Manager
2009-03-18 17:50 --------- d-----w c:\program files\HP
2009-03-18 17:50 --------- d-----w c:\program files\Hewlett-Packard
2009-03-17 19:52 --------- d-----w c:\program files\WhizFolders Organizer Deluxe
2009-03-15 19:47 --------- d-----w c:\program files\Maxthon2
2009-03-08 15:46 --------- d-----w c:\program files\Common Files\Adobe
2009-03-05 00:20 --------- d-----w c:\program files\Amara - Flash Photo Animation Software
2009-03-04 23:45 --------- d-----w c:\program files\FastStone Photo Resizer
2009-03-04 23:45 --------- d-----w c:\documents and settings\NancyGail\Application Data\FastStone
2009-03-04 22:51 --------- d-----w c:\program files\Flash Slideshow Maker Professional
2009-03-04 22:48 --------- d-----w c:\program files\Microsoft Student
2009-03-04 19:43 --------- d-----w c:\documents and settings\NancyGail\Application Data\ColorCop
2009-03-04 19:18 --------- d-----w c:\program files\AllToTray
2009-03-04 02:57 --------- d-----w c:\program files\Cool MP3 Splitter
2009-03-03 22:35 --------- d-----w c:\program files\Common Files\AVSMedia
2009-03-03 22:35 --------- d-----w c:\program files\AVS4YOU
2009-03-03 21:12 --------- d-----w c:\documents and settings\NancyGail\Application Data\vlc
2009-03-03 19:56 --------- d-----w c:\program files\Canon
2009-03-03 17:13 --------- d-----w c:\documents and settings\NancyGail\Application Data\AVS4YOU
2009-03-03 17:13 --------- d-----w c:\documents and settings\All Users\Application Data\AVS4YOU
2009-03-03 03:09 --------- d-----w c:\program files\Graboid
2009-03-03 03:03 --------- d-----w c:\documents and settings\NancyGail\Application Data\Graboid Inc
2009-03-02 19:02 --------- d-----w c:\program files\Collectorz.com
2009-03-02 16:56 --------- d-----w c:\documents and settings\NancyGail\Application Data\Rules Manager
2009-03-02 01:50 --------- d-----w c:\program files\D-Tools
2009-03-02 00:25 --------- d-----w c:\program files\Unlocker
2009-03-01 21:59 --------- d-----w c:\program files\Mozilla ActiveX Control v1.7.12
2009-03-01 21:59 --------- d-----w c:\documents and settings\NancyGail\Application Data\MozillaControl
2009-03-01 21:59 --------- d-----w c:\documents and settings\All Users\Application Data\Graboid Inc
2009-03-01 16:21 --------- d-----w c:\documents and settings\NancyGail\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2009-03-01 03:48 --------- d-----w c:\program files\VideoLAN
2009-03-01 03:44 --------- d-----w c:\program files\NOS
2009-03-01 03:44 --------- d-----w c:\documents and settings\All Users\Application Data\NOS
2009-03-01 02:51 --------- d-----w c:\program files\MSBuild
2009-03-01 02:50 --------- d-----w c:\program files\Reference Assemblies
2009-03-01 02:48 --------- d-----w c:\program files\MSXML 4.0
2009-03-01 02:27 121,887 ----a-w c:\windows\File Renamer - Basic Uninstaller.exe
2009-03-01 02:27 --------- d-----w c:\program files\File Renamer
2009-03-01 01:36 --------- d-----w c:\program files\Lakefront Software
2009-03-01 01:17 --------- d-----w c:\documents and settings\All Users\Application Data\WEBREG
2009-03-01 01:15 --------- d-----w c:\program files\Common Files\HP
2009-03-01 01:15 --------- d-----w c:\program files\Common Files\Hewlett-Packard
2009-03-01 01:15 --------- d-----w c:\documents and settings\All Users\Application Data\HP
2009-03-01 01:14 --------- d-----w c:\documents and settings\All Users\Application Data\Hewlett-Packard
2009-03-01 01:07 --------- d-----w c:\program files\PDFCreator
2009-03-01 00:44 --------- d-----w c:\documents and settings\NancyGail\Application Data\AvniTech
2009-03-01 00:39 --------- d-----w c:\program files\Color_Cop
2009-03-01 00:37 6,144 ----a-w c:\windows\system32\drivers\NTIDrvr.sys
2009-03-01 00:37 --------- d-----w c:\program files\NewTech Infosystems
2009-03-01 00:37 --------- d-----w c:\program files\Common Files\NewTech Infosystems
2009-03-01 00:37 --------- d-----w c:\program files\Common Files\muvee Technologies
2009-03-01 00:31 --------- d-----w c:\program files\TweetDeck
2009-03-01 00:31 --------- d-----w c:\documents and settings\NancyGail\Application Data\TweetDeckFast.F9107117265DB7542C1A806C8DB837742CE14C21.1
2009-02-28 23:26 --------- d-----w c:\program files\Common Files\Adobe AIR
2009-02-28 23:26 --------- d-----w c:\documents and settings\NancyGail\Application Data\de.makesoft.twhirl.0EA062BC275E7ED1E6EC3762EFFD73C7158ADF33.1
2009-02-28 23:17 --------- d-----w c:\program files\MediaMonkey
2009-02-28 23:11 --------- d-----w c:\program files\Olympus
2009-02-28 23:09 --------- d-----w c:\program files\Common Files\InstallShield
2009-02-28 23:07 --------- d-----w c:\program files\Common Files\Canon
2009-02-28 23:00 --------- d-----w c:\program files\Microsoft IntelliType Pro
2009-02-28 22:55 0 ---ha-w c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2009-02-28 22:55 0 ---ha-w c:\windows\system32\drivers\Msft_Kernel_NuidFltr_01005.Wdf
2009-02-28 22:45 --------- d-----w c:\program files\Corel
2009-02-28 22:45 --------- d-----w c:\program files\Common Files\Corel
2009-02-28 22:45 --------- d-----w c:\documents and settings\NancyGail\Application Data\Corel
2009-02-28 22:45 --------- d-----w c:\documents and settings\All Users\Application Data\InstallShield
2009-02-28 22:18 --------- d-----w c:\documents and settings\All Users\Application Data\Corel
2009-02-28 22:15 --------- d-----w c:\documents and settings\NancyGail\Application Data\InstallShield
2009-02-28 22:00 --------- d-----w c:\program files\Macromedia
2009-02-28 22:00 --------- d-----w c:\program files\Common Files\Macromedia
2009-02-28 21:50 --------- d-----w c:\program files\QuickTime
2009-02-28 21:49 --------- d-----w c:\program files\Apple Software Update
2009-02-28 21:49 --------- d-----w c:\documents and settings\All Users\Application Data\Apple
2009-02-28 20:43 --------- d-----w c:\documents and settings\NancyGail\Application Data\MxBoost
2009-02-28 20:40 --------- d-----w c:\program files\TechHit.com
2009-02-28 19:31 --------- d-----w c:\program files\Windows Live SkyDrive
2009-02-28 19:31 --------- d-----w c:\program files\Windows Live
2009-02-28 19:31 --------- d-----w c:\program files\Microsoft
2009-02-28 19:30 --------- d-----w c:\program files\Microsoft.NET
2009-02-28 19:30 --------- d-----w c:\program files\Microsoft ActiveSync
2009-02-28 19:27 --------- d-----w c:\program files\Common Files\Windows Live
2009-02-28 19:11 --------- d-----w c:\documents and settings\All Users\Application Data\nView_Profiles
2009-02-28 19:02 --------- d-----w c:\program files\Setup Files
2009-02-28 19:00 --------- d-----w c:\program files\MSI
2009-02-28 18:38 --------- d-----w c:\documents and settings\All Users\Application Data\RoboForm
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-28 3885408]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"L09AXLRD_139214234"="c:\program files\Microsoft Student\Microsoft Student with Encarta Premium 2009 DVD\EDICT.EXE" [2008-06-03 351000]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-13 1695232]
"Hotkey CD Eject"="c:\program files\Hotkey CD Eject\cdeject.exe" [2003-02-20 597504]
"AllToTray"="c:\program files\AllToTray\AllToTray.exe" [2009-03-04 728576]
"Second Copy"="c:\program files\SecCopy\SecCopy.exe" [2007-10-17 2425856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BJCFD"="c:\program files\BroadJump\Client Foundation\CFD.exe" [2002-09-10 368706]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-03 13529088]
"WinSys2"="c:\windows\system32\winsys2.exe" [2008-01-18 208896]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-03 86016]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]
"itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2008-06-10 1442888]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"Acrobat Assistant 7.0"="c:\program files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2004-12-14 483328]
"HP Software Update"="c:\program files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2004-02-18 49152]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb10.exe" [2004-03-04 172032]
"HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 241664]
"Recordpad"="c:\program files\NCH Swift Sound\Recordpad\recordpad.exe" [2009-03-20 577540]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-03-12 342312]
"RTHDCPL"="RTHDCPL.EXE" [2006-12-18 c:\windows\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 c:\windows\SkyTel.exe]
"nwiz"="nwiz.exe" [2008-05-03 c:\windows\system32\nwiz.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Acrobat Speed Launcher.lnk - c:\windows\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe [2009-03-08 25214]
Device Detector 3.lnk - c:\program files\Olympus\DeviceDetector\DevDtct2.exe [2009-02-28 114688]
Directrec Configuration Tool.lnk - c:\program files\Olympus\DSSPlayer\DirectrecConfig.exe [2009-02-28 122880]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-03-11 210520]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Maxthon2\\Modules\\MxDownloader\\MxDownloadServer.exe"=
"c:\\Program Files\\Macromedia\\Dreamweaver 8\\Dreamweaver.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\Graboid\\GraboidVideo\\1.4.0.0\\DLManager\\GraboidDLManager.exe"=
"c:\\Program Files\\FTP Now\\FTPNow.exe"=
"c:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724

R0 d344bus;d344bus;c:\windows\system32\drivers\d344bus.sys [2009-02-28 137216]
R0 d344prt;d344prt;c:\windows\system32\drivers\d344prt.sys [2009-02-28 5248]
R0 Si3531;SiI-3531 SATA Controller;c:\windows\system32\drivers\Si3531.sys [2009-02-25 210224]
S2 hpdj00;hpdj00;c:\docume~1\NANCYG~1\LOCALS~1\Temp\hpdj00.exe -servicerunning=true -uninstall=HP Deskjet 6500 Series -product=6500 --> c:\docume~1\NANCYG~1\LOCALS~1\Temp\hpdj00.exe -servicerunning=true -uninstall=HP Deskjet 6500 Series -product=6500 [?]
S3 autorun;autorun;\??\c:\huadio.tmp --> c:\huadio.tmp [?]
S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [2009-02-28 33752]
S3 hcdriver;EHCI;c:\windows\system32\drivers\hcdriver.sys [2009-04-01 50304]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4e0fbcfd-0866-11de-b4e8-0019dbcd1b0e}]
\Shell\AutoRun\command - O:\LaunchU3.exe -a
.
Contents of the 'Scheduled Tasks' folder

2009-04-08 c:\windows\Tasks\XoftSpySE 2.job
- c:\program files\XoftSpySE\XoftSpy.exe [2007-07-13 06:43]

2009-04-07 c:\windows\Tasks\XoftSpySE.job
- c:\program files\XoftSpySE\XoftSpy.exe [2007-07-13 06:43]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/ig?gl=all
mStart Page = hxxp://www.google.com/ig?gl=all
uInternet Settings,ProxyOverride = *.local
IE: Copy plain text for WhizFolders - c:\program files\WhizFolders Organizer Deluxe\copytool.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Fill Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
IE: RoboForm Toolbar - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
IE: Save Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
Trusted Zone: com.tw\asia.msi
Trusted Zone: com.tw\global.msi
Trusted Zone: com.tw\www.msi
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} - hxxp://liveupdate.msi.com.tw/autobios/L ... nstall.cab
FF - ProfilePath - c:\documents and settings\NancyGail\Application Data\Mozilla\Firefox\Profiles\ldjw8pvk.default\
FF - component: c:\documents and settings\NancyGail\Application Data\Mozilla\Firefox\Profiles\ldjw8pvk.default\extensions\{22119944-ED35-4ab1-910B-E619EA06A115}\components\rfproxy_27.dll
.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-07 19:30:13
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\autorun]
"ImagePath"="\??\c:\huadio.tmp"
.
Completion time: 2009-04-07 19:30:56
ComboFix-quarantined-files.txt 2009-04-08 02:30:54
ComboFix2.txt 2009-04-08 02:27:02
ComboFix3.txt 2009-04-08 01:55:08
ComboFix4.txt 2009-04-08 01:44:58

Pre-Run: 67,555,303,424 bytes free
Post-Run: 67,541,626,880 bytes free

295 --- E O F --- 2009-03-20 10:23:10

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:31:40 PM, on 4/7/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Olympus\DeviceDetector\DM1Service.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft Student\Microsoft Student with Encarta Premium 2009 DVD\EDICT.EXE
C:\Program Files\Hotkey CD Eject\cdeject.exe
C:\Program Files\AllToTray\AllToTray.exe
C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe
C:\Program Files\Olympus\DSSPlayer\DirectrecConfig.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Maxthon2\Maxthon.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: RoboForm - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [WinSys2] C:\WINDOWS\system32\winsys2.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [itype] "C:\Program Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [Recordpad] "C:\Program Files\NCH Swift Sound\Recordpad\recordpad.exe" -logon
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [L09AXLRD_139214234] "C:\Program Files\Microsoft Student\Microsoft Student with Encarta Premium 2009 DVD\EDICT.EXE" -m
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Hotkey CD Eject] C:\Program Files\Hotkey CD Eject\cdeject.exe
O4 - HKCU\..\Run: [AllToTray] C:\Program Files\AllToTray\AllToTray.exe
O4 - HKCU\..\Run: [Second Copy] "C:\Program Files\SecCopy\SecCopy.exe"
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Device Detector 3.lnk = C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe
O4 - Global Startup: Directrec Configuration Tool.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: Copy plain text for WhizFolders - C:\Program Files\WhizFolders Organizer Deluxe\copytool.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Encarta Search Bar - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://asia.msi.com.tw
O15 - Trusted Zone: http://global.msi.com.tw
O15 - Trusted Zone: http://www.msi.com.tw
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/200 ... oader5.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 5859193093
O16 - DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} (WebSDev Control) - http://liveupdate.msi.com.tw/autobios/L ... nstall.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://wwwimages.adobe.com/www.adobe.co ... nos/gp.cab
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: DM1Service - OLYMPUS Corporation - C:\Program Files\Olympus\DeviceDetector\DM1Service.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: hpdj00 - Unknown owner - C:\DOCUME~1\NANCYG~1\LOCALS~1\Temp\hpdj00.exe (file missing)
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe

--
End of file - 9682 bytes

by **Bio-Hazard** » April 8th, 2009, 10:25 am

Hello!

You have run combofix 4 times and i need to see the logs from those previous runs so i know what have been cleaned from your system.

Using Windows Explore by right-clicking the Start button and left clicking Explore navigate to and find the following folder:

C:\qoobox In that folder you will find the ComboFix log files.

Please post the contents of each of those log files in your next reply.

ComboFix2.txt 2009-04-08 02:27:02
ComboFix3.txt 2009-04-08 01:55:08
ComboFix4.txt 2009-04-08 01:44:58

by **nanrector** » April 8th, 2009, 11:16 am

I'm Sorry.. I had some issues doing the whole series and had to do it over ... I thought three times. I didnt realzie you needed all the logs.

My first attempt must have glitched... becase I ran the avg remover tool...ran combofix which gave me NO avg warnings now.... then my computer appeared to abruptly restart. Thought that was normal though. I did a hijack this log and posted that with a new combofix, looked them over and saw AVG listed in the combofix log. Sure enough it was showing those same files in the processes. So I had to start over.

Did the avg removal tool again. Did combfix... it did not reboot this time... I posted both logs and looked them over. AVG was gone but I then saw a program in the list that is a no no... so I new I needed too uninstall that and then reboot and do the logs yet again. Hence the different attempts. Plus at that point Irealized I hadn't put on the new AVG. Wasnt sure if that mattered. SO I redid it once more.

Sorry again for the extra crap... it was way too late and I'm not sure I wrote the order of what I did correctly above but its close. Below are the extra logs. Everything appears to be working fine still. No extra popups yet and like i said reboot is instant.

ComboFix 09-04-04.01 - NancyGail 2009-04-07 19:24:50.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3071.2573 [GMT -7:00]
Running from: c:\documents and settings\NancyGail\Desktop\ComboFix.exe
.

((((((((((((((((((((((((( Files Created from 2009-03-08 to 2009-04-08 )))))))))))))))))))))))))))))))
.

2009-04-07 18:29 . 2009-04-07 18:29 <DIR> d-------- c:\program files\ERUNT
2009-04-07 13:43 . 2009-04-07 13:43 <DIR> d-------- c:\program files\twhirl
2009-04-02 06:47 . 2009-04-02 06:47 43,585 --a------ C:\BillingTracker.elf
2009-04-01 18:46 . 2009-04-01 18:50 <DIR> d-------- c:\documents and settings\NancyGail\Application Data\Uniblue
2009-04-01 18:46 . 2009-04-01 18:50 <DIR> d-------- c:\documents and settings\All Users\Application Data\DriverScanner
2009-04-01 18:23 . 2009-04-01 18:25 <DIR> d-------- c:\program files\USB-IF Test Suite
2009-04-01 18:23 . 2008-04-17 14:40 50,304 --a------ c:\windows\system32\drivers\hcdriver.sys
2009-03-31 10:42 . 2009-03-31 10:42 <DIR> d-------- c:\documents and settings\NancyGail\Application Data\Centered Systems
2009-03-31 10:36 . 2009-03-31 10:38 <DIR> d-------- c:\program files\SecCopy
2009-03-31 10:36 . 2006-12-21 15:18 497,496 --a------ c:\windows\system32\XceedZip.dll
2009-03-30 10:03 . 2009-03-30 10:03 <DIR> d-------- c:\program files\Trend Micro
2009-03-29 10:58 . 2009-03-29 10:58 <DIR> d-------- c:\program files\Fraps
2009-03-29 09:24 . 2009-04-04 06:56 <DIR> d-------- c:\program files\XoftSpySE
2009-03-28 09:47 . 2001-05-11 13:18 420,240 --a------ c:\windows\system32\mpg4c32.dll
2009-03-28 09:47 . 2001-05-16 17:54 309,616 --a------ c:\windows\system32\wmv8dmod.dll
2009-03-28 09:47 . 2001-03-26 04:41 245,760 --a------ c:\windows\system32\mp4sds32.ax
2009-03-28 09:45 . 2009-03-29 10:56 <DIR> d-------- c:\program files\Game Cam
2009-03-25 14:33 . 2009-03-25 14:51 <DIR> d-------- c:\program files\Game Cam V2
2009-03-24 14:54 . 2009-03-24 14:54 5,242,934 --ah----- c:\windows\system32\toyhide.bmp
2009-03-24 14:24 . 2009-03-24 14:24 187,072 --a------ c:\windows\walltoyUninst.exe
2009-03-23 10:36 . 2009-03-23 10:36 <DIR> d-------- c:\program files\IrfanView
2009-03-21 13:21 . 2009-03-21 13:21 <DIR> d-------- c:\program files\Hotkey CD Eject
2009-03-20 11:24 . 2009-03-20 11:24 <DIR> d-------- c:\program files\iTunes
2009-03-20 11:24 . 2009-03-20 11:24 <DIR> d-------- c:\program files\iPod
2009-03-20 11:24 . 2009-03-20 11:24 <DIR> d-------- c:\program files\Common Files\Apple
2009-03-20 11:24 . 2009-03-20 11:24 <DIR> d-------- c:\program files\Bonjour
2009-03-20 11:24 . 2009-03-20 11:24 <DIR> d-------- c:\documents and settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
2009-03-20 11:24 . 2008-04-17 12:12 107,368 --a------ c:\windows\system32\GEARAspi.dll
2009-03-20 11:24 . 2009-01-15 12:19 23,848 --a------ c:\windows\system32\drivers\GEARAspiWDM.sys
2009-03-20 11:02 . 2009-03-20 11:02 <DIR> d-------- c:\program files\NCH Software
2009-03-20 11:02 . 2009-03-20 11:02 <DIR> d-------- c:\documents and settings\NancyGail\Application Data\Recordpad
2009-03-20 11:02 . 2009-03-20 11:02 <DIR> d-------- c:\documents and settings\NancyGail\Application Data\NCH Swift Sound
2009-03-20 11:02 . 2009-03-20 11:02 <DIR> d-------- c:\documents and settings\All Users\Application Data\NCH Swift Sound
2009-03-20 11:01 . 2009-03-20 11:02 <DIR> d-------- c:\program files\NCH Swift Sound
2009-03-20 10:50 . 2009-03-20 11:11 <DIR> d-------- c:\program files\All Sound Recorder XP
2009-03-19 10:33 . 2009-03-19 10:33 <DIR> d-------- c:\program files\MAPILab Ltd
2009-03-19 10:13 . 2009-03-19 10:13 <DIR> dr-h----- C:\MSOCache
2009-03-19 10:13 . 2009-03-20 03:23 <DIR> d-------- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-03-19 03:00 . 2009-03-19 03:00 <DIR> d-------- c:\program files\Microsoft CAPICOM 2.1.0.2
2009-03-18 10:49 . 2009-03-18 10:49 2,344 --a------ c:\windows\hpbvspst.his
2009-03-18 10:49 . 2009-03-18 10:49 414 --a------ c:\windows\hpbvspst.ini
2009-03-18 10:44 . 2009-04-03 17:16 50,895 --a------ c:\windows\hpdj6500.hi2
2009-03-18 10:44 . 2009-04-03 17:16 8,768 --a------ c:\windows\hpdj6500.bu2
2009-03-18 10:35 . 2003-12-11 11:15 626,960 -ra------ c:\windows\system32\hpvaut32.dll
2009-03-18 10:35 . 2003-12-11 11:15 487,424 -ra------ c:\windows\system32\hpvcp70.dll
2009-03-18 10:35 . 2003-12-11 11:15 344,064 -ra------ c:\windows\system32\hpvcr70.dll
2009-03-18 10:35 . 2003-12-11 11:15 44,544 -ra------ c:\windows\system32\MSXML4a.dll
2009-03-18 10:30 . 2009-04-03 17:18 42,237 --a------ c:\windows\hpdj6500.hi1
2009-03-18 10:30 . 2009-04-03 17:18 5,586 --a------ c:\windows\hpdj6500.bu1
2009-03-14 15:58 . 2009-03-14 15:58 <DIR> d-------- c:\program files\Common Files\Blizzard Entertainment
2009-03-12 09:11 . 2009-03-12 09:11 <DIR> d-------- c:\program files\Realtek Sound Manager
2009-03-12 09:11 . 2009-03-12 09:11 <DIR> d-------- c:\program files\Realtek AC97
2009-03-12 09:11 . 2009-03-12 09:11 <DIR> d-------- c:\program files\AvRack
2009-03-12 09:11 . 2006-03-22 16:23 10,524,672 --a------ c:\windows\system32\RTLCPL.exe
2009-03-12 09:11 . 2006-03-31 14:38 3,960,896 -ra------ c:\windows\system32\drivers\alcxwdm.sys
2009-03-12 09:11 . 2006-03-20 11:48 315,392 --a------ c:\windows\alcupd.exe
2009-03-12 09:11 . 2005-11-18 11:20 217,088 --a------ c:\windows\alcrmv.exe
2009-03-12 09:11 . 2002-02-05 13:54 141,016 --a------ c:\windows\system32\alsndmgr.wav
2009-03-12 09:11 . 2006-01-10 13:38 135,168 --a------ c:\windows\system32\RtlCPAPI.dll
2009-03-12 09:11 . 2001-07-06 00:19 164 --a------ c:\windows\avrack.ini
2009-03-10 10:15 . 2009-03-10 10:15 <DIR> d-------- c:\program files\MSECache
2009-03-08 13:11 . 2009-03-08 13:11 <DIR> d-------- c:\program files\FTP Now
2009-03-08 08:47 . 2009-03-08 08:47 <DIR> d-------- c:\documents and settings\NancyGail\Application Data\AdobeUM
2009-03-08 08:46 . 2009-03-08 08:46 <DIR> d-------- c:\program files\Common Files\Adobe Systems Shared
2009-03-08 08:46 . 2009-03-08 08:46 <DIR> d-------- c:\documents and settings\All Users\Application Data\Adobe Systems

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-08 02:24 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-04-08 02:24 --------- d-----w c:\documents and settings\NancyGail\Application Data\nView_Wallpaper
2009-04-08 02:22 --------- d-----w c:\documents and settings\All Users\Application Data\avg8
2009-04-08 02:13 --------- d-----w c:\program files\eMule
2009-04-08 00:56 --------- d-----w c:\documents and settings\NancyGail\Application Data\UseNeXT
2009-04-07 23:13 --------- d-----w c:\program files\BillingTracker Pro 4
2009-04-06 12:35 --------- d-----w c:\documents and settings\NancyGail\Application Data\ZoomBrowser EX
2009-04-06 12:35 --------- d-----w c:\documents and settings\All Users\Application Data\ZoomBrowser
2009-04-05 19:54 --------- d-----w c:\documents and settings\NancyGail\Application Data\U3
2009-04-02 23:37 --------- d-----w c:\program files\World of Warcraft
2009-04-01 00:35 5,014 --sha-w c:\windows\system32\KGyGaAvL.sys
2009-03-29 17:56 --------- d--h--w c:\program files\InstallShield Installation Information
2009-03-25 21:33 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2009-03-24 17:18 --------- d-----w c:\program files\UseNeXT
2009-03-20 18:25 --------- d-----w c:\documents and settings\NancyGail\Application Data\Apple Computer
2009-03-20 18:24 --------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer
2009-03-19 17:34 --------- d-----w c:\program files\Rules Manager
2009-03-18 17:50 --------- d-----w c:\program files\HP
2009-03-18 17:50 --------- d-----w c:\program files\Hewlett-Packard
2009-03-17 19:52 --------- d-----w c:\program files\WhizFolders Organizer Deluxe
2009-03-15 19:47 --------- d-----w c:\program files\Maxthon2
2009-03-08 15:46 --------- d-----w c:\program files\Common Files\Adobe
2009-03-05 00:20 --------- d-----w c:\program files\Amara - Flash Photo Animation Software
2009-03-04 23:45 --------- d-----w c:\program files\FastStone Photo Resizer
2009-03-04 23:45 --------- d-----w c:\documents and settings\NancyGail\Application Data\FastStone
2009-03-04 22:51 --------- d-----w c:\program files\Flash Slideshow Maker Professional
2009-03-04 22:48 --------- d-----w c:\program files\Microsoft Student
2009-03-04 19:43 --------- d-----w c:\documents and settings\NancyGail\Application Data\ColorCop
2009-03-04 19:18 --------- d-----w c:\program files\AllToTray
2009-03-04 02:57 --------- d-----w c:\program files\Cool MP3 Splitter
2009-03-03 22:35 --------- d-----w c:\program files\Common Files\AVSMedia
2009-03-03 22:35 --------- d-----w c:\program files\AVS4YOU
2009-03-03 21:12 --------- d-----w c:\documents and settings\NancyGail\Application Data\vlc
2009-03-03 19:56 --------- d-----w c:\program files\Canon
2009-03-03 17:13 --------- d-----w c:\documents and settings\NancyGail\Application Data\AVS4YOU
2009-03-03 17:13 --------- d-----w c:\documents and settings\All Users\Application Data\AVS4YOU
2009-03-03 03:09 --------- d-----w c:\program files\Graboid
2009-03-03 03:03 --------- d-----w c:\documents and settings\NancyGail\Application Data\Graboid Inc
2009-03-02 19:02 --------- d-----w c:\program files\Collectorz.com
2009-03-02 16:56 --------- d-----w c:\documents and settings\NancyGail\Application Data\Rules Manager
2009-03-02 01:50 --------- d-----w c:\program files\D-Tools
2009-03-02 00:25 --------- d-----w c:\program files\Unlocker
2009-03-01 21:59 --------- d-----w c:\program files\Mozilla ActiveX Control v1.7.12
2009-03-01 21:59 --------- d-----w c:\documents and settings\NancyGail\Application Data\MozillaControl
2009-03-01 21:59 --------- d-----w c:\documents and settings\All Users\Application Data\Graboid Inc
2009-03-01 16:21 --------- d-----w c:\documents and settings\NancyGail\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2009-03-01 03:48 --------- d-----w c:\program files\VideoLAN
2009-03-01 03:44 --------- d-----w c:\program files\NOS
2009-03-01 03:44 --------- d-----w c:\documents and settings\All Users\Application Data\NOS
2009-03-01 02:51 --------- d-----w c:\program files\MSBuild
2009-03-01 02:50 --------- d-----w c:\program files\Reference Assemblies
2009-03-01 02:48 --------- d-----w c:\program files\MSXML 4.0
2009-03-01 02:27 121,887 ----a-w c:\windows\File Renamer - Basic Uninstaller.exe
2009-03-01 02:27 --------- d-----w c:\program files\File Renamer
2009-03-01 01:36 --------- d-----w c:\program files\Lakefront Software
2009-03-01 01:17 --------- d-----w c:\documents and settings\All Users\Application Data\WEBREG
2009-03-01 01:15 --------- d-----w c:\program files\Common Files\HP
2009-03-01 01:15 --------- d-----w c:\program files\Common Files\Hewlett-Packard
2009-03-01 01:15 --------- d-----w c:\documents and settings\All Users\Application Data\HP
2009-03-01 01:14 --------- d-----w c:\documents and settings\All Users\Application Data\Hewlett-Packard
2009-03-01 01:07 --------- d-----w c:\program files\PDFCreator
2009-03-01 00:44 --------- d-----w c:\documents and settings\NancyGail\Application Data\AvniTech
2009-03-01 00:39 --------- d-----w c:\program files\Color_Cop
2009-03-01 00:37 6,144 ----a-w c:\windows\system32\drivers\NTIDrvr.sys
2009-03-01 00:37 --------- d-----w c:\program files\NewTech Infosystems
2009-03-01 00:37 --------- d-----w c:\program files\Common Files\NewTech Infosystems
2009-03-01 00:37 --------- d-----w c:\program files\Common Files\muvee Technologies
2009-03-01 00:31 --------- d-----w c:\program files\TweetDeck
2009-03-01 00:31 --------- d-----w c:\documents and settings\NancyGail\Application Data\TweetDeckFast.F9107117265DB7542C1A806C8DB837742CE14C21.1
2009-02-28 23:26 --------- d-----w c:\program files\Common Files\Adobe AIR
2009-02-28 23:26 --------- d-----w c:\documents and settings\NancyGail\Application Data\de.makesoft.twhirl.0EA062BC275E7ED1E6EC3762EFFD73C7158ADF33.1
2009-02-28 23:17 --------- d-----w c:\program files\MediaMonkey
2009-02-28 23:11 --------- d-----w c:\program files\Olympus
2009-02-28 23:09 --------- d-----w c:\program files\Common Files\InstallShield
2009-02-28 23:07 --------- d-----w c:\program files\Common Files\Canon
2009-02-28 23:00 --------- d-----w c:\program files\Microsoft IntelliType Pro
2009-02-28 22:55 0 ---ha-w c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2009-02-28 22:55 0 ---ha-w c:\windows\system32\drivers\Msft_Kernel_NuidFltr_01005.Wdf
2009-02-28 22:45 --------- d-----w c:\program files\Corel
2009-02-28 22:45 --------- d-----w c:\program files\Common Files\Corel
2009-02-28 22:45 --------- d-----w c:\documents and settings\NancyGail\Application Data\Corel
2009-02-28 22:45 --------- d-----w c:\documents and settings\All Users\Application Data\InstallShield
2009-02-28 22:18 --------- d-----w c:\documents and settings\All Users\Application Data\Corel
2009-02-28 22:15 --------- d-----w c:\documents and settings\NancyGail\Application Data\InstallShield
2009-02-28 22:00 --------- d-----w c:\program files\Macromedia
2009-02-28 22:00 --------- d-----w c:\program files\Common Files\Macromedia
2009-02-28 21:50 --------- d-----w c:\program files\QuickTime
2009-02-28 21:49 --------- d-----w c:\program files\Apple Software Update
2009-02-28 21:49 --------- d-----w c:\documents and settings\All Users\Application Data\Apple
2009-02-28 20:43 --------- d-----w c:\documents and settings\NancyGail\Application Data\MxBoost
2009-02-28 20:40 --------- d-----w c:\program files\TechHit.com
2009-02-28 19:31 --------- d-----w c:\program files\Windows Live SkyDrive
2009-02-28 19:31 --------- d-----w c:\program files\Windows Live
2009-02-28 19:31 --------- d-----w c:\program files\Microsoft
2009-02-28 19:30 --------- d-----w c:\program files\Microsoft.NET
2009-02-28 19:30 --------- d-----w c:\program files\Microsoft ActiveSync
2009-02-28 19:27 --------- d-----w c:\program files\Common Files\Windows Live
2009-02-28 19:11 --------- d-----w c:\documents and settings\All Users\Application Data\nView_Profiles
2009-02-28 19:02 --------- d-----w c:\program files\Setup Files
2009-02-28 19:00 --------- d-----w c:\program files\MSI
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-28 3885408]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"L09AXLRD_139214234"="c:\program files\Microsoft Student\Microsoft Student with Encarta Premium 2009 DVD\EDICT.EXE" [2008-06-03 351000]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-13 1695232]
"Hotkey CD Eject"="c:\program files\Hotkey CD Eject\cdeject.exe" [2003-02-20 597504]
"AllToTray"="c:\program files\AllToTray\AllToTray.exe" [2009-03-04 728576]
"Second Copy"="c:\program files\SecCopy\SecCopy.exe" [2007-10-17 2425856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BJCFD"="c:\program files\BroadJump\Client Foundation\CFD.exe" [2002-09-10 368706]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-03 13529088]
"WinSys2"="c:\windows\system32\winsys2.exe" [2008-01-18 208896]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-03 86016]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]
"itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2008-06-10 1442888]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"Acrobat Assistant 7.0"="c:\program files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2004-12-14 483328]
"HP Software Update"="c:\program files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2004-02-18 49152]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb10.exe" [2004-03-04 172032]
"HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 241664]
"Recordpad"="c:\program files\NCH Swift Sound\Recordpad\recordpad.exe" [2009-03-20 577540]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-03-12 342312]
"RTHDCPL"="RTHDCPL.EXE" [2006-12-18 c:\windows\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 c:\windows\SkyTel.exe]
"nwiz"="nwiz.exe" [2008-05-03 c:\windows\system32\nwiz.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Acrobat Speed Launcher.lnk - c:\windows\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe [2009-03-08 25214]
Device Detector 3.lnk - c:\program files\Olympus\DeviceDetector\DevDtct2.exe [2009-02-28 114688]
Directrec Configuration Tool.lnk - c:\program files\Olympus\DSSPlayer\DirectrecConfig.exe [2009-02-28 122880]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-03-11 210520]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Maxthon2\\Modules\\MxDownloader\\MxDownloadServer.exe"=
"c:\\Program Files\\Macromedia\\Dreamweaver 8\\Dreamweaver.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\Graboid\\GraboidVideo\\1.4.0.0\\DLManager\\GraboidDLManager.exe"=
"c:\\Program Files\\FTP Now\\FTPNow.exe"=
"c:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724

R0 d344bus;d344bus;c:\windows\system32\drivers\d344bus.sys [2009-02-28 137216]
R0 d344prt;d344prt;c:\windows\system32\drivers\d344prt.sys [2009-02-28 5248]
R0 Si3531;SiI-3531 SATA Controller;c:\windows\system32\drivers\Si3531.sys [2009-02-25 210224]
S2 hpdj00;hpdj00;c:\docume~1\NANCYG~1\LOCALS~1\Temp\hpdj00.exe -servicerunning=true -uninstall=HP Deskjet 6500 Series -product=6500 --> c:\docume~1\NANCYG~1\LOCALS~1\Temp\hpdj00.exe -servicerunning=true -uninstall=HP Deskjet 6500 Series -product=6500 [?]
S3 autorun;autorun;\??\c:\huadio.tmp --> c:\huadio.tmp [?]
S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [2009-02-28 33752]
S3 hcdriver;EHCI;c:\windows\system32\drivers\hcdriver.sys [2009-04-01 50304]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4e0fbcfd-0866-11de-b4e8-0019dbcd1b0e}]
\Shell\AutoRun\command - O:\LaunchU3.exe -a
.
Contents of the 'Scheduled Tasks' folder

2009-04-08 c:\windows\Tasks\XoftSpySE 2.job
- c:\program files\XoftSpySE\XoftSpy.exe [2007-07-13 06:43]

2009-04-07 c:\windows\Tasks\XoftSpySE.job
- c:\program files\XoftSpySE\XoftSpy.exe [2007-07-13 06:43]
.
- - - - ORPHANS REMOVED - - - -

Notify-avgrsstarter - avgrsstx.dll

.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/ig?gl=all
mStart Page = hxxp://www.google.com/ig?gl=all
uInternet Settings,ProxyOverride = *.local
IE: Copy plain text for WhizFolders - c:\program files\WhizFolders Organizer Deluxe\copytool.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Fill Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
IE: RoboForm Toolbar - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
IE: Save Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
Trusted Zone: com.tw\asia.msi
Trusted Zone: com.tw\global.msi
Trusted Zone: com.tw\www.msi
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} - hxxp://liveupdate.msi.com.tw/autobios/L ... nstall.cab
FF - ProfilePath - c:\documents and settings\NancyGail\Application Data\Mozilla\Firefox\Profiles\ldjw8pvk.default\
FF - component: c:\documents and settings\NancyGail\Application Data\Mozilla\Firefox\Profiles\ldjw8pvk.default\extensions\{22119944-ED35-4ab1-910B-E619EA06A115}\components\rfproxy_27.dll
.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-07 19:26:16
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\autorun]
"ImagePath"="\??\c:\huadio.tmp"
.
Completion time: 2009-04-07 19:27:01
ComboFix-quarantined-files.txt 2009-04-08 02:26:59
ComboFix2.txt 2009-04-08 01:55:08
ComboFix3.txt 2009-04-08 01:44:58

Pre-Run: 67,553,652,736 bytes free
Post-Run: 67,544,166,400 bytes free

296 --- E O F --- 2009-03-20 10:23:10

ComboFix 09-04-04.01 - NancyGail 2009-04-07 18:53:11.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3071.2476 [GMT -7:00]
Running from: c:\documents and settings\NancyGail\Desktop\ComboFix.exe
.

((((((((((((((((((((((((( Files Created from 2009-03-08 to 2009-04-08 )))))))))))))))))))))))))))))))
.

2009-04-07 18:29 . 2009-04-07 18:29 <DIR> d-------- c:\program files\ERUNT
2009-04-07 13:43 . 2009-04-07 13:43 <DIR> d-------- c:\program files\twhirl
2009-04-02 06:47 . 2009-04-02 06:47 43,585 --a------ C:\BillingTracker.elf
2009-04-01 18:46 . 2009-04-01 18:50 <DIR> d-------- c:\documents and settings\NancyGail\Application Data\Uniblue
2009-04-01 18:46 . 2009-04-01 18:50 <DIR> d-------- c:\documents and settings\All Users\Application Data\DriverScanner
2009-04-01 18:23 . 2009-04-01 18:25 <DIR> d-------- c:\program files\USB-IF Test Suite
2009-04-01 18:23 . 2008-04-17 14:40 50,304 --a------ c:\windows\system32\drivers\hcdriver.sys
2009-03-31 10:42 . 2009-03-31 10:42 <DIR> d-------- c:\documents and settings\NancyGail\Application Data\Centered Systems
2009-03-31 10:36 . 2009-03-31 10:38 <DIR> d-------- c:\program files\SecCopy
2009-03-31 10:36 . 2006-12-21 15:18 497,496 --a------ c:\windows\system32\XceedZip.dll
2009-03-30 10:03 . 2009-03-30 10:03 <DIR> d-------- c:\program files\Trend Micro
2009-03-29 10:58 . 2009-03-29 10:58 <DIR> d-------- c:\program files\Fraps
2009-03-29 09:24 . 2009-04-04 06:56 <DIR> d-------- c:\program files\XoftSpySE
2009-03-28 09:47 . 2001-05-11 13:18 420,240 --a------ c:\windows\system32\mpg4c32.dll
2009-03-28 09:47 . 2001-05-16 17:54 309,616 --a------ c:\windows\system32\wmv8dmod.dll
2009-03-28 09:47 . 2001-03-26 04:41 245,760 --a------ c:\windows\system32\mp4sds32.ax
2009-03-28 09:45 . 2009-03-29 10:56 <DIR> d-------- c:\program files\Game Cam
2009-03-25 14:33 . 2009-03-25 14:51 <DIR> d-------- c:\program files\Game Cam V2
2009-03-24 14:54 . 2009-03-24 14:54 5,242,934 --ah----- c:\windows\system32\toyhide.bmp
2009-03-24 14:24 . 2009-03-24 14:24 187,072 --a------ c:\windows\walltoyUninst.exe
2009-03-23 10:36 . 2009-03-23 10:36 <DIR> d-------- c:\program files\IrfanView
2009-03-21 13:21 . 2009-03-21 13:21 <DIR> d-------- c:\program files\Hotkey CD Eject
2009-03-20 11:24 . 2009-03-20 11:24 <DIR> d-------- c:\program files\iTunes
2009-03-20 11:24 . 2009-03-20 11:24 <DIR> d-------- c:\program files\iPod
2009-03-20 11:24 . 2009-03-20 11:24 <DIR> d-------- c:\program files\Common Files\Apple
2009-03-20 11:24 . 2009-03-20 11:24 <DIR> d-------- c:\program files\Bonjour
2009-03-20 11:24 . 2009-03-20 11:24 <DIR> d-------- c:\documents and settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
2009-03-20 11:24 . 2008-04-17 12:12 107,368 --a------ c:\windows\system32\GEARAspi.dll
2009-03-20 11:24 . 2009-01-15 12:19 23,848 --a------ c:\windows\system32\drivers\GEARAspiWDM.sys
2009-03-20 11:02 . 2009-03-20 11:02 <DIR> d-------- c:\program files\NCH Software
2009-03-20 11:02 . 2009-03-20 11:02 <DIR> d-------- c:\documents and settings\NancyGail\Application Data\Recordpad
2009-03-20 11:02 . 2009-03-20 11:02 <DIR> d-------- c:\documents and settings\NancyGail\Application Data\NCH Swift Sound
2009-03-20 11:02 . 2009-03-20 11:02 <DIR> d-------- c:\documents and settings\All Users\Application Data\NCH Swift Sound
2009-03-20 11:01 . 2009-03-20 11:02 <DIR> d-------- c:\program files\NCH Swift Sound
2009-03-20 10:50 . 2009-03-20 11:11 <DIR> d-------- c:\program files\All Sound Recorder XP
2009-03-19 10:33 . 2009-03-19 10:33 <DIR> d-------- c:\program files\MAPILab Ltd
2009-03-19 10:13 . 2009-03-19 10:13 <DIR> dr-h----- C:\MSOCache
2009-03-19 10:13 . 2009-03-20 03:23 <DIR> d-------- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-03-19 03:00 . 2009-03-19 03:00 <DIR> d-------- c:\program files\Microsoft CAPICOM 2.1.0.2
2009-03-18 10:49 . 2009-03-18 10:49 2,344 --a------ c:\windows\hpbvspst.his
2009-03-18 10:49 . 2009-03-18 10:49 414 --a------ c:\windows\hpbvspst.ini
2009-03-18 10:44 . 2009-04-03 17:16 50,895 --a------ c:\windows\hpdj6500.hi2
2009-03-18 10:44 . 2009-04-03 17:16 8,768 --a------ c:\windows\hpdj6500.bu2
2009-03-18 10:35 . 2003-12-11 11:15 626,960 -ra------ c:\windows\system32\hpvaut32.dll
2009-03-18 10:35 . 2003-12-11 11:15 487,424 -ra------ c:\windows\system32\hpvcp70.dll
2009-03-18 10:35 . 2003-12-11 11:15 344,064 -ra------ c:\windows\system32\hpvcr70.dll
2009-03-18 10:35 . 2003-12-11 11:15 44,544 -ra------ c:\windows\system32\MSXML4a.dll
2009-03-18 10:30 . 2009-04-03 17:18 42,237 --a------ c:\windows\hpdj6500.hi1
2009-03-18 10:30 . 2009-04-03 17:18 5,586 --a------ c:\windows\hpdj6500.bu1
2009-03-14 15:58 . 2009-03-14 15:58 <DIR> d-------- c:\program files\Common Files\Blizzard Entertainment
2009-03-12 09:11 . 2009-03-12 09:11 <DIR> d-------- c:\program files\Realtek Sound Manager
2009-03-12 09:11 . 2009-03-12 09:11 <DIR> d-------- c:\program files\Realtek AC97
2009-03-12 09:11 . 2009-03-12 09:11 <DIR> d-------- c:\program files\AvRack
2009-03-12 09:11 . 2006-03-22 16:23 10,524,672 --a------ c:\windows\system32\RTLCPL.exe
2009-03-12 09:11 . 2006-03-31 14:38 3,960,896 -ra------ c:\windows\system32\drivers\alcxwdm.sys
2009-03-12 09:11 . 2006-03-20 11:48 315,392 --a------ c:\windows\alcupd.exe
2009-03-12 09:11 . 2005-11-18 11:20 217,088 --a------ c:\windows\alcrmv.exe
2009-03-12 09:11 . 2002-02-05 13:54 141,016 --a------ c:\windows\system32\alsndmgr.wav
2009-03-12 09:11 . 2006-01-10 13:38 135,168 --a------ c:\windows\system32\RtlCPAPI.dll
2009-03-12 09:11 . 2001-07-06 00:19 164 --a------ c:\windows\avrack.ini
2009-03-10 10:15 . 2009-03-10 10:15 <DIR> d-------- c:\program files\MSECache
2009-03-08 13:11 . 2009-03-08 13:11 <DIR> d-------- c:\program files\FTP Now
2009-03-08 08:47 . 2009-03-08 08:47 <DIR> d-------- c:\documents and settings\NancyGail\Application Data\AdobeUM
2009-03-08 08:46 . 2009-03-08 08:46 <DIR> d-------- c:\program files\Common Files\Adobe Systems Shared
2009-03-08 08:46 . 2009-03-08 08:46 <DIR> d-------- c:\documents and settings\All Users\Application Data\Adobe Systems

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-08 01:53 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-04-08 01:52 --------- d-----w c:\documents and settings\All Users\Application Data\avg8
2009-04-08 01:42 --------- d-----w c:\documents and settings\NancyGail\Application Data\nView_Wallpaper
2009-04-08 00:56 --------- d-----w c:\documents and settings\NancyGail\Application Data\UseNeXT
2009-04-07 23:13 --------- d-----w c:\program files\BillingTracker Pro 4
2009-04-06 12:35 --------- d-----w c:\documents and settings\NancyGail\Application Data\ZoomBrowser EX
2009-04-06 12:35 --------- d-----w c:\documents and settings\All Users\Application Data\ZoomBrowser
2009-04-05 19:54 --------- d-----w c:\documents and settings\NancyGail\Application Data\U3
2009-04-02 23:37 --------- d-----w c:\program files\World of Warcraft
2009-04-01 00:35 5,014 --sha-w c:\windows\system32\KGyGaAvL.sys
2009-03-29 17:56 --------- d--h--w c:\program files\InstallShield Installation Information
2009-03-25 21:33 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2009-03-24 17:18 --------- d-----w c:\program files\UseNeXT
2009-03-20 18:25 --------- d-----w c:\documents and settings\NancyGail\Application Data\Apple Computer
2009-03-20 18:24 --------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer
2009-03-19 17:34 --------- d-----w c:\program files\Rules Manager
2009-03-18 17:50 --------- d-----w c:\program files\HP
2009-03-18 17:50 --------- d-----w c:\program files\Hewlett-Packard
2009-03-17 19:52 --------- d-----w c:\program files\WhizFolders Organizer Deluxe
2009-03-15 19:47 --------- d-----w c:\program files\Maxthon2
2009-03-08 15:46 --------- d-----w c:\program files\Common Files\Adobe
2009-03-05 00:20 --------- d-----w c:\program files\Amara - Flash Photo Animation Software
2009-03-04 23:45 --------- d-----w c:\program files\FastStone Photo Resizer
2009-03-04 23:45 --------- d-----w c:\documents and settings\NancyGail\Application Data\FastStone
2009-03-04 22:51 --------- d-----w c:\program files\Flash Slideshow Maker Professional
2009-03-04 22:48 --------- d-----w c:\program files\Microsoft Student
2009-03-04 19:43 --------- d-----w c:\documents and settings\NancyGail\Application Data\ColorCop
2009-03-04 19:18 --------- d-----w c:\program files\AllToTray
2009-03-04 02:57 --------- d-----w c:\program files\Cool MP3 Splitter
2009-03-03 22:35 --------- d-----w c:\program files\Common Files\AVSMedia
2009-03-03 22:35 --------- d-----w c:\program files\AVS4YOU
2009-03-03 21:12 --------- d-----w c:\documents and settings\NancyGail\Application Data\vlc
2009-03-03 19:56 --------- d-----w c:\program files\Canon
2009-03-03 17:13 --------- d-----w c:\documents and settings\NancyGail\Application Data\AVS4YOU
2009-03-03 17:13 --------- d-----w c:\documents and settings\All Users\Application Data\AVS4YOU
2009-03-03 03:09 --------- d-----w c:\program files\Graboid
2009-03-03 03:03 --------- d-----w c:\documents and settings\NancyGail\Application Data\Graboid Inc
2009-03-02 19:02 --------- d-----w c:\program files\Collectorz.com
2009-03-02 16:56 --------- d-----w c:\documents and settings\NancyGail\Application Data\Rules Manager
2009-03-02 01:50 --------- d-----w c:\program files\D-Tools
2009-03-02 00:25 --------- d-----w c:\program files\Unlocker
2009-03-01 21:59 --------- d-----w c:\program files\Mozilla ActiveX Control v1.7.12
2009-03-01 21:59 --------- d-----w c:\documents and settings\NancyGail\Application Data\MozillaControl
2009-03-01 21:59 --------- d-----w c:\documents and settings\All Users\Application Data\Graboid Inc
2009-03-01 16:21 --------- d-----w c:\documents and settings\NancyGail\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2009-03-01 04:55 --------- d-----w c:\program files\eMule
2009-03-01 03:48 --------- d-----w c:\program files\VideoLAN
2009-03-01 03:44 --------- d-----w c:\program files\NOS
2009-03-01 03:44 --------- d-----w c:\documents and settings\All Users\Application Data\NOS
2009-03-01 02:51 --------- d-----w c:\program files\MSBuild
2009-03-01 02:50 --------- d-----w c:\program files\Reference Assemblies
2009-03-01 02:48 --------- d-----w c:\program files\MSXML 4.0
2009-03-01 02:27 121,887 ----a-w c:\windows\File Renamer - Basic Uninstaller.exe
2009-03-01 02:27 --------- d-----w c:\program files\File Renamer
2009-03-01 01:36 --------- d-----w c:\program files\Lakefront Software
2009-03-01 01:17 --------- d-----w c:\documents and settings\All Users\Application Data\WEBREG
2009-03-01 01:15 --------- d-----w c:\program files\Common Files\HP
2009-03-01 01:15 --------- d-----w c:\program files\Common Files\Hewlett-Packard
2009-03-01 01:15 --------- d-----w c:\documents and settings\All Users\Application Data\HP
2009-03-01 01:14 --------- d-----w c:\documents and settings\All Users\Application Data\Hewlett-Packard
2009-03-01 01:07 --------- d-----w c:\program files\PDFCreator
2009-03-01 00:44 --------- d-----w c:\documents and settings\NancyGail\Application Data\AvniTech
2009-03-01 00:39 --------- d-----w c:\program files\Color_Cop
2009-03-01 00:37 6,144 ----a-w c:\windows\system32\drivers\NTIDrvr.sys
2009-03-01 00:37 --------- d-----w c:\program files\NewTech Infosystems
2009-03-01 00:37 --------- d-----w c:\program files\Common Files\NewTech Infosystems
2009-03-01 00:37 --------- d-----w c:\program files\Common Files\muvee Technologies
2009-03-01 00:31 --------- d-----w c:\program files\TweetDeck
2009-03-01 00:31 --------- d-----w c:\documents and settings\NancyGail\Application Data\TweetDeckFast.F9107117265DB7542C1A806C8DB837742CE14C21.1
2009-02-28 23:26 --------- d-----w c:\program files\Common Files\Adobe AIR
2009-02-28 23:26 --------- d-----w c:\documents and settings\NancyGail\Application Data\de.makesoft.twhirl.0EA062BC275E7ED1E6EC3762EFFD73C7158ADF33.1
2009-02-28 23:17 --------- d-----w c:\program files\MediaMonkey
2009-02-28 23:11 --------- d-----w c:\program files\Olympus
2009-02-28 23:09 --------- d-----w c:\program files\Common Files\InstallShield
2009-02-28 23:07 --------- d-----w c:\program files\Common Files\Canon
2009-02-28 23:00 --------- d-----w c:\program files\Microsoft IntelliType Pro
2009-02-28 22:55 0 ---ha-w c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2009-02-28 22:55 0 ---ha-w c:\windows\system32\drivers\Msft_Kernel_NuidFltr_01005.Wdf
2009-02-28 22:50 --------- d-----w c:\program files\AVG
2009-02-28 22:45 --------- d-----w c:\program files\Corel
2009-02-28 22:45 --------- d-----w c:\program files\Common Files\Corel
2009-02-28 22:45 --------- d-----w c:\documents and settings\NancyGail\Application Data\Corel
2009-02-28 22:45 --------- d-----w c:\documents and settings\All Users\Application Data\InstallShield
2009-02-28 22:18 --------- d-----w c:\documents and settings\All Users\Application Data\Corel
2009-02-28 22:15 --------- d-----w c:\documents and settings\NancyGail\Application Data\InstallShield
2009-02-28 22:00 --------- d-----w c:\program files\Macromedia
2009-02-28 22:00 --------- d-----w c:\program files\Common Files\Macromedia
2009-02-28 21:50 --------- d-----w c:\program files\QuickTime
2009-02-28 21:49 --------- d-----w c:\program files\Apple Software Update
2009-02-28 21:49 --------- d-----w c:\documents and settings\All Users\Application Data\Apple
2009-02-28 20:43 --------- d-----w c:\documents and settings\NancyGail\Application Data\MxBoost
2009-02-28 20:40 --------- d-----w c:\program files\TechHit.com
2009-02-28 19:31 --------- d-----w c:\program files\Windows Live SkyDrive
2009-02-28 19:31 --------- d-----w c:\program files\Windows Live
2009-02-28 19:31 --------- d-----w c:\program files\Microsoft
2009-02-28 19:30 --------- d-----w c:\program files\Microsoft.NET
2009-02-28 19:30 --------- d-----w c:\program files\Microsoft ActiveSync
2009-02-28 19:27 --------- d-----w c:\program files\Common Files\Windows Live
2009-02-28 19:11 --------- d-----w c:\documents and settings\All Users\Application Data\nView_Profiles
2009-02-28 19:02 --------- d-----w c:\program files\Setup Files
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-28 3885408]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"L09AXLRD_139214234"="c:\program files\Microsoft Student\Microsoft Student with Encarta Premium 2009 DVD\EDICT.EXE" [2008-06-03 351000]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-13 1695232]
"Hotkey CD Eject"="c:\program files\Hotkey CD Eject\cdeject.exe" [2003-02-20 597504]
"AllToTray"="c:\program files\AllToTray\AllToTray.exe" [2009-03-04 728576]
"Second Copy"="c:\program files\SecCopy\SecCopy.exe" [2007-10-17 2425856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BJCFD"="c:\program files\BroadJump\Client Foundation\CFD.exe" [2002-09-10 368706]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-03 13529088]
"WinSys2"="c:\windows\system32\winsys2.exe" [2008-01-18 208896]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-03 86016]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]
"itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2008-06-10 1442888]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"Acrobat Assistant 7.0"="c:\program files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2004-12-14 483328]
"HP Software Update"="c:\program files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2004-02-18 49152]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb10.exe" [2004-03-04 172032]
"HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 241664]
"Recordpad"="c:\program files\NCH Swift Sound\Recordpad\recordpad.exe" [2009-03-20 577540]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-03-12 342312]
"RTHDCPL"="RTHDCPL.EXE" [2006-12-18 c:\windows\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 c:\windows\SkyTel.exe]
"nwiz"="nwiz.exe" [2008-05-03 c:\windows\system32\nwiz.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Acrobat Speed Launcher.lnk - c:\windows\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe [2009-03-08 25214]
Device Detector 3.lnk - c:\program files\Olympus\DeviceDetector\DevDtct2.exe [2009-02-28 114688]
Directrec Configuration Tool.lnk - c:\program files\Olympus\DSSPlayer\DirectrecConfig.exe [2009-02-28 122880]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-03-11 210520]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Maxthon2\\Modules\\MxDownloader\\MxDownloadServer.exe"=
"c:\\Program Files\\Macromedia\\Dreamweaver 8\\Dreamweaver.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\Graboid\\GraboidVideo\\1.4.0.0\\DLManager\\GraboidDLManager.exe"=
"c:\\Program Files\\FTP Now\\FTPNow.exe"=
"c:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724

R0 d344bus;d344bus;c:\windows\system32\drivers\d344bus.sys [2009-02-28 137216]
R0 d344prt;d344prt;c:\windows\system32\drivers\d344prt.sys [2009-02-28 5248]
R0 Si3531;SiI-3531 SATA Controller;c:\windows\system32\drivers\Si3531.sys [2009-02-25 210224]
R4 AvgRkx86;avgrkx86.sys;c:\windows\system32\Drivers\avgrkx86.sys --> c:\windows\system32\Drivers\avgrkx86.sys [?]
S2 hpdj00;hpdj00;c:\docume~1\NANCYG~1\LOCALS~1\Temp\hpdj00.exe -servicerunning=true -uninstall=HP Deskjet 6500 Series -product=6500 --> c:\docume~1\NANCYG~1\LOCALS~1\Temp\hpdj00.exe -servicerunning=true -uninstall=HP Deskjet 6500 Series -product=6500 [?]
S3 autorun;autorun;\??\c:\huadio.tmp --> c:\huadio.tmp [?]
S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [2009-02-28 33752]
S3 hcdriver;EHCI;c:\windows\system32\drivers\hcdriver.sys [2009-04-01 50304]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - HPDJ00
*Deregistered* - AvgLdx86

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4e0fbcfd-0866-11de-b4e8-0019dbcd1b0e}]
\Shell\AutoRun\command - O:\LaunchU3.exe -a
.
Contents of the 'Scheduled Tasks' folder

2009-04-08 c:\windows\Tasks\XoftSpySE 2.job
- c:\program files\XoftSpySE\XoftSpy.exe [2007-07-13 06:43]

2009-04-07 c:\windows\Tasks\XoftSpySE.job
- c:\program files\XoftSpySE\XoftSpy.exe [2007-07-13 06:43]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/ig?gl=all
mStart Page = hxxp://www.google.com/ig?gl=all
uInternet Settings,ProxyOverride = *.local
IE: Copy plain text for WhizFolders - c:\program files\WhizFolders Organizer Deluxe\copytool.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Fill Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
IE: RoboForm Toolbar - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
IE: Save Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
Trusted Zone: com.tw\asia.msi
Trusted Zone: com.tw\global.msi
Trusted Zone: com.tw\www.msi
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} - hxxp://liveupdate.msi.com.tw/autobios/L ... nstall.cab
FF - ProfilePath - c:\documents and settings\NancyGail\Application Data\Mozilla\Firefox\Profiles\ldjw8pvk.default\
FF - component: c:\documents and settings\NancyGail\Application Data\Mozilla\Firefox\Profiles\ldjw8pvk.default\extensions\{22119944-ED35-4ab1-910B-E619EA06A115}\components\rfproxy_27.dll
.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-07 18:54:18
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\autorun]
"ImagePath"="\??\c:\huadio.tmp"
.
Completion time: 2009-04-07 18:55:06
ComboFix-quarantined-files.txt 2009-04-08 01:55:04
ComboFix2.txt 2009-04-08 01:44:58

Pre-Run: 67,436,482,560 bytes free
Post-Run: 67,419,357,184 bytes free

298 --- E O F --- 2009-03-20 10:23:10

ComboFix 09-04-04.01 - NancyGail 2009-04-07 18:34:56.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3071.2243 [GMT -7:00]
Running from: c:\documents and settings\NancyGail\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\adetuled.ini
c:\windows\system32\AutoRun.inf
c:\windows\system32\ayizales.ini
c:\windows\system32\egeyuzut.ini
c:\windows\system32\igetavip.ini
c:\windows\system32\otobarub.ini
c:\windows\system32\ujabizeg.ini
c:\windows\system32\unomugos.ini

.
((((((((((((((((((((((((( Files Created from 2009-03-08 to 2009-04-08 )))))))))))))))))))))))))))))))
.

2009-04-07 18:29 . 2009-04-07 18:29 <DIR> d-------- c:\program files\ERUNT
2009-04-07 13:43 . 2009-04-07 13:43 <DIR> d-------- c:\program files\twhirl
2009-04-02 06:47 . 2009-04-02 06:47 43,585 --a------ C:\BillingTracker.elf
2009-04-01 18:46 . 2009-04-01 18:50 <DIR> d-------- c:\documents and settings\NancyGail\Application Data\Uniblue
2009-04-01 18:46 . 2009-04-01 18:50 <DIR> d-------- c:\documents and settings\All Users\Application Data\DriverScanner
2009-04-01 18:23 . 2009-04-01 18:25 <DIR> d-------- c:\program files\USB-IF Test Suite
2009-04-01 18:23 . 2008-04-17 14:40 50,304 --a------ c:\windows\system32\drivers\hcdriver.sys
2009-03-31 10:42 . 2009-03-31 10:42 <DIR> d-------- c:\documents and settings\NancyGail\Application Data\Centered Systems
2009-03-31 10:36 . 2009-03-31 10:38 <DIR> d-------- c:\program files\SecCopy
2009-03-31 10:36 . 2006-12-21 15:18 497,496 --a------ c:\windows\system32\XceedZip.dll
2009-03-30 10:03 . 2009-03-30 10:03 <DIR> d-------- c:\program files\Trend Micro
2009-03-29 10:58 . 2009-03-29 10:58 <DIR> d-------- c:\program files\Fraps
2009-03-29 09:24 . 2009-04-04 06:56 <DIR> d-------- c:\program files\XoftSpySE
2009-03-28 09:47 . 2001-05-11 13:18 420,240 --a------ c:\windows\system32\mpg4c32.dll
2009-03-28 09:47 . 2001-05-16 17:54 309,616 --a------ c:\windows\system32\wmv8dmod.dll
2009-03-28 09:47 . 2001-03-26 04:41 245,760 --a------ c:\windows\system32\mp4sds32.ax
2009-03-28 09:45 . 2009-03-29 10:56 <DIR> d-------- c:\program files\Game Cam
2009-03-25 14:33 . 2009-03-25 14:51 <DIR> d-------- c:\program files\Game Cam V2
2009-03-24 14:54 . 2009-03-24 14:54 5,242,934 --ah----- c:\windows\system32\toyhide.bmp
2009-03-24 14:24 . 2009-03-24 14:24 187,072 --a------ c:\windows\walltoyUninst.exe
2009-03-23 10:36 . 2009-03-23 10:36 <DIR> d-------- c:\program files\IrfanView
2009-03-21 13:21 . 2009-03-21 13:21 <DIR> d-------- c:\program files\Hotkey CD Eject
2009-03-20 11:24 . 2009-03-20 11:24 <DIR> d-------- c:\program files\iTunes
2009-03-20 11:24 . 2009-03-20 11:24 <DIR> d-------- c:\program files\iPod
2009-03-20 11:24 . 2009-03-20 11:24 <DIR> d-------- c:\program files\Common Files\Apple
2009-03-20 11:24 . 2009-03-20 11:24 <DIR> d-------- c:\program files\Bonjour
2009-03-20 11:24 . 2009-03-20 11:24 <DIR> d-------- c:\documents and settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
2009-03-20 11:24 . 2008-04-17 12:12 107,368 --a------ c:\windows\system32\GEARAspi.dll
2009-03-20 11:24 . 2009-01-15 12:19 23,848 --a------ c:\windows\system32\drivers\GEARAspiWDM.sys
2009-03-20 11:02 . 2009-03-20 11:02 <DIR> d-------- c:\program files\NCH Software
2009-03-20 11:02 . 2009-03-20 11:02 <DIR> d-------- c:\documents and settings\NancyGail\Application Data\Recordpad
2009-03-20 11:02 . 2009-03-20 11:02 <DIR> d-------- c:\documents and settings\NancyGail\Application Data\NCH Swift Sound
2009-03-20 11:02 . 2009-03-20 11:02 <DIR> d-------- c:\documents and settings\All Users\Application Data\NCH Swift Sound
2009-03-20 11:01 . 2009-03-20 11:02 <DIR> d-------- c:\program files\NCH Swift Sound
2009-03-20 10:50 . 2009-03-20 11:11 <DIR> d-------- c:\program files\All Sound Recorder XP
2009-03-19 10:33 . 2009-03-19 10:33 <DIR> d-------- c:\program files\MAPILab Ltd
2009-03-19 10:13 . 2009-03-19 10:13 <DIR> dr-h----- C:\MSOCache
2009-03-19 10:13 . 2009-03-20 03:23 <DIR> d-------- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-03-19 03:00 . 2009-03-19 03:00 <DIR> d-------- c:\program files\Microsoft CAPICOM 2.1.0.2
2009-03-18 10:49 . 2009-03-18 10:49 2,344 --a------ c:\windows\hpbvspst.his
2009-03-18 10:49 . 2009-03-18 10:49 414 --a------ c:\windows\hpbvspst.ini
2009-03-18 10:44 . 2009-04-03 17:16 50,895 --a------ c:\windows\hpdj6500.hi2
2009-03-18 10:44 . 2009-04-03 17:16 8,768 --a------ c:\windows\hpdj6500.bu2
2009-03-18 10:35 . 2003-12-11 11:15 626,960 -ra------ c:\windows\system32\hpvaut32.dll
2009-03-18 10:35 . 2003-12-11 11:15 487,424 -ra------ c:\windows\system32\hpvcp70.dll
2009-03-18 10:35 . 2003-12-11 11:15 344,064 -ra------ c:\windows\system32\hpvcr70.dll
2009-03-18 10:35 . 2003-12-11 11:15 44,544 -ra------ c:\windows\system32\MSXML4a.dll
2009-03-18 10:30 . 2009-04-03 17:18 42,237 --a------ c:\windows\hpdj6500.hi1
2009-03-18 10:30 . 2009-04-03 17:18 5,586 --a------ c:\windows\hpdj6500.bu1
2009-03-14 15:58 . 2009-03-14 15:58 <DIR> d-------- c:\program files\Common Files\Blizzard Entertainment
2009-03-12 09:11 . 2009-03-12 09:11 <DIR> d-------- c:\program files\Realtek Sound Manager
2009-03-12 09:11 . 2009-03-12 09:11 <DIR> d-------- c:\program files\Realtek AC97
2009-03-12 09:11 . 2009-03-12 09:11 <DIR> d-------- c:\program files\AvRack
2009-03-12 09:11 . 2006-03-22 16:23 10,524,672 --a------ c:\windows\system32\RTLCPL.exe
2009-03-12 09:11 . 2006-03-31 14:38 3,960,896 -ra------ c:\windows\system32\drivers\alcxwdm.sys
2009-03-12 09:11 . 2006-03-20 11:48 315,392 --a------ c:\windows\alcupd.exe
2009-03-12 09:11 . 2005-11-18 11:20 217,088 --a------ c:\windows\alcrmv.exe
2009-03-12 09:11 . 2002-02-05 13:54 141,016 --a------ c:\windows\system32\alsndmgr.wav
2009-03-12 09:11 . 2006-01-10 13:38 135,168 --a------ c:\windows\system32\RtlCPAPI.dll
2009-03-12 09:11 . 2001-07-06 00:19 164 --a------ c:\windows\avrack.ini
2009-03-10 10:15 . 2009-03-10 10:15 <DIR> d-------- c:\program files\MSECache
2009-03-08 13:11 . 2009-03-08 13:11 <DIR> d-------- c:\program files\FTP Now
2009-03-08 08:47 . 2009-03-08 08:47 <DIR> d-------- c:\documents and settings\NancyGail\Application Data\AdobeUM
2009-03-08 08:46 . 2009-03-08 08:46 <DIR> d-------- c:\program files\Common Files\Adobe Systems Shared
2009-03-08 08:46 . 2009-03-08 08:46 <DIR> d-------- c:\documents and settings\All Users\Application Data\Adobe Systems

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-08 01:42 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-04-08 01:42 --------- d-----w c:\documents and settings\NancyGail\Application Data\nView_Wallpaper
2009-04-08 00:56 --------- d-----w c:\documents and settings\NancyGail\Application Data\UseNeXT
2009-04-07 23:13 --------- d-----w c:\program files\BillingTracker Pro 4
2009-04-06 12:59 --------- d-----w c:\documents and settings\All Users\Application Data\avg8
2009-04-06 12:35 --------- d-----w c:\documents and settings\NancyGail\Application Data\ZoomBrowser EX
2009-04-06 12:35 --------- d-----w c:\documents and settings\All Users\Application Data\ZoomBrowser
2009-04-05 19:54 --------- d-----w c:\documents and settings\NancyGail\Application Data\U3
2009-04-02 23:37 --------- d-----w c:\program files\World of Warcraft
2009-03-29 17:56 --------- d--h--w c:\program files\InstallShield Installation Information
2009-03-25 21:33 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2009-03-24 17:18 --------- d-----w c:\program files\UseNeXT
2009-03-20 18:25 --------- d-----w c:\documents and settings\NancyGail\Application Data\Apple Computer
2009-03-20 18:24 --------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer
2009-03-19 17:34 --------- d-----w c:\program files\Rules Manager
2009-03-18 17:50 --------- d-----w c:\program files\HP
2009-03-18 17:50 --------- d-----w c:\program files\Hewlett-Packard
2009-03-17 19:52 --------- d-----w c:\program files\WhizFolders Organizer Deluxe
2009-03-17 15:24 325,640 ----a-w c:\windows\system32\drivers\avgldx86.sys
2009-03-15 19:47 --------- d-----w c:\program files\Maxthon2
2009-03-08 15:46 --------- d-----w c:\program files\Common Files\Adobe
2009-03-05 00:20 --------- d-----w c:\program files\Amara - Flash Photo Animation Software
2009-03-04 23:45 --------- d-----w c:\program files\FastStone Photo Resizer
2009-03-04 23:45 --------- d-----w c:\documents and settings\NancyGail\Application Data\FastStone
2009-03-04 22:51 --------- d-----w c:\program files\Flash Slideshow Maker Professional
2009-03-04 22:48 --------- d-----w c:\program files\Microsoft Student
2009-03-04 19:43 --------- d-----w c:\documents and settings\NancyGail\Application Data\ColorCop
2009-03-04 19:18 --------- d-----w c:\program files\AllToTray
2009-03-04 02:57 --------- d-----w c:\program files\Cool MP3 Splitter
2009-03-03 22:35 --------- d-----w c:\program files\Common Files\AVSMedia
2009-03-03 22:35 --------- d-----w c:\program files\AVS4YOU
2009-03-03 21:12 --------- d-----w c:\documents and settings\NancyGail\Application Data\vlc
2009-03-03 19:56 --------- d-----w c:\program files\Canon
2009-03-03 17:13 --------- d-----w c:\documents and settings\NancyGail\Application Data\AVS4YOU
2009-03-03 17:13 --------- d-----w c:\documents and settings\All Users\Application Data\AVS4YOU
2009-03-03 03:09 --------- d-----w c:\program files\Graboid
2009-03-03 03:03 --------- d-----w c:\documents and settings\NancyGail\Application Data\Graboid Inc
2009-03-02 19:02 --------- d-----w c:\program files\Collectorz.com
2009-03-02 16:56 --------- d-----w c:\documents and settings\NancyGail\Application Data\Rules Manager
2009-03-02 01:50 --------- d-----w c:\program files\D-Tools
2009-03-02 00:25 --------- d-----w c:\program files\Unlocker
2009-03-01 21:59 --------- d-----w c:\program files\Mozilla ActiveX Control v1.7.12
2009-03-01 21:59 --------- d-----w c:\documents and settings\NancyGail\Application Data\MozillaControl
2009-03-01 21:59 --------- d-----w c:\documents and settings\All Users\Application Data\Graboid Inc
2009-03-01 16:21 --------- d-----w c:\documents and settings\NancyGail\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2009-03-01 04:55 --------- d-----w c:\program files\eMule
2009-03-01 03:48 --------- d-----w c:\program files\VideoLAN
2009-03-01 03:44 --------- d-----w c:\program files\NOS
2009-03-01 03:44 --------- d-----w c:\documents and settings\All Users\Application Data\NOS
2009-03-01 02:51 --------- d-----w c:\program files\MSBuild
2009-03-01 02:50 --------- d-----w c:\program files\Reference Assemblies
2009-03-01 02:48 --------- d-----w c:\program files\MSXML 4.0
2009-03-01 02:27 121,887 ----a-w c:\windows\File Renamer - Basic Uninstaller.exe
2009-03-01 02:27 --------- d-----w c:\program files\File Renamer
2009-03-01 01:36 --------- d-----w c:\program files\Lakefront Software
2009-03-01 01:17 --------- d-----w c:\documents and settings\All Users\Application Data\WEBREG
2009-03-01 01:15 --------- d-----w c:\program files\Common Files\HP
2009-03-01 01:15 --------- d-----w c:\program files\Common Files\Hewlett-Packard
2009-03-01 01:15 --------- d-----w c:\documents and settings\All Users\Application Data\HP
2009-03-01 01:14 --------- d-----w c:\documents and settings\All Users\Application Data\Hewlett-Packard
2009-03-01 01:07 --------- d-----w c:\program files\PDFCreator
2009-03-01 00:44 --------- d-----w c:\documents and settings\NancyGail\Application Data\AvniTech
2009-03-01 00:39 --------- d-----w c:\program files\Color_Cop
2009-03-01 00:37 6,144 ----a-w c:\windows\system32\drivers\NTIDrvr.sys
2009-03-01 00:37 --------- d-----w c:\program files\NewTech Infosystems
2009-03-01 00:37 --------- d-----w c:\program files\Common Files\NewTech Infosystems
2009-03-01 00:37 --------- d-----w c:\program files\Common Files\muvee Technologies
2009-03-01 00:31 --------- d-----w c:\program files\TweetDeck
2009-03-01 00:31 --------- d-----w c:\documents and settings\NancyGail\Application Data\TweetDeckFast.F9107117265DB7542C1A806C8DB837742CE14C21.1
2009-02-28 23:26 --------- d-----w c:\program files\Common Files\Adobe AIR
2009-02-28 23:26 --------- d-----w c:\documents and settings\NancyGail\Application Data\de.makesoft.twhirl.0EA062BC275E7ED1E6EC3762EFFD73C7158ADF33.1
2009-02-28 23:17 --------- d-----w c:\program files\MediaMonkey
2009-02-28 23:11 --------- d-----w c:\program files\Olympus
2009-02-28 23:09 --------- d-----w c:\program files\Common Files\InstallShield
2009-02-28 23:07 --------- d-----w c:\program files\Common Files\Canon
2009-02-28 23:00 --------- d-----w c:\program files\Microsoft IntelliType Pro
2009-02-28 22:55 12,552 ----a-w c:\windows\system32\drivers\avgrkx86.sys
2009-02-28 22:55 0 ---ha-w c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2009-02-28 22:55 0 ---ha-w c:\windows\system32\drivers\Msft_Kernel_NuidFltr_01005.Wdf
2009-02-28 22:50 --------- d-----w c:\program files\AVG
2009-02-28 22:45 --------- d-----w c:\program files\Corel
2009-02-28 22:45 --------- d-----w c:\program files\Common Files\Corel
2009-02-28 22:45 --------- d-----w c:\documents and settings\NancyGail\Application Data\Corel
2009-02-28 22:45 --------- d-----w c:\documents and settings\All Users\Application Data\InstallShield
2009-02-28 22:18 --------- d-----w c:\documents and settings\All Users\Application Data\Corel
2009-02-28 22:15 --------- d-----w c:\documents and settings\NancyGail\Application Data\InstallShield
2009-02-28 22:00 --------- d-----w c:\program files\Macromedia
2009-02-28 22:00 --------- d-----w c:\program files\Common Files\Macromedia
2009-02-28 21:50 --------- d-----w c:\program files\QuickTime
2009-02-28 21:49 --------- d-----w c:\program files\Apple Software Update
2009-02-28 21:49 --------- d-----w c:\documents and settings\All Users\Application Data\Apple
2009-02-28 20:43 --------- d-----w c:\documents and settings\NancyGail\Application Data\MxBoost
2009-02-28 20:40 --------- d-----w c:\program files\TechHit.com
2009-02-28 19:31 --------- d-----w c:\program files\Windows Live SkyDrive
2009-02-28 19:31 --------- d-----w c:\program files\Windows Live
2009-02-28 19:31 --------- d-----w c:\program files\Microsoft
2009-02-28 19:30 --------- d-----w c:\program files\Microsoft.NET
2009-02-28 19:30 --------- d-----w c:\program files\Microsoft ActiveSync
2009-02-28 19:27 --------- d-----w c:\program files\Common Files\Windows Live
2009-02-28 19:11 --------- d-----w c:\documents and settings\All Users\Application Data\nView_Profiles
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-28 3885408]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"L09AXLRD_139214234"="c:\program files\Microsoft Student\Microsoft Student with Encarta Premium 2009 DVD\EDICT.EXE" [2008-06-03 351000]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-13 1695232]
"Hotkey CD Eject"="c:\program files\Hotkey CD Eject\cdeject.exe" [2003-02-20 597504]
"AllToTray"="c:\program files\AllToTray\AllToTray.exe" [2009-03-04 728576]
"Second Copy"="c:\program files\SecCopy\SecCopy.exe" [2007-10-17 2425856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BJCFD"="c:\program files\BroadJump\Client Foundation\CFD.exe" [2002-09-10 368706]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-03 13529088]
"WinSys2"="c:\windows\system32\winsys2.exe" [2008-01-18 208896]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-03 86016]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-03-17 1932568]
"itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2008-06-10 1442888]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"Acrobat Assistant 7.0"="c:\program files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2004-12-14 483328]
"HP Software Update"="c:\program files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2004-02-18 49152]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb10.exe" [2004-03-04 172032]
"HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 241664]
"Recordpad"="c:\program files\NCH Swift Sound\Recordpad\recordpad.exe" [2009-03-20 577540]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-03-12 342312]
"RTHDCPL"="RTHDCPL.EXE" [2006-12-18 c:\windows\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 c:\windows\SkyTel.exe]
"nwiz"="nwiz.exe" [2008-05-03 c:\windows\system32\nwiz.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Acrobat Speed Launcher.lnk - c:\windows\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe [2009-03-08 25214]
Device Detector 3.lnk - c:\program files\Olympus\DeviceDetector\DevDtct2.exe [2009-02-28 114688]
Directrec Configuration Tool.lnk - c:\program files\Olympus\DSSPlayer\DirectrecConfig.exe [2009-02-28 122880]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-03-11 210520]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-03-17 08:24 10520 c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Maxthon2\\Modules\\MxDownloader\\MxDownloadServer.exe"=
"c:\\Program Files\\Macromedia\\Dreamweaver 8\\Dreamweaver.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\Graboid\\GraboidVideo\\1.4.0.0\\DLManager\\GraboidDLManager.exe"=
"c:\\Program Files\\FTP Now\\FTPNow.exe"=
"c:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724

R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [2009-02-28 12552]
R0 d344bus;d344bus;c:\windows\system32\drivers\d344bus.sys [2009-02-28 137216]
R0 d344prt;d344prt;c:\windows\system32\drivers\d344prt.sys [2009-02-28 5248]
R0 Si3531;SiI-3531 SATA Controller;c:\windows\system32\drivers\Si3531.sys [2009-02-25 210224]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-02-28 325640]
S2 hpdj00;hpdj00;c:\docume~1\NANCYG~1\LOCALS~1\Temp\hpdj00.exe -servicerunning=true -uninstall=HP Deskjet 6500 Series -product=6500 --> c:\docume~1\NANCYG~1\LOCALS~1\Temp\hpdj00.exe -servicerunning=true -uninstall=HP Deskjet 6500 Series -product=6500 [?]
S3 autorun;autorun;\??\c:\huadio.tmp --> c:\huadio.tmp [?]
S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [2009-02-28 33752]
S3 hcdriver;EHCI;c:\windows\system32\drivers\hcdriver.sys [2009-04-01 50304]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - HPDJ00

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4e0fbcfd-0866-11de-b4e8-0019dbcd1b0e}]
\Shell\AutoRun\command - O:\LaunchU3.exe -a
.
Contents of the 'Scheduled Tasks' folder

2009-04-08 c:\windows\Tasks\XoftSpySE 2.job
- c:\program files\XoftSpySE\XoftSpy.exe [2007-07-13 06:43]

2009-04-07 c:\windows\Tasks\XoftSpySE.job
- c:\program files\XoftSpySE\XoftSpy.exe [2007-07-13 06:43]
.
- - - - ORPHANS REMOVED - - - -

BHO-{3419acba-553c-445e-a7e8-5c10b2db2b44} - c:\windows\system32\ralavepe.dll
HKLM-Run-melurayeto - c:\windows\system32\huhasuso.dll
HKLM-Run-1ca3a4ba - c:\windows\system32\selaziya.dll
HKLM-Run-CPM1f909726 - c:\windows\system32\rutefori.dll

.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/ig?gl=all
mStart Page = hxxp://www.google.com/ig?gl=all
uInternet Settings,ProxyOverride = *.local
IE: Copy plain text for WhizFolders - c:\program files\WhizFolders Organizer Deluxe\copytool.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Fill Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
IE: RoboForm Toolbar - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
IE: Save Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
Trusted Zone: com.tw\asia.msi
Trusted Zone: com.tw\global.msi
Trusted Zone: com.tw\www.msi
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} - hxxp://liveupdate.msi.com.tw/autobios/L ... nstall.cab
FF - ProfilePath - c:\documents and settings\NancyGail\Application Data\Mozilla\Firefox\Profiles\ldjw8pvk.default\
FF - component: c:\documents and settings\NancyGail\Application Data\Mozilla\Firefox\Profiles\ldjw8pvk.default\extensions\{22119944-ED35-4ab1-910B-E619EA06A115}\components\rfproxy_27.dll
.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-07 18:42:19
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\autorun]
"ImagePath"="\??\c:\huadio.tmp"
.
------------------------ Other Running Processes ------------------------
.
c:\program files\AVG\AVG8\avgrsx.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Olympus\DeviceDetector\DM1Service.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\PSIService.exe
c:\program files\Canon\CAL\CALMAIN.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\rundll32.exe
c:\program files\Adobe\Acrobat 7.0\Acrobat\acrobat_sl.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Maxthon2\Maxthon.exe
c:\program files\HP\Digital Imaging\bin\hpqste08.exe
c:\program files\Windows Live\Contacts\wlcomm.exe
.
**************************************************************************
.
Completion time: 2009-04-07 18:44:57 - machine was rebooted
ComboFix-quarantined-files.txt 2009-04-08 01:44:54

Pre-Run: 65,819,119,616 bytes free
Post-Run: 67,320,266,752 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

345 --- E O F --- 2009-03-20 10:23:10

I

by **Bio-Hazard** » April 8th, 2009, 1:23 pm

Hello!

Are you doing fine.

Do you know what folder this is c:\program files\Setup Files

Run CFScript

Close any open browsers.
Open Notepad by click start
Click Run
Type notepad into the box and click enter
Notepad will open
Copy and Paste everything from the Code box into Notepad:

Code: Select all

File::
c:\windows\system32\winsys2.exe
Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinSys2"=-
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"=-

Save this as CFScript.txt, in the same location as ComboFix.exe (on your desktop)

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt

NOTE: Do not mouseclick combofix's window whilst it's running. That may cause it to stall it.

Next Reply

Please reply with:

ComboFix log (found at C:\Combofix.txt)
New HijackThis log

by **nanrector** » April 8th, 2009, 2:17 pm

That folder (c:\program files\Setup Files) appears to go to my graphics card. The folder inside it is labled: NVIDIA v175.16 (MSI Version)

I ran Combofix... told me AVG was running again evenAFTER I closed the new free version I installed. I ran Combofix anyway. Does that matter?
Below are the logs:

ComboFix 09-04-04.01 - NancyGail 2009-04-08 13:08:35.5 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3071.2388 [GMT -7:00]
Running from: c:\documents and settings\NancyGail\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\NancyGail\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated)
* Created a new restore point

FILE ::
c:\windows\system32\winsys2.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\winsys2.exe

.
((((((((((((((((((((((((( Files Created from 2009-03-08 to 2009-04-08 )))))))))))))))))))))))))))))))
.

2009-04-08 00:03 . 2009-04-08 00:03 <DIR> d--h----- C:\$AVG8.VAULT$
2009-04-07 19:35 . 2009-04-07 19:35 10,520 --a------ c:\windows\system32\avgrsstx.dll
2009-04-07 19:34 . 2009-04-08 09:59 <DIR> d-------- c:\windows\system32\drivers\Avg
2009-04-07 19:34 . 2009-04-07 19:34 <DIR> d-------- c:\program files\AVG
2009-04-07 19:34 . 2009-04-07 19:34 325,640 --a------ c:\windows\system32\drivers\avgldx86.sys
2009-04-07 18:29 . 2009-04-07 18:29 <DIR> d-------- c:\program files\ERUNT
2009-04-07 13:43 . 2009-04-07 13:43 <DIR> d-------- c:\program files\twhirl
2009-04-02 06:47 . 2009-04-02 06:47 43,585 --a------ C:\BillingTracker.elf
2009-04-01 18:46 . 2009-04-01 18:50 <DIR> d-------- c:\documents and settings\NancyGail\Application Data\Uniblue
2009-04-01 18:46 . 2009-04-01 18:50 <DIR> d-------- c:\documents and settings\All Users\Application Data\DriverScanner
2009-04-01 18:23 . 2009-04-01 18:25 <DIR> d-------- c:\program files\USB-IF Test Suite
2009-04-01 18:23 . 2008-04-17 14:40 50,304 --a------ c:\windows\system32\drivers\hcdriver.sys
2009-03-31 10:42 . 2009-03-31 10:42 <DIR> d-------- c:\documents and settings\NancyGail\Application Data\Centered Systems
2009-03-31 10:36 . 2009-03-31 10:38 <DIR> d-------- c:\program files\SecCopy
2009-03-31 10:36 . 2006-12-21 15:18 497,496 --a------ c:\windows\system32\XceedZip.dll
2009-03-30 10:03 . 2009-03-30 10:03 <DIR> d-------- c:\program files\Trend Micro
2009-03-29 10:58 . 2009-03-29 10:58 <DIR> d-------- c:\program files\Fraps
2009-03-29 09:24 . 2009-04-04 06:56 <DIR> d-------- c:\program files\XoftSpySE
2009-03-28 09:47 . 2001-05-11 13:18 420,240 --a------ c:\windows\system32\mpg4c32.dll
2009-03-28 09:47 . 2001-05-16 17:54 309,616 --a------ c:\windows\system32\wmv8dmod.dll
2009-03-28 09:47 . 2001-03-26 04:41 245,760 --a------ c:\windows\system32\mp4sds32.ax
2009-03-28 09:45 . 2009-03-29 10:56 <DIR> d-------- c:\program files\Game Cam
2009-03-25 14:33 . 2009-03-25 14:51 <DIR> d-------- c:\program files\Game Cam V2
2009-03-24 14:54 . 2009-03-24 14:54 5,242,934 --ah----- c:\windows\system32\toyhide.bmp
2009-03-24 14:24 . 2009-03-24 14:24 187,072 --a------ c:\windows\walltoyUninst.exe
2009-03-23 10:36 . 2009-03-23 10:36 <DIR> d-------- c:\program files\IrfanView
2009-03-21 13:21 . 2009-03-21 13:21 <DIR> d-------- c:\program files\Hotkey CD Eject
2009-03-20 11:24 . 2009-03-20 11:24 <DIR> d-------- c:\program files\iTunes
2009-03-20 11:24 . 2009-03-20 11:24 <DIR> d-------- c:\program files\iPod
2009-03-20 11:24 . 2009-03-20 11:24 <DIR> d-------- c:\program files\Common Files\Apple
2009-03-20 11:24 . 2009-03-20 11:24 <DIR> d-------- c:\program files\Bonjour
2009-03-20 11:24 . 2009-03-20 11:24 <DIR> d-------- c:\documents and settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
2009-03-20 11:24 . 2008-04-17 12:12 107,368 --a------ c:\windows\system32\GEARAspi.dll
2009-03-20 11:24 . 2009-01-15 12:19 23,848 --a------ c:\windows\system32\drivers\GEARAspiWDM.sys
2009-03-20 11:02 . 2009-03-20 11:02 <DIR> d-------- c:\program files\NCH Software
2009-03-20 11:02 . 2009-03-20 11:02 <DIR> d-------- c:\documents and settings\NancyGail\Application Data\Recordpad
2009-03-20 11:02 . 2009-03-20 11:02 <DIR> d-------- c:\documents and settings\NancyGail\Application Data\NCH Swift Sound
2009-03-20 11:02 . 2009-03-20 11:02 <DIR> d-------- c:\documents and settings\All Users\Application Data\NCH Swift Sound
2009-03-20 11:01 . 2009-03-20 11:02 <DIR> d-------- c:\program files\NCH Swift Sound
2009-03-20 10:50 . 2009-03-20 11:11 <DIR> d-------- c:\program files\All Sound Recorder XP
2009-03-19 10:33 . 2009-03-19 10:33 <DIR> d-------- c:\program files\MAPILab Ltd
2009-03-19 10:13 . 2009-03-19 10:13 <DIR> dr-h----- C:\MSOCache
2009-03-19 10:13 . 2009-03-20 03:23 <DIR> d-------- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-03-19 03:00 . 2009-03-19 03:00 <DIR> d-------- c:\program files\Microsoft CAPICOM 2.1.0.2
2009-03-18 10:49 . 2009-03-18 10:49 2,344 --a------ c:\windows\hpbvspst.his
2009-03-18 10:49 . 2009-03-18 10:49 414 --a------ c:\windows\hpbvspst.ini
2009-03-18 10:44 . 2009-04-03 17:16 50,895 --a------ c:\windows\hpdj6500.hi2
2009-03-18 10:44 . 2009-04-03 17:16 8,768 --a------ c:\windows\hpdj6500.bu2
2009-03-18 10:35 . 2003-12-11 11:15 626,960 -ra------ c:\windows\system32\hpvaut32.dll
2009-03-18 10:35 . 2003-12-11 11:15 487,424 -ra------ c:\windows\system32\hpvcp70.dll
2009-03-18 10:35 . 2003-12-11 11:15 344,064 -ra------ c:\windows\system32\hpvcr70.dll
2009-03-18 10:35 . 2003-12-11 11:15 44,544 -ra------ c:\windows\system32\MSXML4a.dll
2009-03-18 10:30 . 2009-04-03 17:18 42,237 --a------ c:\windows\hpdj6500.hi1
2009-03-18 10:30 . 2009-04-03 17:18 5,586 --a------ c:\windows\hpdj6500.bu1
2009-03-14 15:58 . 2009-03-14 15:58 <DIR> d-------- c:\program files\Common Files\Blizzard Entertainment
2009-03-12 09:11 . 2009-03-12 09:11 <DIR> d-------- c:\program files\Realtek Sound Manager
2009-03-12 09:11 . 2009-03-12 09:11 <DIR> d-------- c:\program files\Realtek AC97
2009-03-12 09:11 . 2009-03-12 09:11 <DIR> d-------- c:\program files\AvRack
2009-03-12 09:11 . 2006-03-22 16:23 10,524,672 --a------ c:\windows\system32\RTLCPL.exe
2009-03-12 09:11 . 2006-03-31 14:38 3,960,896 -ra------ c:\windows\system32\drivers\alcxwdm.sys
2009-03-12 09:11 . 2006-03-20 11:48 315,392 --a------ c:\windows\alcupd.exe
2009-03-12 09:11 . 2005-11-18 11:20 217,088 --a------ c:\windows\alcrmv.exe
2009-03-12 09:11 . 2002-02-05 13:54 141,016 --a------ c:\windows\system32\alsndmgr.wav
2009-03-12 09:11 . 2006-01-10 13:38 135,168 --a------ c:\windows\system32\RtlCPAPI.dll
2009-03-12 09:11 . 2001-07-06 00:19 164 --a------ c:\windows\avrack.ini
2009-03-10 10:15 . 2009-03-10 10:15 <DIR> d-------- c:\program files\MSECache
2009-03-08 13:11 . 2009-03-08 13:11 <DIR> d-------- c:\program files\FTP Now
2009-03-08 08:47 . 2009-03-08 08:47 <DIR> d-------- c:\documents and settings\NancyGail\Application Data\AdobeUM
2009-03-08 08:46 . 2009-03-08 08:46 <DIR> d-------- c:\program files\Common Files\Adobe Systems Shared
2009-03-08 08:46 . 2009-03-08 08:46 <DIR> d-------- c:\documents and settings\All Users\Application Data\Adobe Systems

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-08 17:35 --------- d-----w c:\program files\BillingTracker Pro 4
2009-04-08 02:34 --------- d-----w c:\documents and settings\All Users\Application Data\avg8
2009-04-08 02:31 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-04-08 02:24 --------- d-----w c:\documents and settings\NancyGail\Application Data\nView_Wallpaper
2009-04-08 00:56 --------- d-----w c:\documents and settings\NancyGail\Application Data\UseNeXT
2009-04-06 12:35 --------- d-----w c:\documents and settings\NancyGail\Application Data\ZoomBrowser EX
2009-04-06 12:35 --------- d-----w c:\documents and settings\All Users\Application Data\ZoomBrowser
2009-04-05 19:54 --------- d-----w c:\documents and settings\NancyGail\Application Data\U3
2009-04-02 23:37 --------- d-----w c:\program files\World of Warcraft
2009-04-01 00:35 5,014 --sha-w c:\windows\system32\KGyGaAvL.sys
2009-03-29 17:56 --------- d--h--w c:\program files\InstallShield Installation Information
2009-03-25 21:33 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2009-03-24 17:18 --------- d-----w c:\program files\UseNeXT
2009-03-20 18:25 --------- d-----w c:\documents and settings\NancyGail\Application Data\Apple Computer
2009-03-20 18:24 --------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer
2009-03-19 17:34 --------- d-----w c:\program files\Rules Manager
2009-03-18 17:50 --------- d-----w c:\program files\HP
2009-03-18 17:50 --------- d-----w c:\program files\Hewlett-Packard
2009-03-17 19:52 --------- d-----w c:\program files\WhizFolders Organizer Deluxe
2009-03-15 19:47 --------- d-----w c:\program files\Maxthon2
2009-03-08 15:46 --------- d-----w c:\program files\Common Files\Adobe
2009-03-05 00:20 --------- d-----w c:\program files\Amara - Flash Photo Animation Software
2009-03-04 23:45 --------- d-----w c:\program files\FastStone Photo Resizer
2009-03-04 23:45 --------- d-----w c:\documents and settings\NancyGail\Application Data\FastStone
2009-03-04 22:51 --------- d-----w c:\program files\Flash Slideshow Maker Professional
2009-03-04 22:48 --------- d-----w c:\program files\Microsoft Student
2009-03-04 19:43 --------- d-----w c:\documents and settings\NancyGail\Application Data\ColorCop
2009-03-04 19:18 --------- d-----w c:\program files\AllToTray
2009-03-04 02:57 --------- d-----w c:\program files\Cool MP3 Splitter
2009-03-03 22:35 --------- d-----w c:\program files\Common Files\AVSMedia
2009-03-03 22:35 --------- d-----w c:\program files\AVS4YOU
2009-03-03 21:12 --------- d-----w c:\documents and settings\NancyGail\Application Data\vlc
2009-03-03 19:56 --------- d-----w c:\program files\Canon
2009-03-03 17:13 --------- d-----w c:\documents and settings\NancyGail\Application Data\AVS4YOU
2009-03-03 17:13 --------- d-----w c:\documents and settings\All Users\Application Data\AVS4YOU
2009-03-03 03:09 --------- d-----w c:\program files\Graboid
2009-03-03 03:03 --------- d-----w c:\documents and settings\NancyGail\Application Data\Graboid Inc
2009-03-02 19:02 --------- d-----w c:\program files\Collectorz.com
2009-03-02 16:56 --------- d-----w c:\documents and settings\NancyGail\Application Data\Rules Manager
2009-03-02 01:50 --------- d-----w c:\program files\D-Tools
2009-03-02 00:25 --------- d-----w c:\program files\Unlocker
2009-03-01 21:59 --------- d-----w c:\program files\Mozilla ActiveX Control v1.7.12
2009-03-01 21:59 --------- d-----w c:\documents and settings\NancyGail\Application Data\MozillaControl
2009-03-01 21:59 --------- d-----w c:\documents and settings\All Users\Application Data\Graboid Inc
2009-03-01 16:21 --------- d-----w c:\documents and settings\NancyGail\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2009-03-01 03:48 --------- d-----w c:\program files\VideoLAN
2009-03-01 03:44 --------- d-----w c:\program files\NOS
2009-03-01 03:44 --------- d-----w c:\documents and settings\All Users\Application Data\NOS
2009-03-01 02:51 --------- d-----w c:\program files\MSBuild
2009-03-01 02:50 --------- d-----w c:\program files\Reference Assemblies
2009-03-01 02:48 --------- d-----w c:\program files\MSXML 4.0
2009-03-01 02:27 121,887 ----a-w c:\windows\File Renamer - Basic Uninstaller.exe
2009-03-01 02:27 --------- d-----w c:\program files\File Renamer
2009-03-01 01:36 --------- d-----w c:\program files\Lakefront Software
2009-03-01 01:17 --------- d-----w c:\documents and settings\All Users\Application Data\WEBREG
2009-03-01 01:15 --------- d-----w c:\program files\Common Files\HP
2009-03-01 01:15 --------- d-----w c:\program files\Common Files\Hewlett-Packard
2009-03-01 01:15 --------- d-----w c:\documents and settings\All Users\Application Data\HP
2009-03-01 01:14 --------- d-----w c:\documents and settings\All Users\Application Data\Hewlett-Packard
2009-03-01 01:07 --------- d-----w c:\program files\PDFCreator
2009-03-01 00:44 --------- d-----w c:\documents and settings\NancyGail\Application Data\AvniTech
2009-03-01 00:39 --------- d-----w c:\program files\Color_Cop
2009-03-01 00:37 6,144 ----a-w c:\windows\system32\drivers\NTIDrvr.sys
2009-03-01 00:37 --------- d-----w c:\program files\NewTech Infosystems
2009-03-01 00:37 --------- d-----w c:\program files\Common Files\NewTech Infosystems
2009-03-01 00:37 --------- d-----w c:\program files\Common Files\muvee Technologies
2009-03-01 00:31 --------- d-----w c:\program files\TweetDeck
2009-03-01 00:31 --------- d-----w c:\documents and settings\NancyGail\Application Data\TweetDeckFast.F9107117265DB7542C1A806C8DB837742CE14C21.1
2009-02-28 23:26 --------- d-----w c:\program files\Common Files\Adobe AIR
2009-02-28 23:26 --------- d-----w c:\documents and settings\NancyGail\Application Data\de.makesoft.twhirl.0EA062BC275E7ED1E6EC3762EFFD73C7158ADF33.1
2009-02-28 23:17 --------- d-----w c:\program files\MediaMonkey
2009-02-28 23:11 --------- d-----w c:\program files\Olympus
2009-02-28 23:09 --------- d-----w c:\program files\Common Files\InstallShield
2009-02-28 23:07 --------- d-----w c:\program files\Common Files\Canon
2009-02-28 23:00 --------- d-----w c:\program files\Microsoft IntelliType Pro
2009-02-28 22:55 0 ---ha-w c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2009-02-28 22:55 0 ---ha-w c:\windows\system32\drivers\Msft_Kernel_NuidFltr_01005.Wdf
2009-02-28 22:45 --------- d-----w c:\program files\Corel
2009-02-28 22:45 --------- d-----w c:\program files\Common Files\Corel
2009-02-28 22:45 --------- d-----w c:\documents and settings\NancyGail\Application Data\Corel
2009-02-28 22:45 --------- d-----w c:\documents and settings\All Users\Application Data\InstallShield
2009-02-28 22:18 --------- d-----w c:\documents and settings\All Users\Application Data\Corel
2009-02-28 22:15 --------- d-----w c:\documents and settings\NancyGail\Application Data\InstallShield
2009-02-28 22:00 --------- d-----w c:\program files\Macromedia
2009-02-28 22:00 --------- d-----w c:\program files\Common Files\Macromedia
2009-02-28 21:50 --------- d-----w c:\program files\QuickTime
2009-02-28 21:49 --------- d-----w c:\program files\Apple Software Update
2009-02-28 21:49 --------- d-----w c:\documents and settings\All Users\Application Data\Apple
2009-02-28 20:43 --------- d-----w c:\documents and settings\NancyGail\Application Data\MxBoost
2009-02-28 20:40 --------- d-----w c:\program files\TechHit.com
2009-02-28 19:31 --------- d-----w c:\program files\Windows Live SkyDrive
2009-02-28 19:31 --------- d-----w c:\program files\Windows Live
2009-02-28 19:31 --------- d-----w c:\program files\Microsoft
2009-02-28 19:30 --------- d-----w c:\program files\Microsoft.NET
2009-02-28 19:30 --------- d-----w c:\program files\Microsoft ActiveSync
2009-02-28 19:27 --------- d-----w c:\program files\Common Files\Windows Live
2009-02-28 19:11 --------- d-----w c:\documents and settings\All Users\Application Data\nView_Profiles
2009-02-28 19:02 --------- d-----w c:\program files\Setup Files
2009-02-28 19:00 --------- d-----w c:\program files\MSI
2009-02-28 18:38 --------- d-----w c:\documents and settings\All Users\Application Data\RoboForm
.

((((((((((((((((((((((((((((( SnapShot@2009-04-07_18.44.25.28 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-02-28 22:55:28 27,656 ----a-w c:\windows\system32\drivers\avgmfx86.sys
+ 2009-04-08 02:34:58 27,656 ----a-w c:\windows\system32\drivers\avgmfx86.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-28 3885408]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"L09AXLRD_139214234"="c:\program files\Microsoft Student\Microsoft Student with Encarta Premium 2009 DVD\EDICT.EXE" [2008-06-03 351000]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-13 1695232]
"Hotkey CD Eject"="c:\program files\Hotkey CD Eject\cdeject.exe" [2003-02-20 597504]
"AllToTray"="c:\program files\AllToTray\AllToTray.exe" [2009-03-04 728576]
"Second Copy"="c:\program files\SecCopy\SecCopy.exe" [2007-10-17 2425856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BJCFD"="c:\program files\BroadJump\Client Foundation\CFD.exe" [2002-09-10 368706]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-03 13529088]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-03 86016]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]
"itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2008-06-10 1442888]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"Acrobat Assistant 7.0"="c:\program files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2004-12-14 483328]
"HP Software Update"="c:\program files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2004-02-18 49152]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb10.exe" [2004-03-04 172032]
"HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 241664]
"Recordpad"="c:\program files\NCH Swift Sound\Recordpad\recordpad.exe" [2009-03-20 577540]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-03-12 342312]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-04-07 1932568]
"RTHDCPL"="RTHDCPL.EXE" [2006-12-18 c:\windows\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 c:\windows\SkyTel.exe]
"nwiz"="nwiz.exe" [2008-05-03 c:\windows\system32\nwiz.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Acrobat Speed Launcher.lnk - c:\windows\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe [2009-03-08 25214]
Device Detector 3.lnk - c:\program files\Olympus\DeviceDetector\DevDtct2.exe [2009-02-28 114688]
Directrec Configuration Tool.lnk - c:\program files\Olympus\DSSPlayer\DirectrecConfig.exe [2009-02-28 122880]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-03-11 210520]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-04-07 19:35 10520 c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Maxthon2\\Modules\\MxDownloader\\MxDownloadServer.exe"=
"c:\\Program Files\\Macromedia\\Dreamweaver 8\\Dreamweaver.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\Graboid\\GraboidVideo\\1.4.0.0\\DLManager\\GraboidDLManager.exe"=
"c:\\Program Files\\FTP Now\\FTPNow.exe"=
"c:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

R2 hpdj00;hpdj00; [x]
R3 autorun;autorun; [x]
R3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [2008-12-01 33752]
R3 hcdriver;EHCI;c:\windows\system32\Drivers\hcdriver.sys [2008-04-17 50304]
S0 d344bus;d344bus;c:\windows\system32\DRIVERS\d344bus.sys [2003-12-27 137216]
S0 d344prt;d344prt;c:\windows\System32\Drivers\d344prt.sys [2003-12-27 5248]
S0 Si3531;SiI-3531 SATA Controller;c:\windows\system32\DRIVERS\Si3531.sys [2006-11-17 210224]
S1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\Drivers\avgldx86.sys [2009-04-07 325640]
S2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-04-07 298264]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - AVG8WD
*NewlyCreated* - AVGLDX86
*NewlyCreated* - AVGMFX86
*Deregistered* - AFD
*Deregistered* - ALG
*Deregistered* - Apple Mobile Device
*Deregistered* - Arp1394
*Deregistered* - AudioSrv
*Deregistered* - audstub
*Deregistered* - avg8wd
*Deregistered* - AvgLdx86
*Deregistered* - AvgMfx86
*Deregistered* - Beep
*Deregistered* - BITS
*Deregistered* - Bonjour Service
*Deregistered* - Browser
*Deregistered* - CCALib8
*Deregistered* - Cdfs
*Deregistered* - CryptSvc
*Deregistered* - d344bus
*Deregistered* - DcomLaunch
*Deregistered* - Dhcp
*Deregistered* - DM1Service
*Deregistered* - dmboot
*Deregistered* - dmio
*Deregistered* - dmload
*Deregistered* - dmserver
*Deregistered* - Dnscache
*Deregistered* - ERSvc
*Deregistered* - EventSystem
*Deregistered* - FastUserSwitchingCompatibility
*Deregistered* - Fips
*Deregistered* - FltMgr
*Deregistered* - Ftdisk
*Deregistered* - Gpc
*Deregistered* - helpsvc
*Deregistered* - HidServ
*Deregistered* - hpqcxs08
*Deregistered* - hpqddsvc
*Deregistered* - HTTP
*Deregistered* - ImapiService
*Deregistered* - IpNat
*Deregistered* - iPod Service
*Deregistered* - IPSec
*Deregistered* - KSecDD
*Deregistered* - lanmanserver
*Deregistered* - lanmanworkstation
*Deregistered* - LmHosts
*Deregistered* - mdmxsdk
*Deregistered* - mnmdd
*Deregistered* - MountMgr
*Deregistered* - MRxDAV
*Deregistered* - MRxSmb
*Deregistered* - Msfs
*Deregistered* - MSIServer
*Deregistered* - mssmbios
*Deregistered* - Mup
*Deregistered* - NDIS
*Deregistered* - NdisTapi
*Deregistered* - Ndisuio
*Deregistered* - NdisWan
*Deregistered* - NDProxy
*Deregistered* - Net Driver HPZ12
*Deregistered* - NetBIOS
*Deregistered* - NetBT
*Deregistered* - Netman
*Deregistered* - Nla
*Deregistered* - Npfs
*Deregistered* - Ntfs
*Deregistered* - Null
*Deregistered* - NVSvc
*Deregistered* - PartMgr
*Deregistered* - ParVdm
*Deregistered* - Pml Driver HPZ12
*Deregistered* - PolicyAgent
*Deregistered* - PptpMiniport
*Deregistered* - ProtectedStorage
*Deregistered* - ProtexisLicensing
*Deregistered* - PSched
*Deregistered* - RasAcd
*Deregistered* - Rasl2tp
*Deregistered* - RasMan
*Deregistered* - RasPppoe
*Deregistered* - Raspti
*Deregistered* - Rdbss
*Deregistered* - RDPCDD
*Deregistered* - rdpdr
*Deregistered* - RemoteRegistry
*Deregistered* - RpcSs
*Deregistered* - SamSs
*Deregistered* - Schedule
*Deregistered* - seclogon
*Deregistered* - SENS
*Deregistered* - SharedAccess
*Deregistered* - ShellHWDetection
*Deregistered* - SiFilter
*Deregistered* - Spooler
*Deregistered* - sptd
*Deregistered* - sr
*Deregistered* - srservice
*Deregistered* - Srv
*Deregistered* - SSDPSRV
*Deregistered* - stisvc
*Deregistered* - swenum
*Deregistered* - TapiSrv
*Deregistered* - Tcpip
*Deregistered* - TermDD
*Deregistered* - TermService
*Deregistered* - Themes
*Deregistered* - TrkWks
*Deregistered* - Update
*Deregistered* - VgaSave
*Deregistered* - VolSnap
*Deregistered* - W32Time
*Deregistered* - Wanarp
*Deregistered* - Wdf01000
*Deregistered* - WebClient
*Deregistered* - winmgmt
*Deregistered* - wscsvc
*Deregistered* - wuauserv
*Deregistered* - WZCSVC

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4e0fbcfd-0866-11de-b4e8-0019dbcd1b0e}]
\Shell\AutoRun\command - O:\LaunchU3.exe -a
.
Contents of the 'Scheduled Tasks' folder

2009-04-08 c:\windows\Tasks\XoftSpySE 2.job
- c:\program files\XoftSpySE\XoftSpy.exe [2007-07-13 06:43]

2009-04-08 c:\windows\Tasks\XoftSpySE.job
- c:\program files\XoftSpySE\XoftSpy.exe [2007-07-13 06:43]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/ig?gl=all
mStart Page = hxxp://www.google.com/ig?gl=all
uInternet Settings,ProxyOverride = *.local
IE: Copy plain text for WhizFolders - c:\program files\WhizFolders Organizer Deluxe\copytool.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Fill Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
IE: RoboForm Toolbar - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
IE: Save Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
Trusted Zone: com.tw\asia.msi
Trusted Zone: com.tw\global.msi
Trusted Zone: com.tw\www.msi
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} - hxxp://liveupdate.msi.com.tw/autobios/L ... nstall.cab
FF - ProfilePath - c:\documents and settings\NancyGail\Application Data\Mozilla\Firefox\Profiles\ldjw8pvk.default\
FF - component: c:\documents and settings\NancyGail\Application Data\Mozilla\Firefox\Profiles\ldjw8pvk.default\extensions\{22119944-ED35-4ab1-910B-E619EA06A115}\components\rfproxy_27.dll
.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-08 13:10:11
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\autorun]
"ImagePath"="\??\c:\huadio.tmp"
.
Completion time: 2009-04-08 13:14:09
ComboFix-quarantined-files.txt 2009-04-08 20:14:07
ComboFix2.txt 2009-04-08 02:30:57
ComboFix3.txt 2009-04-08 02:27:02
ComboFix4.txt 2009-04-08 01:55:08
ComboFix5.txt 2009-04-08 20:08:03

Pre-Run: 67,317,338,112 bytes free
Post-Run: 67,311,210,496 bytes free

440 --- E O F --- 2009-03-20 10:23:10

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:17:02 PM, on 4/8/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Olympus\DeviceDetector\DM1Service.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Maxthon2\Maxthon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: RoboForm - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [itype] "C:\Program Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [Recordpad] "C:\Program Files\NCH Swift Sound\Recordpad\recordpad.exe" -logon
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [L09AXLRD_139214234] "C:\Program Files\Microsoft Student\Microsoft Student with Encarta Premium 2009 DVD\EDICT.EXE" -m
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Hotkey CD Eject] C:\Program Files\Hotkey CD Eject\cdeject.exe
O4 - HKCU\..\Run: [AllToTray] C:\Program Files\AllToTray\AllToTray.exe
O4 - HKCU\..\Run: [Second Copy] "C:\Program Files\SecCopy\SecCopy.exe"
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Device Detector 3.lnk = C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe
O4 - Global Startup: Directrec Configuration Tool.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: Copy plain text for WhizFolders - C:\Program Files\WhizFolders Organizer Deluxe\copytool.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Encarta Search Bar - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://asia.msi.com.tw
O15 - Trusted Zone: http://global.msi.com.tw
O15 - Trusted Zone: http://www.msi.com.tw
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/200 ... oader5.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 5859193093
O16 - DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} (WebSDev Control) - http://liveupdate.msi.com.tw/autobios/L ... nstall.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://wwwimages.adobe.com/www.adobe.co ... nos/gp.cab
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: DM1Service - OLYMPUS Corporation - C:\Program Files\Olympus\DeviceDetector\DM1Service.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: hpdj00 - Unknown owner - C:\DOCUME~1\NANCYG~1\LOCALS~1\Temp\hpdj00.exe (file missing)
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe

--
End of file - 9120 bytes

by **Bio-Hazard** » April 9th, 2009, 10:05 am

Hello!

I ran Combofix... told me AVG was running again evenAFTER I closed the new free version I installed. I ran Combofix anyway. Does that matter?

it is ok. You are doing a great job. we still have some work to do.

Remove HijackThis entries

Run HijackThis
Click on the Scan button
Put a check beside all of the items listed below (if present):

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
Close all open windows and browsers/email etc...
Click on the Fix Checked button
When completed close the application.

ATF-Cleaner

Please download ATF Cleaner by Atribune.

Save it to your desktop
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

If you use Firefox browser
Click Firefox at the top and choose: Select All
Click the Empty Selected button.

NOTE: If you would like to keep your saved passwords please click No at the prompt.
Click Exit on the Main menu to close the program.

Kaspersky Online Scan

Please go to Kaspersky website and perform an online antivirus scan.

Note: If you are using Windows Vista, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan.

Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
- Spyware, Adware, Dialers, and other potentially dangerous programs
- Archives
Click on My Computer under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As....
Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
Please post this log in your next reply along with a fresh HijackThis log.

Logs/Information to Post in Next Reply

Please post the following logs/Information in your reply:

Kaspersky log
A fresh HijackThis Log ( after all the above has been done)
A description of how your computer is behaving

by **nanrector** » April 10th, 2009, 8:14 am

I had done everything and started the Kaspersky Online Scan early in the day and it was at about 20% a 8 pm... and we had tornado watches and severe storms. Had to turn the computer off.

I've done a Kaspersky Online Scan a year or so agao... seems like it took at least 30 plus hours to complete. I'll start it again... baring any more weather issues it should be done by monday!

Thanks!
Nancy

by **Bio-Hazard** » April 10th, 2009, 10:36 am

Hello!

Take your time. I hope you and your family are ok. There is no rush. Kaspersky online scan unfortunately takes time but it is one of the best online scan.

by **nanrector** » April 10th, 2009, 7:08 pm

Here are the logs! My computer seems to be dragging a bit now. But that's it. A reboot may correct that. Not sure. No popups though.

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0 REPORT
Friday, April 10, 2009
Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Program database last update: Friday, April 10, 2009 13:53:48
Records in database: 2031505
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\
F:\
G:\
H:\
I:\
K:\
L:\
M:\
N:\
P:\
R:\
S:\
T:\
V:\
W:\
Y:\

Scan statistics:
Files scanned: 942462
Threat name: 9
Infected objects: 48
Suspicious objects: 5
Duration of the scan: 10:39:20

File name / Threat name / Threats count
C:\Documents and Settings\NancyGail\Local Settings\Application Data\Microsoft\Outlook\Archives\archive-household.pst Suspicious: Trojan-Spy.HTML.Fraud.gen 2
C:\Documents and Settings\NancyGail\Local Settings\Application Data\Microsoft\Outlook\Archives\archive-sent-Dec08.pst Infected: Trojan-Downloader.JS.Iframe.xa 6
C:\Documents and Settings\NancyGail\Local Settings\Application Data\Microsoft\Outlook\Archives\archive-sentMarch09.pst Infected: Trojan-Downloader.JS.Iframe.xa 1
C:\Documents and Settings\NancyGail\Local Settings\Application Data\Microsoft\Outlook\Archives\Outlook-Main.pst Infected: Trojan-Clicker.HTML.IFrame.mo 1
C:\Documents and Settings\NancyGail\Local Settings\Application Data\Microsoft\Outlook\household.pst Infected: Trojan-Downloader.JS.Iframe.xa 6
E:\LAST C DRIVE\Documents and Settings\Nancy\Local Settings\Application Data\Identities\{C98238B7-B17B-4CF9-93F3-42A8FEBEFB34}\Microsoft\Outlook Express\Inbox.dbx Infected: Trojan-Downloader.Win32.Small.aafc 1
E:\LAST C DRIVE\Documents and Settings\Nancy\Local Settings\Application Data\Microsoft\Outlook\Archives\archive-household.pst Suspicious: Trojan-Spy.HTML.Fraud.gen 2
E:\LAST C DRIVE\Documents and Settings\Nancy\Local Settings\Application Data\Microsoft\Outlook\Archives\archive-sent-Dec08.pst Infected: Trojan-Downloader.JS.Iframe.xa 6
E:\LAST C DRIVE\Documents and Settings\Nancy\Local Settings\Application Data\Microsoft\Outlook\Archives\Outlook-Main.pst Infected: Trojan-Clicker.HTML.IFrame.mo 1
E:\LAST C DRIVE\Documents and Settings\Nancy\Local Settings\Application Data\Microsoft\Outlook\household.pst Infected: Trojan-Downloader.JS.Iframe.xa 6
E:\LAST C DRIVE\Documents and Settings\Nancy\Local Settings\Application Data\Microsoft\Outlook\Outlook.pst Suspicious: Trojan-Spy.HTML.Fraud.gen 1
E:\LAST C DRIVE\Documents and Settings\Nancy\Local Settings\temp\~tmp\hmunmlcn38a\svchost.exe Infected: Trojan-Mailfinder.Win32.Blen.fq 1
E:\LAST C DRIVE\Documents and Settings\Nancy\Local Settings\temp\~tmp\msycn04\mdm.exe Infected: Worm.Win32.Myspch.n 1
E:\LAST C DRIVE\Documents and Settings\Nancy\Local Settings\temp\~tmp\sps32_1\mdm32.exe Infected: Trojan-Downloader.Win32.Agent.bbcu 1
F:\1-Family\Roy\RoysZipDisks\Mail Backup\Deleted Items.dbx Infected: Email-Worm.VBS.KakWorm 1
F:\1-Family\Roy\RoysZipDisks\Mail Backup\Inbox.dbx Infected: Email-Worm.VBS.KakWorm 12
I:\AUDIO\!MP3 SPLITTERS JOINERS\Cool MP3 Splitter (and joiner) 2.02 (Inc Crack)\mp3splitter.exe Infected: Trojan-Downloader.Win32.Hilldoor.u 1
W:\Family\www.rectors.net\gallery\albums\index.php Infected: Trojan-Downloader.JS.Iframe.xa 1
W:\Family\www.rectors.net\gallery\docs\index.htm Infected: Trojan-Downloader.JS.Iframe.xa 1
W:\Family\www.rectors.net\gallery\include\index.html Infected: Trojan-Downloader.JS.Iframe.xa 1

The selected area was scanned.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:06:47 PM, on 4/10/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Olympus\DeviceDetector\DM1Service.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\PSIService.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft Student\Microsoft Student with Encarta Premium 2009 DVD\EDICT.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Hotkey CD Eject\cdeject.exe
C:\Program Files\AllToTray\AllToTray.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Java\jre6\bin\java.exe
C:\Program Files\twhirl\twhirl.exe
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Acrobat.exe
C:\DOCUME~1\NANCYG~1\LOCALS~1\Temp\Adobelm_Cleanup.0001
C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
C:\DOCUME~1\NANCYG~1\LOCALS~1\Temp\Adobelm_Cleanup.0001
C:\Program Files\Maxthon2\Maxthon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RoboForm - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [itype] "C:\Program Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [Recordpad] "C:\Program Files\NCH Swift Sound\Recordpad\recordpad.exe" -logon
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [L09AXLRD_139214234] "C:\Program Files\Microsoft Student\Microsoft Student with Encarta Premium 2009 DVD\EDICT.EXE" -m
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Hotkey CD Eject] C:\Program Files\Hotkey CD Eject\cdeject.exe
O4 - HKCU\..\Run: [AllToTray] C:\Program Files\AllToTray\AllToTray.exe
O4 - HKCU\..\Run: [Second Copy] "C:\Program Files\SecCopy\SecCopy.exe"
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Device Detector 3.lnk = C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe
O4 - Global Startup: Directrec Configuration Tool.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: Copy plain text for WhizFolders - C:\Program Files\WhizFolders Organizer Deluxe\copytool.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Encarta Search Bar - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://asia.msi.com.tw
O15 - Trusted Zone: http://global.msi.com.tw
O15 - Trusted Zone: http://www.msi.com.tw
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/200 ... oader5.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 5859193093
O16 - DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} (WebSDev Control) - http://liveupdate.msi.com.tw/autobios/L ... nstall.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-09.sun.com/s/ESD7/JSCDL/ ... 586-jc.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://wwwimages.adobe.com/www.adobe.co ... nos/gp.cab
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: DM1Service - OLYMPUS Corporation - C:\Program Files\Olympus\DeviceDetector\DM1Service.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: hpdj00 - Unknown owner - C:\DOCUME~1\NANCYG~1\LOCALS~1\Temp\hpdj00.exe (file missing)
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe

--
End of file - 11059 bytes

by **Bio-Hazard** » April 11th, 2009, 12:15 pm

Hello!

Slow Computer

Read here What to do if your Computer is running slowly

The Kaspersky log indicates that there are infected emails in the Inbox and Archives folder in Outlook Express.

Please delete the emails in your Inbox folder - keep only the emails that are of extreme importance. After you finish deleting the emails, please right click on the Deleted Items folder and click Empty 'Deleted Items' Folder.

Having removed all your unwanted Emails completely it is now wise to Compact all your remaining Emails. Compacting makes the size of the folders smaller by compacting the files contained within them. All the Emails are still readable and still intact just smaller.

To do this click from the top toolbar File / Folder / Compact All Folders

These are the entries in Kaspersky Scan:

C:\Documents and Settings\NancyGail\Local Settings\Application Data\Microsoft\Outlook\Archives\archive-household.pst
C:\Documents and Settings\NancyGail\Local Settings\Application Data\Microsoft\Outlook\Archives\archive-sent-Dec08.pst
C:\Documents and Settings\NancyGail\Local Settings\Application Data\Microsoft\Outlook\Archives\archive-sentMarch09.pst
C:\Documents and Settings\NancyGail\Local Settings\Application Data\Microsoft\Outlook\Archives\Outlook-Main.pst
C:\Documents and Settings\NancyGail\Local Settings\Application Data\Microsoft\Outlook\household.pst
E:\LAST C DRIVE\Documents and Settings\Nancy\Local Settings\Application Data\Identities\{C98238B7-B17B-4CF9-93F3-42A8FEBEFB34}\Microsoft\Outlook Express\Inbox.dbx
E:\LAST C DRIVE\Documents and Settings\Nancy\Local Settings\Application Data\Microsoft\Outlook\Archives\archive-household.pst
E:\LAST C DRIVE\Documents and Settings\Nancy\Local Settings\Application Data\Microsoft\Outlook\Archives\archive-sent-Dec08.pst
E:\LAST C DRIVE\Documents and Settings\Nancy\Local Settings\Application Data\Microsoft\Outlook\Archives\Outlook-Main.pst
E:\LAST C DRIVE\Documents and Settings\Nancy\Local Settings\Application Data\Microsoft\Outlook\household.pst
E:\LAST C DRIVE\Documents and Settings\Nancy\Local Settings\Application Data\Microsoft\Outlook\Outlook.pst

Do you know what these files are? are they important?:

F:\1-Family\Roy\RoysZipDisks\Mail Backup\Deleted Items.dbx
F:\1-Family\Roy\RoysZipDisks\Mail Backup\Inbox.dbx
W:\Family\www.rectors.net\gallery\albums\index.php
W:\Family\www.rectors.net\gallery\docs\index.htm
W:\Family\www.rectors.net\gallery\include\index.html

OTMoveIt3

Download OTMoveIt3 by Old Timer and save it to your Desktop.

Double-click OTMoveIt3.exe to run it.
Copy the lines in the codebox below.

Code: Select all

:files
I:\AUDIO\!MP3 SPLITTERS JOINERS\Cool MP3 Splitter (and joiner) 2.02 (Inc Crack)
E:\LAST C DRIVE\Documents and Settings\Nancy\Local Settings\temp\~tmp\hmunmlcn38a
E:\LAST C DRIVE\Documents and Settings\Nancy\Local Settings\temp\~tmp\msycn04
E:\LAST C DRIVE\Documents and Settings\Nancy\Local Settings\temp\~tmp\sps32_1
:commands
[EmptyTemp]

Return to OTMoveIt3, right click in the Paste List of Files/Folders to Move window (under the yellow bar) and choose Paste.

Click the red Moveit! button.
OTMI3 may ask to reboot the machine. Please do so if asked.
Copy everything in the Results window (under the green bar), and paste it in your next reply.
Close OTMoveIt3

Logs/Information to Post in Next Reply

Please post the following logs/Information in your reply:

OTMoveIt log
A fresh HijackThis Log ( after all the above has been done)
A description of how your computer is behaving

Free Malware Removal Forum

Internet issues

Internet issues

Re: Internet issues

Re: Internet issues

Re: Internet issues

Re: Internet issues

Re: Internet issues

Re: Internet issues

Re: Internet issues

Re: Internet issues

Re: Internet issues

Re: Internet issues

Re: Internet issues

Re: Internet issues

Re: Internet issues

Re: Internet issues

Who is online